diff --git a/.gitignore b/.gitignore index 89b92438..11d5c28c 100644 --- a/.gitignore +++ b/.gitignore @@ -4,6 +4,7 @@ frontend/dist/ # Go backend/bin/ +backend/server # Editor / OS .DS_Store diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go index 0b5895ac..0293fbdd 100644 --- a/backend/cmd/server/main.go +++ b/backend/cmd/server/main.go @@ -12,15 +12,19 @@ package main import ( "flag" + "fmt" "log/slog" "net" "net/http" "os" + "strings" "time" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/api" "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/gateway" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/sdkclient" ) const ( @@ -35,7 +39,7 @@ func envOr(key, fallback string) string { return fallback } -func main() { +func main() { //nolint:gocyclo // main is inherently branchy due to flag/config handling var ( port = flag.String("port", envOr("PORT", defaultPort), "listen port (env PORT)") listenAddress = flag.String("listen-address", envOr("LISTEN_ADDRESS", ""), "listen address (env LISTEN_ADDRESS)") @@ -58,6 +62,13 @@ func main() { if *gatewayURL == defaultGatewayURL { slog.Warn("gateway URL is the default — verify OPENSHELL_GATEWAY_URL is configured correctly", "url", *gatewayURL) } + if *gatewayCACert != "" && !strings.HasPrefix(*gatewayURL, "grpcs://") && !strings.HasPrefix(*gatewayURL, "https://") { + slog.Warn( + "gateway CA cert is set but gateway URL has no TLS scheme; use grpcs:// or https:// for TLS gateways", + "url", *gatewayURL, + "caCert", *gatewayCACert, + ) + } if *authDisabled { slog.Warn("AUTH_DISABLED=true — authentication is OFF; never use this outside local development") } @@ -83,14 +94,58 @@ func main() { }, } - gatewayClient, err := gateway.New(*gatewayURL, *gatewayCACert, *gatewayClientCert, *gatewayClientKey) + useTLS := strings.HasPrefix(*gatewayURL, "grpcs://") || strings.HasPrefix(*gatewayURL, "https://") + sdkAddress := *gatewayURL + switch { + case strings.HasPrefix(sdkAddress, "grpcs://"): + sdkAddress = "https://" + strings.TrimPrefix(sdkAddress, "grpcs://") + case strings.HasPrefix(sdkAddress, "grpc://"): + sdkAddress = "http://" + strings.TrimPrefix(sdkAddress, "grpc://") + case !strings.HasPrefix(sdkAddress, "https://") && !strings.HasPrefix(sdkAddress, "http://"): + scheme := "http" + if useTLS { + scheme = "https" + } + sdkAddress = fmt.Sprintf("%s://%s", scheme, sdkAddress) + } + if (*gatewayClientCert == "") != (*gatewayClientKey == "") { + slog.Error("gateway mTLS requires both --gateway-client-cert and --gateway-client-key") + os.Exit(1) + } + sdkCfg := openshell.Config{ + Address: sdkAddress, + Auth: sdkclient.ContextAuthProvider{RequireTLS: useTLS}, + } + if useTLS { + tlsCfg := &openshell.TLSConfig{CAFile: *gatewayCACert} + if *gatewayClientCert != "" { + tlsCfg.CertFile = *gatewayClientCert + tlsCfg.KeyFile = *gatewayClientKey + } + sdkCfg.TLS = tlsCfg + } else { + sdkCfg.TLS = &openshell.TLSConfig{Insecure: true} + } + sdkClient, err := openshell.NewClient(sdkCfg) + if err != nil { + slog.Error("SDK client setup failed", "error", err) + os.Exit(1) + } + defer sdkClient.Close() + + // Dedicated raw client for the one gateway capability the SDK omits: + // non-TTY, stdin-carrying ExecSandbox, used for binary file upload. + rawHost := sdkAddress + rawHost = strings.TrimPrefix(rawHost, "https://") + rawHost = strings.TrimPrefix(rawHost, "http://") + uploadExec, err := sdkclient.NewRawExecClient(rawHost, *gatewayCACert, *gatewayClientCert, *gatewayClientKey, useTLS) if err != nil { - slog.Error("gateway client setup failed", "error", err) + slog.Error("upload exec client setup failed", "error", err) os.Exit(1) } - defer gatewayClient.Close() + defer uploadExec.Close() - app := api.NewApp(gatewayClient, authMiddleware, *staticDir, authCfg) + app := api.NewApp(sdkClient, uploadExec, authMiddleware, *staticDir, authCfg) addr := net.JoinHostPort(*listenAddress, *port) slog.Info("openshell-dashboard BFF listening", diff --git a/backend/gen/datamodelv1/datamodel.pb.go b/backend/gen/datamodelv1/datamodel.pb.go deleted file mode 100644 index 9a88dbdb..00000000 --- a/backend/gen/datamodelv1/datamodel.pb.go +++ /dev/null @@ -1,507 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: datamodel.proto - -package datamodelv1 - -import ( - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Phase of a workspace's lifecycle. -type WorkspacePhase int32 - -const ( - WorkspacePhase_WORKSPACE_PHASE_UNSPECIFIED WorkspacePhase = 0 - WorkspacePhase_WORKSPACE_PHASE_ACTIVE WorkspacePhase = 1 - WorkspacePhase_WORKSPACE_PHASE_TERMINATING WorkspacePhase = 2 -) - -// Enum value maps for WorkspacePhase. -var ( - WorkspacePhase_name = map[int32]string{ - 0: "WORKSPACE_PHASE_UNSPECIFIED", - 1: "WORKSPACE_PHASE_ACTIVE", - 2: "WORKSPACE_PHASE_TERMINATING", - } - WorkspacePhase_value = map[string]int32{ - "WORKSPACE_PHASE_UNSPECIFIED": 0, - "WORKSPACE_PHASE_ACTIVE": 1, - "WORKSPACE_PHASE_TERMINATING": 2, - } -) - -func (x WorkspacePhase) Enum() *WorkspacePhase { - p := new(WorkspacePhase) - *p = x - return p -} - -func (x WorkspacePhase) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WorkspacePhase) Descriptor() protoreflect.EnumDescriptor { - return file_datamodel_proto_enumTypes[0].Descriptor() -} - -func (WorkspacePhase) Type() protoreflect.EnumType { - return &file_datamodel_proto_enumTypes[0] -} - -func (x WorkspacePhase) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WorkspacePhase.Descriptor instead. -func (WorkspacePhase) EnumDescriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{0} -} - -// Kubernetes-style metadata shared by all top-level OpenShell domain objects. -// -// This structure provides consistent metadata (identity, labels, annotations, -// timestamps, resource versioning) across Sandbox, Provider, SshSession, and -// other resources. -type ObjectMeta struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Stable object ID generated by the gateway. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Human-readable object name (unique per object type). - Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` - // Milliseconds since Unix epoch when the object was created. - CreatedAtMs int64 `protobuf:"varint,3,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // Key-value labels for filtering and organization. - // Labels must follow Kubernetes conventions: alphanumeric + `-._/`, max 63 chars per segment. - Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optimistic concurrency control version. - // Incremented by the gateway on each update. Clients can use this for compare-and-swap operations. - ResourceVersion uint64 `protobuf:"varint,5,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` - // Opaque key-value metadata that is not used for selectors. - // Annotation keys use the same qualified-key shape as labels, but values may be longer. - Annotations map[string]string `protobuf:"bytes,6,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace that owns this resource. Empty is normalized to "default" by the - // gateway. Immutable after creation. - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - // Milliseconds since Unix epoch when graceful deletion was initiated. - // Zero means the object is not being deleted. Once set, this field is - // immutable — the only path forward is completing deletion. - DeletionTimestampMs int64 `protobuf:"varint,8,opt,name=deletion_timestamp_ms,json=deletionTimestampMs,proto3" json:"deletion_timestamp_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ObjectMeta) Reset() { - *x = ObjectMeta{} - mi := &file_datamodel_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ObjectMeta) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ObjectMeta) ProtoMessage() {} - -func (x *ObjectMeta) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ObjectMeta.ProtoReflect.Descriptor instead. -func (*ObjectMeta) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{0} -} - -func (x *ObjectMeta) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *ObjectMeta) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ObjectMeta) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *ObjectMeta) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *ObjectMeta) GetResourceVersion() uint64 { - if x != nil { - return x.ResourceVersion - } - return 0 -} - -func (x *ObjectMeta) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *ObjectMeta) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ObjectMeta) GetDeletionTimestampMs() int64 { - if x != nil { - return x.DeletionTimestampMs - } - return 0 -} - -// Status of a workspace. -type WorkspaceStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - Phase WorkspacePhase `protobuf:"varint,1,opt,name=phase,proto3,enum=openshell.datamodel.v1.WorkspacePhase" json:"phase,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WorkspaceStatus) Reset() { - *x = WorkspaceStatus{} - mi := &file_datamodel_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WorkspaceStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WorkspaceStatus) ProtoMessage() {} - -func (x *WorkspaceStatus) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WorkspaceStatus.ProtoReflect.Descriptor instead. -func (*WorkspaceStatus) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{1} -} - -func (x *WorkspaceStatus) GetPhase() WorkspacePhase { - if x != nil { - return x.Phase - } - return WorkspacePhase_WORKSPACE_PHASE_UNSPECIFIED -} - -// Workspace resource. A hard isolation boundary for sandboxes, providers, and -// other workspace-scoped resources. -type Workspace struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - // The workspace field in this ObjectMeta is unused (a workspace does not - // belong to another workspace). - Metadata *ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Current lifecycle status. - Status *WorkspaceStatus `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Workspace) Reset() { - *x = Workspace{} - mi := &file_datamodel_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Workspace) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Workspace) ProtoMessage() {} - -func (x *Workspace) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Workspace.ProtoReflect.Descriptor instead. -func (*Workspace) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{2} -} - -func (x *Workspace) GetMetadata() *ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Workspace) GetStatus() *WorkspaceStatus { - if x != nil { - return x.Status - } - return nil -} - -// Provider model stored by OpenShell. -type Provider struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Canonical provider type slug (for example: "claude", "gitlab"). - Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"` - // Secret values used for authentication. - Credentials map[string]string `protobuf:"bytes,3,rep,name=credentials,proto3" json:"credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Non-secret provider configuration. - Config map[string]string `protobuf:"bytes,4,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Expiration timestamps for credential values, keyed by credential/env var - // name. A zero or missing value means the credential does not expire. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,5,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Workspace where this provider's type profile is stored. - // Empty string = platform/global scope. Must be empty or match - // metadata.workspace; cross-workspace references are rejected. - ProfileWorkspace string `protobuf:"bytes,6,opt,name=profile_workspace,json=profileWorkspace,proto3" json:"profile_workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Provider) Reset() { - *x = Provider{} - mi := &file_datamodel_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Provider) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Provider) ProtoMessage() {} - -func (x *Provider) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Provider.ProtoReflect.Descriptor instead. -func (*Provider) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{3} -} - -func (x *Provider) GetMetadata() *ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Provider) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *Provider) GetCredentials() map[string]string { - if x != nil { - return x.Credentials - } - return nil -} - -func (x *Provider) GetConfig() map[string]string { - if x != nil { - return x.Config - } - return nil -} - -func (x *Provider) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *Provider) GetProfileWorkspace() string { - if x != nil { - return x.ProfileWorkspace - } - return "" -} - -var File_datamodel_proto protoreflect.FileDescriptor - -const file_datamodel_proto_rawDesc = "" + - "\n" + - "\x0fdatamodel.proto\x12\x16openshell.datamodel.v1\x1a\roptions.proto\"\xeb\x03\n" + - "\n" + - "ObjectMeta\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\x12\"\n" + - "\rcreated_at_ms\x18\x03 \x01(\x03R\vcreatedAtMs\x12F\n" + - "\x06labels\x18\x04 \x03(\v2..openshell.datamodel.v1.ObjectMeta.LabelsEntryR\x06labels\x12)\n" + - "\x10resource_version\x18\x05 \x01(\x04R\x0fresourceVersion\x12U\n" + - "\vannotations\x18\x06 \x03(\v23.openshell.datamodel.v1.ObjectMeta.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\x122\n" + - "\x15deletion_timestamp_ms\x18\b \x01(\x03R\x13deletionTimestampMs\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"O\n" + - "\x0fWorkspaceStatus\x12<\n" + - "\x05phase\x18\x01 \x01(\x0e2&.openshell.datamodel.v1.WorkspacePhaseR\x05phase\"\x8c\x01\n" + - "\tWorkspace\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12?\n" + - "\x06status\x18\x02 \x01(\v2'.openshell.datamodel.v1.WorkspaceStatusR\x06status\"\xe7\x04\n" + - "\bProvider\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x12\n" + - "\x04type\x18\x02 \x01(\tR\x04type\x12Y\n" + - "\vcredentials\x18\x03 \x03(\v21.openshell.datamodel.v1.Provider.CredentialsEntryB\x04\x88\xb5\x18\x01R\vcredentials\x12D\n" + - "\x06config\x18\x04 \x03(\v2,.openshell.datamodel.v1.Provider.ConfigEntryR\x06config\x12t\n" + - "\x18credential_expires_at_ms\x18\x05 \x03(\v2;.openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12+\n" + - "\x11profile_workspace\x18\x06 \x01(\tR\x10profileWorkspace\x1a>\n" + - "\x10CredentialsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a9\n" + - "\vConfigEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01*n\n" + - "\x0eWorkspacePhase\x12\x1f\n" + - "\x1bWORKSPACE_PHASE_UNSPECIFIED\x10\x00\x12\x1a\n" + - "\x16WORKSPACE_PHASE_ACTIVE\x10\x01\x12\x1f\n" + - "\x1bWORKSPACE_PHASE_TERMINATING\x10\x02b\x06proto3" - -var ( - file_datamodel_proto_rawDescOnce sync.Once - file_datamodel_proto_rawDescData []byte -) - -func file_datamodel_proto_rawDescGZIP() []byte { - file_datamodel_proto_rawDescOnce.Do(func() { - file_datamodel_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_datamodel_proto_rawDesc), len(file_datamodel_proto_rawDesc))) - }) - return file_datamodel_proto_rawDescData -} - -var file_datamodel_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_datamodel_proto_msgTypes = make([]protoimpl.MessageInfo, 9) -var file_datamodel_proto_goTypes = []any{ - (WorkspacePhase)(0), // 0: openshell.datamodel.v1.WorkspacePhase - (*ObjectMeta)(nil), // 1: openshell.datamodel.v1.ObjectMeta - (*WorkspaceStatus)(nil), // 2: openshell.datamodel.v1.WorkspaceStatus - (*Workspace)(nil), // 3: openshell.datamodel.v1.Workspace - (*Provider)(nil), // 4: openshell.datamodel.v1.Provider - nil, // 5: openshell.datamodel.v1.ObjectMeta.LabelsEntry - nil, // 6: openshell.datamodel.v1.ObjectMeta.AnnotationsEntry - nil, // 7: openshell.datamodel.v1.Provider.CredentialsEntry - nil, // 8: openshell.datamodel.v1.Provider.ConfigEntry - nil, // 9: openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntry -} -var file_datamodel_proto_depIdxs = []int32{ - 5, // 0: openshell.datamodel.v1.ObjectMeta.labels:type_name -> openshell.datamodel.v1.ObjectMeta.LabelsEntry - 6, // 1: openshell.datamodel.v1.ObjectMeta.annotations:type_name -> openshell.datamodel.v1.ObjectMeta.AnnotationsEntry - 0, // 2: openshell.datamodel.v1.WorkspaceStatus.phase:type_name -> openshell.datamodel.v1.WorkspacePhase - 1, // 3: openshell.datamodel.v1.Workspace.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 2, // 4: openshell.datamodel.v1.Workspace.status:type_name -> openshell.datamodel.v1.WorkspaceStatus - 1, // 5: openshell.datamodel.v1.Provider.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 7, // 6: openshell.datamodel.v1.Provider.credentials:type_name -> openshell.datamodel.v1.Provider.CredentialsEntry - 8, // 7: openshell.datamodel.v1.Provider.config:type_name -> openshell.datamodel.v1.Provider.ConfigEntry - 9, // 8: openshell.datamodel.v1.Provider.credential_expires_at_ms:type_name -> openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntry - 9, // [9:9] is the sub-list for method output_type - 9, // [9:9] is the sub-list for method input_type - 9, // [9:9] is the sub-list for extension type_name - 9, // [9:9] is the sub-list for extension extendee - 0, // [0:9] is the sub-list for field type_name -} - -func init() { file_datamodel_proto_init() } -func file_datamodel_proto_init() { - if File_datamodel_proto != nil { - return - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_datamodel_proto_rawDesc), len(file_datamodel_proto_rawDesc)), - NumEnums: 1, - NumMessages: 9, - NumExtensions: 0, - NumServices: 0, - }, - GoTypes: file_datamodel_proto_goTypes, - DependencyIndexes: file_datamodel_proto_depIdxs, - EnumInfos: file_datamodel_proto_enumTypes, - MessageInfos: file_datamodel_proto_msgTypes, - }.Build() - File_datamodel_proto = out.File - file_datamodel_proto_goTypes = nil - file_datamodel_proto_depIdxs = nil -} diff --git a/backend/gen/inferencev1/inference.pb.go b/backend/gen/inferencev1/inference.pb.go deleted file mode 100644 index e1b70216..00000000 --- a/backend/gen/inferencev1/inference.pb.go +++ /dev/null @@ -1,1018 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: inference.proto - -package inferencev1 - -import ( - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Persisted inference route configuration. -// -// Only `provider_name` and `model_id` are stored; endpoint, protocols, -// credentials, and auth style are resolved from the provider at bundle time. -type InferenceRouteConfig struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider record name backing this route. - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Model identifier to force on generation calls. - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,3,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *InferenceRouteConfig) Reset() { - *x = InferenceRouteConfig{} - mi := &file_inference_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *InferenceRouteConfig) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*InferenceRouteConfig) ProtoMessage() {} - -func (x *InferenceRouteConfig) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use InferenceRouteConfig.ProtoReflect.Descriptor instead. -func (*InferenceRouteConfig) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{0} -} - -func (x *InferenceRouteConfig) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *InferenceRouteConfig) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *InferenceRouteConfig) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -// Storage envelope for a workspace-scoped inference route. -type InferenceRoute struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - Config *InferenceRouteConfig `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"` - // Monotonic version incremented on every update. - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *InferenceRoute) Reset() { - *x = InferenceRoute{} - mi := &file_inference_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *InferenceRoute) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*InferenceRoute) ProtoMessage() {} - -func (x *InferenceRoute) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use InferenceRoute.ProtoReflect.Descriptor instead. -func (*InferenceRoute) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{1} -} - -func (x *InferenceRoute) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *InferenceRoute) GetConfig() *InferenceRouteConfig { - if x != nil { - return x.Config - } - return nil -} - -func (x *InferenceRoute) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -type SetInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider record name to use for credentials + endpoint mapping. - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Model identifier to force on generation calls. - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - // Route name to target. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,3,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Verify the resolved upstream endpoint synchronously before persistence. - Verify bool `protobuf:"varint,4,opt,name=verify,proto3" json:"verify,omitempty"` - // Skip synchronous endpoint validation before persistence. - NoVerify bool `protobuf:"varint,5,opt,name=no_verify,json=noVerify,proto3" json:"no_verify,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,6,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SetInferenceRouteRequest) Reset() { - *x = SetInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SetInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SetInferenceRouteRequest) ProtoMessage() {} - -func (x *SetInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SetInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*SetInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{2} -} - -func (x *SetInferenceRouteRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *SetInferenceRouteRequest) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *SetInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *SetInferenceRouteRequest) GetVerify() bool { - if x != nil { - return x.Verify - } - return false -} - -func (x *SetInferenceRouteRequest) GetNoVerify() bool { - if x != nil { - return x.NoVerify - } - return false -} - -func (x *SetInferenceRouteRequest) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *SetInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ValidatedEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` - Protocol string `protobuf:"bytes,2,opt,name=protocol,proto3" json:"protocol,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ValidatedEndpoint) Reset() { - *x = ValidatedEndpoint{} - mi := &file_inference_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ValidatedEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ValidatedEndpoint) ProtoMessage() {} - -func (x *ValidatedEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ValidatedEndpoint.ProtoReflect.Descriptor instead. -func (*ValidatedEndpoint) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{3} -} - -func (x *ValidatedEndpoint) GetUrl() string { - if x != nil { - return x.Url - } - return "" -} - -func (x *ValidatedEndpoint) GetProtocol() string { - if x != nil { - return x.Protocol - } - return "" -} - -type SetInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - // Route name that was configured. - RouteName string `protobuf:"bytes,4,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Whether endpoint verification ran as part of this request. - ValidationPerformed bool `protobuf:"varint,5,opt,name=validation_performed,json=validationPerformed,proto3" json:"validation_performed,omitempty"` - // The concrete endpoints that were probed during validation, when available. - ValidatedEndpoints []*ValidatedEndpoint `protobuf:"bytes,6,rep,name=validated_endpoints,json=validatedEndpoints,proto3" json:"validated_endpoints,omitempty"` - // Per-route request timeout in seconds that was persisted. - TimeoutSecs uint64 `protobuf:"varint,7,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Workspace the route was configured in. - Workspace string `protobuf:"bytes,8,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SetInferenceRouteResponse) Reset() { - *x = SetInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SetInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SetInferenceRouteResponse) ProtoMessage() {} - -func (x *SetInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SetInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*SetInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{4} -} - -func (x *SetInferenceRouteResponse) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *SetInferenceRouteResponse) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *SetInferenceRouteResponse) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SetInferenceRouteResponse) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *SetInferenceRouteResponse) GetValidationPerformed() bool { - if x != nil { - return x.ValidationPerformed - } - return false -} - -func (x *SetInferenceRouteResponse) GetValidatedEndpoints() []*ValidatedEndpoint { - if x != nil { - return x.ValidatedEndpoints - } - return nil -} - -func (x *SetInferenceRouteResponse) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *SetInferenceRouteResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Route name to query. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,1,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceRouteRequest) Reset() { - *x = GetInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceRouteRequest) ProtoMessage() {} - -func (x *GetInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*GetInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{5} -} - -func (x *GetInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *GetInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - // Route name that was queried. - RouteName string `protobuf:"bytes,4,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Per-route request timeout in seconds. 0 means default (60s). - TimeoutSecs uint64 `protobuf:"varint,5,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Workspace the route belongs to. - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceRouteResponse) Reset() { - *x = GetInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceRouteResponse) ProtoMessage() {} - -func (x *GetInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*GetInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{6} -} - -func (x *GetInferenceRouteResponse) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *GetInferenceRouteResponse) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *GetInferenceRouteResponse) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetInferenceRouteResponse) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *GetInferenceRouteResponse) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *GetInferenceRouteResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Route name to delete. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,1,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteInferenceRouteRequest) Reset() { - *x = DeleteInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteInferenceRouteRequest) ProtoMessage() {} - -func (x *DeleteInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*DeleteInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{7} -} - -func (x *DeleteInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *DeleteInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Whether a route was actually deleted. - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteInferenceRouteResponse) Reset() { - *x = DeleteInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteInferenceRouteResponse) ProtoMessage() {} - -func (x *DeleteInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*DeleteInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{8} -} - -func (x *DeleteInferenceRouteResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -type GetInferenceBundleRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceBundleRequest) Reset() { - *x = GetInferenceBundleRequest{} - mi := &file_inference_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceBundleRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceBundleRequest) ProtoMessage() {} - -func (x *GetInferenceBundleRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceBundleRequest.ProtoReflect.Descriptor instead. -func (*GetInferenceBundleRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{9} -} - -// A single resolved route ready for sandbox-local execution. -type ResolvedRoute struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - BaseUrl string `protobuf:"bytes,2,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"` - Protocols []string `protobuf:"bytes,3,rep,name=protocols,proto3" json:"protocols,omitempty"` - ApiKey string `protobuf:"bytes,4,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"` - ModelId string `protobuf:"bytes,5,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - ProviderType string `protobuf:"bytes,6,opt,name=provider_type,json=providerType,proto3" json:"provider_type,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,7,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // When true, the model identifier is embedded in the URL path (e.g. Vertex AI). - ModelInPath bool `protobuf:"varint,8,opt,name=model_in_path,json=modelInPath,proto3" json:"model_in_path,omitempty"` - // Optional override for the request path. When set, replaces the protocol-derived path. - // An empty string means POST directly to base_url/model_id with no additional path. - RequestPathOverride *string `protobuf:"bytes,9,opt,name=request_path_override,json=requestPathOverride,proto3,oneof" json:"request_path_override,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ResolvedRoute) Reset() { - *x = ResolvedRoute{} - mi := &file_inference_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ResolvedRoute) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ResolvedRoute) ProtoMessage() {} - -func (x *ResolvedRoute) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ResolvedRoute.ProtoReflect.Descriptor instead. -func (*ResolvedRoute) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{10} -} - -func (x *ResolvedRoute) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ResolvedRoute) GetBaseUrl() string { - if x != nil { - return x.BaseUrl - } - return "" -} - -func (x *ResolvedRoute) GetProtocols() []string { - if x != nil { - return x.Protocols - } - return nil -} - -func (x *ResolvedRoute) GetApiKey() string { - if x != nil { - return x.ApiKey - } - return "" -} - -func (x *ResolvedRoute) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *ResolvedRoute) GetProviderType() string { - if x != nil { - return x.ProviderType - } - return "" -} - -func (x *ResolvedRoute) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *ResolvedRoute) GetModelInPath() bool { - if x != nil { - return x.ModelInPath - } - return false -} - -func (x *ResolvedRoute) GetRequestPathOverride() string { - if x != nil && x.RequestPathOverride != nil { - return *x.RequestPathOverride - } - return "" -} - -type GetInferenceBundleResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Routes []*ResolvedRoute `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"` - // Opaque revision tag for cache freshness checks. - Revision string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"` - // Timestamp (epoch ms) when this bundle was generated. - GeneratedAtMs int64 `protobuf:"varint,3,opt,name=generated_at_ms,json=generatedAtMs,proto3" json:"generated_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceBundleResponse) Reset() { - *x = GetInferenceBundleResponse{} - mi := &file_inference_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceBundleResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceBundleResponse) ProtoMessage() {} - -func (x *GetInferenceBundleResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceBundleResponse.ProtoReflect.Descriptor instead. -func (*GetInferenceBundleResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{11} -} - -func (x *GetInferenceBundleResponse) GetRoutes() []*ResolvedRoute { - if x != nil { - return x.Routes - } - return nil -} - -func (x *GetInferenceBundleResponse) GetRevision() string { - if x != nil { - return x.Revision - } - return "" -} - -func (x *GetInferenceBundleResponse) GetGeneratedAtMs() int64 { - if x != nil { - return x.GeneratedAtMs - } - return 0 -} - -var File_inference_proto protoreflect.FileDescriptor - -const file_inference_proto_rawDesc = "" + - "\n" + - "\x0finference.proto\x12\x16openshell.inference.v1\x1a\x0fdatamodel.proto\x1a\roptions.proto\"y\n" + - "\x14InferenceRouteConfig\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12!\n" + - "\ftimeout_secs\x18\x03 \x01(\x04R\vtimeoutSecs\"\xb0\x01\n" + - "\x0eInferenceRoute\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12D\n" + - "\x06config\x18\x02 \x01(\v2,.openshell.inference.v1.InferenceRouteConfigR\x06config\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\"\xef\x01\n" + - "\x18SetInferenceRouteRequest\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x1d\n" + - "\n" + - "route_name\x18\x03 \x01(\tR\trouteName\x12\x16\n" + - "\x06verify\x18\x04 \x01(\bR\x06verify\x12\x1b\n" + - "\tno_verify\x18\x05 \x01(\bR\bnoVerify\x12!\n" + - "\ftimeout_secs\x18\x06 \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\"A\n" + - "\x11ValidatedEndpoint\x12\x10\n" + - "\x03url\x18\x01 \x01(\tR\x03url\x12\x1a\n" + - "\bprotocol\x18\x02 \x01(\tR\bprotocol\"\xe4\x02\n" + - "\x19SetInferenceRouteResponse\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\x12\x1d\n" + - "\n" + - "route_name\x18\x04 \x01(\tR\trouteName\x121\n" + - "\x14validation_performed\x18\x05 \x01(\bR\x13validationPerformed\x12Z\n" + - "\x13validated_endpoints\x18\x06 \x03(\v2).openshell.inference.v1.ValidatedEndpointR\x12validatedEndpoints\x12!\n" + - "\ftimeout_secs\x18\a \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\b \x01(\tR\tworkspace\"W\n" + - "\x18GetInferenceRouteRequest\x12\x1d\n" + - "\n" + - "route_name\x18\x01 \x01(\tR\trouteName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xd5\x01\n" + - "\x19GetInferenceRouteResponse\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\x12\x1d\n" + - "\n" + - "route_name\x18\x04 \x01(\tR\trouteName\x12!\n" + - "\ftimeout_secs\x18\x05 \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"Z\n" + - "\x1bDeleteInferenceRouteRequest\x12\x1d\n" + - "\n" + - "route_name\x18\x01 \x01(\tR\trouteName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"8\n" + - "\x1cDeleteInferenceRouteResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\x1b\n" + - "\x19GetInferenceBundleRequest\"\xd5\x02\n" + - "\rResolvedRoute\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bbase_url\x18\x02 \x01(\tR\abaseUrl\x12\x1c\n" + - "\tprotocols\x18\x03 \x03(\tR\tprotocols\x12\x1d\n" + - "\aapi_key\x18\x04 \x01(\tB\x04\x88\xb5\x18\x01R\x06apiKey\x12\x19\n" + - "\bmodel_id\x18\x05 \x01(\tR\amodelId\x12#\n" + - "\rprovider_type\x18\x06 \x01(\tR\fproviderType\x12!\n" + - "\ftimeout_secs\x18\a \x01(\x04R\vtimeoutSecs\x12\"\n" + - "\rmodel_in_path\x18\b \x01(\bR\vmodelInPath\x127\n" + - "\x15request_path_override\x18\t \x01(\tH\x00R\x13requestPathOverride\x88\x01\x01B\x18\n" + - "\x16_request_path_override\"\x9f\x01\n" + - "\x1aGetInferenceBundleResponse\x12=\n" + - "\x06routes\x18\x01 \x03(\v2%.openshell.inference.v1.ResolvedRouteR\x06routes\x12\x1a\n" + - "\brevision\x18\x02 \x01(\tR\brevision\x12&\n" + - "\x0fgenerated_at_ms\x18\x03 \x01(\x03R\rgeneratedAtMs2\x82\x05\n" + - "\tInference\x12\x8a\x01\n" + - "\x12GetInferenceBundle\x121.openshell.inference.v1.GetInferenceBundleRequest\x1a2.openshell.inference.v1.GetInferenceBundleResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x9e\x01\n" + - "\x11SetInferenceRoute\x120.openshell.inference.v1.SetInferenceRouteRequest\x1a1.openshell.inference.v1.SetInferenceRouteResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0finference:write\x12\x9c\x01\n" + - "\x11GetInferenceRoute\x120.openshell.inference.v1.GetInferenceRouteRequest\x1a1.openshell.inference.v1.GetInferenceRouteResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0einference:read\x12\xa7\x01\n" + - "\x14DeleteInferenceRoute\x123.openshell.inference.v1.DeleteInferenceRouteRequest\x1a4.openshell.inference.v1.DeleteInferenceRouteResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0finference:writeb\x06proto3" - -var ( - file_inference_proto_rawDescOnce sync.Once - file_inference_proto_rawDescData []byte -) - -func file_inference_proto_rawDescGZIP() []byte { - file_inference_proto_rawDescOnce.Do(func() { - file_inference_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_inference_proto_rawDesc), len(file_inference_proto_rawDesc))) - }) - return file_inference_proto_rawDescData -} - -var file_inference_proto_msgTypes = make([]protoimpl.MessageInfo, 12) -var file_inference_proto_goTypes = []any{ - (*InferenceRouteConfig)(nil), // 0: openshell.inference.v1.InferenceRouteConfig - (*InferenceRoute)(nil), // 1: openshell.inference.v1.InferenceRoute - (*SetInferenceRouteRequest)(nil), // 2: openshell.inference.v1.SetInferenceRouteRequest - (*ValidatedEndpoint)(nil), // 3: openshell.inference.v1.ValidatedEndpoint - (*SetInferenceRouteResponse)(nil), // 4: openshell.inference.v1.SetInferenceRouteResponse - (*GetInferenceRouteRequest)(nil), // 5: openshell.inference.v1.GetInferenceRouteRequest - (*GetInferenceRouteResponse)(nil), // 6: openshell.inference.v1.GetInferenceRouteResponse - (*DeleteInferenceRouteRequest)(nil), // 7: openshell.inference.v1.DeleteInferenceRouteRequest - (*DeleteInferenceRouteResponse)(nil), // 8: openshell.inference.v1.DeleteInferenceRouteResponse - (*GetInferenceBundleRequest)(nil), // 9: openshell.inference.v1.GetInferenceBundleRequest - (*ResolvedRoute)(nil), // 10: openshell.inference.v1.ResolvedRoute - (*GetInferenceBundleResponse)(nil), // 11: openshell.inference.v1.GetInferenceBundleResponse - (*datamodelv1.ObjectMeta)(nil), // 12: openshell.datamodel.v1.ObjectMeta -} -var file_inference_proto_depIdxs = []int32{ - 12, // 0: openshell.inference.v1.InferenceRoute.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 0, // 1: openshell.inference.v1.InferenceRoute.config:type_name -> openshell.inference.v1.InferenceRouteConfig - 3, // 2: openshell.inference.v1.SetInferenceRouteResponse.validated_endpoints:type_name -> openshell.inference.v1.ValidatedEndpoint - 10, // 3: openshell.inference.v1.GetInferenceBundleResponse.routes:type_name -> openshell.inference.v1.ResolvedRoute - 9, // 4: openshell.inference.v1.Inference.GetInferenceBundle:input_type -> openshell.inference.v1.GetInferenceBundleRequest - 2, // 5: openshell.inference.v1.Inference.SetInferenceRoute:input_type -> openshell.inference.v1.SetInferenceRouteRequest - 5, // 6: openshell.inference.v1.Inference.GetInferenceRoute:input_type -> openshell.inference.v1.GetInferenceRouteRequest - 7, // 7: openshell.inference.v1.Inference.DeleteInferenceRoute:input_type -> openshell.inference.v1.DeleteInferenceRouteRequest - 11, // 8: openshell.inference.v1.Inference.GetInferenceBundle:output_type -> openshell.inference.v1.GetInferenceBundleResponse - 4, // 9: openshell.inference.v1.Inference.SetInferenceRoute:output_type -> openshell.inference.v1.SetInferenceRouteResponse - 6, // 10: openshell.inference.v1.Inference.GetInferenceRoute:output_type -> openshell.inference.v1.GetInferenceRouteResponse - 8, // 11: openshell.inference.v1.Inference.DeleteInferenceRoute:output_type -> openshell.inference.v1.DeleteInferenceRouteResponse - 8, // [8:12] is the sub-list for method output_type - 4, // [4:8] is the sub-list for method input_type - 4, // [4:4] is the sub-list for extension type_name - 4, // [4:4] is the sub-list for extension extendee - 0, // [0:4] is the sub-list for field type_name -} - -func init() { file_inference_proto_init() } -func file_inference_proto_init() { - if File_inference_proto != nil { - return - } - file_inference_proto_msgTypes[10].OneofWrappers = []any{} - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_inference_proto_rawDesc), len(file_inference_proto_rawDesc)), - NumEnums: 0, - NumMessages: 12, - NumExtensions: 0, - NumServices: 1, - }, - GoTypes: file_inference_proto_goTypes, - DependencyIndexes: file_inference_proto_depIdxs, - MessageInfos: file_inference_proto_msgTypes, - }.Build() - File_inference_proto = out.File - file_inference_proto_goTypes = nil - file_inference_proto_depIdxs = nil -} diff --git a/backend/gen/inferencev1/inference_grpc.pb.go b/backend/gen/inferencev1/inference_grpc.pb.go deleted file mode 100644 index db954492..00000000 --- a/backend/gen/inferencev1/inference_grpc.pb.go +++ /dev/null @@ -1,256 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go-grpc. DO NOT EDIT. -// versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 -// source: inference.proto - -package inferencev1 - -import ( - context "context" - grpc "google.golang.org/grpc" - codes "google.golang.org/grpc/codes" - status "google.golang.org/grpc/status" -) - -// This is a compile-time assertion to ensure that this generated file -// is compatible with the grpc package it is being compiled against. -// Requires gRPC-Go v1.64.0 or later. -const _ = grpc.SupportPackageIsVersion9 - -const ( - Inference_GetInferenceBundle_FullMethodName = "/openshell.inference.v1.Inference/GetInferenceBundle" - Inference_SetInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/SetInferenceRoute" - Inference_GetInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/GetInferenceRoute" - Inference_DeleteInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/DeleteInferenceRoute" -) - -// InferenceClient is the client API for Inference service. -// -// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. -// -// Inference service provides workspace-scoped inference route configuration and bundle delivery. -type InferenceClient interface { - // Return the resolved inference route bundle for sandbox-local execution. - GetInferenceBundle(ctx context.Context, in *GetInferenceBundleRequest, opts ...grpc.CallOption) (*GetInferenceBundleResponse, error) - // Set the inference route for a workspace. - // - // This controls how requests sent to `inference.local` are routed - // for sandboxes in the specified workspace. - SetInferenceRoute(ctx context.Context, in *SetInferenceRouteRequest, opts ...grpc.CallOption) (*SetInferenceRouteResponse, error) - // Get the inference route for a workspace. - GetInferenceRoute(ctx context.Context, in *GetInferenceRouteRequest, opts ...grpc.CallOption) (*GetInferenceRouteResponse, error) - // Delete an inference route from a workspace. - DeleteInferenceRoute(ctx context.Context, in *DeleteInferenceRouteRequest, opts ...grpc.CallOption) (*DeleteInferenceRouteResponse, error) -} - -type inferenceClient struct { - cc grpc.ClientConnInterface -} - -func NewInferenceClient(cc grpc.ClientConnInterface) InferenceClient { - return &inferenceClient{cc} -} - -func (c *inferenceClient) GetInferenceBundle(ctx context.Context, in *GetInferenceBundleRequest, opts ...grpc.CallOption) (*GetInferenceBundleResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetInferenceBundleResponse) - err := c.cc.Invoke(ctx, Inference_GetInferenceBundle_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) SetInferenceRoute(ctx context.Context, in *SetInferenceRouteRequest, opts ...grpc.CallOption) (*SetInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SetInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_SetInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) GetInferenceRoute(ctx context.Context, in *GetInferenceRouteRequest, opts ...grpc.CallOption) (*GetInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_GetInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) DeleteInferenceRoute(ctx context.Context, in *DeleteInferenceRouteRequest, opts ...grpc.CallOption) (*DeleteInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_DeleteInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -// InferenceServer is the server API for Inference service. -// All implementations must embed UnimplementedInferenceServer -// for forward compatibility. -// -// Inference service provides workspace-scoped inference route configuration and bundle delivery. -type InferenceServer interface { - // Return the resolved inference route bundle for sandbox-local execution. - GetInferenceBundle(context.Context, *GetInferenceBundleRequest) (*GetInferenceBundleResponse, error) - // Set the inference route for a workspace. - // - // This controls how requests sent to `inference.local` are routed - // for sandboxes in the specified workspace. - SetInferenceRoute(context.Context, *SetInferenceRouteRequest) (*SetInferenceRouteResponse, error) - // Get the inference route for a workspace. - GetInferenceRoute(context.Context, *GetInferenceRouteRequest) (*GetInferenceRouteResponse, error) - // Delete an inference route from a workspace. - DeleteInferenceRoute(context.Context, *DeleteInferenceRouteRequest) (*DeleteInferenceRouteResponse, error) - mustEmbedUnimplementedInferenceServer() -} - -// UnimplementedInferenceServer must be embedded to have -// forward compatible implementations. -// -// NOTE: this should be embedded by value instead of pointer to avoid a nil -// pointer dereference when methods are called. -type UnimplementedInferenceServer struct{} - -func (UnimplementedInferenceServer) GetInferenceBundle(context.Context, *GetInferenceBundleRequest) (*GetInferenceBundleResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetInferenceBundle not implemented") -} -func (UnimplementedInferenceServer) SetInferenceRoute(context.Context, *SetInferenceRouteRequest) (*SetInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method SetInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) GetInferenceRoute(context.Context, *GetInferenceRouteRequest) (*GetInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) DeleteInferenceRoute(context.Context, *DeleteInferenceRouteRequest) (*DeleteInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) mustEmbedUnimplementedInferenceServer() {} -func (UnimplementedInferenceServer) testEmbeddedByValue() {} - -// UnsafeInferenceServer may be embedded to opt out of forward compatibility for this service. -// Use of this interface is not recommended, as added methods to InferenceServer will -// result in compilation errors. -type UnsafeInferenceServer interface { - mustEmbedUnimplementedInferenceServer() -} - -func RegisterInferenceServer(s grpc.ServiceRegistrar, srv InferenceServer) { - // If the following call panics, it indicates UnimplementedInferenceServer was - // embedded by pointer and is nil. This will cause panics if an - // unimplemented method is ever invoked, so we test this at initialization - // time to prevent it from happening at runtime later due to I/O. - if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { - t.testEmbeddedByValue() - } - s.RegisterService(&Inference_ServiceDesc, srv) -} - -func _Inference_GetInferenceBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetInferenceBundleRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).GetInferenceBundle(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_GetInferenceBundle_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).GetInferenceBundle(ctx, req.(*GetInferenceBundleRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_SetInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(SetInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).SetInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_SetInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).SetInferenceRoute(ctx, req.(*SetInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_GetInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).GetInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_GetInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).GetInferenceRoute(ctx, req.(*GetInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_DeleteInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).DeleteInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_DeleteInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).DeleteInferenceRoute(ctx, req.(*DeleteInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -// Inference_ServiceDesc is the grpc.ServiceDesc for Inference service. -// It's only intended for direct use with grpc.RegisterService, -// and not to be introspected or modified (even as a copy) -var Inference_ServiceDesc = grpc.ServiceDesc{ - ServiceName: "openshell.inference.v1.Inference", - HandlerType: (*InferenceServer)(nil), - Methods: []grpc.MethodDesc{ - { - MethodName: "GetInferenceBundle", - Handler: _Inference_GetInferenceBundle_Handler, - }, - { - MethodName: "SetInferenceRoute", - Handler: _Inference_SetInferenceRoute_Handler, - }, - { - MethodName: "GetInferenceRoute", - Handler: _Inference_GetInferenceRoute_Handler, - }, - { - MethodName: "DeleteInferenceRoute", - Handler: _Inference_DeleteInferenceRoute_Handler, - }, - }, - Streams: []grpc.StreamDesc{}, - Metadata: "inference.proto", -} diff --git a/backend/gen/openshellv1/openshell.pb.go b/backend/gen/openshellv1/openshell.pb.go deleted file mode 100644 index 4037daf5..00000000 --- a/backend/gen/openshellv1/openshell.pb.go +++ /dev/null @@ -1,14464 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: openshell.proto - -package openshellv1 - -import ( - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - structpb "google.golang.org/protobuf/types/known/structpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// High-level sandbox lifecycle phase derived by the gateway. -// -// Clients should rely on this normalized lifecycle summary for readiness and -// deletion decisions instead of interpreting raw conditions. -type SandboxPhase int32 - -const ( - SandboxPhase_SANDBOX_PHASE_UNSPECIFIED SandboxPhase = 0 - SandboxPhase_SANDBOX_PHASE_PROVISIONING SandboxPhase = 1 - SandboxPhase_SANDBOX_PHASE_READY SandboxPhase = 2 - SandboxPhase_SANDBOX_PHASE_ERROR SandboxPhase = 3 - SandboxPhase_SANDBOX_PHASE_DELETING SandboxPhase = 4 - SandboxPhase_SANDBOX_PHASE_UNKNOWN SandboxPhase = 5 -) - -// Enum value maps for SandboxPhase. -var ( - SandboxPhase_name = map[int32]string{ - 0: "SANDBOX_PHASE_UNSPECIFIED", - 1: "SANDBOX_PHASE_PROVISIONING", - 2: "SANDBOX_PHASE_READY", - 3: "SANDBOX_PHASE_ERROR", - 4: "SANDBOX_PHASE_DELETING", - 5: "SANDBOX_PHASE_UNKNOWN", - } - SandboxPhase_value = map[string]int32{ - "SANDBOX_PHASE_UNSPECIFIED": 0, - "SANDBOX_PHASE_PROVISIONING": 1, - "SANDBOX_PHASE_READY": 2, - "SANDBOX_PHASE_ERROR": 3, - "SANDBOX_PHASE_DELETING": 4, - "SANDBOX_PHASE_UNKNOWN": 5, - } -) - -func (x SandboxPhase) Enum() *SandboxPhase { - p := new(SandboxPhase) - *p = x - return p -} - -func (x SandboxPhase) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SandboxPhase) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[0].Descriptor() -} - -func (SandboxPhase) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[0] -} - -func (x SandboxPhase) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SandboxPhase.Descriptor instead. -func (SandboxPhase) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{0} -} - -type ProviderCredentialRefreshStrategy int32 - -const ( - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED ProviderCredentialRefreshStrategy = 0 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC ProviderCredentialRefreshStrategy = 1 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL ProviderCredentialRefreshStrategy = 2 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN ProviderCredentialRefreshStrategy = 3 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS ProviderCredentialRefreshStrategy = 4 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT ProviderCredentialRefreshStrategy = 5 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE ProviderCredentialRefreshStrategy = 6 -) - -// Enum value maps for ProviderCredentialRefreshStrategy. -var ( - ProviderCredentialRefreshStrategy_name = map[int32]string{ - 0: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED", - 1: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC", - 2: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL", - 3: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN", - 4: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS", - 5: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT", - 6: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE", - } - ProviderCredentialRefreshStrategy_value = map[string]int32{ - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED": 0, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC": 1, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL": 2, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN": 3, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS": 4, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT": 5, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE": 6, - } -) - -func (x ProviderCredentialRefreshStrategy) Enum() *ProviderCredentialRefreshStrategy { - p := new(ProviderCredentialRefreshStrategy) - *p = x - return p -} - -func (x ProviderCredentialRefreshStrategy) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ProviderCredentialRefreshStrategy) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[1].Descriptor() -} - -func (ProviderCredentialRefreshStrategy) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[1] -} - -func (x ProviderCredentialRefreshStrategy) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ProviderCredentialRefreshStrategy.Descriptor instead. -func (ProviderCredentialRefreshStrategy) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{1} -} - -// Stable provider profile categories used by clients for grouping and filtering. -type ProviderProfileCategory int32 - -const ( - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED ProviderProfileCategory = 0 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER ProviderProfileCategory = 1 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE ProviderProfileCategory = 2 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT ProviderProfileCategory = 3 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL ProviderProfileCategory = 4 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING ProviderProfileCategory = 5 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA ProviderProfileCategory = 6 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE ProviderProfileCategory = 7 -) - -// Enum value maps for ProviderProfileCategory. -var ( - ProviderProfileCategory_name = map[int32]string{ - 0: "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED", - 1: "PROVIDER_PROFILE_CATEGORY_OTHER", - 2: "PROVIDER_PROFILE_CATEGORY_INFERENCE", - 3: "PROVIDER_PROFILE_CATEGORY_AGENT", - 4: "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL", - 5: "PROVIDER_PROFILE_CATEGORY_MESSAGING", - 6: "PROVIDER_PROFILE_CATEGORY_DATA", - 7: "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE", - } - ProviderProfileCategory_value = map[string]int32{ - "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED": 0, - "PROVIDER_PROFILE_CATEGORY_OTHER": 1, - "PROVIDER_PROFILE_CATEGORY_INFERENCE": 2, - "PROVIDER_PROFILE_CATEGORY_AGENT": 3, - "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL": 4, - "PROVIDER_PROFILE_CATEGORY_MESSAGING": 5, - "PROVIDER_PROFILE_CATEGORY_DATA": 6, - "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE": 7, - } -) - -func (x ProviderProfileCategory) Enum() *ProviderProfileCategory { - p := new(ProviderProfileCategory) - *p = x - return p -} - -func (x ProviderProfileCategory) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ProviderProfileCategory) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[2].Descriptor() -} - -func (ProviderProfileCategory) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[2] -} - -func (x ProviderProfileCategory) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ProviderProfileCategory.Descriptor instead. -func (ProviderProfileCategory) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{2} -} - -// Policy load status. -type PolicyStatus int32 - -const ( - PolicyStatus_POLICY_STATUS_UNSPECIFIED PolicyStatus = 0 - // Server received the update; sandbox has not yet loaded it. - PolicyStatus_POLICY_STATUS_PENDING PolicyStatus = 1 - // Sandbox successfully applied this policy version. - PolicyStatus_POLICY_STATUS_LOADED PolicyStatus = 2 - // Sandbox attempted to apply but failed; LKG policy remains active. - PolicyStatus_POLICY_STATUS_FAILED PolicyStatus = 3 - // A newer version was persisted before the sandbox loaded this one. - PolicyStatus_POLICY_STATUS_SUPERSEDED PolicyStatus = 4 -) - -// Enum value maps for PolicyStatus. -var ( - PolicyStatus_name = map[int32]string{ - 0: "POLICY_STATUS_UNSPECIFIED", - 1: "POLICY_STATUS_PENDING", - 2: "POLICY_STATUS_LOADED", - 3: "POLICY_STATUS_FAILED", - 4: "POLICY_STATUS_SUPERSEDED", - } - PolicyStatus_value = map[string]int32{ - "POLICY_STATUS_UNSPECIFIED": 0, - "POLICY_STATUS_PENDING": 1, - "POLICY_STATUS_LOADED": 2, - "POLICY_STATUS_FAILED": 3, - "POLICY_STATUS_SUPERSEDED": 4, - } -) - -func (x PolicyStatus) Enum() *PolicyStatus { - p := new(PolicyStatus) - *p = x - return p -} - -func (x PolicyStatus) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (PolicyStatus) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[3].Descriptor() -} - -func (PolicyStatus) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[3] -} - -func (x PolicyStatus) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use PolicyStatus.Descriptor instead. -func (PolicyStatus) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{3} -} - -// Service status enum. -type ServiceStatus int32 - -const ( - ServiceStatus_SERVICE_STATUS_UNSPECIFIED ServiceStatus = 0 - ServiceStatus_SERVICE_STATUS_HEALTHY ServiceStatus = 1 - ServiceStatus_SERVICE_STATUS_DEGRADED ServiceStatus = 2 - ServiceStatus_SERVICE_STATUS_UNHEALTHY ServiceStatus = 3 -) - -// Enum value maps for ServiceStatus. -var ( - ServiceStatus_name = map[int32]string{ - 0: "SERVICE_STATUS_UNSPECIFIED", - 1: "SERVICE_STATUS_HEALTHY", - 2: "SERVICE_STATUS_DEGRADED", - 3: "SERVICE_STATUS_UNHEALTHY", - } - ServiceStatus_value = map[string]int32{ - "SERVICE_STATUS_UNSPECIFIED": 0, - "SERVICE_STATUS_HEALTHY": 1, - "SERVICE_STATUS_DEGRADED": 2, - "SERVICE_STATUS_UNHEALTHY": 3, - } -) - -func (x ServiceStatus) Enum() *ServiceStatus { - p := new(ServiceStatus) - *p = x - return p -} - -func (x ServiceStatus) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ServiceStatus) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[4].Descriptor() -} - -func (ServiceStatus) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[4] -} - -func (x ServiceStatus) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ServiceStatus.Descriptor instead. -func (ServiceStatus) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{4} -} - -// Workspace-scoped role for members. -type WorkspaceRole int32 - -const ( - WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED WorkspaceRole = 0 - WorkspaceRole_WORKSPACE_ROLE_USER WorkspaceRole = 1 - WorkspaceRole_WORKSPACE_ROLE_ADMIN WorkspaceRole = 2 -) - -// Enum value maps for WorkspaceRole. -var ( - WorkspaceRole_name = map[int32]string{ - 0: "WORKSPACE_ROLE_UNSPECIFIED", - 1: "WORKSPACE_ROLE_USER", - 2: "WORKSPACE_ROLE_ADMIN", - } - WorkspaceRole_value = map[string]int32{ - "WORKSPACE_ROLE_UNSPECIFIED": 0, - "WORKSPACE_ROLE_USER": 1, - "WORKSPACE_ROLE_ADMIN": 2, - } -) - -func (x WorkspaceRole) Enum() *WorkspaceRole { - p := new(WorkspaceRole) - *p = x - return p -} - -func (x WorkspaceRole) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WorkspaceRole) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[5].Descriptor() -} - -func (WorkspaceRole) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[5] -} - -func (x WorkspaceRole) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WorkspaceRole.Descriptor instead. -func (WorkspaceRole) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{5} -} - -// IssueSandboxToken request. Empty body; identity is established by the -// authentication credentials carried in the request headers (a projected -// Kubernetes ServiceAccount JWT in the K8s driver path). -type IssueSandboxTokenRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *IssueSandboxTokenRequest) Reset() { - *x = IssueSandboxTokenRequest{} - mi := &file_openshell_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *IssueSandboxTokenRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*IssueSandboxTokenRequest) ProtoMessage() {} - -func (x *IssueSandboxTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use IssueSandboxTokenRequest.ProtoReflect.Descriptor instead. -func (*IssueSandboxTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{0} -} - -// IssueSandboxToken response. The supervisor caches the returned token in -// memory and presents it as `Authorization: Bearer` on every subsequent -// gateway RPC. -type IssueSandboxTokenResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-minted JWT bound to the calling sandbox's UUID. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - // Absolute expiry of the issued token, milliseconds since the epoch. 0 means - // the token is non-expiring. - ExpiresAtMs int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *IssueSandboxTokenResponse) Reset() { - *x = IssueSandboxTokenResponse{} - mi := &file_openshell_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *IssueSandboxTokenResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*IssueSandboxTokenResponse) ProtoMessage() {} - -func (x *IssueSandboxTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use IssueSandboxTokenResponse.ProtoReflect.Descriptor instead. -func (*IssueSandboxTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{1} -} - -func (x *IssueSandboxTokenResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *IssueSandboxTokenResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// RefreshSandboxToken request. Empty body; the calling principal must -// already be a sandbox principal (i.e. the request carries a still-valid -// gateway-minted JWT in its Authorization header). -type RefreshSandboxTokenRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RefreshSandboxTokenRequest) Reset() { - *x = RefreshSandboxTokenRequest{} - mi := &file_openshell_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RefreshSandboxTokenRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RefreshSandboxTokenRequest) ProtoMessage() {} - -func (x *RefreshSandboxTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RefreshSandboxTokenRequest.ProtoReflect.Descriptor instead. -func (*RefreshSandboxTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{2} -} - -// RefreshSandboxToken response. The new token replaces the supervisor's -// in-memory bearer credential. -type RefreshSandboxTokenResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Fresh gateway-minted JWT bound to the same sandbox UUID. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - // Absolute expiry of the new token, milliseconds since the epoch. 0 means - // the token is non-expiring. - ExpiresAtMs int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RefreshSandboxTokenResponse) Reset() { - *x = RefreshSandboxTokenResponse{} - mi := &file_openshell_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RefreshSandboxTokenResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RefreshSandboxTokenResponse) ProtoMessage() {} - -func (x *RefreshSandboxTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RefreshSandboxTokenResponse.ProtoReflect.Descriptor instead. -func (*RefreshSandboxTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{3} -} - -func (x *RefreshSandboxTokenResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *RefreshSandboxTokenResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// Health check request. -type HealthRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *HealthRequest) Reset() { - *x = HealthRequest{} - mi := &file_openshell_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *HealthRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*HealthRequest) ProtoMessage() {} - -func (x *HealthRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead. -func (*HealthRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{4} -} - -// Health check response. -type HealthResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Service status. - Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"` - // Service version. - Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *HealthResponse) Reset() { - *x = HealthResponse{} - mi := &file_openshell_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *HealthResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*HealthResponse) ProtoMessage() {} - -func (x *HealthResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead. -func (*HealthResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{5} -} - -func (x *HealthResponse) GetStatus() ServiceStatus { - if x != nil { - return x.Status - } - return ServiceStatus_SERVICE_STATUS_UNSPECIFIED -} - -func (x *HealthResponse) GetVersion() string { - if x != nil { - return x.Version - } - return "" -} - -// Current-user request. The identity comes from the authenticated request. -type GetCurrentUserRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetCurrentUserRequest) Reset() { - *x = GetCurrentUserRequest{} - mi := &file_openshell_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetCurrentUserRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetCurrentUserRequest) ProtoMessage() {} - -func (x *GetCurrentUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetCurrentUserRequest.ProtoReflect.Descriptor instead. -func (*GetCurrentUserRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{6} -} - -// Authenticated user identity as validated by the gateway. -type GetCurrentUserResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Stable identity subject (for example, the OIDC `sub` claim). - Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"` - // Human-readable identity name when supplied by the authentication provider. - DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` - // Roles granted to the authenticated identity. - Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"` - // OAuth2 scopes granted to the authenticated identity. - Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` - // Authentication provider that established the identity. - IdentityProvider string `protobuf:"bytes,5,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetCurrentUserResponse) Reset() { - *x = GetCurrentUserResponse{} - mi := &file_openshell_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetCurrentUserResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetCurrentUserResponse) ProtoMessage() {} - -func (x *GetCurrentUserResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetCurrentUserResponse.ProtoReflect.Descriptor instead. -func (*GetCurrentUserResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{7} -} - -func (x *GetCurrentUserResponse) GetSubject() string { - if x != nil { - return x.Subject - } - return "" -} - -func (x *GetCurrentUserResponse) GetDisplayName() string { - if x != nil { - return x.DisplayName - } - return "" -} - -func (x *GetCurrentUserResponse) GetRoles() []string { - if x != nil { - return x.Roles - } - return nil -} - -func (x *GetCurrentUserResponse) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *GetCurrentUserResponse) GetIdentityProvider() string { - if x != nil { - return x.IdentityProvider - } - return "" -} - -// Gateway info request. -type GetGatewayInfoRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayInfoRequest) Reset() { - *x = GetGatewayInfoRequest{} - mi := &file_openshell_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayInfoRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayInfoRequest) ProtoMessage() {} - -func (x *GetGatewayInfoRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayInfoRequest.ProtoReflect.Descriptor instead. -func (*GetGatewayInfoRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{8} -} - -// Gateway info response. -type GetGatewayInfoResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Service status. - Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"` - // OpenShell gateway binary version. - GatewayVersion string `protobuf:"bytes,2,opt,name=gateway_version,json=gatewayVersion,proto3" json:"gateway_version,omitempty"` - // Compute driver runtimes initialized by this gateway. Current gateways - // return exactly one entry. - ComputeDrivers []*ComputeDriverInfo `protobuf:"bytes,3,rep,name=compute_drivers,json=computeDrivers,proto3" json:"compute_drivers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayInfoResponse) Reset() { - *x = GetGatewayInfoResponse{} - mi := &file_openshell_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayInfoResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayInfoResponse) ProtoMessage() {} - -func (x *GetGatewayInfoResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayInfoResponse.ProtoReflect.Descriptor instead. -func (*GetGatewayInfoResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{9} -} - -func (x *GetGatewayInfoResponse) GetStatus() ServiceStatus { - if x != nil { - return x.Status - } - return ServiceStatus_SERVICE_STATUS_UNSPECIFIED -} - -func (x *GetGatewayInfoResponse) GetGatewayVersion() string { - if x != nil { - return x.GatewayVersion - } - return "" -} - -func (x *GetGatewayInfoResponse) GetComputeDrivers() []*ComputeDriverInfo { - if x != nil { - return x.ComputeDrivers - } - return nil -} - -// Info for one initialized compute driver runtime. -type ComputeDriverInfo struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-selected driver name used for routing and driver_config keys. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Capabilities reported by the driver during gateway runtime initialization. - Capabilities *ComputeDriverCapabilities `protobuf:"bytes,2,opt,name=capabilities,proto3" json:"capabilities,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ComputeDriverInfo) Reset() { - *x = ComputeDriverInfo{} - mi := &file_openshell_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ComputeDriverInfo) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ComputeDriverInfo) ProtoMessage() {} - -func (x *ComputeDriverInfo) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ComputeDriverInfo.ProtoReflect.Descriptor instead. -func (*ComputeDriverInfo) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{10} -} - -func (x *ComputeDriverInfo) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ComputeDriverInfo) GetCapabilities() *ComputeDriverCapabilities { - if x != nil { - return x.Capabilities - } - return nil -} - -// Public compute driver capability snapshot. -type ComputeDriverCapabilities struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Driver-reported human-readable name from the startup capability snapshot. - DriverName string `protobuf:"bytes,1,opt,name=driver_name,json=driverName,proto3" json:"driver_name,omitempty"` - // Driver-reported implementation version from the startup capability snapshot. - DriverVersion string `protobuf:"bytes,2,opt,name=driver_version,json=driverVersion,proto3" json:"driver_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ComputeDriverCapabilities) Reset() { - *x = ComputeDriverCapabilities{} - mi := &file_openshell_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ComputeDriverCapabilities) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ComputeDriverCapabilities) ProtoMessage() {} - -func (x *ComputeDriverCapabilities) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ComputeDriverCapabilities.ProtoReflect.Descriptor instead. -func (*ComputeDriverCapabilities) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{11} -} - -func (x *ComputeDriverCapabilities) GetDriverName() string { - if x != nil { - return x.DriverName - } - return "" -} - -func (x *ComputeDriverCapabilities) GetDriverVersion() string { - if x != nil { - return x.DriverVersion - } - return "" -} - -// Public sandbox resource exposed by the OpenShell API. -// -// This is the canonical gateway-owned view of a sandbox. It merges user intent -// (`spec`) with gateway-managed metadata and status derived from internal -// compute-driver observations. -// -// Note: The `namespace` field has been removed from the public API. It remains -// in the internal `DriverSandbox` message as a compute-driver implementation detail. -type Sandbox struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Desired sandbox configuration submitted through the API. - Spec *SandboxSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"` - // Latest user-facing observed status derived by the gateway. - Status *SandboxStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Sandbox) Reset() { - *x = Sandbox{} - mi := &file_openshell_proto_msgTypes[12] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Sandbox) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Sandbox) ProtoMessage() {} - -func (x *Sandbox) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[12] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Sandbox.ProtoReflect.Descriptor instead. -func (*Sandbox) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{12} -} - -func (x *Sandbox) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Sandbox) GetSpec() *SandboxSpec { - if x != nil { - return x.Spec - } - return nil -} - -func (x *Sandbox) GetStatus() *SandboxStatus { - if x != nil { - return x.Status - } - return nil -} - -// Desired sandbox configuration provided through the public API. -type SandboxSpec struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Log level exposed to processes running inside the sandbox. - LogLevel string `protobuf:"bytes,1,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"` - // Environment variables injected into the sandbox runtime. - Environment map[string]string `protobuf:"bytes,5,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Container or VM template used to provision the sandbox. - Template *SandboxTemplate `protobuf:"bytes,6,opt,name=template,proto3" json:"template,omitempty"` - // Required sandbox policy configuration. - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"` - // Provider names to attach to this sandbox. - Providers []string `protobuf:"bytes,8,rep,name=providers,proto3" json:"providers,omitempty"` - // Portable resource requirements used by the gateway for driver selection - // and by drivers for provisioning. - ResourceRequirements *ResourceRequirements `protobuf:"bytes,9,opt,name=resource_requirements,json=resourceRequirements,proto3" json:"resource_requirements,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxSpec) Reset() { - *x = SandboxSpec{} - mi := &file_openshell_proto_msgTypes[13] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxSpec) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxSpec) ProtoMessage() {} - -func (x *SandboxSpec) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[13] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxSpec.ProtoReflect.Descriptor instead. -func (*SandboxSpec) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{13} -} - -func (x *SandboxSpec) GetLogLevel() string { - if x != nil { - return x.LogLevel - } - return "" -} - -func (x *SandboxSpec) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *SandboxSpec) GetTemplate() *SandboxTemplate { - if x != nil { - return x.Template - } - return nil -} - -func (x *SandboxSpec) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *SandboxSpec) GetProviders() []string { - if x != nil { - return x.Providers - } - return nil -} - -func (x *SandboxSpec) GetResourceRequirements() *ResourceRequirements { - if x != nil { - return x.ResourceRequirements - } - return nil -} - -type ResourceRequirements struct { - state protoimpl.MessageState `protogen:"open.v1"` - // GPU requirements for the sandbox. Presence indicates a GPU request. - Gpu *GpuResourceRequirements `protobuf:"bytes,1,opt,name=gpu,proto3" json:"gpu,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ResourceRequirements) Reset() { - *x = ResourceRequirements{} - mi := &file_openshell_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ResourceRequirements) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ResourceRequirements) ProtoMessage() {} - -func (x *ResourceRequirements) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ResourceRequirements.ProtoReflect.Descriptor instead. -func (*ResourceRequirements) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{14} -} - -func (x *ResourceRequirements) GetGpu() *GpuResourceRequirements { - if x != nil { - return x.Gpu - } - return nil -} - -// Public GPU resource requirements. -type GpuResourceRequirements struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional number of GPUs requested. When omitted, the request is for one - // GPU using the selected driver's default assignment behavior. - Count *uint32 `protobuf:"varint,1,opt,name=count,proto3,oneof" json:"count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GpuResourceRequirements) Reset() { - *x = GpuResourceRequirements{} - mi := &file_openshell_proto_msgTypes[15] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GpuResourceRequirements) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GpuResourceRequirements) ProtoMessage() {} - -func (x *GpuResourceRequirements) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[15] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GpuResourceRequirements.ProtoReflect.Descriptor instead. -func (*GpuResourceRequirements) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{15} -} - -func (x *GpuResourceRequirements) GetCount() uint32 { - if x != nil && x.Count != nil { - return *x.Count - } - return 0 -} - -// Public sandbox template mapped onto compute-driver template inputs. -type SandboxTemplate struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Fully-qualified OCI image reference used to boot the sandbox. - Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"` - // Optional runtime class name requested from the compute platform. - RuntimeClassName string `protobuf:"bytes,2,opt,name=runtime_class_name,json=runtimeClassName,proto3" json:"runtime_class_name,omitempty"` - // Optional agent socket path exposed to the workload. - AgentSocket string `protobuf:"bytes,3,opt,name=agent_socket,json=agentSocket,proto3" json:"agent_socket,omitempty"` - // Labels applied to compute-platform resources for this sandbox. - Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Annotations applied to compute-platform resources for this sandbox. - Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Additional environment variables injected by the template. - Environment map[string]string `protobuf:"bytes,6,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Platform-specific compute resource requirements and limits. - Resources *structpb.Struct `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"` - // Enable Kubernetes user namespace isolation (hostUsers: false). - // When true, container UID 0 maps to a non-root host UID and capabilities - // become namespaced. Requires Kubernetes 1.33+ with user namespace support - // available (beta through 1.35, GA in 1.36+) and a supporting runtime. - // When unset, the cluster-wide default is used. - UserNamespaces *bool `protobuf:"varint,10,opt,name=user_namespaces,json=userNamespaces,proto3,oneof" json:"user_namespaces,omitempty"` - // Driver-keyed opaque config envelope supplied by the caller. - // The gateway selects the block matching the active compute driver and - // forwards only that inner Struct to DriverSandboxTemplate.driver_config. - // The selected driver owns nested schema validation. - DriverConfig *structpb.Struct `protobuf:"bytes,11,opt,name=driver_config,json=driverConfig,proto3" json:"driver_config,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxTemplate) Reset() { - *x = SandboxTemplate{} - mi := &file_openshell_proto_msgTypes[16] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxTemplate) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxTemplate) ProtoMessage() {} - -func (x *SandboxTemplate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[16] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxTemplate.ProtoReflect.Descriptor instead. -func (*SandboxTemplate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{16} -} - -func (x *SandboxTemplate) GetImage() string { - if x != nil { - return x.Image - } - return "" -} - -func (x *SandboxTemplate) GetRuntimeClassName() string { - if x != nil { - return x.RuntimeClassName - } - return "" -} - -func (x *SandboxTemplate) GetAgentSocket() string { - if x != nil { - return x.AgentSocket - } - return "" -} - -func (x *SandboxTemplate) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *SandboxTemplate) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *SandboxTemplate) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *SandboxTemplate) GetResources() *structpb.Struct { - if x != nil { - return x.Resources - } - return nil -} - -func (x *SandboxTemplate) GetUserNamespaces() bool { - if x != nil && x.UserNamespaces != nil { - return *x.UserNamespaces - } - return false -} - -func (x *SandboxTemplate) GetDriverConfig() *structpb.Struct { - if x != nil { - return x.DriverConfig - } - return nil -} - -// User-facing sandbox status derived by the gateway from compute-driver observations. -// -// Public status does not embed driver-only flags such as `deleting`. -type SandboxStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Compute-platform sandbox object name. - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Name of the agent pod or equivalent runtime instance. - AgentPod string `protobuf:"bytes,2,opt,name=agent_pod,json=agentPod,proto3" json:"agent_pod,omitempty"` - // File descriptor or endpoint for reaching the agent service, when available. - AgentFd string `protobuf:"bytes,3,opt,name=agent_fd,json=agentFd,proto3" json:"agent_fd,omitempty"` - // File descriptor or endpoint for reaching the sandbox service, when available. - SandboxFd string `protobuf:"bytes,4,opt,name=sandbox_fd,json=sandboxFd,proto3" json:"sandbox_fd,omitempty"` - // Latest user-facing readiness and lifecycle conditions. - Conditions []*SandboxCondition `protobuf:"bytes,5,rep,name=conditions,proto3" json:"conditions,omitempty"` - // Gateway-derived lifecycle summary. - Phase SandboxPhase `protobuf:"varint,6,opt,name=phase,proto3,enum=openshell.v1.SandboxPhase" json:"phase,omitempty"` - // Currently active policy version (updated when sandbox reports loaded). - CurrentPolicyVersion uint32 `protobuf:"varint,7,opt,name=current_policy_version,json=currentPolicyVersion,proto3" json:"current_policy_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStatus) Reset() { - *x = SandboxStatus{} - mi := &file_openshell_proto_msgTypes[17] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStatus) ProtoMessage() {} - -func (x *SandboxStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[17] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStatus.ProtoReflect.Descriptor instead. -func (*SandboxStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{17} -} - -func (x *SandboxStatus) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *SandboxStatus) GetAgentPod() string { - if x != nil { - return x.AgentPod - } - return "" -} - -func (x *SandboxStatus) GetAgentFd() string { - if x != nil { - return x.AgentFd - } - return "" -} - -func (x *SandboxStatus) GetSandboxFd() string { - if x != nil { - return x.SandboxFd - } - return "" -} - -func (x *SandboxStatus) GetConditions() []*SandboxCondition { - if x != nil { - return x.Conditions - } - return nil -} - -func (x *SandboxStatus) GetPhase() SandboxPhase { - if x != nil { - return x.Phase - } - return SandboxPhase_SANDBOX_PHASE_UNSPECIFIED -} - -func (x *SandboxStatus) GetCurrentPolicyVersion() uint32 { - if x != nil { - return x.CurrentPolicyVersion - } - return 0 -} - -// User-facing sandbox condition derived from driver-native conditions. -type SandboxCondition struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Condition class, typically mirroring the underlying platform condition type. - Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"` - // Condition status value such as `True`, `False`, or `Unknown`. - Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - // Short machine-readable reason associated with the condition. - Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"` - // Human-readable condition message. - Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` - // Timestamp reported by the underlying platform for the last transition. - LastTransitionTime string `protobuf:"bytes,5,opt,name=last_transition_time,json=lastTransitionTime,proto3" json:"last_transition_time,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxCondition) Reset() { - *x = SandboxCondition{} - mi := &file_openshell_proto_msgTypes[18] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxCondition) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxCondition) ProtoMessage() {} - -func (x *SandboxCondition) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[18] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxCondition.ProtoReflect.Descriptor instead. -func (*SandboxCondition) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{18} -} - -func (x *SandboxCondition) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *SandboxCondition) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *SandboxCondition) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *SandboxCondition) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *SandboxCondition) GetLastTransitionTime() string { - if x != nil { - return x.LastTransitionTime - } - return "" -} - -// Public platform event exposed on the sandbox watch stream. -type PlatformEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Event timestamp in milliseconds since epoch. - TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - // Event source (e.g. "kubernetes", "docker", "process"). - Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"` - // Event type/severity (e.g. "Normal", "Warning"). - Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"` - // Short reason code (e.g. "Started", "Pulled", "Failed"). - Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"` - // Human-readable event message. - Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"` - // Optional metadata as key-value pairs. - Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PlatformEvent) Reset() { - *x = PlatformEvent{} - mi := &file_openshell_proto_msgTypes[19] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PlatformEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PlatformEvent) ProtoMessage() {} - -func (x *PlatformEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[19] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PlatformEvent.ProtoReflect.Descriptor instead. -func (*PlatformEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{19} -} - -func (x *PlatformEvent) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *PlatformEvent) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *PlatformEvent) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *PlatformEvent) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *PlatformEvent) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *PlatformEvent) GetMetadata() map[string]string { - if x != nil { - return x.Metadata - } - return nil -} - -// Create sandbox request. -type CreateSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Spec *SandboxSpec `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"` - // Optional user-supplied sandbox name. When empty the server generates one. - Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` - // Optional labels for the sandbox (key-value metadata). - Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optional annotations for the sandbox (non-selector metadata). - Annotations map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace for the sandbox. Empty defaults to "default". - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSandboxRequest) Reset() { - *x = CreateSandboxRequest{} - mi := &file_openshell_proto_msgTypes[20] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSandboxRequest) ProtoMessage() {} - -func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[20] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead. -func (*CreateSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{20} -} - -func (x *CreateSandboxRequest) GetSpec() *SandboxSpec { - if x != nil { - return x.Spec - } - return nil -} - -func (x *CreateSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *CreateSandboxRequest) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *CreateSandboxRequest) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *CreateSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get sandbox request. -type GetSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxRequest) Reset() { - *x = GetSandboxRequest{} - mi := &file_openshell_proto_msgTypes[21] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxRequest) ProtoMessage() {} - -func (x *GetSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[21] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{21} -} - -func (x *GetSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List sandboxes request. -type ListSandboxesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxesRequest) Reset() { - *x = ListSandboxesRequest{} - mi := &file_openshell_proto_msgTypes[22] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxesRequest) ProtoMessage() {} - -func (x *ListSandboxesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[22] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxesRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{22} -} - -func (x *ListSandboxesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListSandboxesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListSandboxesRequest) GetLabelSelector() string { - if x != nil { - return x.LabelSelector - } - return "" -} - -func (x *ListSandboxesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListSandboxesRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// List providers attached to a sandbox request. -type ListSandboxProvidersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxProvidersRequest) Reset() { - *x = ListSandboxProvidersRequest{} - mi := &file_openshell_proto_msgTypes[23] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxProvidersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxProvidersRequest) ProtoMessage() {} - -func (x *ListSandboxProvidersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[23] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxProvidersRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxProvidersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{23} -} - -func (x *ListSandboxProvidersRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *ListSandboxProvidersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Attach provider to sandbox request. -type AttachSandboxProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Provider name to attach. - ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AttachSandboxProviderRequest) Reset() { - *x = AttachSandboxProviderRequest{} - mi := &file_openshell_proto_msgTypes[24] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AttachSandboxProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AttachSandboxProviderRequest) ProtoMessage() {} - -func (x *AttachSandboxProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[24] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AttachSandboxProviderRequest.ProtoReflect.Descriptor instead. -func (*AttachSandboxProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{24} -} - -func (x *AttachSandboxProviderRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *AttachSandboxProviderRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *AttachSandboxProviderRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *AttachSandboxProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Detach provider from sandbox request. -type DetachSandboxProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Provider name to detach. - ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DetachSandboxProviderRequest) Reset() { - *x = DetachSandboxProviderRequest{} - mi := &file_openshell_proto_msgTypes[25] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DetachSandboxProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DetachSandboxProviderRequest) ProtoMessage() {} - -func (x *DetachSandboxProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[25] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DetachSandboxProviderRequest.ProtoReflect.Descriptor instead. -func (*DetachSandboxProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{25} -} - -func (x *DetachSandboxProviderRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *DetachSandboxProviderRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *DetachSandboxProviderRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *DetachSandboxProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete sandbox request. -type DeleteSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteSandboxRequest) Reset() { - *x = DeleteSandboxRequest{} - mi := &file_openshell_proto_msgTypes[26] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteSandboxRequest) ProtoMessage() {} - -func (x *DeleteSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[26] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteSandboxRequest.ProtoReflect.Descriptor instead. -func (*DeleteSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{26} -} - -func (x *DeleteSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *DeleteSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Sandbox response. -type SandboxResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxResponse) Reset() { - *x = SandboxResponse{} - mi := &file_openshell_proto_msgTypes[27] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxResponse) ProtoMessage() {} - -func (x *SandboxResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[27] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxResponse.ProtoReflect.Descriptor instead. -func (*SandboxResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{27} -} - -func (x *SandboxResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -// List sandboxes response. -type ListSandboxesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandboxes []*Sandbox `protobuf:"bytes,1,rep,name=sandboxes,proto3" json:"sandboxes,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxesResponse) Reset() { - *x = ListSandboxesResponse{} - mi := &file_openshell_proto_msgTypes[28] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxesResponse) ProtoMessage() {} - -func (x *ListSandboxesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[28] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxesResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{28} -} - -func (x *ListSandboxesResponse) GetSandboxes() []*Sandbox { - if x != nil { - return x.Sandboxes - } - return nil -} - -// List providers attached to a sandbox response. -type ListSandboxProvidersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Providers []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxProvidersResponse) Reset() { - *x = ListSandboxProvidersResponse{} - mi := &file_openshell_proto_msgTypes[29] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxProvidersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxProvidersResponse) ProtoMessage() {} - -func (x *ListSandboxProvidersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[29] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxProvidersResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxProvidersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{29} -} - -func (x *ListSandboxProvidersResponse) GetProviders() []*datamodelv1.Provider { - if x != nil { - return x.Providers - } - return nil -} - -// Attach provider to sandbox response. -type AttachSandboxProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // True when the provider was newly attached. False means it was already attached. - Attached bool `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AttachSandboxProviderResponse) Reset() { - *x = AttachSandboxProviderResponse{} - mi := &file_openshell_proto_msgTypes[30] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AttachSandboxProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AttachSandboxProviderResponse) ProtoMessage() {} - -func (x *AttachSandboxProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[30] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AttachSandboxProviderResponse.ProtoReflect.Descriptor instead. -func (*AttachSandboxProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{30} -} - -func (x *AttachSandboxProviderResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -func (x *AttachSandboxProviderResponse) GetAttached() bool { - if x != nil { - return x.Attached - } - return false -} - -// Detach provider from sandbox response. -type DetachSandboxProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // True when the provider was removed. False means it was not attached. - Detached bool `protobuf:"varint,2,opt,name=detached,proto3" json:"detached,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DetachSandboxProviderResponse) Reset() { - *x = DetachSandboxProviderResponse{} - mi := &file_openshell_proto_msgTypes[31] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DetachSandboxProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DetachSandboxProviderResponse) ProtoMessage() {} - -func (x *DetachSandboxProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[31] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DetachSandboxProviderResponse.ProtoReflect.Descriptor instead. -func (*DetachSandboxProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{31} -} - -func (x *DetachSandboxProviderResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -func (x *DetachSandboxProviderResponse) GetDetached() bool { - if x != nil { - return x.Detached - } - return false -} - -// Delete sandbox response. -type DeleteSandboxResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteSandboxResponse) Reset() { - *x = DeleteSandboxResponse{} - mi := &file_openshell_proto_msgTypes[32] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteSandboxResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteSandboxResponse) ProtoMessage() {} - -func (x *DeleteSandboxResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[32] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteSandboxResponse.ProtoReflect.Descriptor instead. -func (*DeleteSandboxResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{32} -} - -func (x *DeleteSandboxResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Create SSH session request. -type CreateSshSessionRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSshSessionRequest) Reset() { - *x = CreateSshSessionRequest{} - mi := &file_openshell_proto_msgTypes[33] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSshSessionRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSshSessionRequest) ProtoMessage() {} - -func (x *CreateSshSessionRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[33] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSshSessionRequest.ProtoReflect.Descriptor instead. -func (*CreateSshSessionRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{33} -} - -func (x *CreateSshSessionRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Create SSH session response. -// -// Fields are interpolated into an SSH `ProxyCommand` string that OpenSSH -// executes through `/bin/sh -c` on the caller's workstation. Servers MUST -// uphold the charset contract below; clients MUST reject responses that -// violate it. The client's own escaping provides defense-in-depth, but -// narrow charsets close injection vectors at the trust boundary. -type CreateSshSessionResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. [A-Za-z0-9._-]{1,128}. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Session token for the gateway tunnel. URL-safe ASCII - // ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or - // whitespace. - Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"` - // Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6 - // address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus - // `.-:[]` only, up to 253 bytes. - GatewayHost string `protobuf:"bytes,3,opt,name=gateway_host,json=gatewayHost,proto3" json:"gateway_host,omitempty"` - // Gateway port for SSH proxy connection. Must be in range 1..=65535. - GatewayPort uint32 `protobuf:"varint,4,opt,name=gateway_port,json=gatewayPort,proto3" json:"gateway_port,omitempty"` - // Gateway scheme. Must be exactly "http" or "https". - GatewayScheme string `protobuf:"bytes,5,opt,name=gateway_scheme,json=gatewayScheme,proto3" json:"gateway_scheme,omitempty"` - // Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only. - HostKeyFingerprint string `protobuf:"bytes,7,opt,name=host_key_fingerprint,json=hostKeyFingerprint,proto3" json:"host_key_fingerprint,omitempty"` - // Expiry timestamp in milliseconds since epoch. 0 means no expiry. - ExpiresAtMs int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSshSessionResponse) Reset() { - *x = CreateSshSessionResponse{} - mi := &file_openshell_proto_msgTypes[34] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSshSessionResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSshSessionResponse) ProtoMessage() {} - -func (x *CreateSshSessionResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[34] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSshSessionResponse.ProtoReflect.Descriptor instead. -func (*CreateSshSessionResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{34} -} - -func (x *CreateSshSessionResponse) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *CreateSshSessionResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *CreateSshSessionResponse) GetGatewayHost() string { - if x != nil { - return x.GatewayHost - } - return "" -} - -func (x *CreateSshSessionResponse) GetGatewayPort() uint32 { - if x != nil { - return x.GatewayPort - } - return 0 -} - -func (x *CreateSshSessionResponse) GetGatewayScheme() string { - if x != nil { - return x.GatewayScheme - } - return "" -} - -func (x *CreateSshSessionResponse) GetHostKeyFingerprint() string { - if x != nil { - return x.HostKeyFingerprint - } - return "" -} - -func (x *CreateSshSessionResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// Request to expose an HTTP service running inside a sandbox. -type ExposeServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Loopback TCP port inside the sandbox. - TargetPort uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"` - // Whether to print/use the browser-facing service URL. - Domain bool `protobuf:"varint,4,opt,name=domain,proto3" json:"domain,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExposeServiceRequest) Reset() { - *x = ExposeServiceRequest{} - mi := &file_openshell_proto_msgTypes[35] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExposeServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExposeServiceRequest) ProtoMessage() {} - -func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[35] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead. -func (*ExposeServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{35} -} - -func (x *ExposeServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *ExposeServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *ExposeServiceRequest) GetTargetPort() uint32 { - if x != nil { - return x.TargetPort - } - return 0 -} - -func (x *ExposeServiceRequest) GetDomain() bool { - if x != nil { - return x.Domain - } - return false -} - -func (x *ExposeServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Request to fetch an exposed sandbox service endpoint. -type GetServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. Empty selects the unnamed endpoint. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetServiceRequest) Reset() { - *x = GetServiceRequest{} - mi := &file_openshell_proto_msgTypes[36] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetServiceRequest) ProtoMessage() {} - -func (x *GetServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[36] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetServiceRequest.ProtoReflect.Descriptor instead. -func (*GetServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{36} -} - -func (x *GetServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *GetServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *GetServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Request to list exposed sandbox service endpoints. -type ListServicesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional sandbox name. Empty lists endpoints for all sandboxes. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Page size. Zero uses the server default. - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - // Page offset. - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListServicesRequest) Reset() { - *x = ListServicesRequest{} - mi := &file_openshell_proto_msgTypes[37] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListServicesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListServicesRequest) ProtoMessage() {} - -func (x *ListServicesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[37] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListServicesRequest.ProtoReflect.Descriptor instead. -func (*ListServicesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{37} -} - -func (x *ListServicesRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *ListServicesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListServicesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListServicesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListServicesRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// Response containing exposed sandbox service endpoints. -type ListServicesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Services []*ServiceEndpointResponse `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListServicesResponse) Reset() { - *x = ListServicesResponse{} - mi := &file_openshell_proto_msgTypes[38] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListServicesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListServicesResponse) ProtoMessage() {} - -func (x *ListServicesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[38] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListServicesResponse.ProtoReflect.Descriptor instead. -func (*ListServicesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{38} -} - -func (x *ListServicesResponse) GetServices() []*ServiceEndpointResponse { - if x != nil { - return x.Services - } - return nil -} - -// Request to delete an exposed sandbox service endpoint. -type DeleteServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. Empty selects the unnamed endpoint. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteServiceRequest) Reset() { - *x = DeleteServiceRequest{} - mi := &file_openshell_proto_msgTypes[39] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteServiceRequest) ProtoMessage() {} - -func (x *DeleteServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[39] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteServiceRequest.ProtoReflect.Descriptor instead. -func (*DeleteServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{39} -} - -func (x *DeleteServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *DeleteServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *DeleteServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Response for deleting an exposed sandbox service endpoint. -type DeleteServiceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // True when an endpoint existed and was deleted. - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteServiceResponse) Reset() { - *x = DeleteServiceResponse{} - mi := &file_openshell_proto_msgTypes[40] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteServiceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteServiceResponse) ProtoMessage() {} - -func (x *DeleteServiceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[40] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteServiceResponse.ProtoReflect.Descriptor instead. -func (*DeleteServiceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{40} -} - -func (x *DeleteServiceResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Persisted sandbox service endpoint. -type ServiceEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata. - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Sandbox object ID. - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Sandbox name. - SandboxName string `protobuf:"bytes,3,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Service name within the sandbox. - ServiceName string `protobuf:"bytes,4,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"` - // Loopback TCP port inside the sandbox. - TargetPort uint32 `protobuf:"varint,5,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"` - // Whether browser-facing service routing is enabled for this endpoint. - Domain bool `protobuf:"varint,6,opt,name=domain,proto3" json:"domain,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ServiceEndpoint) Reset() { - *x = ServiceEndpoint{} - mi := &file_openshell_proto_msgTypes[41] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ServiceEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ServiceEndpoint) ProtoMessage() {} - -func (x *ServiceEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[41] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ServiceEndpoint.ProtoReflect.Descriptor instead. -func (*ServiceEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{41} -} - -func (x *ServiceEndpoint) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *ServiceEndpoint) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ServiceEndpoint) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *ServiceEndpoint) GetServiceName() string { - if x != nil { - return x.ServiceName - } - return "" -} - -func (x *ServiceEndpoint) GetTargetPort() uint32 { - if x != nil { - return x.TargetPort - } - return 0 -} - -func (x *ServiceEndpoint) GetDomain() bool { - if x != nil { - return x.Domain - } - return false -} - -// Response containing a service endpoint and, when available, its local URL. -type ServiceEndpointResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Endpoint *ServiceEndpoint `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"` - Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ServiceEndpointResponse) Reset() { - *x = ServiceEndpointResponse{} - mi := &file_openshell_proto_msgTypes[42] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ServiceEndpointResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ServiceEndpointResponse) ProtoMessage() {} - -func (x *ServiceEndpointResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[42] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ServiceEndpointResponse.ProtoReflect.Descriptor instead. -func (*ServiceEndpointResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{42} -} - -func (x *ServiceEndpointResponse) GetEndpoint() *ServiceEndpoint { - if x != nil { - return x.Endpoint - } - return nil -} - -func (x *ServiceEndpointResponse) GetUrl() string { - if x != nil { - return x.Url - } - return "" -} - -// Revoke SSH session request. -type RevokeSshSessionRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Session token to revoke. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RevokeSshSessionRequest) Reset() { - *x = RevokeSshSessionRequest{} - mi := &file_openshell_proto_msgTypes[43] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RevokeSshSessionRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RevokeSshSessionRequest) ProtoMessage() {} - -func (x *RevokeSshSessionRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[43] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RevokeSshSessionRequest.ProtoReflect.Descriptor instead. -func (*RevokeSshSessionRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{43} -} - -func (x *RevokeSshSessionRequest) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -// Revoke SSH session response. -type RevokeSshSessionResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // True when a session was revoked. - Revoked bool `protobuf:"varint,1,opt,name=revoked,proto3" json:"revoked,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RevokeSshSessionResponse) Reset() { - *x = RevokeSshSessionResponse{} - mi := &file_openshell_proto_msgTypes[44] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RevokeSshSessionResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RevokeSshSessionResponse) ProtoMessage() {} - -func (x *RevokeSshSessionResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[44] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RevokeSshSessionResponse.ProtoReflect.Descriptor instead. -func (*RevokeSshSessionResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{44} -} - -func (x *RevokeSshSessionResponse) GetRevoked() bool { - if x != nil { - return x.Revoked - } - return false -} - -// Execute command request. -type ExecSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Command and arguments. - Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"` - // Optional working directory. - Workdir string `protobuf:"bytes,3,opt,name=workdir,proto3" json:"workdir,omitempty"` - // Optional environment overrides. - Environment map[string]string `protobuf:"bytes,4,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optional timeout in seconds. 0 means no timeout. - TimeoutSeconds uint32 `protobuf:"varint,5,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"` - // Optional stdin payload passed to the command. - Stdin []byte `protobuf:"bytes,6,opt,name=stdin,proto3" json:"stdin,omitempty"` - // Request a pseudo-terminal for the remote command. - Tty bool `protobuf:"varint,7,opt,name=tty,proto3" json:"tty,omitempty"` - // Initial terminal columns (used when tty=true, 0 = use default). - Cols uint32 `protobuf:"varint,8,opt,name=cols,proto3" json:"cols,omitempty"` - // Initial terminal rows (used when tty=true, 0 = use default). - Rows uint32 `protobuf:"varint,9,opt,name=rows,proto3" json:"rows,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxRequest) Reset() { - *x = ExecSandboxRequest{} - mi := &file_openshell_proto_msgTypes[45] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxRequest) ProtoMessage() {} - -func (x *ExecSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[45] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxRequest.ProtoReflect.Descriptor instead. -func (*ExecSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{45} -} - -func (x *ExecSandboxRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ExecSandboxRequest) GetCommand() []string { - if x != nil { - return x.Command - } - return nil -} - -func (x *ExecSandboxRequest) GetWorkdir() string { - if x != nil { - return x.Workdir - } - return "" -} - -func (x *ExecSandboxRequest) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *ExecSandboxRequest) GetTimeoutSeconds() uint32 { - if x != nil { - return x.TimeoutSeconds - } - return 0 -} - -func (x *ExecSandboxRequest) GetStdin() []byte { - if x != nil { - return x.Stdin - } - return nil -} - -func (x *ExecSandboxRequest) GetTty() bool { - if x != nil { - return x.Tty - } - return false -} - -func (x *ExecSandboxRequest) GetCols() uint32 { - if x != nil { - return x.Cols - } - return 0 -} - -func (x *ExecSandboxRequest) GetRows() uint32 { - if x != nil { - return x.Rows - } - return 0 -} - -// One stdout chunk from a sandbox exec. -type ExecSandboxStdout struct { - state protoimpl.MessageState `protogen:"open.v1"` - Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxStdout) Reset() { - *x = ExecSandboxStdout{} - mi := &file_openshell_proto_msgTypes[46] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxStdout) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxStdout) ProtoMessage() {} - -func (x *ExecSandboxStdout) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[46] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxStdout.ProtoReflect.Descriptor instead. -func (*ExecSandboxStdout) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{46} -} - -func (x *ExecSandboxStdout) GetData() []byte { - if x != nil { - return x.Data - } - return nil -} - -// One stderr chunk from a sandbox exec. -type ExecSandboxStderr struct { - state protoimpl.MessageState `protogen:"open.v1"` - Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxStderr) Reset() { - *x = ExecSandboxStderr{} - mi := &file_openshell_proto_msgTypes[47] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxStderr) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxStderr) ProtoMessage() {} - -func (x *ExecSandboxStderr) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[47] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxStderr.ProtoReflect.Descriptor instead. -func (*ExecSandboxStderr) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{47} -} - -func (x *ExecSandboxStderr) GetData() []byte { - if x != nil { - return x.Data - } - return nil -} - -// Final exit status for a sandbox exec. -type ExecSandboxExit struct { - state protoimpl.MessageState `protogen:"open.v1"` - ExitCode int32 `protobuf:"varint,1,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxExit) Reset() { - *x = ExecSandboxExit{} - mi := &file_openshell_proto_msgTypes[48] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxExit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxExit) ProtoMessage() {} - -func (x *ExecSandboxExit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[48] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxExit.ProtoReflect.Descriptor instead. -func (*ExecSandboxExit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{48} -} - -func (x *ExecSandboxExit) GetExitCode() int32 { - if x != nil { - return x.ExitCode - } - return 0 -} - -// One event in a sandbox exec stream. -type ExecSandboxEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *ExecSandboxEvent_Stdout - // *ExecSandboxEvent_Stderr - // *ExecSandboxEvent_Exit - Payload isExecSandboxEvent_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxEvent) Reset() { - *x = ExecSandboxEvent{} - mi := &file_openshell_proto_msgTypes[49] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxEvent) ProtoMessage() {} - -func (x *ExecSandboxEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[49] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxEvent.ProtoReflect.Descriptor instead. -func (*ExecSandboxEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{49} -} - -func (x *ExecSandboxEvent) GetPayload() isExecSandboxEvent_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *ExecSandboxEvent) GetStdout() *ExecSandboxStdout { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Stdout); ok { - return x.Stdout - } - } - return nil -} - -func (x *ExecSandboxEvent) GetStderr() *ExecSandboxStderr { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Stderr); ok { - return x.Stderr - } - } - return nil -} - -func (x *ExecSandboxEvent) GetExit() *ExecSandboxExit { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Exit); ok { - return x.Exit - } - } - return nil -} - -type isExecSandboxEvent_Payload interface { - isExecSandboxEvent_Payload() -} - -type ExecSandboxEvent_Stdout struct { - Stdout *ExecSandboxStdout `protobuf:"bytes,1,opt,name=stdout,proto3,oneof"` -} - -type ExecSandboxEvent_Stderr struct { - Stderr *ExecSandboxStderr `protobuf:"bytes,2,opt,name=stderr,proto3,oneof"` -} - -type ExecSandboxEvent_Exit struct { - Exit *ExecSandboxExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"` -} - -func (*ExecSandboxEvent_Stdout) isExecSandboxEvent_Payload() {} - -func (*ExecSandboxEvent_Stderr) isExecSandboxEvent_Payload() {} - -func (*ExecSandboxEvent_Exit) isExecSandboxEvent_Payload() {} - -// Initial frame for one TCP forward stream. -type TcpForwardInit struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Optional service identifier for audit/correlation. - ServiceId string `protobuf:"bytes,4,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"` - // Target the gateway should request from the supervisor. - // - // Types that are valid to be assigned to Target: - // - // *TcpForwardInit_Ssh - // *TcpForwardInit_Tcp - Target isTcpForwardInit_Target `protobuf_oneof:"target"` - // Optional target-specific authorization token. SSH targets use this as the - // short-lived SSH session token issued by CreateSshSession. - AuthorizationToken string `protobuf:"bytes,7,opt,name=authorization_token,json=authorizationToken,proto3" json:"authorization_token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpForwardInit) Reset() { - *x = TcpForwardInit{} - mi := &file_openshell_proto_msgTypes[50] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpForwardInit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpForwardInit) ProtoMessage() {} - -func (x *TcpForwardInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[50] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpForwardInit.ProtoReflect.Descriptor instead. -func (*TcpForwardInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{50} -} - -func (x *TcpForwardInit) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *TcpForwardInit) GetServiceId() string { - if x != nil { - return x.ServiceId - } - return "" -} - -func (x *TcpForwardInit) GetTarget() isTcpForwardInit_Target { - if x != nil { - return x.Target - } - return nil -} - -func (x *TcpForwardInit) GetSsh() *SshRelayTarget { - if x != nil { - if x, ok := x.Target.(*TcpForwardInit_Ssh); ok { - return x.Ssh - } - } - return nil -} - -func (x *TcpForwardInit) GetTcp() *TcpRelayTarget { - if x != nil { - if x, ok := x.Target.(*TcpForwardInit_Tcp); ok { - return x.Tcp - } - } - return nil -} - -func (x *TcpForwardInit) GetAuthorizationToken() string { - if x != nil { - return x.AuthorizationToken - } - return "" -} - -type isTcpForwardInit_Target interface { - isTcpForwardInit_Target() -} - -type TcpForwardInit_Ssh struct { - Ssh *SshRelayTarget `protobuf:"bytes,5,opt,name=ssh,proto3,oneof"` -} - -type TcpForwardInit_Tcp struct { - Tcp *TcpRelayTarget `protobuf:"bytes,6,opt,name=tcp,proto3,oneof"` -} - -func (*TcpForwardInit_Ssh) isTcpForwardInit_Target() {} - -func (*TcpForwardInit_Tcp) isTcpForwardInit_Target() {} - -// A single frame on the CLI-to-gateway TCP forward stream. -type TcpForwardFrame struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *TcpForwardFrame_Init - // *TcpForwardFrame_Data - Payload isTcpForwardFrame_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpForwardFrame) Reset() { - *x = TcpForwardFrame{} - mi := &file_openshell_proto_msgTypes[51] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpForwardFrame) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpForwardFrame) ProtoMessage() {} - -func (x *TcpForwardFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[51] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpForwardFrame.ProtoReflect.Descriptor instead. -func (*TcpForwardFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{51} -} - -func (x *TcpForwardFrame) GetPayload() isTcpForwardFrame_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *TcpForwardFrame) GetInit() *TcpForwardInit { - if x != nil { - if x, ok := x.Payload.(*TcpForwardFrame_Init); ok { - return x.Init - } - } - return nil -} - -func (x *TcpForwardFrame) GetData() []byte { - if x != nil { - if x, ok := x.Payload.(*TcpForwardFrame_Data); ok { - return x.Data - } - } - return nil -} - -type isTcpForwardFrame_Payload interface { - isTcpForwardFrame_Payload() -} - -type TcpForwardFrame_Init struct { - Init *TcpForwardInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"` -} - -type TcpForwardFrame_Data struct { - Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"` -} - -func (*TcpForwardFrame_Init) isTcpForwardFrame_Payload() {} - -func (*TcpForwardFrame_Data) isTcpForwardFrame_Payload() {} - -// Client-to-server message for interactive exec. -type ExecSandboxInput struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *ExecSandboxInput_Start - // *ExecSandboxInput_Stdin - // *ExecSandboxInput_Resize - Payload isExecSandboxInput_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxInput) Reset() { - *x = ExecSandboxInput{} - mi := &file_openshell_proto_msgTypes[52] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxInput) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxInput) ProtoMessage() {} - -func (x *ExecSandboxInput) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[52] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxInput.ProtoReflect.Descriptor instead. -func (*ExecSandboxInput) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{52} -} - -func (x *ExecSandboxInput) GetPayload() isExecSandboxInput_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *ExecSandboxInput) GetStart() *ExecSandboxRequest { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Start); ok { - return x.Start - } - } - return nil -} - -func (x *ExecSandboxInput) GetStdin() []byte { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Stdin); ok { - return x.Stdin - } - } - return nil -} - -func (x *ExecSandboxInput) GetResize() *ExecSandboxWindowResize { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Resize); ok { - return x.Resize - } - } - return nil -} - -type isExecSandboxInput_Payload interface { - isExecSandboxInput_Payload() -} - -type ExecSandboxInput_Start struct { - // First message: exec request metadata. - Start *ExecSandboxRequest `protobuf:"bytes,1,opt,name=start,proto3,oneof"` -} - -type ExecSandboxInput_Stdin struct { - // Subsequent messages: raw stdin bytes. - Stdin []byte `protobuf:"bytes,2,opt,name=stdin,proto3,oneof"` -} - -type ExecSandboxInput_Resize struct { - // Terminal window size change. - Resize *ExecSandboxWindowResize `protobuf:"bytes,3,opt,name=resize,proto3,oneof"` -} - -func (*ExecSandboxInput_Start) isExecSandboxInput_Payload() {} - -func (*ExecSandboxInput_Stdin) isExecSandboxInput_Payload() {} - -func (*ExecSandboxInput_Resize) isExecSandboxInput_Payload() {} - -// Terminal window resize event for interactive exec. -type ExecSandboxWindowResize struct { - state protoimpl.MessageState `protogen:"open.v1"` - Cols uint32 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"` - Rows uint32 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxWindowResize) Reset() { - *x = ExecSandboxWindowResize{} - mi := &file_openshell_proto_msgTypes[53] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxWindowResize) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxWindowResize) ProtoMessage() {} - -func (x *ExecSandboxWindowResize) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[53] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxWindowResize.ProtoReflect.Descriptor instead. -func (*ExecSandboxWindowResize) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{53} -} - -func (x *ExecSandboxWindowResize) GetCols() uint32 { - if x != nil { - return x.Cols - } - return 0 -} - -func (x *ExecSandboxWindowResize) GetRows() uint32 { - if x != nil { - return x.Rows - } - return 0 -} - -// SSH session record stored in persistence. -type SshSession struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Sandbox id. - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Session token. - Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"` - // Expiry timestamp in milliseconds since epoch. 0 means no expiry - // (backward-compatible default for sessions created before this field existed). - ExpiresAtMs int64 `protobuf:"varint,4,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - // Revoked flag. - Revoked bool `protobuf:"varint,5,opt,name=revoked,proto3" json:"revoked,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SshSession) Reset() { - *x = SshSession{} - mi := &file_openshell_proto_msgTypes[54] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SshSession) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SshSession) ProtoMessage() {} - -func (x *SshSession) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[54] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SshSession.ProtoReflect.Descriptor instead. -func (*SshSession) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{54} -} - -func (x *SshSession) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *SshSession) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SshSession) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *SshSession) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *SshSession) GetRevoked() bool { - if x != nil { - return x.Revoked - } - return false -} - -// Watch sandbox request. -type WatchSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Stream sandbox status snapshots. - FollowStatus bool `protobuf:"varint,2,opt,name=follow_status,json=followStatus,proto3" json:"follow_status,omitempty"` - // Stream openshell-server process logs correlated to this sandbox. - FollowLogs bool `protobuf:"varint,3,opt,name=follow_logs,json=followLogs,proto3" json:"follow_logs,omitempty"` - // Stream platform events correlated to this sandbox. - FollowEvents bool `protobuf:"varint,4,opt,name=follow_events,json=followEvents,proto3" json:"follow_events,omitempty"` - // Replay the last N log lines (best-effort) before following. - LogTailLines uint32 `protobuf:"varint,5,opt,name=log_tail_lines,json=logTailLines,proto3" json:"log_tail_lines,omitempty"` - // Replay the last N platform events (best-effort) before following. - EventTail uint32 `protobuf:"varint,6,opt,name=event_tail,json=eventTail,proto3" json:"event_tail,omitempty"` - // Stop streaming once the sandbox reaches a terminal phase (READY or ERROR). - StopOnTerminal bool `protobuf:"varint,7,opt,name=stop_on_terminal,json=stopOnTerminal,proto3" json:"stop_on_terminal,omitempty"` - // Only include log lines with timestamp >= this value (milliseconds since epoch). - // 0 means no time filter. Applies to both tail replay and live streaming. - LogSinceMs int64 `protobuf:"varint,8,opt,name=log_since_ms,json=logSinceMs,proto3" json:"log_since_ms,omitempty"` - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - LogSources []string `protobuf:"bytes,9,rep,name=log_sources,json=logSources,proto3" json:"log_sources,omitempty"` - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - LogMinLevel string `protobuf:"bytes,10,opt,name=log_min_level,json=logMinLevel,proto3" json:"log_min_level,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WatchSandboxRequest) Reset() { - *x = WatchSandboxRequest{} - mi := &file_openshell_proto_msgTypes[55] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WatchSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WatchSandboxRequest) ProtoMessage() {} - -func (x *WatchSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[55] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WatchSandboxRequest.ProtoReflect.Descriptor instead. -func (*WatchSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{55} -} - -func (x *WatchSandboxRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *WatchSandboxRequest) GetFollowStatus() bool { - if x != nil { - return x.FollowStatus - } - return false -} - -func (x *WatchSandboxRequest) GetFollowLogs() bool { - if x != nil { - return x.FollowLogs - } - return false -} - -func (x *WatchSandboxRequest) GetFollowEvents() bool { - if x != nil { - return x.FollowEvents - } - return false -} - -func (x *WatchSandboxRequest) GetLogTailLines() uint32 { - if x != nil { - return x.LogTailLines - } - return 0 -} - -func (x *WatchSandboxRequest) GetEventTail() uint32 { - if x != nil { - return x.EventTail - } - return 0 -} - -func (x *WatchSandboxRequest) GetStopOnTerminal() bool { - if x != nil { - return x.StopOnTerminal - } - return false -} - -func (x *WatchSandboxRequest) GetLogSinceMs() int64 { - if x != nil { - return x.LogSinceMs - } - return 0 -} - -func (x *WatchSandboxRequest) GetLogSources() []string { - if x != nil { - return x.LogSources - } - return nil -} - -func (x *WatchSandboxRequest) GetLogMinLevel() string { - if x != nil { - return x.LogMinLevel - } - return "" -} - -// One event in a sandbox watch stream. -type SandboxStreamEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *SandboxStreamEvent_Sandbox - // *SandboxStreamEvent_Log - // *SandboxStreamEvent_Event - // *SandboxStreamEvent_Warning - // *SandboxStreamEvent_DraftPolicyUpdate - Payload isSandboxStreamEvent_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStreamEvent) Reset() { - *x = SandboxStreamEvent{} - mi := &file_openshell_proto_msgTypes[56] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStreamEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStreamEvent) ProtoMessage() {} - -func (x *SandboxStreamEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[56] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStreamEvent.ProtoReflect.Descriptor instead. -func (*SandboxStreamEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{56} -} - -func (x *SandboxStreamEvent) GetPayload() isSandboxStreamEvent_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *SandboxStreamEvent) GetSandbox() *Sandbox { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Sandbox); ok { - return x.Sandbox - } - } - return nil -} - -func (x *SandboxStreamEvent) GetLog() *SandboxLogLine { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Log); ok { - return x.Log - } - } - return nil -} - -func (x *SandboxStreamEvent) GetEvent() *PlatformEvent { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Event); ok { - return x.Event - } - } - return nil -} - -func (x *SandboxStreamEvent) GetWarning() *SandboxStreamWarning { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Warning); ok { - return x.Warning - } - } - return nil -} - -func (x *SandboxStreamEvent) GetDraftPolicyUpdate() *DraftPolicyUpdate { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_DraftPolicyUpdate); ok { - return x.DraftPolicyUpdate - } - } - return nil -} - -type isSandboxStreamEvent_Payload interface { - isSandboxStreamEvent_Payload() -} - -type SandboxStreamEvent_Sandbox struct { - // Latest sandbox snapshot. - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3,oneof"` -} - -type SandboxStreamEvent_Log struct { - // One server log line/event. - Log *SandboxLogLine `protobuf:"bytes,2,opt,name=log,proto3,oneof"` -} - -type SandboxStreamEvent_Event struct { - // One platform event. - Event *PlatformEvent `protobuf:"bytes,3,opt,name=event,proto3,oneof"` -} - -type SandboxStreamEvent_Warning struct { - // Warning from the server (e.g. missed messages due to lag). - Warning *SandboxStreamWarning `protobuf:"bytes,4,opt,name=warning,proto3,oneof"` -} - -type SandboxStreamEvent_DraftPolicyUpdate struct { - // Draft policy update notification. - DraftPolicyUpdate *DraftPolicyUpdate `protobuf:"bytes,5,opt,name=draft_policy_update,json=draftPolicyUpdate,proto3,oneof"` -} - -func (*SandboxStreamEvent_Sandbox) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Log) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Event) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Warning) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_DraftPolicyUpdate) isSandboxStreamEvent_Payload() {} - -// Log line correlated to a sandbox. -type SandboxLogLine struct { - state protoimpl.MessageState `protogen:"open.v1"` - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - TimestampMs int64 `protobuf:"varint,2,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - Level string `protobuf:"bytes,3,opt,name=level,proto3" json:"level,omitempty"` - Target string `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"` - Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"` - // Log source: "gateway" (server-side) or "sandbox" (supervisor). - // Empty is treated as "gateway" for backward compatibility. - Source string `protobuf:"bytes,6,opt,name=source,proto3" json:"source,omitempty"` - // Structured key-value fields from the tracing event (e.g. dst_host, action). - Fields map[string]string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxLogLine) Reset() { - *x = SandboxLogLine{} - mi := &file_openshell_proto_msgTypes[57] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxLogLine) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxLogLine) ProtoMessage() {} - -func (x *SandboxLogLine) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[57] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxLogLine.ProtoReflect.Descriptor instead. -func (*SandboxLogLine) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{57} -} - -func (x *SandboxLogLine) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SandboxLogLine) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *SandboxLogLine) GetLevel() string { - if x != nil { - return x.Level - } - return "" -} - -func (x *SandboxLogLine) GetTarget() string { - if x != nil { - return x.Target - } - return "" -} - -func (x *SandboxLogLine) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *SandboxLogLine) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *SandboxLogLine) GetFields() map[string]string { - if x != nil { - return x.Fields - } - return nil -} - -type SandboxStreamWarning struct { - state protoimpl.MessageState `protogen:"open.v1"` - Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStreamWarning) Reset() { - *x = SandboxStreamWarning{} - mi := &file_openshell_proto_msgTypes[58] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStreamWarning) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStreamWarning) ProtoMessage() {} - -func (x *SandboxStreamWarning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[58] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStreamWarning.ProtoReflect.Descriptor instead. -func (*SandboxStreamWarning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{58} -} - -func (x *SandboxStreamWarning) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -// Create provider request. -type CreateProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - // Workspace for the provider. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateProviderRequest) Reset() { - *x = CreateProviderRequest{} - mi := &file_openshell_proto_msgTypes[59] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateProviderRequest) ProtoMessage() {} - -func (x *CreateProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[59] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateProviderRequest.ProtoReflect.Descriptor instead. -func (*CreateProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{59} -} - -func (x *CreateProviderRequest) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -func (x *CreateProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get provider request. -type GetProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRequest) Reset() { - *x = GetProviderRequest{} - mi := &file_openshell_proto_msgTypes[60] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRequest) ProtoMessage() {} - -func (x *GetProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[60] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRequest.ProtoReflect.Descriptor instead. -func (*GetProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{60} -} - -func (x *GetProviderRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List providers request. -type ListProvidersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,4,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProvidersRequest) Reset() { - *x = ListProvidersRequest{} - mi := &file_openshell_proto_msgTypes[61] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProvidersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProvidersRequest) ProtoMessage() {} - -func (x *ListProvidersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[61] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProvidersRequest.ProtoReflect.Descriptor instead. -func (*ListProvidersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{61} -} - -func (x *ListProvidersRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListProvidersRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListProvidersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListProvidersRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// Update provider request. -type UpdateProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - // Optional per-credential expiry timestamps to merge into the provider. - // A zero value removes the expiry for that credential. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,2,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderRequest) Reset() { - *x = UpdateProviderRequest{} - mi := &file_openshell_proto_msgTypes[62] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderRequest) ProtoMessage() {} - -func (x *UpdateProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[62] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderRequest.ProtoReflect.Descriptor instead. -func (*UpdateProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{62} -} - -func (x *UpdateProviderRequest) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -func (x *UpdateProviderRequest) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *UpdateProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete provider request. -type DeleteProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRequest) Reset() { - *x = DeleteProviderRequest{} - mi := &file_openshell_proto_msgTypes[63] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRequest) ProtoMessage() {} - -func (x *DeleteProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[63] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{63} -} - -func (x *DeleteProviderRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *DeleteProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Provider response. -type ProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderResponse) Reset() { - *x = ProviderResponse{} - mi := &file_openshell_proto_msgTypes[64] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderResponse) ProtoMessage() {} - -func (x *ProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[64] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderResponse.ProtoReflect.Descriptor instead. -func (*ProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{64} -} - -func (x *ProviderResponse) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -// List providers response. -type ListProvidersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Providers []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProvidersResponse) Reset() { - *x = ListProvidersResponse{} - mi := &file_openshell_proto_msgTypes[65] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProvidersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProvidersResponse) ProtoMessage() {} - -func (x *ListProvidersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[65] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProvidersResponse.ProtoReflect.Descriptor instead. -func (*ListProvidersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{65} -} - -func (x *ListProvidersResponse) GetProviders() []*datamodelv1.Provider { - if x != nil { - return x.Providers - } - return nil -} - -// List provider type profiles request. -type ListProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. When set, returns workspace-scoped + built-in profiles. - // When empty, returns platform-scoped + built-in only. - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProviderProfilesRequest) Reset() { - *x = ListProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[66] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProviderProfilesRequest) ProtoMessage() {} - -func (x *ListProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[66] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*ListProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{66} -} - -func (x *ListProviderProfilesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListProviderProfilesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Fetch provider type profile request. -type GetProviderProfileRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope for two-tier profile resolution. When set, checks - // workspace-scoped profiles first, then platform-scoped, then built-in. - // When empty, checks platform-scoped then built-in only. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderProfileRequest) Reset() { - *x = GetProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[67] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderProfileRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderProfileRequest) ProtoMessage() {} - -func (x *GetProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[67] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderProfileRequest.ProtoReflect.Descriptor instead. -func (*GetProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{67} -} - -func (x *GetProviderProfileRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *GetProviderProfileRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Provider profile payload with optional source metadata for diagnostics. -type ProviderProfileImportItem struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfile `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileImportItem) Reset() { - *x = ProviderProfileImportItem{} - mi := &file_openshell_proto_msgTypes[68] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileImportItem) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileImportItem) ProtoMessage() {} - -func (x *ProviderProfileImportItem) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[68] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileImportItem.ProtoReflect.Descriptor instead. -func (*ProviderProfileImportItem) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{68} -} - -func (x *ProviderProfileImportItem) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -func (x *ProviderProfileImportItem) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -// Provider profile validation diagnostic. -type ProviderProfileDiagnostic struct { - state protoimpl.MessageState `protogen:"open.v1"` - Source string `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"` - ProfileId string `protobuf:"bytes,2,opt,name=profile_id,json=profileId,proto3" json:"profile_id,omitempty"` - Field string `protobuf:"bytes,3,opt,name=field,proto3" json:"field,omitempty"` - Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` - Severity string `protobuf:"bytes,5,opt,name=severity,proto3" json:"severity,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileDiagnostic) Reset() { - *x = ProviderProfileDiagnostic{} - mi := &file_openshell_proto_msgTypes[69] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileDiagnostic) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileDiagnostic) ProtoMessage() {} - -func (x *ProviderProfileDiagnostic) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[69] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileDiagnostic.ProtoReflect.Descriptor instead. -func (*ProviderProfileDiagnostic) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{69} -} - -func (x *ProviderProfileDiagnostic) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetProfileId() string { - if x != nil { - return x.ProfileId - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetField() string { - if x != nil { - return x.Field - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetSeverity() string { - if x != nil { - return x.Severity - } - return "" -} - -// Endpoint selector for token grant audience overrides. -type ProviderCredentialTokenGrantAudienceOverride struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional: endpoint host selector. If omitted, inherits the profile endpoint host. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Optional: endpoint port selector. If omitted, matches the expanded profile endpoint port. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - // Optional: endpoint path selector. If omitted, inherits the profile endpoint path. - Path string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"` - // Resource audience to request for matching endpoints. - Audience string `protobuf:"bytes,4,opt,name=audience,proto3" json:"audience,omitempty"` - // Optional: OAuth2 scopes to request. If omitted, inherits the token grant scopes. - Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) Reset() { - *x = ProviderCredentialTokenGrantAudienceOverride{} - mi := &file_openshell_proto_msgTypes[70] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialTokenGrantAudienceOverride) ProtoMessage() {} - -func (x *ProviderCredentialTokenGrantAudienceOverride) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[70] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialTokenGrantAudienceOverride.ProtoReflect.Descriptor instead. -func (*ProviderCredentialTokenGrantAudienceOverride) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{70} -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetAudience() string { - if x != nil { - return x.Audience - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -// Provider credential token grant configuration. -// When present, the credential is obtained dynamically via OAuth2 grant when needed. -type ProviderCredentialTokenGrant struct { - state protoimpl.MessageState `protogen:"open.v1"` - // OAuth2 token endpoint URL (e.g., https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token) - TokenEndpoint string `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"` - // Optional: default resource audience to request from the token service - Audience string `protobuf:"bytes,2,opt,name=audience,proto3" json:"audience,omitempty"` - // Optional: audience to request when fetching the JWT-SVID from SPIRE. - // If omitted, the sandbox derives this from token_endpoint. - JwtSvidAudience string `protobuf:"bytes,6,opt,name=jwt_svid_audience,json=jwtSvidAudience,proto3" json:"jwt_svid_audience,omitempty"` - // Optional: OAuth2 scopes to request - Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` - // Optional: override token cache TTL (seconds) - // If 0 or omitted, use expires_in from token response - CacheTtlSeconds int64 `protobuf:"varint,4,opt,name=cache_ttl_seconds,json=cacheTtlSeconds,proto3" json:"cache_ttl_seconds,omitempty"` - // Optional: endpoint-specific resource audience overrides. - AudienceOverrides []*ProviderCredentialTokenGrantAudienceOverride `protobuf:"bytes,5,rep,name=audience_overrides,json=audienceOverrides,proto3" json:"audience_overrides,omitempty"` - // Optional: OAuth2 client_assertion_type value. If omitted, OpenShell uses - // urn:ietf:params:oauth:client-assertion-type:jwt-bearer. - ClientAssertionType string `protobuf:"bytes,7,opt,name=client_assertion_type,json=clientAssertionType,proto3" json:"client_assertion_type,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialTokenGrant) Reset() { - *x = ProviderCredentialTokenGrant{} - mi := &file_openshell_proto_msgTypes[71] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialTokenGrant) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialTokenGrant) ProtoMessage() {} - -func (x *ProviderCredentialTokenGrant) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[71] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialTokenGrant.ProtoReflect.Descriptor instead. -func (*ProviderCredentialTokenGrant) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{71} -} - -func (x *ProviderCredentialTokenGrant) GetTokenEndpoint() string { - if x != nil { - return x.TokenEndpoint - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetAudience() string { - if x != nil { - return x.Audience - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetJwtSvidAudience() string { - if x != nil { - return x.JwtSvidAudience - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *ProviderCredentialTokenGrant) GetCacheTtlSeconds() int64 { - if x != nil { - return x.CacheTtlSeconds - } - return 0 -} - -func (x *ProviderCredentialTokenGrant) GetAudienceOverrides() []*ProviderCredentialTokenGrantAudienceOverride { - if x != nil { - return x.AudienceOverrides - } - return nil -} - -func (x *ProviderCredentialTokenGrant) GetClientAssertionType() string { - if x != nil { - return x.ClientAssertionType - } - return "" -} - -// Provider credential declaration. -type ProviderProfileCredential struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"` - EnvVars []string `protobuf:"bytes,3,rep,name=env_vars,json=envVars,proto3" json:"env_vars,omitempty"` - Required bool `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"` - AuthStyle string `protobuf:"bytes,5,opt,name=auth_style,json=authStyle,proto3" json:"auth_style,omitempty"` - HeaderName string `protobuf:"bytes,6,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"` - QueryParam string `protobuf:"bytes,7,opt,name=query_param,json=queryParam,proto3" json:"query_param,omitempty"` - Refresh *ProviderCredentialRefresh `protobuf:"bytes,8,opt,name=refresh,proto3" json:"refresh,omitempty"` - PathTemplate string `protobuf:"bytes,9,opt,name=path_template,json=pathTemplate,proto3" json:"path_template,omitempty"` - TokenGrant *ProviderCredentialTokenGrant `protobuf:"bytes,10,opt,name=token_grant,json=tokenGrant,proto3" json:"token_grant,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileCredential) Reset() { - *x = ProviderProfileCredential{} - mi := &file_openshell_proto_msgTypes[72] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileCredential) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileCredential) ProtoMessage() {} - -func (x *ProviderProfileCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[72] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileCredential.ProtoReflect.Descriptor instead. -func (*ProviderProfileCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{72} -} - -func (x *ProviderProfileCredential) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ProviderProfileCredential) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderProfileCredential) GetEnvVars() []string { - if x != nil { - return x.EnvVars - } - return nil -} - -func (x *ProviderProfileCredential) GetRequired() bool { - if x != nil { - return x.Required - } - return false -} - -func (x *ProviderProfileCredential) GetAuthStyle() string { - if x != nil { - return x.AuthStyle - } - return "" -} - -func (x *ProviderProfileCredential) GetHeaderName() string { - if x != nil { - return x.HeaderName - } - return "" -} - -func (x *ProviderProfileCredential) GetQueryParam() string { - if x != nil { - return x.QueryParam - } - return "" -} - -func (x *ProviderProfileCredential) GetRefresh() *ProviderCredentialRefresh { - if x != nil { - return x.Refresh - } - return nil -} - -func (x *ProviderProfileCredential) GetPathTemplate() string { - if x != nil { - return x.PathTemplate - } - return "" -} - -func (x *ProviderProfileCredential) GetTokenGrant() *ProviderCredentialTokenGrant { - if x != nil { - return x.TokenGrant - } - return nil -} - -type ProviderCredentialRefreshMaterial struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"` - Required bool `protobuf:"varint,3,opt,name=required,proto3" json:"required,omitempty"` - Secret bool `protobuf:"varint,4,opt,name=secret,proto3" json:"secret,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshMaterial) Reset() { - *x = ProviderCredentialRefreshMaterial{} - mi := &file_openshell_proto_msgTypes[73] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshMaterial) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshMaterial) ProtoMessage() {} - -func (x *ProviderCredentialRefreshMaterial) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[73] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshMaterial.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshMaterial) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{73} -} - -func (x *ProviderCredentialRefreshMaterial) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ProviderCredentialRefreshMaterial) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderCredentialRefreshMaterial) GetRequired() bool { - if x != nil { - return x.Required - } - return false -} - -func (x *ProviderCredentialRefreshMaterial) GetSecret() bool { - if x != nil { - return x.Secret - } - return false -} - -// Declares that a single refresh operation mints more than one credential. -// The refresh is attached to a primary credential; each additional output -// maps a strategy-defined semantic output id to a sibling credential whose -// env_vars receive the minted value. -type ProviderCredentialRefreshOutput struct { - state protoimpl.MessageState `protogen:"open.v1"` - Output string `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"` // strategy-defined semantic output id (e.g. "session_token") - Credential string `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"` // sibling credential name whose env_vars receive this output - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshOutput) Reset() { - *x = ProviderCredentialRefreshOutput{} - mi := &file_openshell_proto_msgTypes[74] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshOutput) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshOutput) ProtoMessage() {} - -func (x *ProviderCredentialRefreshOutput) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[74] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshOutput.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshOutput) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{74} -} - -func (x *ProviderCredentialRefreshOutput) GetOutput() string { - if x != nil { - return x.Output - } - return "" -} - -func (x *ProviderCredentialRefreshOutput) GetCredential() string { - if x != nil { - return x.Credential - } - return "" -} - -type ProviderCredentialRefresh struct { - state protoimpl.MessageState `protogen:"open.v1"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,1,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - TokenUrl string `protobuf:"bytes,2,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"` - Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` - RefreshBeforeSeconds int64 `protobuf:"varint,4,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"` - MaxLifetimeSeconds int64 `protobuf:"varint,5,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"` - Material []*ProviderCredentialRefreshMaterial `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty"` - AdditionalOutputs []*ProviderCredentialRefreshOutput `protobuf:"bytes,7,rep,name=additional_outputs,json=additionalOutputs,proto3" json:"additional_outputs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefresh) Reset() { - *x = ProviderCredentialRefresh{} - mi := &file_openshell_proto_msgTypes[75] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefresh) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefresh) ProtoMessage() {} - -func (x *ProviderCredentialRefresh) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[75] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefresh.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefresh) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{75} -} - -func (x *ProviderCredentialRefresh) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ProviderCredentialRefresh) GetTokenUrl() string { - if x != nil { - return x.TokenUrl - } - return "" -} - -func (x *ProviderCredentialRefresh) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *ProviderCredentialRefresh) GetRefreshBeforeSeconds() int64 { - if x != nil { - return x.RefreshBeforeSeconds - } - return 0 -} - -func (x *ProviderCredentialRefresh) GetMaxLifetimeSeconds() int64 { - if x != nil { - return x.MaxLifetimeSeconds - } - return 0 -} - -func (x *ProviderCredentialRefresh) GetMaterial() []*ProviderCredentialRefreshMaterial { - if x != nil { - return x.Material - } - return nil -} - -func (x *ProviderCredentialRefresh) GetAdditionalOutputs() []*ProviderCredentialRefreshOutput { - if x != nil { - return x.AdditionalOutputs - } - return nil -} - -type ProviderCredentialRefreshStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ProviderId string `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"` - CredentialKey string `protobuf:"bytes,3,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,4,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Status string `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"` - ExpiresAtMs int64 `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - NextRefreshAtMs int64 `protobuf:"varint,7,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"` - LastRefreshAtMs int64 `protobuf:"varint,8,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"` - LastError string `protobuf:"bytes,9,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshStatus) Reset() { - *x = ProviderCredentialRefreshStatus{} - mi := &file_openshell_proto_msgTypes[76] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshStatus) ProtoMessage() {} - -func (x *ProviderCredentialRefreshStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[76] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshStatus.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{76} -} - -func (x *ProviderCredentialRefreshStatus) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetProviderId() string { - if x != nil { - return x.ProviderId - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ProviderCredentialRefreshStatus) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetNextRefreshAtMs() int64 { - if x != nil { - return x.NextRefreshAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetLastRefreshAtMs() int64 { - if x != nil { - return x.LastRefreshAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetLastError() string { - if x != nil { - return x.LastError - } - return "" -} - -// Provider profile local discovery declaration. -type ProviderProfileDiscovery struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Credential names from ProviderProfile.credentials eligible for local discovery. - Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileDiscovery) Reset() { - *x = ProviderProfileDiscovery{} - mi := &file_openshell_proto_msgTypes[77] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileDiscovery) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileDiscovery) ProtoMessage() {} - -func (x *ProviderProfileDiscovery) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[77] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileDiscovery.ProtoReflect.Descriptor instead. -func (*ProviderProfileDiscovery) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{77} -} - -func (x *ProviderProfileDiscovery) GetCredentials() []string { - if x != nil { - return x.Credentials - } - return nil -} - -type StoredProviderCredentialRefreshState struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - ProviderId string `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"` - ProviderName string `protobuf:"bytes,3,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - CredentialKey string `protobuf:"bytes,4,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,5,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Material map[string]string `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - SecretMaterialKeys []string `protobuf:"bytes,7,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"` - ExpiresAtMs int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - NextRefreshAtMs int64 `protobuf:"varint,9,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"` - LastRefreshAtMs int64 `protobuf:"varint,10,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"` - Status string `protobuf:"bytes,11,opt,name=status,proto3" json:"status,omitempty"` - LastError string `protobuf:"bytes,12,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"` - TokenUrl string `protobuf:"bytes,13,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"` - Scopes []string `protobuf:"bytes,14,rep,name=scopes,proto3" json:"scopes,omitempty"` - RefreshBeforeSeconds int64 `protobuf:"varint,15,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"` - MaxLifetimeSeconds int64 `protobuf:"varint,16,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"` - // Resolved mapping of strategy-defined output id -> concrete env key, pinned - // at configure time from the profile's additional_outputs. Read by minting, - // collision reservation, and env-key surfacing so later profile edits cannot - // silently redirect writes. - AdditionalOutputKeys map[string]string `protobuf:"bytes,17,rep,name=additional_output_keys,json=additionalOutputKeys,proto3" json:"additional_output_keys,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredProviderCredentialRefreshState) Reset() { - *x = StoredProviderCredentialRefreshState{} - mi := &file_openshell_proto_msgTypes[78] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredProviderCredentialRefreshState) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredProviderCredentialRefreshState) ProtoMessage() {} - -func (x *StoredProviderCredentialRefreshState) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[78] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredProviderCredentialRefreshState.ProtoReflect.Descriptor instead. -func (*StoredProviderCredentialRefreshState) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{78} -} - -func (x *StoredProviderCredentialRefreshState) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetProviderId() string { - if x != nil { - return x.ProviderId - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *StoredProviderCredentialRefreshState) GetMaterial() map[string]string { - if x != nil { - return x.Material - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetSecretMaterialKeys() []string { - if x != nil { - return x.SecretMaterialKeys - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetNextRefreshAtMs() int64 { - if x != nil { - return x.NextRefreshAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetLastRefreshAtMs() int64 { - if x != nil { - return x.LastRefreshAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetLastError() string { - if x != nil { - return x.LastError - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetTokenUrl() string { - if x != nil { - return x.TokenUrl - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetRefreshBeforeSeconds() int64 { - if x != nil { - return x.RefreshBeforeSeconds - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetMaxLifetimeSeconds() int64 { - if x != nil { - return x.MaxLifetimeSeconds - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetAdditionalOutputKeys() map[string]string { - if x != nil { - return x.AdditionalOutputKeys - } - return nil -} - -type GetProviderRefreshStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRefreshStatusRequest) Reset() { - *x = GetProviderRefreshStatusRequest{} - mi := &file_openshell_proto_msgTypes[79] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRefreshStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRefreshStatusRequest) ProtoMessage() {} - -func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[79] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead. -func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{79} -} - -func (x *GetProviderRefreshStatusRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *GetProviderRefreshStatusRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *GetProviderRefreshStatusRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetProviderRefreshStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Credentials []*ProviderCredentialRefreshStatus `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRefreshStatusResponse) Reset() { - *x = GetProviderRefreshStatusResponse{} - mi := &file_openshell_proto_msgTypes[80] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRefreshStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRefreshStatusResponse) ProtoMessage() {} - -func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[80] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead. -func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{80} -} - -func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus { - if x != nil { - return x.Credentials - } - return nil -} - -type ConfigureProviderRefreshRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,3,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Material map[string]string `protobuf:"bytes,4,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - SecretMaterialKeys []string `protobuf:"bytes,5,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"` - ExpiresAtMs *int64 `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3,oneof" json:"expires_at_ms,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ConfigureProviderRefreshRequest) Reset() { - *x = ConfigureProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[81] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ConfigureProviderRefreshRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ConfigureProviderRefreshRequest) ProtoMessage() {} - -func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[81] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead. -func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{81} -} - -func (x *ConfigureProviderRefreshRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *ConfigureProviderRefreshRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *ConfigureProviderRefreshRequest) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ConfigureProviderRefreshRequest) GetMaterial() map[string]string { - if x != nil { - return x.Material - } - return nil -} - -func (x *ConfigureProviderRefreshRequest) GetSecretMaterialKeys() []string { - if x != nil { - return x.SecretMaterialKeys - } - return nil -} - -func (x *ConfigureProviderRefreshRequest) GetExpiresAtMs() int64 { - if x != nil && x.ExpiresAtMs != nil { - return *x.ExpiresAtMs - } - return 0 -} - -func (x *ConfigureProviderRefreshRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ConfigureProviderRefreshResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Status *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ConfigureProviderRefreshResponse) Reset() { - *x = ConfigureProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[82] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ConfigureProviderRefreshResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ConfigureProviderRefreshResponse) ProtoMessage() {} - -func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[82] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead. -func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{82} -} - -func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus { - if x != nil { - return x.Status - } - return nil -} - -type RotateProviderCredentialRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RotateProviderCredentialRequest) Reset() { - *x = RotateProviderCredentialRequest{} - mi := &file_openshell_proto_msgTypes[83] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RotateProviderCredentialRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RotateProviderCredentialRequest) ProtoMessage() {} - -func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[83] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead. -func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{83} -} - -func (x *RotateProviderCredentialRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *RotateProviderCredentialRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *RotateProviderCredentialRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type RotateProviderCredentialResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Status *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RotateProviderCredentialResponse) Reset() { - *x = RotateProviderCredentialResponse{} - mi := &file_openshell_proto_msgTypes[84] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RotateProviderCredentialResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RotateProviderCredentialResponse) ProtoMessage() {} - -func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[84] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead. -func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{84} -} - -func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus { - if x != nil { - return x.Status - } - return nil -} - -type DeleteProviderRefreshRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRefreshRequest) Reset() { - *x = DeleteProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[85] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRefreshRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRefreshRequest) ProtoMessage() {} - -func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[85] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{85} -} - -func (x *DeleteProviderRefreshRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *DeleteProviderRefreshRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *DeleteProviderRefreshRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteProviderRefreshResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRefreshResponse) Reset() { - *x = DeleteProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[86] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRefreshResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRefreshResponse) ProtoMessage() {} - -func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[86] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{86} -} - -func (x *DeleteProviderRefreshResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Provider type profile metadata exposed to clients. -type ProviderProfile struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` - Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` - Category ProviderProfileCategory `protobuf:"varint,4,opt,name=category,proto3,enum=openshell.v1.ProviderProfileCategory" json:"category,omitempty"` - Credentials []*ProviderProfileCredential `protobuf:"bytes,5,rep,name=credentials,proto3" json:"credentials,omitempty"` - Endpoints []*sandboxv1.NetworkEndpoint `protobuf:"bytes,6,rep,name=endpoints,proto3" json:"endpoints,omitempty"` - Binaries []*sandboxv1.NetworkBinary `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"` - InferenceCapable bool `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"` - Discovery *ProviderProfileDiscovery `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"` - // Storage resource version for custom profiles. Built-in profiles and new - // profile files use 0. Gateway responses set this for stored custom profiles. - // Update calls use this for optimistic concurrency. - ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` - // Optional non-secret annotations attached by profile sources or importers. - Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Server-set provenance: "builtin", "user", or "interceptor/{name}". - // Ignored on import/update payloads. - Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"` - // Server-set visibility: "platform", "workspace", or empty for - // non-scoped sources. Ignored on import/update payloads. - Scope string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfile) Reset() { - *x = ProviderProfile{} - mi := &file_openshell_proto_msgTypes[87] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfile) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfile) ProtoMessage() {} - -func (x *ProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[87] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead. -func (*ProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{87} -} - -func (x *ProviderProfile) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *ProviderProfile) GetDisplayName() string { - if x != nil { - return x.DisplayName - } - return "" -} - -func (x *ProviderProfile) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderProfile) GetCategory() ProviderProfileCategory { - if x != nil { - return x.Category - } - return ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED -} - -func (x *ProviderProfile) GetCredentials() []*ProviderProfileCredential { - if x != nil { - return x.Credentials - } - return nil -} - -func (x *ProviderProfile) GetEndpoints() []*sandboxv1.NetworkEndpoint { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *ProviderProfile) GetBinaries() []*sandboxv1.NetworkBinary { - if x != nil { - return x.Binaries - } - return nil -} - -func (x *ProviderProfile) GetInferenceCapable() bool { - if x != nil { - return x.InferenceCapable - } - return false -} - -func (x *ProviderProfile) GetDiscovery() *ProviderProfileDiscovery { - if x != nil { - return x.Discovery - } - return nil -} - -func (x *ProviderProfile) GetResourceVersion() uint64 { - if x != nil { - return x.ResourceVersion - } - return 0 -} - -func (x *ProviderProfile) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *ProviderProfile) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *ProviderProfile) GetScope() string { - if x != nil { - return x.Scope - } - return "" -} - -// Stored custom provider profile object. -type StoredProviderProfile struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - Profile *ProviderProfile `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredProviderProfile) Reset() { - *x = StoredProviderProfile{} - mi := &file_openshell_proto_msgTypes[88] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredProviderProfile) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredProviderProfile) ProtoMessage() {} - -func (x *StoredProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[88] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredProviderProfile.ProtoReflect.Descriptor instead. -func (*StoredProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{88} -} - -func (x *StoredProviderProfile) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *StoredProviderProfile) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -// Provider profile response. -type ProviderProfileResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfile `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileResponse) Reset() { - *x = ProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[89] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileResponse) ProtoMessage() {} - -func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[89] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead. -func (*ProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{89} -} - -func (x *ProviderProfileResponse) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -// List provider profiles response. -type ListProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfile `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProviderProfilesResponse) Reset() { - *x = ListProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[90] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProviderProfilesResponse) ProtoMessage() {} - -func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[90] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{90} -} - -func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile { - if x != nil { - return x.Profiles - } - return nil -} - -// Import custom provider profiles request. -type ImportProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - // Workspace scope. When set, profiles are workspace-scoped (Workspace Admin). - // When empty, profiles are platform-scoped (Platform Admin). - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ImportProviderProfilesRequest) Reset() { - *x = ImportProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[91] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ImportProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ImportProviderProfilesRequest) ProtoMessage() {} - -func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[91] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{91} -} - -func (x *ImportProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *ImportProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Import custom provider profiles response. -type ImportProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Profiles []*ProviderProfile `protobuf:"bytes,2,rep,name=profiles,proto3" json:"profiles,omitempty"` - Imported bool `protobuf:"varint,3,opt,name=imported,proto3" json:"imported,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ImportProviderProfilesResponse) Reset() { - *x = ImportProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[92] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ImportProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ImportProviderProfilesResponse) ProtoMessage() {} - -func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[92] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{92} -} - -func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *ImportProviderProfilesResponse) GetProfiles() []*ProviderProfile { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *ImportProviderProfilesResponse) GetImported() bool { - if x != nil { - return x.Imported - } - return false -} - -// Update one custom provider profile request. -type UpdateProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfileImportItem `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - // Expected storage resource version for optimistic concurrency control. - // If 0, the server uses the resource_version embedded in profile.profile. - // Updates without a non-zero version are rejected to prevent stale files from - // silently overwriting newer profile definitions. - ExpectedResourceVersion uint64 `protobuf:"varint,2,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Existing custom provider profile ID to update. The payload ID must match. - Id string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderProfilesRequest) Reset() { - *x = UpdateProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[93] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderProfilesRequest) ProtoMessage() {} - -func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[93] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{93} -} - -func (x *UpdateProviderProfilesRequest) GetProfile() *ProviderProfileImportItem { - if x != nil { - return x.Profile - } - return nil -} - -func (x *UpdateProviderProfilesRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *UpdateProviderProfilesRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *UpdateProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Update one custom provider profile response. -type UpdateProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Profile *ProviderProfile `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"` - Updated bool `protobuf:"varint,3,opt,name=updated,proto3" json:"updated,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderProfilesResponse) Reset() { - *x = UpdateProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[94] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderProfilesResponse) ProtoMessage() {} - -func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[94] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{94} -} - -func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *UpdateProviderProfilesResponse) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -func (x *UpdateProviderProfilesResponse) GetUpdated() bool { - if x != nil { - return x.Updated - } - return false -} - -// Lint provider profiles request. -type LintProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - // Workspace scope. Used to check for conflicts against existing profiles - // in the target workspace. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LintProviderProfilesRequest) Reset() { - *x = LintProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[95] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LintProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LintProviderProfilesRequest) ProtoMessage() {} - -func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[95] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{95} -} - -func (x *LintProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *LintProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Lint provider profiles response. -type LintProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Valid bool `protobuf:"varint,2,opt,name=valid,proto3" json:"valid,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LintProviderProfilesResponse) Reset() { - *x = LintProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[96] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LintProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LintProviderProfilesResponse) ProtoMessage() {} - -func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[96] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{96} -} - -func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *LintProviderProfilesResponse) GetValid() bool { - if x != nil { - return x.Valid - } - return false -} - -// Delete provider response. -type DeleteProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderResponse) Reset() { - *x = DeleteProviderResponse{} - mi := &file_openshell_proto_msgTypes[97] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderResponse) ProtoMessage() {} - -func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[97] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{97} -} - -func (x *DeleteProviderResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Delete custom provider profile request. -type DeleteProviderProfileRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderProfileRequest) Reset() { - *x = DeleteProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[98] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderProfileRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderProfileRequest) ProtoMessage() {} - -func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[98] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{98} -} - -func (x *DeleteProviderProfileRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *DeleteProviderProfileRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete custom provider profile response. -type DeleteProviderProfileResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderProfileResponse) Reset() { - *x = DeleteProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[99] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderProfileResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderProfileResponse) ProtoMessage() {} - -func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[99] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{99} -} - -func (x *DeleteProviderProfileResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Get sandbox provider environment request. -type GetSandboxProviderEnvironmentRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxProviderEnvironmentRequest) Reset() { - *x = GetSandboxProviderEnvironmentRequest{} - mi := &file_openshell_proto_msgTypes[100] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxProviderEnvironmentRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {} - -func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[100] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{100} -} - -func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Get sandbox provider environment response. -type GetSandboxProviderEnvironmentResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider credential environment variables. - Environment map[string]string `protobuf:"bytes,1,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Fingerprint for the provider credential inputs that produced environment. - ProviderEnvRevision uint64 `protobuf:"varint,2,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` - // Expiration timestamps for returned environment variables. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,3,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Dynamic credentials that require token grants or other runtime injection. - // Maps endpoint-bound provider metadata to credential metadata. - // Supervisor uses this to inject Authorization headers for token grant credentials. - DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,4,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxProviderEnvironmentResponse) Reset() { - *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[101] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxProviderEnvironmentResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} - -func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[101] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{101} -} - -func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *GetSandboxProviderEnvironmentResponse) GetProviderEnvRevision() uint64 { - if x != nil { - return x.ProviderEnvRevision - } - return 0 -} - -func (x *GetSandboxProviderEnvironmentResponse) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *GetSandboxProviderEnvironmentResponse) GetDynamicCredentials() map[string]*ProviderProfileCredential { - if x != nil { - return x.DynamicCredentials - } - return nil -} - -// Update sandbox policy request. -type UpdateConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Required for sandbox-scoped updates. - // Not required when `global=true`. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // The new policy to apply. - // - // Sandbox scope (`global=false`): - // - only network_policies and inference fields may differ from create-time - // policy; static fields must match version 1. - // - // Global scope (`global=true`): - // - applies to all sandboxes in full (no merge). - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"` - // Optional single setting key to mutate. - SettingKey string `protobuf:"bytes,3,opt,name=setting_key,json=settingKey,proto3" json:"setting_key,omitempty"` - // Setting value for upsert operations. - SettingValue *sandboxv1.SettingValue `protobuf:"bytes,4,opt,name=setting_value,json=settingValue,proto3" json:"setting_value,omitempty"` - // Delete the setting key from scope. - // Sandbox-scoped deletes are rejected; only global delete is supported. - DeleteSetting bool `protobuf:"varint,5,opt,name=delete_setting,json=deleteSetting,proto3" json:"delete_setting,omitempty"` - // Apply mutation at gateway-global scope. - Global bool `protobuf:"varint,6,opt,name=global,proto3" json:"global,omitempty"` - // Batched incremental policy merge operations. Sandbox-scoped only. - MergeOperations []*PolicyMergeOperation `protobuf:"bytes,7,rep,name=merge_operations,json=mergeOperations,proto3" json:"merge_operations,omitempty"` - // Expected resource version for optimistic concurrency control (sandbox-scoped only). - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - // Ignored for global-scoped updates. - ExpectedResourceVersion uint64 `protobuf:"varint,8,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Caller-provided annotations associated with a sandbox-scoped update. Values - // must not contain secrets; the gateway treats them as opaque metadata and does - // not interpret or verify their semantics. For policy updates, the gateway - // stores the annotations immutably with the revision and merges them into - // sandbox metadata as a convenience projection. For setting-only updates, it - // only merges them into sandbox metadata. - Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace scope. Empty defaults to "default". Ignored for global-scoped updates. - Workspace string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateConfigRequest) Reset() { - *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[102] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateConfigRequest) ProtoMessage() {} - -func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[102] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. -func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{102} -} - -func (x *UpdateConfigRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *UpdateConfigRequest) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *UpdateConfigRequest) GetSettingKey() string { - if x != nil { - return x.SettingKey - } - return "" -} - -func (x *UpdateConfigRequest) GetSettingValue() *sandboxv1.SettingValue { - if x != nil { - return x.SettingValue - } - return nil -} - -func (x *UpdateConfigRequest) GetDeleteSetting() bool { - if x != nil { - return x.DeleteSetting - } - return false -} - -func (x *UpdateConfigRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *UpdateConfigRequest) GetMergeOperations() []*PolicyMergeOperation { - if x != nil { - return x.MergeOperations - } - return nil -} - -func (x *UpdateConfigRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *UpdateConfigRequest) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *UpdateConfigRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type PolicyMergeOperation struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Operation: - // - // *PolicyMergeOperation_AddRule - // *PolicyMergeOperation_RemoveEndpoint - // *PolicyMergeOperation_RemoveRule - // *PolicyMergeOperation_AddDenyRules - // *PolicyMergeOperation_AddAllowRules - // *PolicyMergeOperation_RemoveBinary - Operation isPolicyMergeOperation_Operation `protobuf_oneof:"operation"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyMergeOperation) Reset() { - *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[103] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyMergeOperation) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyMergeOperation) ProtoMessage() {} - -func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[103] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. -func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{103} -} - -func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { - if x != nil { - return x.Operation - } - return nil -} - -func (x *PolicyMergeOperation) GetAddRule() *AddNetworkRule { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddRule); ok { - return x.AddRule - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveEndpoint() *RemoveNetworkEndpoint { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveEndpoint); ok { - return x.RemoveEndpoint - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveRule() *RemoveNetworkRule { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveRule); ok { - return x.RemoveRule - } - } - return nil -} - -func (x *PolicyMergeOperation) GetAddDenyRules() *AddDenyRules { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddDenyRules); ok { - return x.AddDenyRules - } - } - return nil -} - -func (x *PolicyMergeOperation) GetAddAllowRules() *AddAllowRules { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddAllowRules); ok { - return x.AddAllowRules - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveBinary() *RemoveNetworkBinary { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveBinary); ok { - return x.RemoveBinary - } - } - return nil -} - -type isPolicyMergeOperation_Operation interface { - isPolicyMergeOperation_Operation() -} - -type PolicyMergeOperation_AddRule struct { - AddRule *AddNetworkRule `protobuf:"bytes,1,opt,name=add_rule,json=addRule,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveEndpoint struct { - RemoveEndpoint *RemoveNetworkEndpoint `protobuf:"bytes,2,opt,name=remove_endpoint,json=removeEndpoint,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveRule struct { - RemoveRule *RemoveNetworkRule `protobuf:"bytes,3,opt,name=remove_rule,json=removeRule,proto3,oneof"` -} - -type PolicyMergeOperation_AddDenyRules struct { - AddDenyRules *AddDenyRules `protobuf:"bytes,4,opt,name=add_deny_rules,json=addDenyRules,proto3,oneof"` -} - -type PolicyMergeOperation_AddAllowRules struct { - AddAllowRules *AddAllowRules `protobuf:"bytes,5,opt,name=add_allow_rules,json=addAllowRules,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveBinary struct { - RemoveBinary *RemoveNetworkBinary `protobuf:"bytes,6,opt,name=remove_binary,json=removeBinary,proto3,oneof"` -} - -func (*PolicyMergeOperation_AddRule) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveEndpoint) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveRule) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_AddDenyRules) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_AddAllowRules) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveBinary) isPolicyMergeOperation_Operation() {} - -type AddNetworkRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - Rule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=rule,proto3" json:"rule,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddNetworkRule) Reset() { - *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[104] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddNetworkRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddNetworkRule) ProtoMessage() {} - -func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[104] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. -func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{104} -} - -func (x *AddNetworkRule) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *AddNetworkRule) GetRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.Rule - } - return nil -} - -type RemoveNetworkEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkEndpoint) Reset() { - *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[105] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkEndpoint) ProtoMessage() {} - -func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[105] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. -func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{105} -} - -func (x *RemoveNetworkEndpoint) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *RemoveNetworkEndpoint) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *RemoveNetworkEndpoint) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -type RemoveNetworkRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkRule) Reset() { - *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[106] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkRule) ProtoMessage() {} - -func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[106] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. -func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{106} -} - -func (x *RemoveNetworkRule) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -type AddDenyRules struct { - state protoimpl.MessageState `protogen:"open.v1"` - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - DenyRules []*sandboxv1.L7DenyRule `protobuf:"bytes,3,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddDenyRules) Reset() { - *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[107] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddDenyRules) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddDenyRules) ProtoMessage() {} - -func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[107] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. -func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{107} -} - -func (x *AddDenyRules) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *AddDenyRules) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { - if x != nil { - return x.DenyRules - } - return nil -} - -type AddAllowRules struct { - state protoimpl.MessageState `protogen:"open.v1"` - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - Rules []*sandboxv1.L7Rule `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddAllowRules) Reset() { - *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[108] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddAllowRules) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddAllowRules) ProtoMessage() {} - -func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[108] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. -func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{108} -} - -func (x *AddAllowRules) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *AddAllowRules) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { - if x != nil { - return x.Rules - } - return nil -} - -type RemoveNetworkBinary struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - BinaryPath string `protobuf:"bytes,2,opt,name=binary_path,json=binaryPath,proto3" json:"binary_path,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkBinary) Reset() { - *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[109] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkBinary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkBinary) ProtoMessage() {} - -func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[109] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. -func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{109} -} - -func (x *RemoveNetworkBinary) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *RemoveNetworkBinary) GetBinaryPath() string { - if x != nil { - return x.BinaryPath - } - return "" -} - -// Update sandbox policy response. -type UpdateConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Assigned policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Settings revision for the scope that was modified. - SettingsRevision uint64 `protobuf:"varint,3,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"` - // True when a setting delete operation removed an existing key. - Deleted bool `protobuf:"varint,4,opt,name=deleted,proto3" json:"deleted,omitempty"` - // Sandbox metadata annotations after the update. Empty for global updates. - Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateConfigResponse) Reset() { - *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[110] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateConfigResponse) ProtoMessage() {} - -func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[110] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. -func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{110} -} - -func (x *UpdateConfigResponse) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *UpdateConfigResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *UpdateConfigResponse) GetSettingsRevision() uint64 { - if x != nil { - return x.SettingsRevision - } - return 0 -} - -func (x *UpdateConfigResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -func (x *UpdateConfigResponse) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -// Get sandbox policy status request. -type GetSandboxPolicyStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Ignored when global is true. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // The specific policy version to query. 0 means latest. - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // Query global policy revisions instead of a sandbox-scoped one. - Global bool `protobuf:"varint,3,opt,name=global,proto3" json:"global,omitempty"` - // Workspace scope. Empty defaults to "default". Ignored when global is true. - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxPolicyStatusRequest) Reset() { - *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[111] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxPolicyStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} - -func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[111] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{111} -} - -func (x *GetSandboxPolicyStatusRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetSandboxPolicyStatusRequest) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetSandboxPolicyStatusRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *GetSandboxPolicyStatusRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get sandbox policy status response. -type GetSandboxPolicyStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The queried policy revision. - Revision *SandboxPolicyRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"` - // The currently active (loaded) policy version for this sandbox. - ActiveVersion uint32 `protobuf:"varint,2,opt,name=active_version,json=activeVersion,proto3" json:"active_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxPolicyStatusResponse) Reset() { - *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[112] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxPolicyStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} - -func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[112] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{112} -} - -func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { - if x != nil { - return x.Revision - } - return nil -} - -func (x *GetSandboxPolicyStatusResponse) GetActiveVersion() uint32 { - if x != nil { - return x.ActiveVersion - } - return 0 -} - -// List sandbox policies request. -type ListSandboxPoliciesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Ignored when global is true. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - // List global policy revisions instead of sandbox-scoped ones. - Global bool `protobuf:"varint,4,opt,name=global,proto3" json:"global,omitempty"` - // Workspace scope. Empty defaults to "default". Ignored when global is true. - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxPoliciesRequest) Reset() { - *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[113] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxPoliciesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxPoliciesRequest) ProtoMessage() {} - -func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[113] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{113} -} - -func (x *ListSandboxPoliciesRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ListSandboxPoliciesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListSandboxPoliciesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListSandboxPoliciesRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *ListSandboxPoliciesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List sandbox policies response. -type ListSandboxPoliciesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Revisions []*SandboxPolicyRevision `protobuf:"bytes,1,rep,name=revisions,proto3" json:"revisions,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxPoliciesResponse) Reset() { - *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[114] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxPoliciesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxPoliciesResponse) ProtoMessage() {} - -func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[114] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{114} -} - -func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { - if x != nil { - return x.Revisions - } - return nil -} - -// Report policy load status (called by sandbox runtime after reload attempt). -type ReportPolicyStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // The policy version that was attempted. - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // Load result status. - Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"` - // Error message if status is FAILED. - LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ReportPolicyStatusRequest) Reset() { - *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[115] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ReportPolicyStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ReportPolicyStatusRequest) ProtoMessage() {} - -func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[115] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. -func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{115} -} - -func (x *ReportPolicyStatusRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ReportPolicyStatusRequest) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *ReportPolicyStatusRequest) GetStatus() PolicyStatus { - if x != nil { - return x.Status - } - return PolicyStatus_POLICY_STATUS_UNSPECIFIED -} - -func (x *ReportPolicyStatusRequest) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -// Report policy status response. -type ReportPolicyStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ReportPolicyStatusResponse) Reset() { - *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[116] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ReportPolicyStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ReportPolicyStatusResponse) ProtoMessage() {} - -func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[116] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. -func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{116} -} - -// A versioned policy revision with metadata. -type SandboxPolicyRevision struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Load status of this revision. - Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"` - // Error message if status is FAILED. - LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - // Milliseconds since epoch when this revision was created. - CreatedAtMs int64 `protobuf:"varint,5,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // Milliseconds since epoch when this revision was loaded by the sandbox. - LoadedAtMs int64 `protobuf:"varint,6,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"` - // The full policy (only populated when explicitly requested). - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"` - // Immutable provenance supplied with this policy revision. - Provenance map[string]string `protobuf:"bytes,8,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxPolicyRevision) Reset() { - *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[117] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxPolicyRevision) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxPolicyRevision) ProtoMessage() {} - -func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[117] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. -func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{117} -} - -func (x *SandboxPolicyRevision) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SandboxPolicyRevision) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *SandboxPolicyRevision) GetStatus() PolicyStatus { - if x != nil { - return x.Status - } - return PolicyStatus_POLICY_STATUS_UNSPECIFIED -} - -func (x *SandboxPolicyRevision) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -func (x *SandboxPolicyRevision) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *SandboxPolicyRevision) GetLoadedAtMs() int64 { - if x != nil { - return x.LoadedAtMs - } - return 0 -} - -func (x *SandboxPolicyRevision) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *SandboxPolicyRevision) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Get sandbox logs request (one-shot fetch). -type GetSandboxLogsRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Maximum number of log lines to return. 0 means use default (2000). - Lines uint32 `protobuf:"varint,2,opt,name=lines,proto3" json:"lines,omitempty"` - // Only include logs with timestamp >= this value (ms since epoch). 0 means no filter. - SinceMs int64 `protobuf:"varint,3,opt,name=since_ms,json=sinceMs,proto3" json:"since_ms,omitempty"` - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - Sources []string `protobuf:"bytes,4,rep,name=sources,proto3" json:"sources,omitempty"` - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - MinLevel string `protobuf:"bytes,5,opt,name=min_level,json=minLevel,proto3" json:"min_level,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxLogsRequest) Reset() { - *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[118] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxLogsRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxLogsRequest) ProtoMessage() {} - -func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[118] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{118} -} - -func (x *GetSandboxLogsRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *GetSandboxLogsRequest) GetLines() uint32 { - if x != nil { - return x.Lines - } - return 0 -} - -func (x *GetSandboxLogsRequest) GetSinceMs() int64 { - if x != nil { - return x.SinceMs - } - return 0 -} - -func (x *GetSandboxLogsRequest) GetSources() []string { - if x != nil { - return x.Sources - } - return nil -} - -func (x *GetSandboxLogsRequest) GetMinLevel() string { - if x != nil { - return x.MinLevel - } - return "" -} - -func (x *GetSandboxLogsRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Batch of log lines pushed from sandbox to server. -type PushSandboxLogsRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Log lines to ingest. - Logs []*SandboxLogLine `protobuf:"bytes,2,rep,name=logs,proto3" json:"logs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PushSandboxLogsRequest) Reset() { - *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[119] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PushSandboxLogsRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PushSandboxLogsRequest) ProtoMessage() {} - -func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[119] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. -func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{119} -} - -func (x *PushSandboxLogsRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *PushSandboxLogsRequest) GetLogs() []*SandboxLogLine { - if x != nil { - return x.Logs - } - return nil -} - -// Push sandbox logs response. -type PushSandboxLogsResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PushSandboxLogsResponse) Reset() { - *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[120] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PushSandboxLogsResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PushSandboxLogsResponse) ProtoMessage() {} - -func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[120] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. -func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{120} -} - -// Get sandbox logs response. -type GetSandboxLogsResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Log lines in chronological order. - Logs []*SandboxLogLine `protobuf:"bytes,1,rep,name=logs,proto3" json:"logs,omitempty"` - // Total number of lines in the server's buffer for this sandbox. - BufferTotal uint32 `protobuf:"varint,2,opt,name=buffer_total,json=bufferTotal,proto3" json:"buffer_total,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxLogsResponse) Reset() { - *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[121] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxLogsResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxLogsResponse) ProtoMessage() {} - -func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[121] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{121} -} - -func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { - if x != nil { - return x.Logs - } - return nil -} - -func (x *GetSandboxLogsResponse) GetBufferTotal() uint32 { - if x != nil { - return x.BufferTotal - } - return 0 -} - -// Envelope for supervisor-to-gateway messages on the ConnectSupervisor stream. -type SupervisorMessage struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *SupervisorMessage_Hello - // *SupervisorMessage_Heartbeat - // *SupervisorMessage_RelayOpenResult - // *SupervisorMessage_RelayClose - Payload isSupervisorMessage_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorMessage) Reset() { - *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[122] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorMessage) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorMessage) ProtoMessage() {} - -func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[122] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. -func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{122} -} - -func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *SupervisorMessage) GetHello() *SupervisorHello { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_Hello); ok { - return x.Hello - } - } - return nil -} - -func (x *SupervisorMessage) GetHeartbeat() *SupervisorHeartbeat { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_Heartbeat); ok { - return x.Heartbeat - } - } - return nil -} - -func (x *SupervisorMessage) GetRelayOpenResult() *RelayOpenResult { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_RelayOpenResult); ok { - return x.RelayOpenResult - } - } - return nil -} - -func (x *SupervisorMessage) GetRelayClose() *RelayClose { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_RelayClose); ok { - return x.RelayClose - } - } - return nil -} - -type isSupervisorMessage_Payload interface { - isSupervisorMessage_Payload() -} - -type SupervisorMessage_Hello struct { - Hello *SupervisorHello `protobuf:"bytes,1,opt,name=hello,proto3,oneof"` -} - -type SupervisorMessage_Heartbeat struct { - Heartbeat *SupervisorHeartbeat `protobuf:"bytes,2,opt,name=heartbeat,proto3,oneof"` -} - -type SupervisorMessage_RelayOpenResult struct { - RelayOpenResult *RelayOpenResult `protobuf:"bytes,3,opt,name=relay_open_result,json=relayOpenResult,proto3,oneof"` -} - -type SupervisorMessage_RelayClose struct { - RelayClose *RelayClose `protobuf:"bytes,4,opt,name=relay_close,json=relayClose,proto3,oneof"` -} - -func (*SupervisorMessage_Hello) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_Heartbeat) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_RelayOpenResult) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_RelayClose) isSupervisorMessage_Payload() {} - -// Envelope for gateway-to-supervisor messages on the ConnectSupervisor stream. -type GatewayMessage struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *GatewayMessage_SessionAccepted - // *GatewayMessage_SessionRejected - // *GatewayMessage_Heartbeat - // *GatewayMessage_RelayOpen - // *GatewayMessage_RelayClose - Payload isGatewayMessage_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GatewayMessage) Reset() { - *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[123] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GatewayMessage) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GatewayMessage) ProtoMessage() {} - -func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[123] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. -func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{123} -} - -func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *GatewayMessage) GetSessionAccepted() *SessionAccepted { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_SessionAccepted); ok { - return x.SessionAccepted - } - } - return nil -} - -func (x *GatewayMessage) GetSessionRejected() *SessionRejected { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_SessionRejected); ok { - return x.SessionRejected - } - } - return nil -} - -func (x *GatewayMessage) GetHeartbeat() *GatewayHeartbeat { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_Heartbeat); ok { - return x.Heartbeat - } - } - return nil -} - -func (x *GatewayMessage) GetRelayOpen() *RelayOpen { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_RelayOpen); ok { - return x.RelayOpen - } - } - return nil -} - -func (x *GatewayMessage) GetRelayClose() *RelayClose { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_RelayClose); ok { - return x.RelayClose - } - } - return nil -} - -type isGatewayMessage_Payload interface { - isGatewayMessage_Payload() -} - -type GatewayMessage_SessionAccepted struct { - SessionAccepted *SessionAccepted `protobuf:"bytes,1,opt,name=session_accepted,json=sessionAccepted,proto3,oneof"` -} - -type GatewayMessage_SessionRejected struct { - SessionRejected *SessionRejected `protobuf:"bytes,2,opt,name=session_rejected,json=sessionRejected,proto3,oneof"` -} - -type GatewayMessage_Heartbeat struct { - Heartbeat *GatewayHeartbeat `protobuf:"bytes,3,opt,name=heartbeat,proto3,oneof"` -} - -type GatewayMessage_RelayOpen struct { - RelayOpen *RelayOpen `protobuf:"bytes,4,opt,name=relay_open,json=relayOpen,proto3,oneof"` -} - -type GatewayMessage_RelayClose struct { - RelayClose *RelayClose `protobuf:"bytes,5,opt,name=relay_close,json=relayClose,proto3,oneof"` -} - -func (*GatewayMessage_SessionAccepted) isGatewayMessage_Payload() {} - -func (*GatewayMessage_SessionRejected) isGatewayMessage_Payload() {} - -func (*GatewayMessage_Heartbeat) isGatewayMessage_Payload() {} - -func (*GatewayMessage_RelayOpen) isGatewayMessage_Payload() {} - -func (*GatewayMessage_RelayClose) isGatewayMessage_Payload() {} - -// Supervisor identifies itself and the sandbox it manages. -type SupervisorHello struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox ID this supervisor manages. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Supervisor instance ID (e.g. boot id or process epoch). - InstanceId string `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorHello) Reset() { - *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[124] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorHello) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorHello) ProtoMessage() {} - -func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[124] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. -func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{124} -} - -func (x *SupervisorHello) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SupervisorHello) GetInstanceId() string { - if x != nil { - return x.InstanceId - } - return "" -} - -// Gateway accepts the supervisor session. -type SessionAccepted struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-assigned session ID for this connection. - SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` - // Recommended heartbeat interval in seconds. - HeartbeatIntervalSecs uint32 `protobuf:"varint,2,opt,name=heartbeat_interval_secs,json=heartbeatIntervalSecs,proto3" json:"heartbeat_interval_secs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SessionAccepted) Reset() { - *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[125] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SessionAccepted) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SessionAccepted) ProtoMessage() {} - -func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[125] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. -func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{125} -} - -func (x *SessionAccepted) GetSessionId() string { - if x != nil { - return x.SessionId - } - return "" -} - -func (x *SessionAccepted) GetHeartbeatIntervalSecs() uint32 { - if x != nil { - return x.HeartbeatIntervalSecs - } - return 0 -} - -// Gateway rejects the supervisor session. -type SessionRejected struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable rejection reason. - Reason string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SessionRejected) Reset() { - *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[126] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SessionRejected) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SessionRejected) ProtoMessage() {} - -func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[126] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. -func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{126} -} - -func (x *SessionRejected) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -// Supervisor heartbeat. -type SupervisorHeartbeat struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorHeartbeat) Reset() { - *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[127] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorHeartbeat) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorHeartbeat) ProtoMessage() {} - -func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[127] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. -func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{127} -} - -// Gateway heartbeat. -type GatewayHeartbeat struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GatewayHeartbeat) Reset() { - *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[128] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GatewayHeartbeat) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GatewayHeartbeat) ProtoMessage() {} - -func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[128] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. -func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{128} -} - -// Gateway requests the supervisor to open a relay channel. -// -// On receiving this, the supervisor should initiate a RelayStream RPC to -// the gateway, sending a RelayInit in the first RelayFrame to associate -// the new HTTP/2 stream with the pending relay slot. The supervisor -// bridges that stream to the requested local target. -type RelayOpen struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-allocated channel identifier (UUID). - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // Target the supervisor should dial inside the sandbox. - // If absent, supervisors treat the relay as SSH for compatibility. - // - // Types that are valid to be assigned to Target: - // - // *RelayOpen_Ssh - // *RelayOpen_Tcp - Target isRelayOpen_Target `protobuf_oneof:"target"` - // Optional service identifier for audit/correlation. - ServiceId string `protobuf:"bytes,5,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayOpen) Reset() { - *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[129] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayOpen) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayOpen) ProtoMessage() {} - -func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[129] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. -func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{129} -} - -func (x *RelayOpen) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayOpen) GetTarget() isRelayOpen_Target { - if x != nil { - return x.Target - } - return nil -} - -func (x *RelayOpen) GetSsh() *SshRelayTarget { - if x != nil { - if x, ok := x.Target.(*RelayOpen_Ssh); ok { - return x.Ssh - } - } - return nil -} - -func (x *RelayOpen) GetTcp() *TcpRelayTarget { - if x != nil { - if x, ok := x.Target.(*RelayOpen_Tcp); ok { - return x.Tcp - } - } - return nil -} - -func (x *RelayOpen) GetServiceId() string { - if x != nil { - return x.ServiceId - } - return "" -} - -type isRelayOpen_Target interface { - isRelayOpen_Target() -} - -type RelayOpen_Ssh struct { - Ssh *SshRelayTarget `protobuf:"bytes,2,opt,name=ssh,proto3,oneof"` -} - -type RelayOpen_Tcp struct { - Tcp *TcpRelayTarget `protobuf:"bytes,3,opt,name=tcp,proto3,oneof"` -} - -func (*RelayOpen_Ssh) isRelayOpen_Target() {} - -func (*RelayOpen_Tcp) isRelayOpen_Target() {} - -// Built-in SSH relay target. -type SshRelayTarget struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SshRelayTarget) Reset() { - *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[130] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SshRelayTarget) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SshRelayTarget) ProtoMessage() {} - -func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[130] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. -func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{130} -} - -// TCP target dialed by the supervisor from inside the sandbox. -type TcpRelayTarget struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Phase 1 accepts loopback only: 127.0.0.1, ::1, or localhost. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Target port. Must fit in u16 and be non-zero. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpRelayTarget) Reset() { - *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[131] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpRelayTarget) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpRelayTarget) ProtoMessage() {} - -func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[131] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. -func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{131} -} - -func (x *TcpRelayTarget) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *TcpRelayTarget) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -// Initial RelayStream frame sent by the supervisor to claim a pending relay. -type RelayInit struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-allocated channel identifier (UUID). - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayInit) Reset() { - *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[132] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayInit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayInit) ProtoMessage() {} - -func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[132] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. -func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{132} -} - -func (x *RelayInit) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -// A single frame on the RelayStream RPC. -// -// The supervisor MUST send `init` as the first frame. All subsequent frames -// in either direction carry raw bytes in `data`. -type RelayFrame struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *RelayFrame_Init - // *RelayFrame_Data - Payload isRelayFrame_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayFrame) Reset() { - *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[133] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayFrame) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayFrame) ProtoMessage() {} - -func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[133] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. -func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{133} -} - -func (x *RelayFrame) GetPayload() isRelayFrame_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *RelayFrame) GetInit() *RelayInit { - if x != nil { - if x, ok := x.Payload.(*RelayFrame_Init); ok { - return x.Init - } - } - return nil -} - -func (x *RelayFrame) GetData() []byte { - if x != nil { - if x, ok := x.Payload.(*RelayFrame_Data); ok { - return x.Data - } - } - return nil -} - -type isRelayFrame_Payload interface { - isRelayFrame_Payload() -} - -type RelayFrame_Init struct { - Init *RelayInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"` -} - -type RelayFrame_Data struct { - Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"` -} - -func (*RelayFrame_Init) isRelayFrame_Payload() {} - -func (*RelayFrame_Data) isRelayFrame_Payload() {} - -// Supervisor reports the result of a relay open request. -type RelayOpenResult struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Channel identifier from the RelayOpen request. - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // True if the relay was successfully established. - Success bool `protobuf:"varint,2,opt,name=success,proto3" json:"success,omitempty"` - // Error message if success is false. - Error string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayOpenResult) Reset() { - *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[134] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayOpenResult) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayOpenResult) ProtoMessage() {} - -func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[134] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. -func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{134} -} - -func (x *RelayOpenResult) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayOpenResult) GetSuccess() bool { - if x != nil { - return x.Success - } - return false -} - -func (x *RelayOpenResult) GetError() string { - if x != nil { - return x.Error - } - return "" -} - -// Either side requests closure of a relay channel. -type RelayClose struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Channel identifier to close. - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // Optional reason for closure. - Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayClose) Reset() { - *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[135] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayClose) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayClose) ProtoMessage() {} - -func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[135] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. -func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{135} -} - -func (x *RelayClose) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayClose) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -// Observed HTTP method+path pattern from L7 inspection. -type L7RequestSample struct { - state protoimpl.MessageState `protogen:"open.v1"` - // HTTP method: GET, POST, PUT, DELETE, etc. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // HTTP path: /v1/models, /repos/myorg/issues - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // L7 decision: "audit" or "deny" (allowed requests not collected). - Decision string `protobuf:"bytes,3,opt,name=decision,proto3" json:"decision,omitempty"` - // Number of times this (method, path) was observed. - Count uint32 `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7RequestSample) Reset() { - *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[136] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7RequestSample) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7RequestSample) ProtoMessage() {} - -func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[136] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. -func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{136} -} - -func (x *L7RequestSample) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7RequestSample) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7RequestSample) GetDecision() string { - if x != nil { - return x.Decision - } - return "" -} - -func (x *L7RequestSample) GetCount() uint32 { - if x != nil { - return x.Count - } - return 0 -} - -// Structured denial summary from sandbox aggregator. -type DenialSummary struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox ID that produced this summary. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Denied destination host. - Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"` - // Denied destination port. - Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"` - // Binary that attempted the connection. - Binary string `protobuf:"bytes,4,opt,name=binary,proto3" json:"binary,omitempty"` - // Process ancestor chain. - Ancestors []string `protobuf:"bytes,5,rep,name=ancestors,proto3" json:"ancestors,omitempty"` - // Denial reason from OPA evaluation. - DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"` - // First denial timestamp (ms since epoch). - FirstSeenMs int64 `protobuf:"varint,7,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - // Most recent denial timestamp (ms since epoch). - LastSeenMs int64 `protobuf:"varint,8,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Number of denials in the current window. - Count uint32 `protobuf:"varint,9,opt,name=count,proto3" json:"count,omitempty"` - // Events dropped during aggregator cooldown. - SuppressedCount uint32 `protobuf:"varint,10,opt,name=suppressed_count,json=suppressedCount,proto3" json:"suppressed_count,omitempty"` - // Cumulative lifetime count (never resets). - TotalCount uint32 `protobuf:"varint,11,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"` - // Distinct cmdline strings observed (sanitized of credentials). - SampleCmdlines []string `protobuf:"bytes,12,rep,name=sample_cmdlines,json=sampleCmdlines,proto3" json:"sample_cmdlines,omitempty"` - // SHA-256 of the binary for audit trail. - BinarySha256 string `protobuf:"bytes,13,opt,name=binary_sha256,json=binarySha256,proto3" json:"binary_sha256,omitempty"` - // True if emitted by stale-flush rather than threshold. - Persistent bool `protobuf:"varint,14,opt,name=persistent,proto3" json:"persistent,omitempty"` - // Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf". - DenialStage string `protobuf:"bytes,15,opt,name=denial_stage,json=denialStage,proto3" json:"denial_stage,omitempty"` - // Observed HTTP request patterns (from L7 inspection). - L7RequestSamples []*L7RequestSample `protobuf:"bytes,16,rep,name=l7_request_samples,json=l7RequestSamples,proto3" json:"l7_request_samples,omitempty"` - // True if L7 inspection was active during observation window. - L7InspectionActive bool `protobuf:"varint,17,opt,name=l7_inspection_active,json=l7InspectionActive,proto3" json:"l7_inspection_active,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DenialSummary) Reset() { - *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[137] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DenialSummary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DenialSummary) ProtoMessage() {} - -func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[137] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. -func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{137} -} - -func (x *DenialSummary) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *DenialSummary) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *DenialSummary) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *DenialSummary) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *DenialSummary) GetAncestors() []string { - if x != nil { - return x.Ancestors - } - return nil -} - -func (x *DenialSummary) GetDenyReason() string { - if x != nil { - return x.DenyReason - } - return "" -} - -func (x *DenialSummary) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *DenialSummary) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *DenialSummary) GetCount() uint32 { - if x != nil { - return x.Count - } - return 0 -} - -func (x *DenialSummary) GetSuppressedCount() uint32 { - if x != nil { - return x.SuppressedCount - } - return 0 -} - -func (x *DenialSummary) GetTotalCount() uint32 { - if x != nil { - return x.TotalCount - } - return 0 -} - -func (x *DenialSummary) GetSampleCmdlines() []string { - if x != nil { - return x.SampleCmdlines - } - return nil -} - -func (x *DenialSummary) GetBinarySha256() string { - if x != nil { - return x.BinarySha256 - } - return "" -} - -func (x *DenialSummary) GetPersistent() bool { - if x != nil { - return x.Persistent - } - return false -} - -func (x *DenialSummary) GetDenialStage() string { - if x != nil { - return x.DenialStage - } - return "" -} - -func (x *DenialSummary) GetL7RequestSamples() []*L7RequestSample { - if x != nil { - return x.L7RequestSamples - } - return nil -} - -func (x *DenialSummary) GetL7InspectionActive() bool { - if x != nil { - return x.L7InspectionActive - } - return false -} - -// Count of denied actions grouped only by sanitized telemetry category. -type DenialGroupCount struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sanitized denial category, e.g. "connect_policy", "l7_policy", "ssrf". - DenyGroup string `protobuf:"bytes,1,opt,name=deny_group,json=denyGroup,proto3" json:"deny_group,omitempty"` - // Number of denied actions in this category. - DeniedCount uint32 `protobuf:"varint,2,opt,name=denied_count,json=deniedCount,proto3" json:"denied_count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DenialGroupCount) Reset() { - *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[138] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DenialGroupCount) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DenialGroupCount) ProtoMessage() {} - -func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[138] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. -func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{138} -} - -func (x *DenialGroupCount) GetDenyGroup() string { - if x != nil { - return x.DenyGroup - } - return "" -} - -func (x *DenialGroupCount) GetDeniedCount() uint32 { - if x != nil { - return x.DeniedCount - } - return 0 -} - -// Anonymous sandbox network activity counters. This intentionally excludes -// hosts, paths, binaries, raw deny reasons, sandbox IDs, and user content. -type NetworkActivitySummary struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Total observed network activities in the current window. - NetworkActivityCount uint32 `protobuf:"varint,1,opt,name=network_activity_count,json=networkActivityCount,proto3" json:"network_activity_count,omitempty"` - // Total denied actions in the current window. - DeniedActionCount uint32 `protobuf:"varint,2,opt,name=denied_action_count,json=deniedActionCount,proto3" json:"denied_action_count,omitempty"` - // Denied action counts grouped by sanitized category. - DenialsByGroup []*DenialGroupCount `protobuf:"bytes,3,rep,name=denials_by_group,json=denialsByGroup,proto3" json:"denials_by_group,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkActivitySummary) Reset() { - *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[139] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkActivitySummary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkActivitySummary) ProtoMessage() {} - -func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. -func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} -} - -func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { - if x != nil { - return x.NetworkActivityCount - } - return 0 -} - -func (x *NetworkActivitySummary) GetDeniedActionCount() uint32 { - if x != nil { - return x.DeniedActionCount - } - return 0 -} - -func (x *NetworkActivitySummary) GetDenialsByGroup() []*DenialGroupCount { - if x != nil { - return x.DenialsByGroup - } - return nil -} - -// A proposed policy rule with rationale and approval status. -type PolicyChunk struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Unique chunk identifier. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Approval status: "pending", "approved", "rejected". - Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - // Proposed network_policies map key. - RuleName string `protobuf:"bytes,3,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - // The proposed network policy rule. - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,4,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Human-readable explanation of why this rule is proposed. - Rationale string `protobuf:"bytes,5,opt,name=rationale,proto3" json:"rationale,omitempty"` - // Security concerns flagged by analysis (empty if none). - SecurityNotes string `protobuf:"bytes,6,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - Confidence float32 `protobuf:"fixed32,7,opt,name=confidence,proto3" json:"confidence,omitempty"` - // IDs of denial summaries that led to this chunk. - DenialSummaryIds []string `protobuf:"bytes,8,rep,name=denial_summary_ids,json=denialSummaryIds,proto3" json:"denial_summary_ids,omitempty"` - // Creation timestamp (ms since epoch). - CreatedAtMs int64 `protobuf:"varint,9,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // When the user approved/rejected (ms since epoch). 0 if undecided. - DecidedAtMs int64 `protobuf:"varint,10,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"` - // Recommendation stage: "initial" or "refined" (progressive L7 visibility). - Stage string `protobuf:"bytes,11,opt,name=stage,proto3" json:"stage,omitempty"` - // For stage="refined": the initial chunk this replaces. - SupersedesChunkId string `protobuf:"bytes,12,opt,name=supersedes_chunk_id,json=supersedesChunkId,proto3" json:"supersedes_chunk_id,omitempty"` - // How many times this endpoint has been seen across denial flush cycles. - HitCount int32 `protobuf:"varint,13,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"` - // First time this endpoint was proposed (ms since epoch). - FirstSeenMs int64 `protobuf:"varint,14,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - // Most recent time this endpoint was re-proposed (ms since epoch). - LastSeenMs int64 `protobuf:"varint,15,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Binary path that triggered the denial (denormalized for display convenience). - Binary string `protobuf:"bytes,16,opt,name=binary,proto3" json:"binary,omitempty"` - // Validation verdict from gateway-side static checks (prover output). - // Free-form summary string for human consumption in the inbox card. - // Empty until the prover has run for this chunk. - ValidationResult string `protobuf:"bytes,17,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form text accompanying a rejection. Populated - // when the reviewer rejects via `RejectDraftChunkRequest.reason`; surfaced - // back to the in-sandbox agent so it can revise the proposal. - // Empty for non-rejected chunks. - RejectionReason string `protobuf:"bytes,18,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyChunk) Reset() { - *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[140] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyChunk) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyChunk) ProtoMessage() {} - -func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. -func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} -} - -func (x *PolicyChunk) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *PolicyChunk) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *PolicyChunk) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *PolicyChunk) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *PolicyChunk) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *PolicyChunk) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *PolicyChunk) GetConfidence() float32 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *PolicyChunk) GetDenialSummaryIds() []string { - if x != nil { - return x.DenialSummaryIds - } - return nil -} - -func (x *PolicyChunk) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *PolicyChunk) GetDecidedAtMs() int64 { - if x != nil { - return x.DecidedAtMs - } - return 0 -} - -func (x *PolicyChunk) GetStage() string { - if x != nil { - return x.Stage - } - return "" -} - -func (x *PolicyChunk) GetSupersedesChunkId() string { - if x != nil { - return x.SupersedesChunkId - } - return "" -} - -func (x *PolicyChunk) GetHitCount() int32 { - if x != nil { - return x.HitCount - } - return 0 -} - -func (x *PolicyChunk) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *PolicyChunk) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *PolicyChunk) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *PolicyChunk) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *PolicyChunk) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Notification that the draft policy was updated. -type DraftPolicyUpdate struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Current draft version. - DraftVersion uint64 `protobuf:"varint,1,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // Number of new chunks added in this update. - NewChunks uint32 `protobuf:"varint,2,opt,name=new_chunks,json=newChunks,proto3" json:"new_chunks,omitempty"` - // Total pending chunks awaiting approval. - TotalPending uint32 `protobuf:"varint,3,opt,name=total_pending,json=totalPending,proto3" json:"total_pending,omitempty"` - // Brief description of what changed. - Summary string `protobuf:"bytes,4,opt,name=summary,proto3" json:"summary,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftPolicyUpdate) Reset() { - *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[141] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftPolicyUpdate) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftPolicyUpdate) ProtoMessage() {} - -func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. -func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} -} - -func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *DraftPolicyUpdate) GetNewChunks() uint32 { - if x != nil { - return x.NewChunks - } - return 0 -} - -func (x *DraftPolicyUpdate) GetTotalPending() uint32 { - if x != nil { - return x.TotalPending - } - return 0 -} - -func (x *DraftPolicyUpdate) GetSummary() string { - if x != nil { - return x.Summary - } - return "" -} - -// Submit analysis results from sandbox to gateway. -type SubmitPolicyAnalysisRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Aggregated denial summaries. - Summaries []*DenialSummary `protobuf:"bytes,1,rep,name=summaries,proto3" json:"summaries,omitempty"` - // Proposed policy chunks (validated by sandbox OPA engine). - ProposedChunks []*PolicyChunk `protobuf:"bytes,2,rep,name=proposed_chunks,json=proposedChunks,proto3" json:"proposed_chunks,omitempty"` - // Analysis mode. `mechanistic` is the observation-driven path from the - // denial aggregator — chunks targeting the same host|port|binary fold - // into one row with hit_count incremented. `agent_authored` is an - // intentional proposal from an in-sandbox agent — each submission lands - // as its own chunk so the redraft-after-rejection loop has a stable id - // to watch. Other values are treated as agent-style (no dedup) so a new - // mode does not silently collapse proposals. - AnalysisMode string `protobuf:"bytes,3,opt,name=analysis_mode,json=analysisMode,proto3" json:"analysis_mode,omitempty"` - // Sandbox name. - Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` - // Anonymous network activity counters. - NetworkActivitySummaries []*NetworkActivitySummary `protobuf:"bytes,5,rep,name=network_activity_summaries,json=networkActivitySummaries,proto3" json:"network_activity_summaries,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SubmitPolicyAnalysisRequest) Reset() { - *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[142] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SubmitPolicyAnalysisRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} - -func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. -func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} -} - -func (x *SubmitPolicyAnalysisRequest) GetSummaries() []*DenialSummary { - if x != nil { - return x.Summaries - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetProposedChunks() []*PolicyChunk { - if x != nil { - return x.ProposedChunks - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetAnalysisMode() string { - if x != nil { - return x.AnalysisMode - } - return "" -} - -func (x *SubmitPolicyAnalysisRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *SubmitPolicyAnalysisRequest) GetNetworkActivitySummaries() []*NetworkActivitySummary { - if x != nil { - return x.NetworkActivitySummaries - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type SubmitPolicyAnalysisResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Number of chunks accepted by the gateway. - AcceptedChunks uint32 `protobuf:"varint,1,opt,name=accepted_chunks,json=acceptedChunks,proto3" json:"accepted_chunks,omitempty"` - // Number of chunks rejected by gateway validation. - RejectedChunks uint32 `protobuf:"varint,2,opt,name=rejected_chunks,json=rejectedChunks,proto3" json:"rejected_chunks,omitempty"` - // Reasons for each rejected chunk. - RejectionReasons []string `protobuf:"bytes,3,rep,name=rejection_reasons,json=rejectionReasons,proto3" json:"rejection_reasons,omitempty"` - // Server-assigned chunk IDs for the accepted chunks, in submission order. - // Agents use these to watch proposal state via policy.local's - // GET /v1/proposals/{id} and /wait endpoints. - AcceptedChunkIds []string `protobuf:"bytes,4,rep,name=accepted_chunk_ids,json=acceptedChunkIds,proto3" json:"accepted_chunk_ids,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SubmitPolicyAnalysisResponse) Reset() { - *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[143] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SubmitPolicyAnalysisResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} - -func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. -func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} -} - -func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { - if x != nil { - return x.AcceptedChunks - } - return 0 -} - -func (x *SubmitPolicyAnalysisResponse) GetRejectedChunks() uint32 { - if x != nil { - return x.RejectedChunks - } - return 0 -} - -func (x *SubmitPolicyAnalysisResponse) GetRejectionReasons() []string { - if x != nil { - return x.RejectionReasons - } - return nil -} - -func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunkIds() []string { - if x != nil { - return x.AcceptedChunkIds - } - return nil -} - -// Get draft policy for a sandbox. -type GetDraftPolicyRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Optional status filter: "pending", "approved", "rejected", or "" for all. - StatusFilter string `protobuf:"bytes,2,opt,name=status_filter,json=statusFilter,proto3" json:"status_filter,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftPolicyRequest) Reset() { - *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[144] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftPolicyRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftPolicyRequest) ProtoMessage() {} - -func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. -func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} -} - -func (x *GetDraftPolicyRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetDraftPolicyRequest) GetStatusFilter() string { - if x != nil { - return x.StatusFilter - } - return "" -} - -func (x *GetDraftPolicyRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetDraftPolicyResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Draft policy chunks. - Chunks []*PolicyChunk `protobuf:"bytes,1,rep,name=chunks,proto3" json:"chunks,omitempty"` - // LLM-generated summary of all analysis (empty in mechanistic mode). - RollingSummary string `protobuf:"bytes,2,opt,name=rolling_summary,json=rollingSummary,proto3" json:"rolling_summary,omitempty"` - // Current draft version. - DraftVersion uint64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // When the last analysis completed (ms since epoch). - LastAnalyzedAtMs int64 `protobuf:"varint,4,opt,name=last_analyzed_at_ms,json=lastAnalyzedAtMs,proto3" json:"last_analyzed_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftPolicyResponse) Reset() { - *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[145] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftPolicyResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftPolicyResponse) ProtoMessage() {} - -func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. -func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} -} - -func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { - if x != nil { - return x.Chunks - } - return nil -} - -func (x *GetDraftPolicyResponse) GetRollingSummary() string { - if x != nil { - return x.RollingSummary - } - return "" -} - -func (x *GetDraftPolicyResponse) GetDraftVersion() uint64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *GetDraftPolicyResponse) GetLastAnalyzedAtMs() int64 { - if x != nil { - return x.LastAnalyzedAtMs - } - return 0 -} - -// Approve a single draft chunk. -type ApproveDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to approve. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveDraftChunkRequest) Reset() { - *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[146] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveDraftChunkRequest) ProtoMessage() {} - -func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} -} - -func (x *ApproveDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ApproveDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *ApproveDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ApproveDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after merge. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the new policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveDraftChunkResponse) Reset() { - *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[147] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveDraftChunkResponse) ProtoMessage() {} - -func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} -} - -func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *ApproveDraftChunkResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -// Reject a single draft chunk. -type RejectDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to reject. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Optional reason for rejection (fed to LLM context in future analysis). - Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RejectDraftChunkRequest) Reset() { - *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[148] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RejectDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RejectDraftChunkRequest) ProtoMessage() {} - -func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} -} - -func (x *RejectDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *RejectDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *RejectDraftChunkRequest) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *RejectDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type RejectDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RejectDraftChunkResponse) Reset() { - *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[149] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RejectDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RejectDraftChunkResponse) ProtoMessage() {} - -func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} -} - -// Approve all pending chunks. -type ApproveAllDraftChunksRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Include chunks with security_notes (default false: skips them). - IncludeSecurityFlagged bool `protobuf:"varint,2,opt,name=include_security_flagged,json=includeSecurityFlagged,proto3" json:"include_security_flagged,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveAllDraftChunksRequest) Reset() { - *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[150] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveAllDraftChunksRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveAllDraftChunksRequest) ProtoMessage() {} - -func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. -func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} -} - -func (x *ApproveAllDraftChunksRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ApproveAllDraftChunksRequest) GetIncludeSecurityFlagged() bool { - if x != nil { - return x.IncludeSecurityFlagged - } - return false -} - -func (x *ApproveAllDraftChunksRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ApproveAllDraftChunksResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after merge. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the new policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Number of chunks approved. - ChunksApproved uint32 `protobuf:"varint,3,opt,name=chunks_approved,json=chunksApproved,proto3" json:"chunks_approved,omitempty"` - // Number of chunks skipped (security-flagged). - ChunksSkipped uint32 `protobuf:"varint,4,opt,name=chunks_skipped,json=chunksSkipped,proto3" json:"chunks_skipped,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveAllDraftChunksResponse) Reset() { - *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[151] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveAllDraftChunksResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveAllDraftChunksResponse) ProtoMessage() {} - -func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. -func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} -} - -func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *ApproveAllDraftChunksResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *ApproveAllDraftChunksResponse) GetChunksApproved() uint32 { - if x != nil { - return x.ChunksApproved - } - return 0 -} - -func (x *ApproveAllDraftChunksResponse) GetChunksSkipped() uint32 { - if x != nil { - return x.ChunksSkipped - } - return 0 -} - -// Edit a pending chunk in-place. -type EditDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to edit. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // The modified rule (replaces existing proposed_rule). - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,3,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EditDraftChunkRequest) Reset() { - *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[152] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EditDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EditDraftChunkRequest) ProtoMessage() {} - -func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} -} - -func (x *EditDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *EditDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *EditDraftChunkRequest) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *EditDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type EditDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EditDraftChunkResponse) Reset() { - *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[153] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EditDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EditDraftChunkResponse) ProtoMessage() {} - -func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} -} - -// Reverse an approval (remove merged rule from active policy). -type UndoDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to undo. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UndoDraftChunkRequest) Reset() { - *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[154] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UndoDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UndoDraftChunkRequest) ProtoMessage() {} - -func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} -} - -func (x *UndoDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *UndoDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *UndoDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type UndoDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after removal. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the updated policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UndoDraftChunkResponse) Reset() { - *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[155] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UndoDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UndoDraftChunkResponse) ProtoMessage() {} - -func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} -} - -func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *UndoDraftChunkResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -// Clear all pending draft chunks for a sandbox. -type ClearDraftChunksRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ClearDraftChunksRequest) Reset() { - *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[156] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ClearDraftChunksRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ClearDraftChunksRequest) ProtoMessage() {} - -func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. -func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} -} - -func (x *ClearDraftChunksRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ClearDraftChunksRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ClearDraftChunksResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Number of chunks cleared. - ChunksCleared uint32 `protobuf:"varint,1,opt,name=chunks_cleared,json=chunksCleared,proto3" json:"chunks_cleared,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ClearDraftChunksResponse) Reset() { - *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[157] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ClearDraftChunksResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ClearDraftChunksResponse) ProtoMessage() {} - -func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. -func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} -} - -func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { - if x != nil { - return x.ChunksCleared - } - return 0 -} - -// Get decision history for a sandbox's draft policy. -type GetDraftHistoryRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftHistoryRequest) Reset() { - *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[158] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftHistoryRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftHistoryRequest) ProtoMessage() {} - -func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. -func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} -} - -func (x *GetDraftHistoryRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetDraftHistoryRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DraftHistoryEntry struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Event timestamp (ms since epoch). - TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - // Event type: "denial_detected", "analysis_cycle", "approved", - // "rejected", "edited", "undone", "cleared". - EventType string `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"` - // Human-readable description. - Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` - // Associated chunk ID (if applicable). - ChunkId string `protobuf:"bytes,4,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftHistoryEntry) Reset() { - *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[159] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftHistoryEntry) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftHistoryEntry) ProtoMessage() {} - -func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. -func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} -} - -func (x *DraftHistoryEntry) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *DraftHistoryEntry) GetEventType() string { - if x != nil { - return x.EventType - } - return "" -} - -func (x *DraftHistoryEntry) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *DraftHistoryEntry) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -type GetDraftHistoryResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Chronological decision history. - Entries []*DraftHistoryEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftHistoryResponse) Reset() { - *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[160] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftHistoryResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftHistoryResponse) ProtoMessage() {} - -func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. -func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} -} - -func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { - if x != nil { - return x.Entries - } - return nil -} - -// Stored payload for a policy revision row in the generic objects table. -type PolicyRevisionPayload struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Serialized policy contents. - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` - // Deterministic hash of the policy payload. - Hash string `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"` - // Load error reported by the sandbox, if any. - LoadError string `protobuf:"bytes,3,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - // When the policy version was reported as loaded (ms since epoch). 0 if unset. - LoadedAtMs int64 `protobuf:"varint,4,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"` - // Immutable provenance supplied when this revision was created. - Provenance map[string]string `protobuf:"bytes,5,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyRevisionPayload) Reset() { - *x = PolicyRevisionPayload{} - mi := &file_openshell_proto_msgTypes[161] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyRevisionPayload) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyRevisionPayload) ProtoMessage() {} - -func (x *PolicyRevisionPayload) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyRevisionPayload.ProtoReflect.Descriptor instead. -func (*PolicyRevisionPayload) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} -} - -func (x *PolicyRevisionPayload) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *PolicyRevisionPayload) GetHash() string { - if x != nil { - return x.Hash - } - return "" -} - -func (x *PolicyRevisionPayload) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -func (x *PolicyRevisionPayload) GetLoadedAtMs() int64 { - if x != nil { - return x.LoadedAtMs - } - return 0 -} - -func (x *PolicyRevisionPayload) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Stored payload for a draft policy chunk row in the generic objects table. -type DraftChunkPayload struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Proposed network_policies map key. - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - // Proposed network policy rule. - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Human-readable explanation of why this rule is proposed. - Rationale string `protobuf:"bytes,3,opt,name=rationale,proto3" json:"rationale,omitempty"` - // Security concerns flagged by analysis (empty if none). - SecurityNotes string `protobuf:"bytes,4,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - Confidence float32 `protobuf:"fixed32,5,opt,name=confidence,proto3" json:"confidence,omitempty"` - // When the user approved/rejected (ms since epoch). 0 if undecided. - DecidedAtMs int64 `protobuf:"varint,6,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"` - // Denormalized endpoint host for dedup and display. - Host string `protobuf:"bytes,7,opt,name=host,proto3" json:"host,omitempty"` - // Denormalized endpoint port for dedup and display. - Port int32 `protobuf:"varint,8,opt,name=port,proto3" json:"port,omitempty"` - // Binary path that triggered the denial. - Binary string `protobuf:"bytes,9,opt,name=binary,proto3" json:"binary,omitempty"` - // Current draft version for the owning sandbox. - DraftVersion int64 `protobuf:"varint,10,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // Gateway prover verdict for this chunk; empty until prover runs. - // Mirrors PolicyChunk.validation_result. - ValidationResult string `protobuf:"bytes,11,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form rejection text; empty for non-rejected - // chunks. Mirrors PolicyChunk.rejection_reason. - RejectionReason string `protobuf:"bytes,12,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftChunkPayload) Reset() { - *x = DraftChunkPayload{} - mi := &file_openshell_proto_msgTypes[162] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftChunkPayload) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftChunkPayload) ProtoMessage() {} - -func (x *DraftChunkPayload) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftChunkPayload.ProtoReflect.Descriptor instead. -func (*DraftChunkPayload) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} -} - -func (x *DraftChunkPayload) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *DraftChunkPayload) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *DraftChunkPayload) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *DraftChunkPayload) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *DraftChunkPayload) GetConfidence() float32 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *DraftChunkPayload) GetDecidedAtMs() int64 { - if x != nil { - return x.DecidedAtMs - } - return 0 -} - -func (x *DraftChunkPayload) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *DraftChunkPayload) GetPort() int32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *DraftChunkPayload) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *DraftChunkPayload) GetDraftVersion() int64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *DraftChunkPayload) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *DraftChunkPayload) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Internal stored policy revision row materialized from the generic objects table. -type StoredPolicyRevision struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - Version int64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - PolicyPayload []byte `protobuf:"bytes,4,opt,name=policy_payload,json=policyPayload,proto3" json:"policy_payload,omitempty"` - PolicyHash string `protobuf:"bytes,5,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - Status string `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"` - LoadError *string `protobuf:"bytes,7,opt,name=load_error,json=loadError,proto3,oneof" json:"load_error,omitempty"` - CreatedAtMs int64 `protobuf:"varint,8,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - LoadedAtMs *int64 `protobuf:"varint,9,opt,name=loaded_at_ms,json=loadedAtMs,proto3,oneof" json:"loaded_at_ms,omitempty"` - Provenance map[string]string `protobuf:"bytes,10,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredPolicyRevision) Reset() { - *x = StoredPolicyRevision{} - mi := &file_openshell_proto_msgTypes[163] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredPolicyRevision) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredPolicyRevision) ProtoMessage() {} - -func (x *StoredPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredPolicyRevision.ProtoReflect.Descriptor instead. -func (*StoredPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} -} - -func (x *StoredPolicyRevision) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *StoredPolicyRevision) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *StoredPolicyRevision) GetVersion() int64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *StoredPolicyRevision) GetPolicyPayload() []byte { - if x != nil { - return x.PolicyPayload - } - return nil -} - -func (x *StoredPolicyRevision) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *StoredPolicyRevision) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredPolicyRevision) GetLoadError() string { - if x != nil && x.LoadError != nil { - return *x.LoadError - } - return "" -} - -func (x *StoredPolicyRevision) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *StoredPolicyRevision) GetLoadedAtMs() int64 { - if x != nil && x.LoadedAtMs != nil { - return *x.LoadedAtMs - } - return 0 -} - -func (x *StoredPolicyRevision) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Internal stored draft chunk row materialized from the generic objects table. -type StoredDraftChunk struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - DraftVersion int64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - Status string `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"` - RuleName string `protobuf:"bytes,5,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - ProposedRule []byte `protobuf:"bytes,6,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - Rationale string `protobuf:"bytes,7,opt,name=rationale,proto3" json:"rationale,omitempty"` - SecurityNotes string `protobuf:"bytes,8,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - Confidence float64 `protobuf:"fixed64,9,opt,name=confidence,proto3" json:"confidence,omitempty"` - CreatedAtMs int64 `protobuf:"varint,10,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - DecidedAtMs *int64 `protobuf:"varint,11,opt,name=decided_at_ms,json=decidedAtMs,proto3,oneof" json:"decided_at_ms,omitempty"` - Host string `protobuf:"bytes,12,opt,name=host,proto3" json:"host,omitempty"` - Port int32 `protobuf:"varint,13,opt,name=port,proto3" json:"port,omitempty"` - Binary string `protobuf:"bytes,14,opt,name=binary,proto3" json:"binary,omitempty"` - HitCount int32 `protobuf:"varint,15,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"` - FirstSeenMs int64 `protobuf:"varint,16,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - LastSeenMs int64 `protobuf:"varint,17,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Gateway prover verdict; empty until the prover runs. See PolicyChunk. - ValidationResult string `protobuf:"bytes,18,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form rejection text. See PolicyChunk. - RejectionReason string `protobuf:"bytes,19,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredDraftChunk) Reset() { - *x = StoredDraftChunk{} - mi := &file_openshell_proto_msgTypes[164] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredDraftChunk) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredDraftChunk) ProtoMessage() {} - -func (x *StoredDraftChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredDraftChunk.ProtoReflect.Descriptor instead. -func (*StoredDraftChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} -} - -func (x *StoredDraftChunk) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *StoredDraftChunk) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *StoredDraftChunk) GetDraftVersion() int64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *StoredDraftChunk) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredDraftChunk) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *StoredDraftChunk) GetProposedRule() []byte { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *StoredDraftChunk) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *StoredDraftChunk) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *StoredDraftChunk) GetConfidence() float64 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *StoredDraftChunk) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *StoredDraftChunk) GetDecidedAtMs() int64 { - if x != nil && x.DecidedAtMs != nil { - return *x.DecidedAtMs - } - return 0 -} - -func (x *StoredDraftChunk) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *StoredDraftChunk) GetPort() int32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *StoredDraftChunk) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *StoredDraftChunk) GetHitCount() int32 { - if x != nil { - return x.HitCount - } - return 0 -} - -func (x *StoredDraftChunk) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *StoredDraftChunk) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *StoredDraftChunk) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *StoredDraftChunk) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Create workspace request. -type CreateWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. Must be a valid DNS-1123 label. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Optional labels for the workspace (key-value metadata). - Labels map[string]string `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateWorkspaceRequest) Reset() { - *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[165] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateWorkspaceRequest) ProtoMessage() {} - -func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} -} - -func (x *CreateWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *CreateWorkspaceRequest) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -// Create workspace response. -type CreateWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspace *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateWorkspaceResponse) Reset() { - *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[166] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateWorkspaceResponse) ProtoMessage() {} - -func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} -} - -func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { - if x != nil { - return x.Workspace - } - return nil -} - -// Get workspace request. -type GetWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetWorkspaceRequest) Reset() { - *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[167] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetWorkspaceRequest) ProtoMessage() {} - -func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} -} - -func (x *GetWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -// Get workspace response. -type GetWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspace *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetWorkspaceResponse) Reset() { - *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[168] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetWorkspaceResponse) ProtoMessage() {} - -func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} -} - -func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { - if x != nil { - return x.Workspace - } - return nil -} - -// List workspaces request. -type ListWorkspacesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspacesRequest) Reset() { - *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[169] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspacesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspacesRequest) ProtoMessage() {} - -func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. -func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} -} - -func (x *ListWorkspacesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListWorkspacesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListWorkspacesRequest) GetLabelSelector() string { - if x != nil { - return x.LabelSelector - } - return "" -} - -// List workspaces response. -type ListWorkspacesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspaces []*datamodelv1.Workspace `protobuf:"bytes,1,rep,name=workspaces,proto3" json:"workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspacesResponse) Reset() { - *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[170] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspacesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspacesResponse) ProtoMessage() {} - -func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. -func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} -} - -func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { - if x != nil { - return x.Workspaces - } - return nil -} - -// Delete workspace request. -type DeleteWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteWorkspaceRequest) Reset() { - *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[171] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteWorkspaceRequest) ProtoMessage() {} - -func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} -} - -func (x *DeleteWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -// Delete workspace response. -type DeleteWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteWorkspaceResponse) Reset() { - *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[172] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteWorkspaceResponse) ProtoMessage() {} - -func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} -} - -func (x *DeleteWorkspaceResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Workspace membership record. -type WorkspaceMember struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // OIDC subject claim identifying the principal. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - // Role assigned to the principal within the workspace. - Role WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WorkspaceMember) Reset() { - *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[173] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WorkspaceMember) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WorkspaceMember) ProtoMessage() {} - -func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. -func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} -} - -func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *WorkspaceMember) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -func (x *WorkspaceMember) GetRole() WorkspaceRole { - if x != nil { - return x.Role - } - return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED -} - -// Add workspace member request. -type AddWorkspaceMemberRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - // OIDC subject claim identifying the principal. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - // Role to assign. - Role WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddWorkspaceMemberRequest) Reset() { - *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[174] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddWorkspaceMemberRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddWorkspaceMemberRequest) ProtoMessage() {} - -func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. -func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} -} - -func (x *AddWorkspaceMemberRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *AddWorkspaceMemberRequest) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -func (x *AddWorkspaceMemberRequest) GetRole() WorkspaceRole { - if x != nil { - return x.Role - } - return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED -} - -// Add workspace member response. -type AddWorkspaceMemberResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Member *WorkspaceMember `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddWorkspaceMemberResponse) Reset() { - *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[175] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddWorkspaceMemberResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddWorkspaceMemberResponse) ProtoMessage() {} - -func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. -func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} -} - -func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { - if x != nil { - return x.Member - } - return nil -} - -// Remove workspace member request. -type RemoveWorkspaceMemberRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - // OIDC subject claim identifying the principal to remove. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveWorkspaceMemberRequest) Reset() { - *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[176] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveWorkspaceMemberRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} - -func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. -func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} -} - -func (x *RemoveWorkspaceMemberRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *RemoveWorkspaceMemberRequest) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -// Remove workspace member response. -type RemoveWorkspaceMemberResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Removed bool `protobuf:"varint,1,opt,name=removed,proto3" json:"removed,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveWorkspaceMemberResponse) Reset() { - *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[177] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveWorkspaceMemberResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} - -func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. -func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} -} - -func (x *RemoveWorkspaceMemberResponse) GetRemoved() bool { - if x != nil { - return x.Removed - } - return false -} - -// List workspace members request. -type ListWorkspaceMembersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspaceMembersRequest) Reset() { - *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[178] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspaceMembersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspaceMembersRequest) ProtoMessage() {} - -func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. -func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} -} - -func (x *ListWorkspaceMembersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListWorkspaceMembersRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListWorkspaceMembersRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -// List workspace members response. -type ListWorkspaceMembersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Members []*WorkspaceMember `protobuf:"bytes,1,rep,name=members,proto3" json:"members,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspaceMembersResponse) Reset() { - *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[179] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspaceMembersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspaceMembersResponse) ProtoMessage() {} - -func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. -func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} -} - -func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { - if x != nil { - return x.Members - } - return nil -} - -var File_openshell_proto protoreflect.FileDescriptor - -const file_openshell_proto_rawDesc = "" + - "\n" + - "\x0fopenshell.proto\x12\fopenshell.v1\x1a\x0fdatamodel.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\roptions.proto\x1a\rsandbox.proto\"\x1a\n" + - "\x18IssueSandboxTokenRequest\"[\n" + - "\x19IssueSandboxTokenResponse\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\"\x1c\n" + - "\x1aRefreshSandboxTokenRequest\"]\n" + - "\x1bRefreshSandboxTokenResponse\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\"\x0f\n" + - "\rHealthRequest\"_\n" + - "\x0eHealthResponse\x123\n" + - "\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12\x18\n" + - "\aversion\x18\x02 \x01(\tR\aversion\"\x17\n" + - "\x15GetCurrentUserRequest\"\xb0\x01\n" + - "\x16GetCurrentUserResponse\x12\x18\n" + - "\asubject\x18\x01 \x01(\tR\asubject\x12!\n" + - "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" + - "\x05roles\x18\x03 \x03(\tR\x05roles\x12\x16\n" + - "\x06scopes\x18\x04 \x03(\tR\x06scopes\x12+\n" + - "\x11identity_provider\x18\x05 \x01(\tR\x10identityProvider\"\x17\n" + - "\x15GetGatewayInfoRequest\"\xc0\x01\n" + - "\x16GetGatewayInfoResponse\x123\n" + - "\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12'\n" + - "\x0fgateway_version\x18\x02 \x01(\tR\x0egatewayVersion\x12H\n" + - "\x0fcompute_drivers\x18\x03 \x03(\v2\x1f.openshell.v1.ComputeDriverInfoR\x0ecomputeDrivers\"t\n" + - "\x11ComputeDriverInfo\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12K\n" + - "\fcapabilities\x18\x02 \x01(\v2'.openshell.v1.ComputeDriverCapabilitiesR\fcapabilities\"c\n" + - "\x19ComputeDriverCapabilities\x12\x1f\n" + - "\vdriver_name\x18\x01 \x01(\tR\n" + - "driverName\x12%\n" + - "\x0edriver_version\x18\x02 \x01(\tR\rdriverVersion\"\xd8\x01\n" + - "\aSandbox\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12-\n" + - "\x04spec\x18\x02 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x123\n" + - "\x06status\x18\x03 \x01(\v2\x1b.openshell.v1.SandboxStatusR\x06statusJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x05phaseR\x16current_policy_version\"\xd7\x03\n" + - "\vSandboxSpec\x12\x1b\n" + - "\tlog_level\x18\x01 \x01(\tR\blogLevel\x12L\n" + - "\venvironment\x18\x05 \x03(\v2*.openshell.v1.SandboxSpec.EnvironmentEntryR\venvironment\x129\n" + - "\btemplate\x18\x06 \x01(\v2\x1d.openshell.v1.SandboxTemplateR\btemplate\x12;\n" + - "\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1c\n" + - "\tproviders\x18\b \x03(\tR\tproviders\x12W\n" + - "\x15resource_requirements\x18\t \x01(\v2\".openshell.v1.ResourceRequirementsR\x14resourceRequirements\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\n" + - "\x10\vJ\x04\b\v\x10\fR\n" + - "gpu_deviceR\x16proposal_approval_mode\"O\n" + - "\x14ResourceRequirements\x127\n" + - "\x03gpu\x18\x01 \x01(\v2%.openshell.v1.GpuResourceRequirementsR\x03gpu\">\n" + - "\x17GpuResourceRequirements\x12\x19\n" + - "\x05count\x18\x01 \x01(\rH\x00R\x05count\x88\x01\x01B\b\n" + - "\x06_count\"\xef\x05\n" + - "\x0fSandboxTemplate\x12\x14\n" + - "\x05image\x18\x01 \x01(\tR\x05image\x12,\n" + - "\x12runtime_class_name\x18\x02 \x01(\tR\x10runtimeClassName\x12!\n" + - "\fagent_socket\x18\x03 \x01(\tR\vagentSocket\x12A\n" + - "\x06labels\x18\x04 \x03(\v2).openshell.v1.SandboxTemplate.LabelsEntryR\x06labels\x12P\n" + - "\vannotations\x18\x05 \x03(\v2..openshell.v1.SandboxTemplate.AnnotationsEntryR\vannotations\x12P\n" + - "\venvironment\x18\x06 \x03(\v2..openshell.v1.SandboxTemplate.EnvironmentEntryR\venvironment\x125\n" + - "\tresources\x18\a \x01(\v2\x17.google.protobuf.StructR\tresources\x12,\n" + - "\x0fuser_namespaces\x18\n" + - " \x01(\bH\x00R\x0euserNamespaces\x88\x01\x01\x12<\n" + - "\rdriver_config\x18\v \x01(\v2\x17.google.protobuf.StructR\fdriverConfig\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x12\n" + - "\x10_user_namespacesJ\x04\b\t\x10\n" + - "R\x16volume_claim_templates\"\xb1\x02\n" + - "\rSandboxStatus\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1b\n" + - "\tagent_pod\x18\x02 \x01(\tR\bagentPod\x12\x19\n" + - "\bagent_fd\x18\x03 \x01(\tR\aagentFd\x12\x1d\n" + - "\n" + - "sandbox_fd\x18\x04 \x01(\tR\tsandboxFd\x12>\n" + - "\n" + - "conditions\x18\x05 \x03(\v2\x1e.openshell.v1.SandboxConditionR\n" + - "conditions\x120\n" + - "\x05phase\x18\x06 \x01(\x0e2\x1a.openshell.v1.SandboxPhaseR\x05phase\x124\n" + - "\x16current_policy_version\x18\a \x01(\rR\x14currentPolicyVersion\"\xa2\x01\n" + - "\x10SandboxCondition\x12\x12\n" + - "\x04type\x18\x01 \x01(\tR\x04type\x12\x16\n" + - "\x06status\x18\x02 \x01(\tR\x06status\x12\x16\n" + - "\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" + - "\amessage\x18\x04 \x01(\tR\amessage\x120\n" + - "\x14last_transition_time\x18\x05 \x01(\tR\x12lastTransitionTime\"\x94\x02\n" + - "\rPlatformEvent\x12!\n" + - "\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x16\n" + - "\x06source\x18\x02 \x01(\tR\x06source\x12\x12\n" + - "\x04type\x18\x03 \x01(\tR\x04type\x12\x16\n" + - "\x06reason\x18\x04 \x01(\tR\x06reason\x12\x18\n" + - "\amessage\x18\x05 \x01(\tR\amessage\x12E\n" + - "\bmetadata\x18\x06 \x03(\v2).openshell.v1.PlatformEvent.MetadataEntryR\bmetadata\x1a;\n" + - "\rMetadataEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x91\x03\n" + - "\x14CreateSandboxRequest\x12-\n" + - "\x04spec\x18\x01 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\x12F\n" + - "\x06labels\x18\x03 \x03(\v2..openshell.v1.CreateSandboxRequest.LabelsEntryR\x06labels\x12U\n" + - "\vannotations\x18\x04 \x03(\v23.openshell.v1.CreateSandboxRequest.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"E\n" + - "\x11GetSandboxRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xb0\x01\n" + - "\x14ListSandboxesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" + - "\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"^\n" + - "\x1bListSandboxProvidersRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc0\x01\n" + - "\x1cAttachSandboxProviderRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" + - "\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" + - "\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xc0\x01\n" + - "\x1cDetachSandboxProviderRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" + - "\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" + - "\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"H\n" + - "\x14DeleteSandboxRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"B\n" + - "\x0fSandboxResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\"L\n" + - "\x15ListSandboxesResponse\x123\n" + - "\tsandboxes\x18\x01 \x03(\v2\x15.openshell.v1.SandboxR\tsandboxes\"^\n" + - "\x1cListSandboxProvidersResponse\x12>\n" + - "\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"l\n" + - "\x1dAttachSandboxProviderResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" + - "\battached\x18\x02 \x01(\bR\battached\"l\n" + - "\x1dDetachSandboxProviderResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" + - "\bdetached\x18\x02 \x01(\bR\bdetached\"1\n" + - "\x15DeleteSandboxResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"8\n" + - "\x17CreateSshSessionRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x98\x02\n" + - "\x18CreateSshSessionResponse\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1a\n" + - "\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12!\n" + - "\fgateway_host\x18\x03 \x01(\tR\vgatewayHost\x12!\n" + - "\fgateway_port\x18\x04 \x01(\rR\vgatewayPort\x12%\n" + - "\x0egateway_scheme\x18\x05 \x01(\tR\rgatewayScheme\x120\n" + - "\x14host_key_fingerprint\x18\a \x01(\tR\x12hostKeyFingerprint\x12\"\n" + - "\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\"\xa1\x01\n" + - "\x14ExposeServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1f\n" + - "\vtarget_port\x18\x03 \x01(\rR\n" + - "targetPort\x12\x16\n" + - "\x06domain\x18\x04 \x01(\bR\x06domain\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\"e\n" + - "\x11GetServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xa2\x01\n" + - "\x13ListServicesRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"Y\n" + - "\x14ListServicesResponse\x12A\n" + - "\bservices\x18\x01 \x03(\v2%.openshell.v1.ServiceEndpointResponseR\bservices\"h\n" + - "\x14DeleteServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"1\n" + - "\x15DeleteServiceResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xef\x01\n" + - "\x0fServiceEndpoint\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12!\n" + - "\fsandbox_name\x18\x03 \x01(\tR\vsandboxName\x12!\n" + - "\fservice_name\x18\x04 \x01(\tR\vserviceName\x12\x1f\n" + - "\vtarget_port\x18\x05 \x01(\rR\n" + - "targetPort\x12\x16\n" + - "\x06domain\x18\x06 \x01(\bR\x06domain\"f\n" + - "\x17ServiceEndpointResponse\x129\n" + - "\bendpoint\x18\x01 \x01(\v2\x1d.openshell.v1.ServiceEndpointR\bendpoint\x12\x10\n" + - "\x03url\x18\x02 \x01(\tR\x03url\"5\n" + - "\x17RevokeSshSessionRequest\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\"4\n" + - "\x18RevokeSshSessionResponse\x12\x18\n" + - "\arevoked\x18\x01 \x01(\bR\arevoked\"\xf5\x02\n" + - "\x12ExecSandboxRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" + - "\acommand\x18\x02 \x03(\tR\acommand\x12\x18\n" + - "\aworkdir\x18\x03 \x01(\tR\aworkdir\x12S\n" + - "\venvironment\x18\x04 \x03(\v21.openshell.v1.ExecSandboxRequest.EnvironmentEntryR\venvironment\x12'\n" + - "\x0ftimeout_seconds\x18\x05 \x01(\rR\x0etimeoutSeconds\x12\x14\n" + - "\x05stdin\x18\x06 \x01(\fR\x05stdin\x12\x10\n" + - "\x03tty\x18\a \x01(\bR\x03tty\x12\x12\n" + - "\x04cols\x18\b \x01(\rR\x04cols\x12\x12\n" + - "\x04rows\x18\t \x01(\rR\x04rows\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"'\n" + - "\x11ExecSandboxStdout\x12\x12\n" + - "\x04data\x18\x01 \x01(\fR\x04data\"'\n" + - "\x11ExecSandboxStderr\x12\x12\n" + - "\x04data\x18\x01 \x01(\fR\x04data\".\n" + - "\x0fExecSandboxExit\x12\x1b\n" + - "\texit_code\x18\x01 \x01(\x05R\bexitCode\"\xc8\x01\n" + - "\x10ExecSandboxEvent\x129\n" + - "\x06stdout\x18\x01 \x01(\v2\x1f.openshell.v1.ExecSandboxStdoutH\x00R\x06stdout\x129\n" + - "\x06stderr\x18\x02 \x01(\v2\x1f.openshell.v1.ExecSandboxStderrH\x00R\x06stderr\x123\n" + - "\x04exit\x18\x03 \x01(\v2\x1d.openshell.v1.ExecSandboxExitH\x00R\x04exitB\t\n" + - "\apayload\"\xf3\x01\n" + - "\x0eTcpForwardInit\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1d\n" + - "\n" + - "service_id\x18\x04 \x01(\tR\tserviceId\x120\n" + - "\x03ssh\x18\x05 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" + - "\x03tcp\x18\x06 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x125\n" + - "\x13authorization_token\x18\a \x01(\tB\x04\x88\xb5\x18\x01R\x12authorizationTokenB\b\n" + - "\x06target\"f\n" + - "\x0fTcpForwardFrame\x122\n" + - "\x04init\x18\x01 \x01(\v2\x1c.openshell.v1.TcpForwardInitH\x00R\x04init\x12\x14\n" + - "\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" + - "\apayload\"\xb0\x01\n" + - "\x10ExecSandboxInput\x128\n" + - "\x05start\x18\x01 \x01(\v2 .openshell.v1.ExecSandboxRequestH\x00R\x05start\x12\x16\n" + - "\x05stdin\x18\x02 \x01(\fH\x00R\x05stdin\x12?\n" + - "\x06resize\x18\x03 \x01(\v2%.openshell.v1.ExecSandboxWindowResizeH\x00R\x06resizeB\t\n" + - "\apayload\"A\n" + - "\x17ExecSandboxWindowResize\x12\x12\n" + - "\x04cols\x18\x01 \x01(\rR\x04cols\x12\x12\n" + - "\x04rows\x18\x02 \x01(\rR\x04rows\"\xc5\x01\n" + - "\n" + - "SshSession\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x1a\n" + - "\x05token\x18\x03 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x04 \x01(\x03R\vexpiresAtMs\x12\x18\n" + - "\arevoked\x18\x05 \x01(\bR\arevoked\"\xe6\x02\n" + - "\x13WatchSandboxRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12#\n" + - "\rfollow_status\x18\x02 \x01(\bR\ffollowStatus\x12\x1f\n" + - "\vfollow_logs\x18\x03 \x01(\bR\n" + - "followLogs\x12#\n" + - "\rfollow_events\x18\x04 \x01(\bR\ffollowEvents\x12$\n" + - "\x0elog_tail_lines\x18\x05 \x01(\rR\flogTailLines\x12\x1d\n" + - "\n" + - "event_tail\x18\x06 \x01(\rR\teventTail\x12(\n" + - "\x10stop_on_terminal\x18\a \x01(\bR\x0estopOnTerminal\x12 \n" + - "\flog_since_ms\x18\b \x01(\x03R\n" + - "logSinceMs\x12\x1f\n" + - "\vlog_sources\x18\t \x03(\tR\n" + - "logSources\x12\"\n" + - "\rlog_min_level\x18\n" + - " \x01(\tR\vlogMinLevel\"\xcc\x02\n" + - "\x12SandboxStreamEvent\x121\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxH\x00R\asandbox\x120\n" + - "\x03log\x18\x02 \x01(\v2\x1c.openshell.v1.SandboxLogLineH\x00R\x03log\x123\n" + - "\x05event\x18\x03 \x01(\v2\x1b.openshell.v1.PlatformEventH\x00R\x05event\x12>\n" + - "\awarning\x18\x04 \x01(\v2\".openshell.v1.SandboxStreamWarningH\x00R\awarning\x12Q\n" + - "\x13draft_policy_update\x18\x05 \x01(\v2\x1f.openshell.v1.DraftPolicyUpdateH\x00R\x11draftPolicyUpdateB\t\n" + - "\apayload\"\xaf\x02\n" + - "\x0eSandboxLogLine\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12!\n" + - "\ftimestamp_ms\x18\x02 \x01(\x03R\vtimestampMs\x12\x14\n" + - "\x05level\x18\x03 \x01(\tR\x05level\x12\x16\n" + - "\x06target\x18\x04 \x01(\tR\x06target\x12\x18\n" + - "\amessage\x18\x05 \x01(\tR\amessage\x12\x16\n" + - "\x06source\x18\x06 \x01(\tR\x06source\x12@\n" + - "\x06fields\x18\a \x03(\v2(.openshell.v1.SandboxLogLine.FieldsEntryR\x06fields\x1a9\n" + - "\vFieldsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"0\n" + - "\x14SandboxStreamWarning\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"s\n" + - "\x15CreateProviderRequest\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"F\n" + - "\x12GetProviderRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x89\x01\n" + - "\x14ListProvidersRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x04 \x01(\bR\rallWorkspaces\"\xb6\x02\n" + - "\x15UpdateProviderRequest\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12w\n" + - "\x18credential_expires_at_ms\x18\x02 \x03(\v2>.openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\"I\n" + - "\x15DeleteProviderRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"P\n" + - "\x10ProviderResponse\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\"W\n" + - "\x15ListProvidersResponse\x12>\n" + - "\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"i\n" + - "\x1bListProviderProfilesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"I\n" + - "\x19GetProviderProfileRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"l\n" + - "\x19ProviderProfileImportItem\x127\n" + - "\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x16\n" + - "\x06source\x18\x02 \x01(\tR\x06source\"\x9e\x01\n" + - "\x19ProviderProfileDiagnostic\x12\x16\n" + - "\x06source\x18\x01 \x01(\tR\x06source\x12\x1d\n" + - "\n" + - "profile_id\x18\x02 \x01(\tR\tprofileId\x12\x14\n" + - "\x05field\x18\x03 \x01(\tR\x05field\x12\x18\n" + - "\amessage\x18\x04 \x01(\tR\amessage\x12\x1a\n" + - "\bseverity\x18\x05 \x01(\tR\bseverity\"\x9e\x01\n" + - ",ProviderCredentialTokenGrantAudienceOverride\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" + - "\x04path\x18\x03 \x01(\tR\x04path\x12\x1a\n" + - "\baudience\x18\x04 \x01(\tR\baudience\x12\x16\n" + - "\x06scopes\x18\x05 \x03(\tR\x06scopes\"\xf0\x02\n" + - "\x1cProviderCredentialTokenGrant\x12%\n" + - "\x0etoken_endpoint\x18\x01 \x01(\tR\rtokenEndpoint\x12\x1a\n" + - "\baudience\x18\x02 \x01(\tR\baudience\x12*\n" + - "\x11jwt_svid_audience\x18\x06 \x01(\tR\x0fjwtSvidAudience\x12\x16\n" + - "\x06scopes\x18\x03 \x03(\tR\x06scopes\x12*\n" + - "\x11cache_ttl_seconds\x18\x04 \x01(\x03R\x0fcacheTtlSeconds\x12i\n" + - "\x12audience_overrides\x18\x05 \x03(\v2:.openshell.v1.ProviderCredentialTokenGrantAudienceOverrideR\x11audienceOverrides\x122\n" + - "\x15client_assertion_type\x18\a \x01(\tR\x13clientAssertionType\"\x9e\x03\n" + - "\x19ProviderProfileCredential\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12 \n" + - "\vdescription\x18\x02 \x01(\tR\vdescription\x12\x19\n" + - "\benv_vars\x18\x03 \x03(\tR\aenvVars\x12\x1a\n" + - "\brequired\x18\x04 \x01(\bR\brequired\x12\x1d\n" + - "\n" + - "auth_style\x18\x05 \x01(\tR\tauthStyle\x12\x1f\n" + - "\vheader_name\x18\x06 \x01(\tR\n" + - "headerName\x12\x1f\n" + - "\vquery_param\x18\a \x01(\tR\n" + - "queryParam\x12A\n" + - "\arefresh\x18\b \x01(\v2'.openshell.v1.ProviderCredentialRefreshR\arefresh\x12#\n" + - "\rpath_template\x18\t \x01(\tR\fpathTemplate\x12K\n" + - "\vtoken_grant\x18\n" + - " \x01(\v2*.openshell.v1.ProviderCredentialTokenGrantR\n" + - "tokenGrant\"\x8d\x01\n" + - "!ProviderCredentialRefreshMaterial\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12 \n" + - "\vdescription\x18\x02 \x01(\tR\vdescription\x12\x1a\n" + - "\brequired\x18\x03 \x01(\bR\brequired\x12\x16\n" + - "\x06secret\x18\x04 \x01(\bR\x06secret\"Y\n" + - "\x1fProviderCredentialRefreshOutput\x12\x16\n" + - "\x06output\x18\x01 \x01(\tR\x06output\x12\x1e\n" + - "\n" + - "credential\x18\x02 \x01(\tR\n" + - "credential\"\xb0\x03\n" + - "\x19ProviderCredentialRefresh\x12K\n" + - "\bstrategy\x18\x01 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x1b\n" + - "\ttoken_url\x18\x02 \x01(\tR\btokenUrl\x12\x16\n" + - "\x06scopes\x18\x03 \x03(\tR\x06scopes\x124\n" + - "\x16refresh_before_seconds\x18\x04 \x01(\x03R\x14refreshBeforeSeconds\x120\n" + - "\x14max_lifetime_seconds\x18\x05 \x01(\x03R\x12maxLifetimeSeconds\x12K\n" + - "\bmaterial\x18\x06 \x03(\v2/.openshell.v1.ProviderCredentialRefreshMaterialR\bmaterial\x12\\\n" + - "\x12additional_outputs\x18\a \x03(\v2-.openshell.v1.ProviderCredentialRefreshOutputR\x11additionalOutputs\"\x90\x03\n" + - "\x1fProviderCredentialRefreshStatus\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x1f\n" + - "\vprovider_id\x18\x02 \x01(\tR\n" + - "providerId\x12%\n" + - "\x0ecredential_key\x18\x03 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x04 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x16\n" + - "\x06status\x18\x05 \x01(\tR\x06status\x12\"\n" + - "\rexpires_at_ms\x18\x06 \x01(\x03R\vexpiresAtMs\x12+\n" + - "\x12next_refresh_at_ms\x18\a \x01(\x03R\x0fnextRefreshAtMs\x12+\n" + - "\x12last_refresh_at_ms\x18\b \x01(\x03R\x0flastRefreshAtMs\x12\x1d\n" + - "\n" + - "last_error\x18\t \x01(\tR\tlastError\"<\n" + - "\x18ProviderProfileDiscovery\x12 \n" + - "\vcredentials\x18\x01 \x03(\tR\vcredentials\"\x93\b\n" + - "$StoredProviderCredentialRefreshState\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1f\n" + - "\vprovider_id\x18\x02 \x01(\tR\n" + - "providerId\x12#\n" + - "\rprovider_name\x18\x03 \x01(\tR\fproviderName\x12%\n" + - "\x0ecredential_key\x18\x04 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x05 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12b\n" + - "\bmaterial\x18\x06 \x03(\v2@.openshell.v1.StoredProviderCredentialRefreshState.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" + - "\x14secret_material_keys\x18\a \x03(\tR\x12secretMaterialKeys\x12\"\n" + - "\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\x12+\n" + - "\x12next_refresh_at_ms\x18\t \x01(\x03R\x0fnextRefreshAtMs\x12+\n" + - "\x12last_refresh_at_ms\x18\n" + - " \x01(\x03R\x0flastRefreshAtMs\x12\x16\n" + - "\x06status\x18\v \x01(\tR\x06status\x12\x1d\n" + - "\n" + - "last_error\x18\f \x01(\tR\tlastError\x12\x1b\n" + - "\ttoken_url\x18\r \x01(\tR\btokenUrl\x12\x16\n" + - "\x06scopes\x18\x0e \x03(\tR\x06scopes\x124\n" + - "\x16refresh_before_seconds\x18\x0f \x01(\x03R\x14refreshBeforeSeconds\x120\n" + - "\x14max_lifetime_seconds\x18\x10 \x01(\x03R\x12maxLifetimeSeconds\x12\x82\x01\n" + - "\x16additional_output_keys\x18\x11 \x03(\v2L.openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntryR\x14additionalOutputKeys\x1a;\n" + - "\rMaterialEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aG\n" + - "\x19AdditionalOutputKeysEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x82\x01\n" + - "\x1fGetProviderRefreshStatusRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"s\n" + - " GetProviderRefreshStatusResponse\x12O\n" + - "\vcredentials\x18\x01 \x03(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\vcredentials\"\xd8\x03\n" + - "\x1fConfigureProviderRefreshRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x03 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12]\n" + - "\bmaterial\x18\x04 \x03(\v2;.openshell.v1.ConfigureProviderRefreshRequest.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" + - "\x14secret_material_keys\x18\x05 \x03(\tR\x12secretMaterialKeys\x12'\n" + - "\rexpires_at_ms\x18\x06 \x01(\x03H\x00R\vexpiresAtMs\x88\x01\x01\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\x1a;\n" + - "\rMaterialEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x10\n" + - "\x0e_expires_at_ms\"i\n" + - " ConfigureProviderRefreshResponse\x12E\n" + - "\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x82\x01\n" + - "\x1fRotateProviderCredentialRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"i\n" + - " RotateProviderCredentialResponse\x12E\n" + - "\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x7f\n" + - "\x1cDeleteProviderRefreshRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"9\n" + - "\x1dDeleteProviderRefreshResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xd8\x05\n" + - "\x0fProviderProfile\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12!\n" + - "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" + - "\vdescription\x18\x03 \x01(\tR\vdescription\x12A\n" + - "\bcategory\x18\x04 \x01(\x0e2%.openshell.v1.ProviderProfileCategoryR\bcategory\x12I\n" + - "\vcredentials\x18\x05 \x03(\v2'.openshell.v1.ProviderProfileCredentialR\vcredentials\x12C\n" + - "\tendpoints\x18\x06 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" + - "\bbinaries\x18\a \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\x12+\n" + - "\x11inference_capable\x18\b \x01(\bR\x10inferenceCapable\x12D\n" + - "\tdiscovery\x18\t \x01(\v2&.openshell.v1.ProviderProfileDiscoveryR\tdiscovery\x12)\n" + - "\x10resource_version\x18\n" + - " \x01(\x04R\x0fresourceVersion\x12P\n" + - "\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" + - "\x06source\x18\f \x01(\tR\x06source\x12\x14\n" + - "\x05scope\x18\r \x01(\tR\x05scope\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x90\x01\n" + - "\x15StoredProviderProfile\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x127\n" + - "\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"R\n" + - "\x17ProviderProfileResponse\x127\n" + - "\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"Y\n" + - "\x1cListProviderProfilesResponse\x129\n" + - "\bprofiles\x18\x01 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\"\x82\x01\n" + - "\x1dImportProviderProfilesRequest\x12C\n" + - "\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc2\x01\n" + - "\x1eImportProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x129\n" + - "\bprofiles\x18\x02 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\x12\x1a\n" + - "\bimported\x18\x03 \x01(\bR\bimported\"\xcc\x01\n" + - "\x1dUpdateProviderProfilesRequest\x12A\n" + - "\aprofile\x18\x01 \x01(\v2'.openshell.v1.ProviderProfileImportItemR\aprofile\x12:\n" + - "\x19expected_resource_version\x18\x02 \x01(\x04R\x17expectedResourceVersion\x12\x0e\n" + - "\x02id\x18\x03 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xbe\x01\n" + - "\x1eUpdateProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x127\n" + - "\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x18\n" + - "\aupdated\x18\x03 \x01(\bR\aupdated\"\x80\x01\n" + - "\x1bLintProviderProfilesRequest\x12C\n" + - "\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x7f\n" + - "\x1cLintProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x12\x14\n" + - "\x05valid\x18\x02 \x01(\bR\x05valid\"2\n" + - "\x16DeleteProviderResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"L\n" + - "\x1cDeleteProviderProfileRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"9\n" + - "\x1dDeleteProviderProfileResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"E\n" + - "$GetSandboxProviderEnvironmentRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\xcb\x05\n" + - "%GetSandboxProviderEnvironmentResponse\x12l\n" + - "\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" + - "\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x87\x01\n" + - "\x18credential_expires_at_ms\x18\x03 \x03(\v2N.openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12|\n" + - "\x13dynamic_credentials\x18\x04 \x03(\v2K.openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntryR\x12dynamicCredentials\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\x1an\n" + - "\x17DynamicCredentialsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12=\n" + - "\x05value\x18\x02 \x01(\v2'.openshell.v1.ProviderProfileCredentialR\x05value:\x028\x01\"\xce\x04\n" + - "\x13UpdateConfigRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12;\n" + - "\x06policy\x18\x02 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1f\n" + - "\vsetting_key\x18\x03 \x01(\tR\n" + - "settingKey\x12G\n" + - "\rsetting_value\x18\x04 \x01(\v2\".openshell.sandbox.v1.SettingValueR\fsettingValue\x12%\n" + - "\x0edelete_setting\x18\x05 \x01(\bR\rdeleteSetting\x12\x16\n" + - "\x06global\x18\x06 \x01(\bR\x06global\x12M\n" + - "\x10merge_operations\x18\a \x03(\v2\".openshell.v1.PolicyMergeOperationR\x0fmergeOperations\x12:\n" + - "\x19expected_resource_version\x18\b \x01(\x04R\x17expectedResourceVersion\x12T\n" + - "\vannotations\x18\t \x03(\v22.openshell.v1.UpdateConfigRequest.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\n" + - " \x01(\tR\tworkspace\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc7\x03\n" + - "\x14PolicyMergeOperation\x129\n" + - "\badd_rule\x18\x01 \x01(\v2\x1c.openshell.v1.AddNetworkRuleH\x00R\aaddRule\x12N\n" + - "\x0fremove_endpoint\x18\x02 \x01(\v2#.openshell.v1.RemoveNetworkEndpointH\x00R\x0eremoveEndpoint\x12B\n" + - "\vremove_rule\x18\x03 \x01(\v2\x1f.openshell.v1.RemoveNetworkRuleH\x00R\n" + - "removeRule\x12B\n" + - "\x0eadd_deny_rules\x18\x04 \x01(\v2\x1a.openshell.v1.AddDenyRulesH\x00R\faddDenyRules\x12E\n" + - "\x0fadd_allow_rules\x18\x05 \x01(\v2\x1b.openshell.v1.AddAllowRulesH\x00R\raddAllowRules\x12H\n" + - "\rremove_binary\x18\x06 \x01(\v2!.openshell.v1.RemoveNetworkBinaryH\x00R\fremoveBinaryB\v\n" + - "\toperation\"j\n" + - "\x0eAddNetworkRule\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12;\n" + - "\x04rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x04rule\"\\\n" + - "\x15RemoveNetworkEndpoint\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12\x12\n" + - "\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x03 \x01(\rR\x04port\"0\n" + - "\x11RemoveNetworkRule\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\"w\n" + - "\fAddDenyRules\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12?\n" + - "\n" + - "deny_rules\x18\x03 \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\"k\n" + - "\rAddAllowRules\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x122\n" + - "\x05rules\x18\x03 \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\"S\n" + - "\x13RemoveNetworkBinary\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12\x1f\n" + - "\vbinary_path\x18\x02 \x01(\tR\n" + - "binaryPath\"\xaf\x02\n" + - "\x14UpdateConfigResponse\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x12+\n" + - "\x11settings_revision\x18\x03 \x01(\x04R\x10settingsRevision\x12\x18\n" + - "\adeleted\x18\x04 \x01(\bR\adeleted\x12U\n" + - "\vannotations\x18\x05 \x03(\v23.openshell.v1.UpdateConfigResponse.AnnotationsEntryR\vannotations\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x83\x01\n" + - "\x1dGetSandboxPolicyStatusRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x12\x16\n" + - "\x06global\x18\x03 \x01(\bR\x06global\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x88\x01\n" + - "\x1eGetSandboxPolicyStatusResponse\x12?\n" + - "\brevision\x18\x01 \x01(\v2#.openshell.v1.SandboxPolicyRevisionR\brevision\x12%\n" + - "\x0eactive_version\x18\x02 \x01(\rR\ractiveVersion\"\x94\x01\n" + - "\x1aListSandboxPoliciesRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\x12\x16\n" + - "\x06global\x18\x04 \x01(\bR\x06global\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\"`\n" + - "\x1bListSandboxPoliciesResponse\x12A\n" + - "\trevisions\x18\x01 \x03(\v2#.openshell.v1.SandboxPolicyRevisionR\trevisions\"\xa7\x01\n" + - "\x19ReportPolicyStatusRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x122\n" + - "\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" + - "\n" + - "load_error\x18\x04 \x01(\tR\tloadError\"\x1c\n" + - "\x1aReportPolicyStatusResponse\"\xbc\x03\n" + - "\x15SandboxPolicyRevision\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x122\n" + - "\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" + - "\n" + - "load_error\x18\x04 \x01(\tR\tloadError\x12\"\n" + - "\rcreated_at_ms\x18\x05 \x01(\x03R\vcreatedAtMs\x12 \n" + - "\floaded_at_ms\x18\x06 \x01(\x03R\n" + - "loadedAtMs\x12;\n" + - "\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12S\n" + - "\n" + - "provenance\x18\b \x03(\v23.openshell.v1.SandboxPolicyRevision.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xbc\x01\n" + - "\x15GetSandboxLogsRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x14\n" + - "\x05lines\x18\x02 \x01(\rR\x05lines\x12\x19\n" + - "\bsince_ms\x18\x03 \x01(\x03R\asinceMs\x12\x18\n" + - "\asources\x18\x04 \x03(\tR\asources\x12\x1b\n" + - "\tmin_level\x18\x05 \x01(\tR\bminLevel\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"i\n" + - "\x16PushSandboxLogsRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x120\n" + - "\x04logs\x18\x02 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\"\x19\n" + - "\x17PushSandboxLogsResponse\"m\n" + - "\x16GetSandboxLogsResponse\x120\n" + - "\x04logs\x18\x01 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\x12!\n" + - "\fbuffer_total\x18\x02 \x01(\rR\vbufferTotal\"\xa2\x02\n" + - "\x11SupervisorMessage\x125\n" + - "\x05hello\x18\x01 \x01(\v2\x1d.openshell.v1.SupervisorHelloH\x00R\x05hello\x12A\n" + - "\theartbeat\x18\x02 \x01(\v2!.openshell.v1.SupervisorHeartbeatH\x00R\theartbeat\x12K\n" + - "\x11relay_open_result\x18\x03 \x01(\v2\x1d.openshell.v1.RelayOpenResultH\x00R\x0frelayOpenResult\x12;\n" + - "\vrelay_close\x18\x04 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" + - "relayCloseB\t\n" + - "\apayload\"\xea\x02\n" + - "\x0eGatewayMessage\x12J\n" + - "\x10session_accepted\x18\x01 \x01(\v2\x1d.openshell.v1.SessionAcceptedH\x00R\x0fsessionAccepted\x12J\n" + - "\x10session_rejected\x18\x02 \x01(\v2\x1d.openshell.v1.SessionRejectedH\x00R\x0fsessionRejected\x12>\n" + - "\theartbeat\x18\x03 \x01(\v2\x1e.openshell.v1.GatewayHeartbeatH\x00R\theartbeat\x128\n" + - "\n" + - "relay_open\x18\x04 \x01(\v2\x17.openshell.v1.RelayOpenH\x00R\trelayOpen\x12;\n" + - "\vrelay_close\x18\x05 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" + - "relayCloseB\t\n" + - "\apayload\"Q\n" + - "\x0fSupervisorHello\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" + - "\vinstance_id\x18\x02 \x01(\tR\n" + - "instanceId\"h\n" + - "\x0fSessionAccepted\x12\x1d\n" + - "\n" + - "session_id\x18\x01 \x01(\tR\tsessionId\x126\n" + - "\x17heartbeat_interval_secs\x18\x02 \x01(\rR\x15heartbeatIntervalSecs\")\n" + - "\x0fSessionRejected\x12\x16\n" + - "\x06reason\x18\x01 \x01(\tR\x06reason\"\x15\n" + - "\x13SupervisorHeartbeat\"\x12\n" + - "\x10GatewayHeartbeat\"\xb7\x01\n" + - "\tRelayOpen\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x120\n" + - "\x03ssh\x18\x02 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" + - "\x03tcp\x18\x03 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x12\x1d\n" + - "\n" + - "service_id\x18\x05 \x01(\tR\tserviceIdB\b\n" + - "\x06target\"\x10\n" + - "\x0eSshRelayTarget\"8\n" + - "\x0eTcpRelayTarget\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\"*\n" + - "\tRelayInit\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\"\\\n" + - "\n" + - "RelayFrame\x12-\n" + - "\x04init\x18\x01 \x01(\v2\x17.openshell.v1.RelayInitH\x00R\x04init\x12\x14\n" + - "\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" + - "\apayload\"`\n" + - "\x0fRelayOpenResult\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x12\x18\n" + - "\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" + - "\x05error\x18\x03 \x01(\tR\x05error\"C\n" + - "\n" + - "RelayClose\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x12\x16\n" + - "\x06reason\x18\x02 \x01(\tR\x06reason\"o\n" + - "\x0fL7RequestSample\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x1a\n" + - "\bdecision\x18\x03 \x01(\tR\bdecision\x12\x14\n" + - "\x05count\x18\x04 \x01(\rR\x05count\"\xe5\x04\n" + - "\rDenialSummary\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x12\n" + - "\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x03 \x01(\rR\x04port\x12\x16\n" + - "\x06binary\x18\x04 \x01(\tR\x06binary\x12\x1c\n" + - "\tancestors\x18\x05 \x03(\tR\tancestors\x12\x1f\n" + - "\vdeny_reason\x18\x06 \x01(\tR\n" + - "denyReason\x12\"\n" + - "\rfirst_seen_ms\x18\a \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\b \x01(\x03R\n" + - "lastSeenMs\x12\x14\n" + - "\x05count\x18\t \x01(\rR\x05count\x12)\n" + - "\x10suppressed_count\x18\n" + - " \x01(\rR\x0fsuppressedCount\x12\x1f\n" + - "\vtotal_count\x18\v \x01(\rR\n" + - "totalCount\x12'\n" + - "\x0fsample_cmdlines\x18\f \x03(\tR\x0esampleCmdlines\x12#\n" + - "\rbinary_sha256\x18\r \x01(\tR\fbinarySha256\x12\x1e\n" + - "\n" + - "persistent\x18\x0e \x01(\bR\n" + - "persistent\x12!\n" + - "\fdenial_stage\x18\x0f \x01(\tR\vdenialStage\x12K\n" + - "\x12l7_request_samples\x18\x10 \x03(\v2\x1d.openshell.v1.L7RequestSampleR\x10l7RequestSamples\x120\n" + - "\x14l7_inspection_active\x18\x11 \x01(\bR\x12l7InspectionActive\"T\n" + - "\x10DenialGroupCount\x12\x1d\n" + - "\n" + - "deny_group\x18\x01 \x01(\tR\tdenyGroup\x12!\n" + - "\fdenied_count\x18\x02 \x01(\rR\vdeniedCount\"\xc8\x01\n" + - "\x16NetworkActivitySummary\x124\n" + - "\x16network_activity_count\x18\x01 \x01(\rR\x14networkActivityCount\x12.\n" + - "\x13denied_action_count\x18\x02 \x01(\rR\x11deniedActionCount\x12H\n" + - "\x10denials_by_group\x18\x03 \x03(\v2\x1e.openshell.v1.DenialGroupCountR\x0edenialsByGroup\"\x94\x05\n" + - "\vPolicyChunk\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" + - "\x06status\x18\x02 \x01(\tR\x06status\x12\x1b\n" + - "\trule_name\x18\x03 \x01(\tR\bruleName\x12L\n" + - "\rproposed_rule\x18\x04 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\trationale\x18\x05 \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\x06 \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\a \x01(\x02R\n" + - "confidence\x12,\n" + - "\x12denial_summary_ids\x18\b \x03(\tR\x10denialSummaryIds\x12\"\n" + - "\rcreated_at_ms\x18\t \x01(\x03R\vcreatedAtMs\x12\"\n" + - "\rdecided_at_ms\x18\n" + - " \x01(\x03R\vdecidedAtMs\x12\x14\n" + - "\x05stage\x18\v \x01(\tR\x05stage\x12.\n" + - "\x13supersedes_chunk_id\x18\f \x01(\tR\x11supersedesChunkId\x12\x1b\n" + - "\thit_count\x18\r \x01(\x05R\bhitCount\x12\"\n" + - "\rfirst_seen_ms\x18\x0e \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\x0f \x01(\x03R\n" + - "lastSeenMs\x12\x16\n" + - "\x06binary\x18\x10 \x01(\tR\x06binary\x12+\n" + - "\x11validation_result\x18\x11 \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\x12 \x01(\tR\x0frejectionReason\"\x96\x01\n" + - "\x11DraftPolicyUpdate\x12#\n" + - "\rdraft_version\x18\x01 \x01(\x04R\fdraftVersion\x12\x1d\n" + - "\n" + - "new_chunks\x18\x02 \x01(\rR\tnewChunks\x12#\n" + - "\rtotal_pending\x18\x03 \x01(\rR\ftotalPending\x12\x18\n" + - "\asummary\x18\x04 \x01(\tR\asummary\"\xd7\x02\n" + - "\x1bSubmitPolicyAnalysisRequest\x129\n" + - "\tsummaries\x18\x01 \x03(\v2\x1b.openshell.v1.DenialSummaryR\tsummaries\x12B\n" + - "\x0fproposed_chunks\x18\x02 \x03(\v2\x19.openshell.v1.PolicyChunkR\x0eproposedChunks\x12#\n" + - "\ranalysis_mode\x18\x03 \x01(\tR\fanalysisMode\x12\x12\n" + - "\x04name\x18\x04 \x01(\tR\x04name\x12b\n" + - "\x1anetwork_activity_summaries\x18\x05 \x03(\v2$.openshell.v1.NetworkActivitySummaryR\x18networkActivitySummaries\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"\xcb\x01\n" + - "\x1cSubmitPolicyAnalysisResponse\x12'\n" + - "\x0faccepted_chunks\x18\x01 \x01(\rR\x0eacceptedChunks\x12'\n" + - "\x0frejected_chunks\x18\x02 \x01(\rR\x0erejectedChunks\x12+\n" + - "\x11rejection_reasons\x18\x03 \x03(\tR\x10rejectionReasons\x12,\n" + - "\x12accepted_chunk_ids\x18\x04 \x03(\tR\x10acceptedChunkIds\"n\n" + - "\x15GetDraftPolicyRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12#\n" + - "\rstatus_filter\x18\x02 \x01(\tR\fstatusFilter\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xc8\x01\n" + - "\x16GetDraftPolicyResponse\x121\n" + - "\x06chunks\x18\x01 \x03(\v2\x19.openshell.v1.PolicyChunkR\x06chunks\x12'\n" + - "\x0frolling_summary\x18\x02 \x01(\tR\x0erollingSummary\x12#\n" + - "\rdraft_version\x18\x03 \x01(\x04R\fdraftVersion\x12-\n" + - "\x13last_analyzed_at_ms\x18\x04 \x01(\x03R\x10lastAnalyzedAtMs\"g\n" + - "\x18ApproveDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"c\n" + - "\x19ApproveDraftChunkResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\"~\n" + - "\x17RejectDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x16\n" + - "\x06reason\x18\x03 \x01(\tR\x06reason\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x1a\n" + - "\x18RejectDraftChunkResponse\"\x8a\x01\n" + - "\x1cApproveAllDraftChunksRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x128\n" + - "\x18include_security_flagged\x18\x02 \x01(\bR\x16includeSecurityFlagged\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xb7\x01\n" + - "\x1dApproveAllDraftChunksResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x12'\n" + - "\x0fchunks_approved\x18\x03 \x01(\rR\x0echunksApproved\x12%\n" + - "\x0echunks_skipped\x18\x04 \x01(\rR\rchunksSkipped\"\xb2\x01\n" + - "\x15EditDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12L\n" + - "\rproposed_rule\x18\x03 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x18\n" + - "\x16EditDraftChunkResponse\"d\n" + - "\x15UndoDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"`\n" + - "\x16UndoDraftChunkResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\"K\n" + - "\x17ClearDraftChunksRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"A\n" + - "\x18ClearDraftChunksResponse\x12%\n" + - "\x0echunks_cleared\x18\x01 \x01(\rR\rchunksCleared\"J\n" + - "\x16GetDraftHistoryRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x92\x01\n" + - "\x11DraftHistoryEntry\x12!\n" + - "\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x1d\n" + - "\n" + - "event_type\x18\x02 \x01(\tR\teventType\x12 \n" + - "\vdescription\x18\x03 \x01(\tR\vdescription\x12\x19\n" + - "\bchunk_id\x18\x04 \x01(\tR\achunkId\"T\n" + - "\x17GetDraftHistoryResponse\x129\n" + - "\aentries\x18\x01 \x03(\v2\x1f.openshell.v1.DraftHistoryEntryR\aentries\"\xbd\x02\n" + - "\x15PolicyRevisionPayload\x12;\n" + - "\x06policy\x18\x01 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x12\n" + - "\x04hash\x18\x02 \x01(\tR\x04hash\x12\x1d\n" + - "\n" + - "load_error\x18\x03 \x01(\tR\tloadError\x12 \n" + - "\floaded_at_ms\x18\x04 \x01(\x03R\n" + - "loadedAtMs\x12S\n" + - "\n" + - "provenance\x18\x05 \x03(\v23.openshell.v1.PolicyRevisionPayload.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc4\x03\n" + - "\x11DraftChunkPayload\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12L\n" + - "\rproposed_rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\trationale\x18\x03 \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\x04 \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\x05 \x01(\x02R\n" + - "confidence\x12\"\n" + - "\rdecided_at_ms\x18\x06 \x01(\x03R\vdecidedAtMs\x12\x12\n" + - "\x04host\x18\a \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\b \x01(\x05R\x04port\x12\x16\n" + - "\x06binary\x18\t \x01(\tR\x06binary\x12#\n" + - "\rdraft_version\x18\n" + - " \x01(\x03R\fdraftVersion\x12+\n" + - "\x11validation_result\x18\v \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\f \x01(\tR\x0frejectionReason\"\xe1\x03\n" + - "\x14StoredPolicyRevision\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x03R\aversion\x12%\n" + - "\x0epolicy_payload\x18\x04 \x01(\fR\rpolicyPayload\x12\x1f\n" + - "\vpolicy_hash\x18\x05 \x01(\tR\n" + - "policyHash\x12\x16\n" + - "\x06status\x18\x06 \x01(\tR\x06status\x12\"\n" + - "\n" + - "load_error\x18\a \x01(\tH\x00R\tloadError\x88\x01\x01\x12\"\n" + - "\rcreated_at_ms\x18\b \x01(\x03R\vcreatedAtMs\x12%\n" + - "\floaded_at_ms\x18\t \x01(\x03H\x01R\n" + - "loadedAtMs\x88\x01\x01\x12R\n" + - "\n" + - "provenance\x18\n" + - " \x03(\v22.openshell.v1.StoredPolicyRevision.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\r\n" + - "\v_load_errorB\x0f\n" + - "\r_loaded_at_ms\"\xff\x04\n" + - "\x10StoredDraftChunk\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12#\n" + - "\rdraft_version\x18\x03 \x01(\x03R\fdraftVersion\x12\x16\n" + - "\x06status\x18\x04 \x01(\tR\x06status\x12\x1b\n" + - "\trule_name\x18\x05 \x01(\tR\bruleName\x12#\n" + - "\rproposed_rule\x18\x06 \x01(\fR\fproposedRule\x12\x1c\n" + - "\trationale\x18\a \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\b \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\t \x01(\x01R\n" + - "confidence\x12\"\n" + - "\rcreated_at_ms\x18\n" + - " \x01(\x03R\vcreatedAtMs\x12'\n" + - "\rdecided_at_ms\x18\v \x01(\x03H\x00R\vdecidedAtMs\x88\x01\x01\x12\x12\n" + - "\x04host\x18\f \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\r \x01(\x05R\x04port\x12\x16\n" + - "\x06binary\x18\x0e \x01(\tR\x06binary\x12\x1b\n" + - "\thit_count\x18\x0f \x01(\x05R\bhitCount\x12\"\n" + - "\rfirst_seen_ms\x18\x10 \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\x11 \x01(\x03R\n" + - "lastSeenMs\x12+\n" + - "\x11validation_result\x18\x12 \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\x13 \x01(\tR\x0frejectionReasonB\x10\n" + - "\x0e_decided_at_ms\"\xb1\x01\n" + - "\x16CreateWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12H\n" + - "\x06labels\x18\x02 \x03(\v20.openshell.v1.CreateWorkspaceRequest.LabelsEntryR\x06labels\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"Z\n" + - "\x17CreateWorkspaceResponse\x12?\n" + - "\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\")\n" + - "\x13GetWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\"W\n" + - "\x14GetWorkspaceResponse\x12?\n" + - "\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\"l\n" + - "\x15ListWorkspacesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" + - "\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"[\n" + - "\x16ListWorkspacesResponse\x12A\n" + - "\n" + - "workspaces\x18\x01 \x03(\v2!.openshell.datamodel.v1.WorkspaceR\n" + - "workspaces\",\n" + - "\x16DeleteWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\"3\n" + - "\x17DeleteWorkspaceResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xaf\x01\n" + - "\x0fWorkspaceMember\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" + - "\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"\x97\x01\n" + - "\x19AddWorkspaceMemberRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" + - "\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"S\n" + - "\x1aAddWorkspaceMemberResponse\x125\n" + - "\x06member\x18\x01 \x01(\v2\x1d.openshell.v1.WorkspaceMemberR\x06member\"i\n" + - "\x1cRemoveWorkspaceMemberRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\"9\n" + - "\x1dRemoveWorkspaceMemberResponse\x12\x18\n" + - "\aremoved\x18\x01 \x01(\bR\aremoved\"i\n" + - "\x1bListWorkspaceMembersRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\"W\n" + - "\x1cListWorkspaceMembersResponse\x127\n" + - "\amembers\x18\x01 \x03(\v2\x1d.openshell.v1.WorkspaceMemberR\amembers*\xb6\x01\n" + - "\fSandboxPhase\x12\x1d\n" + - "\x19SANDBOX_PHASE_UNSPECIFIED\x10\x00\x12\x1e\n" + - "\x1aSANDBOX_PHASE_PROVISIONING\x10\x01\x12\x17\n" + - "\x13SANDBOX_PHASE_READY\x10\x02\x12\x17\n" + - "\x13SANDBOX_PHASE_ERROR\x10\x03\x12\x1a\n" + - "\x16SANDBOX_PHASE_DELETING\x10\x04\x12\x19\n" + - "\x15SANDBOX_PHASE_UNKNOWN\x10\x05*\xc3\x03\n" + - "!ProviderCredentialRefreshStrategy\x124\n" + - "0PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED\x10\x00\x12/\n" + - "+PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC\x10\x01\x121\n" + - "-PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL\x10\x02\x12=\n" + - "9PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN\x10\x03\x12B\n" + - ">PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS\x10\x04\x12C\n" + - "?PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT\x10\x05\x12<\n" + - "8PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE\x10\x06*\xdb\x02\n" + - "\x17ProviderProfileCategory\x12)\n" + - "%PROVIDER_PROFILE_CATEGORY_UNSPECIFIED\x10\x00\x12#\n" + - "\x1fPROVIDER_PROFILE_CATEGORY_OTHER\x10\x01\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_INFERENCE\x10\x02\x12#\n" + - "\x1fPROVIDER_PROFILE_CATEGORY_AGENT\x10\x03\x12,\n" + - "(PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL\x10\x04\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_MESSAGING\x10\x05\x12\"\n" + - "\x1ePROVIDER_PROFILE_CATEGORY_DATA\x10\x06\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_KNOWLEDGE\x10\a*\x9a\x01\n" + - "\fPolicyStatus\x12\x1d\n" + - "\x19POLICY_STATUS_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15POLICY_STATUS_PENDING\x10\x01\x12\x18\n" + - "\x14POLICY_STATUS_LOADED\x10\x02\x12\x18\n" + - "\x14POLICY_STATUS_FAILED\x10\x03\x12\x1c\n" + - "\x18POLICY_STATUS_SUPERSEDED\x10\x04*\x86\x01\n" + - "\rServiceStatus\x12\x1e\n" + - "\x1aSERVICE_STATUS_UNSPECIFIED\x10\x00\x12\x1a\n" + - "\x16SERVICE_STATUS_HEALTHY\x10\x01\x12\x1b\n" + - "\x17SERVICE_STATUS_DEGRADED\x10\x02\x12\x1c\n" + - "\x18SERVICE_STATUS_UNHEALTHY\x10\x03*b\n" + - "\rWorkspaceRole\x12\x1e\n" + - "\x1aWORKSPACE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n" + - "\x13WORKSPACE_ROLE_USER\x10\x01\x12\x18\n" + - "\x14WORKSPACE_ROLE_ADMIN\x10\x022\xacB\n" + - "\tOpenShell\x12Z\n" + - "\x06Health\x12\x1b.openshell.v1.HealthRequest\x1a\x1c.openshell.v1.HealthResponse\"\x15\x82\xb5\x18\x11\n" + - "\x0funauthenticated\x12i\n" + - "\x0eGetCurrentUser\x12#.openshell.v1.GetCurrentUserRequest\x1a$.openshell.v1.GetCurrentUserResponse\"\f\x82\xb5\x18\b\n" + - "\x06bearer\x12\x86\x01\n" + - "\x0eGetGatewayInfo\x12#.openshell.v1.GetGatewayInfoRequest\x1a$.openshell.v1.GetGatewayInfoResponse\")\x82\xb5\x18%\n" + - "\x06bearer\x1a\x0eplatform_admin\"\vconfig:read\x12u\n" + - "\rCreateSandbox\x12\".openshell.v1.CreateSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12n\n" + - "\n" + - "GetSandbox\x12\x1f.openshell.v1.GetSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12z\n" + - "\rListSandboxes\x12\".openshell.v1.ListSandboxesRequest\x1a#.openshell.v1.ListSandboxesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x8f\x01\n" + - "\x14ListSandboxProviders\x12).openshell.v1.ListSandboxProvidersRequest\x1a*.openshell.v1.ListSandboxProvidersResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x93\x01\n" + - "\x15AttachSandboxProvider\x12*.openshell.v1.AttachSandboxProviderRequest\x1a+.openshell.v1.AttachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x93\x01\n" + - "\x15DetachSandboxProvider\x12*.openshell.v1.DetachSandboxProviderRequest\x1a+.openshell.v1.DetachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12{\n" + - "\rDeleteSandbox\x12\".openshell.v1.DeleteSandboxRequest\x1a#.openshell.v1.DeleteSandboxResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" + - "\x10CreateSshSession\x12%.openshell.v1.CreateSshSessionRequest\x1a&.openshell.v1.CreateSshSessionResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12}\n" + - "\rExposeService\x12\".openshell.v1.ExposeServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12v\n" + - "\n" + - "GetService\x12\x1f.openshell.v1.GetServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12w\n" + - "\fListServices\x12!.openshell.v1.ListServicesRequest\x1a\".openshell.v1.ListServicesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12{\n" + - "\rDeleteService\x12\".openshell.v1.DeleteServiceRequest\x1a#.openshell.v1.DeleteServiceResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" + - "\x10RevokeSshSession\x12%.openshell.v1.RevokeSshSessionRequest\x1a&.openshell.v1.RevokeSshSessionResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12t\n" + - "\vExecSandbox\x12 .openshell.v1.ExecSandboxRequest\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write0\x01\x12q\n" + - "\n" + - "ForwardTcp\x12\x1d.openshell.v1.TcpForwardFrame\x1a\x1d.openshell.v1.TcpForwardFrame\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12\x7f\n" + - "\x16ExecSandboxInteractive\x12\x1e.openshell.v1.ExecSandboxInput\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12z\n" + - "\x0eCreateProvider\x12#.openshell.v1.CreateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12r\n" + - "\vGetProvider\x12 .openshell.v1.GetProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12{\n" + - "\rListProviders\x12\".openshell.v1.ListProvidersRequest\x1a#.openshell.v1.ListProvidersResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x90\x01\n" + - "\x14ListProviderProfiles\x12).openshell.v1.ListProviderProfilesRequest\x1a*.openshell.v1.ListProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x87\x01\n" + - "\x12GetProviderProfile\x12'.openshell.v1.GetProviderProfileRequest\x1a%.openshell.v1.ProviderProfileResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x98\x01\n" + - "\x16ImportProviderProfiles\x12+.openshell.v1.ImportProviderProfilesRequest\x1a,.openshell.v1.ImportProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x98\x01\n" + - "\x16UpdateProviderProfiles\x12+.openshell.v1.UpdateProviderProfilesRequest\x1a,.openshell.v1.UpdateProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" + - "\x14LintProviderProfiles\x12).openshell.v1.LintProviderProfilesRequest\x1a*.openshell.v1.LintProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12z\n" + - "\x0eUpdateProvider\x12#.openshell.v1.UpdateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9c\x01\n" + - "\x18GetProviderRefreshStatus\x12-.openshell.v1.GetProviderRefreshStatusRequest\x1a..openshell.v1.GetProviderRefreshStatusResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x9e\x01\n" + - "\x18ConfigureProviderRefresh\x12-.openshell.v1.ConfigureProviderRefreshRequest\x1a..openshell.v1.ConfigureProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9e\x01\n" + - "\x18RotateProviderCredential\x12-.openshell.v1.RotateProviderCredentialRequest\x1a..openshell.v1.RotateProviderCredentialResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" + - "\x15DeleteProviderRefresh\x12*.openshell.v1.DeleteProviderRefreshRequest\x1a+.openshell.v1.DeleteProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x80\x01\n" + - "\x0eDeleteProvider\x12#.openshell.v1.DeleteProviderRequest\x1a$.openshell.v1.DeleteProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" + - "\x15DeleteProviderProfile\x12*.openshell.v1.DeleteProviderProfileRequest\x1a+.openshell.v1.DeleteProviderProfileResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" + - "\x10GetSandboxConfig\x12-.openshell.sandbox.v1.GetSandboxConfigRequest\x1a..openshell.sandbox.v1.GetSandboxConfigResponse\"\x1d\x82\xb5\x18\x19\n" + - "\x04dual\x12\x04user\"\vconfig:read\x12\x8c\x01\n" + - "\x10GetGatewayConfig\x12-.openshell.sandbox.v1.GetGatewayConfigRequest\x1a..openshell.sandbox.v1.GetGatewayConfigResponse\"\x19\x82\xb5\x18\x15\n" + - "\x06bearer\"\vconfig:read\x12v\n" + - "\fUpdateConfig\x12!.openshell.v1.UpdateConfigRequest\x1a\".openshell.v1.UpdateConfigResponse\"\x1f\x82\xb5\x18\x1b\n" + - "\x04dual\x12\x05admin\"\fconfig:write\x12\x95\x01\n" + - "\x16GetSandboxPolicyStatus\x12+.openshell.v1.GetSandboxPolicyStatusRequest\x1a,.openshell.v1.GetSandboxPolicyStatusResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x8c\x01\n" + - "\x13ListSandboxPolicies\x12(.openshell.v1.ListSandboxPoliciesRequest\x1a).openshell.v1.ListSandboxPoliciesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12v\n" + - "\x12ReportPolicyStatus\x12'.openshell.v1.ReportPolicyStatusRequest\x1a(.openshell.v1.ReportPolicyStatusResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x97\x01\n" + - "\x1dGetSandboxProviderEnvironment\x122.openshell.v1.GetSandboxProviderEnvironmentRequest\x1a3.openshell.v1.GetSandboxProviderEnvironmentResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12}\n" + - "\x0eGetSandboxLogs\x12#.openshell.v1.GetSandboxLogsRequest\x1a$.openshell.v1.GetSandboxLogsResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12o\n" + - "\x0fPushSandboxLogs\x12$.openshell.v1.PushSandboxLogsRequest\x1a%.openshell.v1.PushSandboxLogsResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x01\x12e\n" + - "\x11ConnectSupervisor\x12\x1f.openshell.v1.SupervisorMessage\x1a\x1c.openshell.v1.GatewayMessage\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x010\x01\x12T\n" + - "\vRelayStream\x12\x18.openshell.v1.RelayFrame\x1a\x18.openshell.v1.RelayFrame\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x010\x01\x12w\n" + - "\fWatchSandbox\x12!.openshell.v1.WatchSandboxRequest\x1a .openshell.v1.SandboxStreamEvent\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read0\x01\x12|\n" + - "\x14SubmitPolicyAnalysis\x12).openshell.v1.SubmitPolicyAnalysisRequest\x1a*.openshell.v1.SubmitPolicyAnalysisResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12z\n" + - "\x0eGetDraftPolicy\x12#.openshell.v1.GetDraftPolicyRequest\x1a$.openshell.v1.GetDraftPolicyResponse\"\x1d\x82\xb5\x18\x19\n" + - "\x04dual\x12\x04user\"\vconfig:read\x12\x87\x01\n" + - "\x11ApproveDraftChunk\x12&.openshell.v1.ApproveDraftChunkRequest\x1a'.openshell.v1.ApproveDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" + - "\x10RejectDraftChunk\x12%.openshell.v1.RejectDraftChunkRequest\x1a&.openshell.v1.RejectDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x93\x01\n" + - "\x15ApproveAllDraftChunks\x12*.openshell.v1.ApproveAllDraftChunksRequest\x1a+.openshell.v1.ApproveAllDraftChunksResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" + - "\x0eEditDraftChunk\x12#.openshell.v1.EditDraftChunkRequest\x1a$.openshell.v1.EditDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" + - "\x0eUndoDraftChunk\x12#.openshell.v1.UndoDraftChunkRequest\x1a$.openshell.v1.UndoDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" + - "\x10ClearDraftChunks\x12%.openshell.v1.ClearDraftChunksRequest\x1a&.openshell.v1.ClearDraftChunksResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x7f\n" + - "\x0fGetDraftHistory\x12$.openshell.v1.GetDraftHistoryRequest\x1a%.openshell.v1.GetDraftHistoryResponse\"\x1f\x82\xb5\x18\x1b\n" + - "\x06bearer\x12\x04user\"\vconfig:read\x12s\n" + - "\x11IssueSandboxToken\x12&.openshell.v1.IssueSandboxTokenRequest\x1a'.openshell.v1.IssueSandboxTokenResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12y\n" + - "\x13RefreshSandboxToken\x12(.openshell.v1.RefreshSandboxTokenRequest\x1a).openshell.v1.RefreshSandboxTokenResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x8d\x01\n" + - "\x0fCreateWorkspace\x12$.openshell.v1.CreateWorkspaceRequest\x1a%.openshell.v1.CreateWorkspaceResponse\"-\x82\xb5\x18)\n" + - "\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12y\n" + - "\fGetWorkspace\x12!.openshell.v1.GetWorkspaceRequest\x1a\".openshell.v1.GetWorkspaceResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x7f\n" + - "\x0eListWorkspaces\x12#.openshell.v1.ListWorkspacesRequest\x1a$.openshell.v1.ListWorkspacesResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x8d\x01\n" + - "\x0fDeleteWorkspace\x12$.openshell.v1.DeleteWorkspaceRequest\x1a%.openshell.v1.DeleteWorkspaceResponse\"-\x82\xb5\x18)\n" + - "\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12\x8d\x01\n" + - "\x12AddWorkspaceMember\x12'.openshell.v1.AddWorkspaceMemberRequest\x1a(.openshell.v1.AddWorkspaceMemberResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x96\x01\n" + - "\x15RemoveWorkspaceMember\x12*.openshell.v1.RemoveWorkspaceMemberRequest\x1a+.openshell.v1.RemoveWorkspaceMemberResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x91\x01\n" + - "\x14ListWorkspaceMembers\x12).openshell.v1.ListWorkspaceMembersRequest\x1a*.openshell.v1.ListWorkspaceMembersResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:readb\x06proto3" - -var ( - file_openshell_proto_rawDescOnce sync.Once - file_openshell_proto_rawDescData []byte -) - -func file_openshell_proto_rawDescGZIP() []byte { - file_openshell_proto_rawDescOnce.Do(func() { - file_openshell_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc))) - }) - return file_openshell_proto_rawDescData -} - -var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 6) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 203) -var file_openshell_proto_goTypes = []any{ - (SandboxPhase)(0), // 0: openshell.v1.SandboxPhase - (ProviderCredentialRefreshStrategy)(0), // 1: openshell.v1.ProviderCredentialRefreshStrategy - (ProviderProfileCategory)(0), // 2: openshell.v1.ProviderProfileCategory - (PolicyStatus)(0), // 3: openshell.v1.PolicyStatus - (ServiceStatus)(0), // 4: openshell.v1.ServiceStatus - (WorkspaceRole)(0), // 5: openshell.v1.WorkspaceRole - (*IssueSandboxTokenRequest)(nil), // 6: openshell.v1.IssueSandboxTokenRequest - (*IssueSandboxTokenResponse)(nil), // 7: openshell.v1.IssueSandboxTokenResponse - (*RefreshSandboxTokenRequest)(nil), // 8: openshell.v1.RefreshSandboxTokenRequest - (*RefreshSandboxTokenResponse)(nil), // 9: openshell.v1.RefreshSandboxTokenResponse - (*HealthRequest)(nil), // 10: openshell.v1.HealthRequest - (*HealthResponse)(nil), // 11: openshell.v1.HealthResponse - (*GetCurrentUserRequest)(nil), // 12: openshell.v1.GetCurrentUserRequest - (*GetCurrentUserResponse)(nil), // 13: openshell.v1.GetCurrentUserResponse - (*GetGatewayInfoRequest)(nil), // 14: openshell.v1.GetGatewayInfoRequest - (*GetGatewayInfoResponse)(nil), // 15: openshell.v1.GetGatewayInfoResponse - (*ComputeDriverInfo)(nil), // 16: openshell.v1.ComputeDriverInfo - (*ComputeDriverCapabilities)(nil), // 17: openshell.v1.ComputeDriverCapabilities - (*Sandbox)(nil), // 18: openshell.v1.Sandbox - (*SandboxSpec)(nil), // 19: openshell.v1.SandboxSpec - (*ResourceRequirements)(nil), // 20: openshell.v1.ResourceRequirements - (*GpuResourceRequirements)(nil), // 21: openshell.v1.GpuResourceRequirements - (*SandboxTemplate)(nil), // 22: openshell.v1.SandboxTemplate - (*SandboxStatus)(nil), // 23: openshell.v1.SandboxStatus - (*SandboxCondition)(nil), // 24: openshell.v1.SandboxCondition - (*PlatformEvent)(nil), // 25: openshell.v1.PlatformEvent - (*CreateSandboxRequest)(nil), // 26: openshell.v1.CreateSandboxRequest - (*GetSandboxRequest)(nil), // 27: openshell.v1.GetSandboxRequest - (*ListSandboxesRequest)(nil), // 28: openshell.v1.ListSandboxesRequest - (*ListSandboxProvidersRequest)(nil), // 29: openshell.v1.ListSandboxProvidersRequest - (*AttachSandboxProviderRequest)(nil), // 30: openshell.v1.AttachSandboxProviderRequest - (*DetachSandboxProviderRequest)(nil), // 31: openshell.v1.DetachSandboxProviderRequest - (*DeleteSandboxRequest)(nil), // 32: openshell.v1.DeleteSandboxRequest - (*SandboxResponse)(nil), // 33: openshell.v1.SandboxResponse - (*ListSandboxesResponse)(nil), // 34: openshell.v1.ListSandboxesResponse - (*ListSandboxProvidersResponse)(nil), // 35: openshell.v1.ListSandboxProvidersResponse - (*AttachSandboxProviderResponse)(nil), // 36: openshell.v1.AttachSandboxProviderResponse - (*DetachSandboxProviderResponse)(nil), // 37: openshell.v1.DetachSandboxProviderResponse - (*DeleteSandboxResponse)(nil), // 38: openshell.v1.DeleteSandboxResponse - (*CreateSshSessionRequest)(nil), // 39: openshell.v1.CreateSshSessionRequest - (*CreateSshSessionResponse)(nil), // 40: openshell.v1.CreateSshSessionResponse - (*ExposeServiceRequest)(nil), // 41: openshell.v1.ExposeServiceRequest - (*GetServiceRequest)(nil), // 42: openshell.v1.GetServiceRequest - (*ListServicesRequest)(nil), // 43: openshell.v1.ListServicesRequest - (*ListServicesResponse)(nil), // 44: openshell.v1.ListServicesResponse - (*DeleteServiceRequest)(nil), // 45: openshell.v1.DeleteServiceRequest - (*DeleteServiceResponse)(nil), // 46: openshell.v1.DeleteServiceResponse - (*ServiceEndpoint)(nil), // 47: openshell.v1.ServiceEndpoint - (*ServiceEndpointResponse)(nil), // 48: openshell.v1.ServiceEndpointResponse - (*RevokeSshSessionRequest)(nil), // 49: openshell.v1.RevokeSshSessionRequest - (*RevokeSshSessionResponse)(nil), // 50: openshell.v1.RevokeSshSessionResponse - (*ExecSandboxRequest)(nil), // 51: openshell.v1.ExecSandboxRequest - (*ExecSandboxStdout)(nil), // 52: openshell.v1.ExecSandboxStdout - (*ExecSandboxStderr)(nil), // 53: openshell.v1.ExecSandboxStderr - (*ExecSandboxExit)(nil), // 54: openshell.v1.ExecSandboxExit - (*ExecSandboxEvent)(nil), // 55: openshell.v1.ExecSandboxEvent - (*TcpForwardInit)(nil), // 56: openshell.v1.TcpForwardInit - (*TcpForwardFrame)(nil), // 57: openshell.v1.TcpForwardFrame - (*ExecSandboxInput)(nil), // 58: openshell.v1.ExecSandboxInput - (*ExecSandboxWindowResize)(nil), // 59: openshell.v1.ExecSandboxWindowResize - (*SshSession)(nil), // 60: openshell.v1.SshSession - (*WatchSandboxRequest)(nil), // 61: openshell.v1.WatchSandboxRequest - (*SandboxStreamEvent)(nil), // 62: openshell.v1.SandboxStreamEvent - (*SandboxLogLine)(nil), // 63: openshell.v1.SandboxLogLine - (*SandboxStreamWarning)(nil), // 64: openshell.v1.SandboxStreamWarning - (*CreateProviderRequest)(nil), // 65: openshell.v1.CreateProviderRequest - (*GetProviderRequest)(nil), // 66: openshell.v1.GetProviderRequest - (*ListProvidersRequest)(nil), // 67: openshell.v1.ListProvidersRequest - (*UpdateProviderRequest)(nil), // 68: openshell.v1.UpdateProviderRequest - (*DeleteProviderRequest)(nil), // 69: openshell.v1.DeleteProviderRequest - (*ProviderResponse)(nil), // 70: openshell.v1.ProviderResponse - (*ListProvidersResponse)(nil), // 71: openshell.v1.ListProvidersResponse - (*ListProviderProfilesRequest)(nil), // 72: openshell.v1.ListProviderProfilesRequest - (*GetProviderProfileRequest)(nil), // 73: openshell.v1.GetProviderProfileRequest - (*ProviderProfileImportItem)(nil), // 74: openshell.v1.ProviderProfileImportItem - (*ProviderProfileDiagnostic)(nil), // 75: openshell.v1.ProviderProfileDiagnostic - (*ProviderCredentialTokenGrantAudienceOverride)(nil), // 76: openshell.v1.ProviderCredentialTokenGrantAudienceOverride - (*ProviderCredentialTokenGrant)(nil), // 77: openshell.v1.ProviderCredentialTokenGrant - (*ProviderProfileCredential)(nil), // 78: openshell.v1.ProviderProfileCredential - (*ProviderCredentialRefreshMaterial)(nil), // 79: openshell.v1.ProviderCredentialRefreshMaterial - (*ProviderCredentialRefreshOutput)(nil), // 80: openshell.v1.ProviderCredentialRefreshOutput - (*ProviderCredentialRefresh)(nil), // 81: openshell.v1.ProviderCredentialRefresh - (*ProviderCredentialRefreshStatus)(nil), // 82: openshell.v1.ProviderCredentialRefreshStatus - (*ProviderProfileDiscovery)(nil), // 83: openshell.v1.ProviderProfileDiscovery - (*StoredProviderCredentialRefreshState)(nil), // 84: openshell.v1.StoredProviderCredentialRefreshState - (*GetProviderRefreshStatusRequest)(nil), // 85: openshell.v1.GetProviderRefreshStatusRequest - (*GetProviderRefreshStatusResponse)(nil), // 86: openshell.v1.GetProviderRefreshStatusResponse - (*ConfigureProviderRefreshRequest)(nil), // 87: openshell.v1.ConfigureProviderRefreshRequest - (*ConfigureProviderRefreshResponse)(nil), // 88: openshell.v1.ConfigureProviderRefreshResponse - (*RotateProviderCredentialRequest)(nil), // 89: openshell.v1.RotateProviderCredentialRequest - (*RotateProviderCredentialResponse)(nil), // 90: openshell.v1.RotateProviderCredentialResponse - (*DeleteProviderRefreshRequest)(nil), // 91: openshell.v1.DeleteProviderRefreshRequest - (*DeleteProviderRefreshResponse)(nil), // 92: openshell.v1.DeleteProviderRefreshResponse - (*ProviderProfile)(nil), // 93: openshell.v1.ProviderProfile - (*StoredProviderProfile)(nil), // 94: openshell.v1.StoredProviderProfile - (*ProviderProfileResponse)(nil), // 95: openshell.v1.ProviderProfileResponse - (*ListProviderProfilesResponse)(nil), // 96: openshell.v1.ListProviderProfilesResponse - (*ImportProviderProfilesRequest)(nil), // 97: openshell.v1.ImportProviderProfilesRequest - (*ImportProviderProfilesResponse)(nil), // 98: openshell.v1.ImportProviderProfilesResponse - (*UpdateProviderProfilesRequest)(nil), // 99: openshell.v1.UpdateProviderProfilesRequest - (*UpdateProviderProfilesResponse)(nil), // 100: openshell.v1.UpdateProviderProfilesResponse - (*LintProviderProfilesRequest)(nil), // 101: openshell.v1.LintProviderProfilesRequest - (*LintProviderProfilesResponse)(nil), // 102: openshell.v1.LintProviderProfilesResponse - (*DeleteProviderResponse)(nil), // 103: openshell.v1.DeleteProviderResponse - (*DeleteProviderProfileRequest)(nil), // 104: openshell.v1.DeleteProviderProfileRequest - (*DeleteProviderProfileResponse)(nil), // 105: openshell.v1.DeleteProviderProfileResponse - (*GetSandboxProviderEnvironmentRequest)(nil), // 106: openshell.v1.GetSandboxProviderEnvironmentRequest - (*GetSandboxProviderEnvironmentResponse)(nil), // 107: openshell.v1.GetSandboxProviderEnvironmentResponse - (*UpdateConfigRequest)(nil), // 108: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 109: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 110: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 111: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 112: openshell.v1.RemoveNetworkRule - (*AddDenyRules)(nil), // 113: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 114: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 115: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 116: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 117: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 118: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 119: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 120: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 121: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 122: openshell.v1.ReportPolicyStatusResponse - (*SandboxPolicyRevision)(nil), // 123: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 124: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 125: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 126: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 127: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 128: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 129: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 130: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 131: openshell.v1.SessionAccepted - (*SessionRejected)(nil), // 132: openshell.v1.SessionRejected - (*SupervisorHeartbeat)(nil), // 133: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 134: openshell.v1.GatewayHeartbeat - (*RelayOpen)(nil), // 135: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 136: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 137: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 138: openshell.v1.RelayInit - (*RelayFrame)(nil), // 139: openshell.v1.RelayFrame - (*RelayOpenResult)(nil), // 140: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 141: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 142: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 143: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 144: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 145: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 146: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 147: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 148: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 149: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 150: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 151: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 152: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 153: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 154: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 155: openshell.v1.RejectDraftChunkResponse - (*ApproveAllDraftChunksRequest)(nil), // 156: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 157: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 158: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 159: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 160: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 161: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 162: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 163: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 164: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 165: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 166: openshell.v1.GetDraftHistoryResponse - (*PolicyRevisionPayload)(nil), // 167: openshell.v1.PolicyRevisionPayload - (*DraftChunkPayload)(nil), // 168: openshell.v1.DraftChunkPayload - (*StoredPolicyRevision)(nil), // 169: openshell.v1.StoredPolicyRevision - (*StoredDraftChunk)(nil), // 170: openshell.v1.StoredDraftChunk - (*CreateWorkspaceRequest)(nil), // 171: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 172: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 173: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 174: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 175: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 176: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 177: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 178: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 179: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 180: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 181: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 182: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 183: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 184: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 185: openshell.v1.ListWorkspaceMembersResponse - nil, // 186: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 187: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 188: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 189: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 190: openshell.v1.PlatformEvent.MetadataEntry - nil, // 191: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 192: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 193: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 194: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 195: openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry - nil, // 196: openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry - nil, // 197: openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry - nil, // 198: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 199: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 200: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 201: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry - nil, // 202: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 203: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 204: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 205: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 206: openshell.v1.PolicyRevisionPayload.ProvenanceEntry - nil, // 207: openshell.v1.StoredPolicyRevision.ProvenanceEntry - nil, // 208: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*datamodelv1.ObjectMeta)(nil), // 209: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 210: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 211: google.protobuf.Struct - (*datamodelv1.Provider)(nil), // 212: openshell.datamodel.v1.Provider - (*sandboxv1.NetworkEndpoint)(nil), // 213: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 214: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 215: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 216: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 217: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 218: openshell.sandbox.v1.L7Rule - (*datamodelv1.Workspace)(nil), // 219: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 220: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 221: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 222: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 223: openshell.sandbox.v1.GetGatewayConfigResponse -} -var file_openshell_proto_depIdxs = []int32{ - 4, // 0: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus - 4, // 1: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus - 16, // 2: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo - 17, // 3: openshell.v1.ComputeDriverInfo.capabilities:type_name -> openshell.v1.ComputeDriverCapabilities - 209, // 4: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 19, // 5: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec - 23, // 6: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus - 186, // 7: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry - 22, // 8: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 210, // 9: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 20, // 10: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements - 21, // 11: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 187, // 12: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 188, // 13: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 189, // 14: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 211, // 15: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 211, // 16: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 24, // 17: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition - 0, // 18: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 190, // 19: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 19, // 20: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 191, // 21: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 192, // 22: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 18, // 23: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 18, // 24: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 212, // 25: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 18, // 26: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox - 18, // 27: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox - 48, // 28: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 209, // 29: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 47, // 30: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint - 193, // 31: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 52, // 32: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout - 53, // 33: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr - 54, // 34: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 136, // 35: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 137, // 36: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget - 56, // 37: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit - 51, // 38: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest - 59, // 39: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 209, // 40: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 18, // 41: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox - 63, // 42: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine - 25, // 43: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent - 64, // 44: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 147, // 45: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 194, // 46: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 212, // 47: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 212, // 48: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 195, // 49: openshell.v1.UpdateProviderRequest.credential_expires_at_ms:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry - 212, // 50: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider - 212, // 51: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 93, // 52: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 76, // 53: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride - 81, // 54: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh - 77, // 55: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant - 1, // 56: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 79, // 57: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial - 80, // 58: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput - 1, // 59: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 209, // 60: openshell.v1.StoredProviderCredentialRefreshState.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 1, // 61: openshell.v1.StoredProviderCredentialRefreshState.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 196, // 62: openshell.v1.StoredProviderCredentialRefreshState.material:type_name -> openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry - 197, // 63: openshell.v1.StoredProviderCredentialRefreshState.additional_output_keys:type_name -> openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry - 82, // 64: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 1, // 65: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 198, // 66: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 82, // 67: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 82, // 68: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 2, // 69: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory - 78, // 70: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 213, // 71: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 214, // 72: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 83, // 73: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 199, // 74: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry - 209, // 75: openshell.v1.StoredProviderProfile.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 93, // 76: openshell.v1.StoredProviderProfile.profile:type_name -> openshell.v1.ProviderProfile - 93, // 77: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile - 93, // 78: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 74, // 79: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 80: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 93, // 81: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 74, // 82: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 83: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 93, // 84: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 74, // 85: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 86: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 200, // 87: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 201, // 88: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expires_at_ms:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry - 202, // 89: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 210, // 90: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 215, // 91: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 109, // 92: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 203, // 93: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 110, // 94: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 111, // 95: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 112, // 96: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 113, // 97: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 114, // 98: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 115, // 99: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 216, // 100: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 217, // 101: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 218, // 102: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 204, // 103: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 123, // 104: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 123, // 105: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 3, // 106: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 3, // 107: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 210, // 108: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 205, // 109: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 63, // 110: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 63, // 111: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 130, // 112: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 133, // 113: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 140, // 114: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 141, // 115: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 131, // 116: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 132, // 117: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 134, // 118: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 135, // 119: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 141, // 120: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 136, // 121: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 137, // 122: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 138, // 123: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 142, // 124: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 144, // 125: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 216, // 126: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 143, // 127: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 146, // 128: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 145, // 129: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 146, // 130: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 216, // 131: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 165, // 132: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 210, // 133: openshell.v1.PolicyRevisionPayload.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 206, // 134: openshell.v1.PolicyRevisionPayload.provenance:type_name -> openshell.v1.PolicyRevisionPayload.ProvenanceEntry - 216, // 135: openshell.v1.DraftChunkPayload.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 207, // 136: openshell.v1.StoredPolicyRevision.provenance:type_name -> openshell.v1.StoredPolicyRevision.ProvenanceEntry - 208, // 137: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 219, // 138: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 219, // 139: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 219, // 140: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 209, // 141: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 5, // 142: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 5, // 143: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 179, // 144: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 179, // 145: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 78, // 146: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 10, // 147: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 12, // 148: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 14, // 149: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 26, // 150: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 27, // 151: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 28, // 152: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 29, // 153: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 30, // 154: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 31, // 155: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 32, // 156: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 39, // 157: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 41, // 158: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 42, // 159: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 43, // 160: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 45, // 161: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 49, // 162: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 51, // 163: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 57, // 164: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 58, // 165: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 65, // 166: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 66, // 167: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 67, // 168: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 72, // 169: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 73, // 170: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 97, // 171: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 99, // 172: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 101, // 173: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 68, // 174: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 85, // 175: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 87, // 176: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 89, // 177: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 91, // 178: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 69, // 179: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 104, // 180: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 220, // 181: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 221, // 182: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 108, // 183: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 117, // 184: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 119, // 185: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 121, // 186: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 106, // 187: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 124, // 188: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 125, // 189: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 128, // 190: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 139, // 191: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 61, // 192: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 148, // 193: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 150, // 194: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 152, // 195: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 154, // 196: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 156, // 197: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 158, // 198: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 160, // 199: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 162, // 200: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 164, // 201: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 6, // 202: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 8, // 203: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 171, // 204: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 173, // 205: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 175, // 206: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 177, // 207: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 180, // 208: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 182, // 209: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 184, // 210: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 11, // 211: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 13, // 212: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 15, // 213: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 33, // 214: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 33, // 215: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 34, // 216: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 35, // 217: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 36, // 218: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 37, // 219: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 38, // 220: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 40, // 221: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 48, // 222: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 48, // 223: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 44, // 224: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 46, // 225: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 50, // 226: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 55, // 227: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 57, // 228: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 55, // 229: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 70, // 230: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 70, // 231: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 71, // 232: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 96, // 233: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 95, // 234: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 98, // 235: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 100, // 236: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 102, // 237: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 70, // 238: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 86, // 239: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 88, // 240: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 90, // 241: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 92, // 242: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 103, // 243: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 105, // 244: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 222, // 245: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 223, // 246: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 116, // 247: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 118, // 248: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 120, // 249: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 122, // 250: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 107, // 251: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 127, // 252: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 126, // 253: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 129, // 254: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 139, // 255: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 62, // 256: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 149, // 257: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 151, // 258: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 153, // 259: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 155, // 260: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 157, // 261: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 159, // 262: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 161, // 263: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 163, // 264: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 166, // 265: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 7, // 266: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 9, // 267: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 172, // 268: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 174, // 269: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 176, // 270: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 178, // 271: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 181, // 272: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 183, // 273: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 185, // 274: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 211, // [211:275] is the sub-list for method output_type - 147, // [147:211] is the sub-list for method input_type - 147, // [147:147] is the sub-list for extension type_name - 147, // [147:147] is the sub-list for extension extendee - 0, // [0:147] is the sub-list for field type_name -} - -func init() { file_openshell_proto_init() } -func file_openshell_proto_init() { - if File_openshell_proto != nil { - return - } - file_openshell_proto_msgTypes[15].OneofWrappers = []any{} - file_openshell_proto_msgTypes[16].OneofWrappers = []any{} - file_openshell_proto_msgTypes[49].OneofWrappers = []any{ - (*ExecSandboxEvent_Stdout)(nil), - (*ExecSandboxEvent_Stderr)(nil), - (*ExecSandboxEvent_Exit)(nil), - } - file_openshell_proto_msgTypes[50].OneofWrappers = []any{ - (*TcpForwardInit_Ssh)(nil), - (*TcpForwardInit_Tcp)(nil), - } - file_openshell_proto_msgTypes[51].OneofWrappers = []any{ - (*TcpForwardFrame_Init)(nil), - (*TcpForwardFrame_Data)(nil), - } - file_openshell_proto_msgTypes[52].OneofWrappers = []any{ - (*ExecSandboxInput_Start)(nil), - (*ExecSandboxInput_Stdin)(nil), - (*ExecSandboxInput_Resize)(nil), - } - file_openshell_proto_msgTypes[56].OneofWrappers = []any{ - (*SandboxStreamEvent_Sandbox)(nil), - (*SandboxStreamEvent_Log)(nil), - (*SandboxStreamEvent_Event)(nil), - (*SandboxStreamEvent_Warning)(nil), - (*SandboxStreamEvent_DraftPolicyUpdate)(nil), - } - file_openshell_proto_msgTypes[81].OneofWrappers = []any{} - file_openshell_proto_msgTypes[103].OneofWrappers = []any{ - (*PolicyMergeOperation_AddRule)(nil), - (*PolicyMergeOperation_RemoveEndpoint)(nil), - (*PolicyMergeOperation_RemoveRule)(nil), - (*PolicyMergeOperation_AddDenyRules)(nil), - (*PolicyMergeOperation_AddAllowRules)(nil), - (*PolicyMergeOperation_RemoveBinary)(nil), - } - file_openshell_proto_msgTypes[122].OneofWrappers = []any{ - (*SupervisorMessage_Hello)(nil), - (*SupervisorMessage_Heartbeat)(nil), - (*SupervisorMessage_RelayOpenResult)(nil), - (*SupervisorMessage_RelayClose)(nil), - } - file_openshell_proto_msgTypes[123].OneofWrappers = []any{ - (*GatewayMessage_SessionAccepted)(nil), - (*GatewayMessage_SessionRejected)(nil), - (*GatewayMessage_Heartbeat)(nil), - (*GatewayMessage_RelayOpen)(nil), - (*GatewayMessage_RelayClose)(nil), - } - file_openshell_proto_msgTypes[129].OneofWrappers = []any{ - (*RelayOpen_Ssh)(nil), - (*RelayOpen_Tcp)(nil), - } - file_openshell_proto_msgTypes[133].OneofWrappers = []any{ - (*RelayFrame_Init)(nil), - (*RelayFrame_Data)(nil), - } - file_openshell_proto_msgTypes[163].OneofWrappers = []any{} - file_openshell_proto_msgTypes[164].OneofWrappers = []any{} - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), - NumEnums: 6, - NumMessages: 203, - NumExtensions: 0, - NumServices: 1, - }, - GoTypes: file_openshell_proto_goTypes, - DependencyIndexes: file_openshell_proto_depIdxs, - EnumInfos: file_openshell_proto_enumTypes, - MessageInfos: file_openshell_proto_msgTypes, - }.Build() - File_openshell_proto = out.File - file_openshell_proto_goTypes = nil - file_openshell_proto_depIdxs = nil -} diff --git a/backend/gen/openshellv1/openshell_grpc.pb.go b/backend/gen/openshellv1/openshell_grpc.pb.go deleted file mode 100644 index 6c6b7574..00000000 --- a/backend/gen/openshellv1/openshell_grpc.pb.go +++ /dev/null @@ -1,2719 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go-grpc. DO NOT EDIT. -// versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 -// source: openshell.proto - -package openshellv1 - -import ( - context "context" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" - grpc "google.golang.org/grpc" - codes "google.golang.org/grpc/codes" - status "google.golang.org/grpc/status" -) - -// This is a compile-time assertion to ensure that this generated file -// is compatible with the grpc package it is being compiled against. -// Requires gRPC-Go v1.64.0 or later. -const _ = grpc.SupportPackageIsVersion9 - -const ( - OpenShell_Health_FullMethodName = "/openshell.v1.OpenShell/Health" - OpenShell_GetCurrentUser_FullMethodName = "/openshell.v1.OpenShell/GetCurrentUser" - OpenShell_GetGatewayInfo_FullMethodName = "/openshell.v1.OpenShell/GetGatewayInfo" - OpenShell_CreateSandbox_FullMethodName = "/openshell.v1.OpenShell/CreateSandbox" - OpenShell_GetSandbox_FullMethodName = "/openshell.v1.OpenShell/GetSandbox" - OpenShell_ListSandboxes_FullMethodName = "/openshell.v1.OpenShell/ListSandboxes" - OpenShell_ListSandboxProviders_FullMethodName = "/openshell.v1.OpenShell/ListSandboxProviders" - OpenShell_AttachSandboxProvider_FullMethodName = "/openshell.v1.OpenShell/AttachSandboxProvider" - OpenShell_DetachSandboxProvider_FullMethodName = "/openshell.v1.OpenShell/DetachSandboxProvider" - OpenShell_DeleteSandbox_FullMethodName = "/openshell.v1.OpenShell/DeleteSandbox" - OpenShell_CreateSshSession_FullMethodName = "/openshell.v1.OpenShell/CreateSshSession" - OpenShell_ExposeService_FullMethodName = "/openshell.v1.OpenShell/ExposeService" - OpenShell_GetService_FullMethodName = "/openshell.v1.OpenShell/GetService" - OpenShell_ListServices_FullMethodName = "/openshell.v1.OpenShell/ListServices" - OpenShell_DeleteService_FullMethodName = "/openshell.v1.OpenShell/DeleteService" - OpenShell_RevokeSshSession_FullMethodName = "/openshell.v1.OpenShell/RevokeSshSession" - OpenShell_ExecSandbox_FullMethodName = "/openshell.v1.OpenShell/ExecSandbox" - OpenShell_ForwardTcp_FullMethodName = "/openshell.v1.OpenShell/ForwardTcp" - OpenShell_ExecSandboxInteractive_FullMethodName = "/openshell.v1.OpenShell/ExecSandboxInteractive" - OpenShell_CreateProvider_FullMethodName = "/openshell.v1.OpenShell/CreateProvider" - OpenShell_GetProvider_FullMethodName = "/openshell.v1.OpenShell/GetProvider" - OpenShell_ListProviders_FullMethodName = "/openshell.v1.OpenShell/ListProviders" - OpenShell_ListProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/ListProviderProfiles" - OpenShell_GetProviderProfile_FullMethodName = "/openshell.v1.OpenShell/GetProviderProfile" - OpenShell_ImportProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/ImportProviderProfiles" - OpenShell_UpdateProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/UpdateProviderProfiles" - OpenShell_LintProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/LintProviderProfiles" - OpenShell_UpdateProvider_FullMethodName = "/openshell.v1.OpenShell/UpdateProvider" - OpenShell_GetProviderRefreshStatus_FullMethodName = "/openshell.v1.OpenShell/GetProviderRefreshStatus" - OpenShell_ConfigureProviderRefresh_FullMethodName = "/openshell.v1.OpenShell/ConfigureProviderRefresh" - OpenShell_RotateProviderCredential_FullMethodName = "/openshell.v1.OpenShell/RotateProviderCredential" - OpenShell_DeleteProviderRefresh_FullMethodName = "/openshell.v1.OpenShell/DeleteProviderRefresh" - OpenShell_DeleteProvider_FullMethodName = "/openshell.v1.OpenShell/DeleteProvider" - OpenShell_DeleteProviderProfile_FullMethodName = "/openshell.v1.OpenShell/DeleteProviderProfile" - OpenShell_GetSandboxConfig_FullMethodName = "/openshell.v1.OpenShell/GetSandboxConfig" - OpenShell_GetGatewayConfig_FullMethodName = "/openshell.v1.OpenShell/GetGatewayConfig" - OpenShell_UpdateConfig_FullMethodName = "/openshell.v1.OpenShell/UpdateConfig" - OpenShell_GetSandboxPolicyStatus_FullMethodName = "/openshell.v1.OpenShell/GetSandboxPolicyStatus" - OpenShell_ListSandboxPolicies_FullMethodName = "/openshell.v1.OpenShell/ListSandboxPolicies" - OpenShell_ReportPolicyStatus_FullMethodName = "/openshell.v1.OpenShell/ReportPolicyStatus" - OpenShell_GetSandboxProviderEnvironment_FullMethodName = "/openshell.v1.OpenShell/GetSandboxProviderEnvironment" - OpenShell_GetSandboxLogs_FullMethodName = "/openshell.v1.OpenShell/GetSandboxLogs" - OpenShell_PushSandboxLogs_FullMethodName = "/openshell.v1.OpenShell/PushSandboxLogs" - OpenShell_ConnectSupervisor_FullMethodName = "/openshell.v1.OpenShell/ConnectSupervisor" - OpenShell_RelayStream_FullMethodName = "/openshell.v1.OpenShell/RelayStream" - OpenShell_WatchSandbox_FullMethodName = "/openshell.v1.OpenShell/WatchSandbox" - OpenShell_SubmitPolicyAnalysis_FullMethodName = "/openshell.v1.OpenShell/SubmitPolicyAnalysis" - OpenShell_GetDraftPolicy_FullMethodName = "/openshell.v1.OpenShell/GetDraftPolicy" - OpenShell_ApproveDraftChunk_FullMethodName = "/openshell.v1.OpenShell/ApproveDraftChunk" - OpenShell_RejectDraftChunk_FullMethodName = "/openshell.v1.OpenShell/RejectDraftChunk" - OpenShell_ApproveAllDraftChunks_FullMethodName = "/openshell.v1.OpenShell/ApproveAllDraftChunks" - OpenShell_EditDraftChunk_FullMethodName = "/openshell.v1.OpenShell/EditDraftChunk" - OpenShell_UndoDraftChunk_FullMethodName = "/openshell.v1.OpenShell/UndoDraftChunk" - OpenShell_ClearDraftChunks_FullMethodName = "/openshell.v1.OpenShell/ClearDraftChunks" - OpenShell_GetDraftHistory_FullMethodName = "/openshell.v1.OpenShell/GetDraftHistory" - OpenShell_IssueSandboxToken_FullMethodName = "/openshell.v1.OpenShell/IssueSandboxToken" - OpenShell_RefreshSandboxToken_FullMethodName = "/openshell.v1.OpenShell/RefreshSandboxToken" - OpenShell_CreateWorkspace_FullMethodName = "/openshell.v1.OpenShell/CreateWorkspace" - OpenShell_GetWorkspace_FullMethodName = "/openshell.v1.OpenShell/GetWorkspace" - OpenShell_ListWorkspaces_FullMethodName = "/openshell.v1.OpenShell/ListWorkspaces" - OpenShell_DeleteWorkspace_FullMethodName = "/openshell.v1.OpenShell/DeleteWorkspace" - OpenShell_AddWorkspaceMember_FullMethodName = "/openshell.v1.OpenShell/AddWorkspaceMember" - OpenShell_RemoveWorkspaceMember_FullMethodName = "/openshell.v1.OpenShell/RemoveWorkspaceMember" - OpenShell_ListWorkspaceMembers_FullMethodName = "/openshell.v1.OpenShell/ListWorkspaceMembers" -) - -// OpenShellClient is the client API for OpenShell service. -// -// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. -// -// OpenShell service provides sandbox, provider, and runtime management capabilities. -// -// Conventions: -// - This file owns the public API resource model exposed to OpenShell clients. -// - `Sandbox`, `SandboxSpec`, `SandboxStatus`, and `SandboxPhase` are gateway-owned -// public types. Internal compute drivers must not import or return them directly. -// - The gateway translates internal compute-driver observations into these public -// resource messages before persisting or returning them to clients. -type OpenShellClient interface { - // Check the health of the service. - Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) - // Return the authenticated caller identity established by the gateway. - GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error) - // Fetch elevated live gateway runtime metadata. - GetGatewayInfo(ctx context.Context, in *GetGatewayInfoRequest, opts ...grpc.CallOption) (*GetGatewayInfoResponse, error) - // Create a new sandbox. - CreateSandbox(ctx context.Context, in *CreateSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) - // Fetch a sandbox by name. - GetSandbox(ctx context.Context, in *GetSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) - // List sandboxes. - ListSandboxes(ctx context.Context, in *ListSandboxesRequest, opts ...grpc.CallOption) (*ListSandboxesResponse, error) - // List provider records attached to a sandbox. - ListSandboxProviders(ctx context.Context, in *ListSandboxProvidersRequest, opts ...grpc.CallOption) (*ListSandboxProvidersResponse, error) - // Attach a provider record to an existing sandbox. - AttachSandboxProvider(ctx context.Context, in *AttachSandboxProviderRequest, opts ...grpc.CallOption) (*AttachSandboxProviderResponse, error) - // Detach a provider record from an existing sandbox. - DetachSandboxProvider(ctx context.Context, in *DetachSandboxProviderRequest, opts ...grpc.CallOption) (*DetachSandboxProviderResponse, error) - // Delete a sandbox by name. - DeleteSandbox(ctx context.Context, in *DeleteSandboxRequest, opts ...grpc.CallOption) (*DeleteSandboxResponse, error) - // Create a short-lived SSH session for a sandbox. - CreateSshSession(ctx context.Context, in *CreateSshSessionRequest, opts ...grpc.CallOption) (*CreateSshSessionResponse, error) - // Create or update a sandbox HTTP service endpoint for local routing. - ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) - // Fetch one sandbox HTTP service endpoint. - GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) - // List sandbox HTTP service endpoints. - ListServices(ctx context.Context, in *ListServicesRequest, opts ...grpc.CallOption) (*ListServicesResponse, error) - // Delete one sandbox HTTP service endpoint. - DeleteService(ctx context.Context, in *DeleteServiceRequest, opts ...grpc.CallOption) (*DeleteServiceResponse, error) - // Revoke a previously issued SSH session. - RevokeSshSession(ctx context.Context, in *RevokeSshSessionRequest, opts ...grpc.CallOption) (*RevokeSshSessionResponse, error) - // Execute a command in a ready sandbox and stream output. - ExecSandbox(ctx context.Context, in *ExecSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExecSandboxEvent], error) - // Forward one CLI-side TCP connection to a loopback TCP target in a sandbox. - ForwardTcp(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame], error) - // Execute an interactive command with bidirectional stdin/stdout streaming. - // The first client message MUST carry an ExecSandboxInput with the start - // variant. Subsequent messages carry stdin bytes or window resize events. - ExecSandboxInteractive(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent], error) - // Create a provider. - CreateProvider(ctx context.Context, in *CreateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // Fetch a provider by name. - GetProvider(ctx context.Context, in *GetProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // List providers. - ListProviders(ctx context.Context, in *ListProvidersRequest, opts ...grpc.CallOption) (*ListProvidersResponse, error) - // List available provider type profiles. - ListProviderProfiles(ctx context.Context, in *ListProviderProfilesRequest, opts ...grpc.CallOption) (*ListProviderProfilesResponse, error) - // Fetch one provider type profile by id. - GetProviderProfile(ctx context.Context, in *GetProviderProfileRequest, opts ...grpc.CallOption) (*ProviderProfileResponse, error) - // Import custom provider type profiles. - ImportProviderProfiles(ctx context.Context, in *ImportProviderProfilesRequest, opts ...grpc.CallOption) (*ImportProviderProfilesResponse, error) - // Update an existing custom provider type profile. - UpdateProviderProfiles(ctx context.Context, in *UpdateProviderProfilesRequest, opts ...grpc.CallOption) (*UpdateProviderProfilesResponse, error) - // Validate provider type profiles without registering them. - LintProviderProfiles(ctx context.Context, in *LintProviderProfilesRequest, opts ...grpc.CallOption) (*LintProviderProfilesResponse, error) - // Update an existing provider by name. - UpdateProvider(ctx context.Context, in *UpdateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // Fetch refresh status for one provider or provider credential. - GetProviderRefreshStatus(ctx context.Context, in *GetProviderRefreshStatusRequest, opts ...grpc.CallOption) (*GetProviderRefreshStatusResponse, error) - // Configure gateway-owned refresh material for one provider credential. - ConfigureProviderRefresh(ctx context.Context, in *ConfigureProviderRefreshRequest, opts ...grpc.CallOption) (*ConfigureProviderRefreshResponse, error) - // Record a gateway-owned refresh request for one provider credential. - RotateProviderCredential(ctx context.Context, in *RotateProviderCredentialRequest, opts ...grpc.CallOption) (*RotateProviderCredentialResponse, error) - // Delete gateway-owned refresh configuration for one provider credential. - DeleteProviderRefresh(ctx context.Context, in *DeleteProviderRefreshRequest, opts ...grpc.CallOption) (*DeleteProviderRefreshResponse, error) - // Delete a provider by name. - DeleteProvider(ctx context.Context, in *DeleteProviderRequest, opts ...grpc.CallOption) (*DeleteProviderResponse, error) - // Delete a custom provider type profile by id. - DeleteProviderProfile(ctx context.Context, in *DeleteProviderProfileRequest, opts ...grpc.CallOption) (*DeleteProviderProfileResponse, error) - // Get sandbox settings by id (called by sandbox entrypoint and poll loop). - GetSandboxConfig(ctx context.Context, in *sandboxv1.GetSandboxConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetSandboxConfigResponse, error) - // Get gateway-global settings (read-only feature flags; any authenticated - // user may read these so the CLI and TUI can discover capabilities like - // providers_v2_enabled without requiring Platform Admin). - // - // Scope-only (no role): scopes are granted by the IdP at token issuance, - // orthogonal to workspace membership. Deployments that enable scope - // enforcement configure the IdP to grant config:read (or openshell:all) - // to all sandbox users, so this does not block least-privilege flows. - GetGatewayConfig(ctx context.Context, in *sandboxv1.GetGatewayConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetGatewayConfigResponse, error) - // Update settings or policy at sandbox or global scope. - UpdateConfig(ctx context.Context, in *UpdateConfigRequest, opts ...grpc.CallOption) (*UpdateConfigResponse, error) - // Get the load status of a specific policy version. - GetSandboxPolicyStatus(ctx context.Context, in *GetSandboxPolicyStatusRequest, opts ...grpc.CallOption) (*GetSandboxPolicyStatusResponse, error) - // List policy history for a sandbox. - ListSandboxPolicies(ctx context.Context, in *ListSandboxPoliciesRequest, opts ...grpc.CallOption) (*ListSandboxPoliciesResponse, error) - // Report policy load result (called by sandbox after reload attempt). - ReportPolicyStatus(ctx context.Context, in *ReportPolicyStatusRequest, opts ...grpc.CallOption) (*ReportPolicyStatusResponse, error) - // Get provider environment for a sandbox (called by sandbox supervisor at startup). - GetSandboxProviderEnvironment(ctx context.Context, in *GetSandboxProviderEnvironmentRequest, opts ...grpc.CallOption) (*GetSandboxProviderEnvironmentResponse, error) - // Fetch recent sandbox logs (one-shot). - GetSandboxLogs(ctx context.Context, in *GetSandboxLogsRequest, opts ...grpc.CallOption) (*GetSandboxLogsResponse, error) - // Push sandbox supervisor logs to the server (client-streaming). - PushSandboxLogs(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse], error) - // Persistent supervisor-to-gateway session (bidirectional streaming). - // - // The supervisor opens this stream at startup and keeps it alive for the - // sandbox lifetime. The gateway uses it to coordinate relay channels for - // SSH connect, ExecSandbox, and targetable sandbox services. Raw service - // bytes flow over RelayStream calls (separate HTTP/2 streams on the same - // connection), not over this stream. - ConnectSupervisor(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage], error) - // Raw byte relay between supervisor and gateway. - // - // The supervisor initiates this call after receiving a RelayOpen message - // on its ConnectSupervisor stream. The first RelayFrame carries a - // RelayInit with the channel_id to associate the new HTTP/2 stream with - // the pending relay slot on the gateway. Subsequent frames carry raw bytes in either - // direction between the gateway-side waiter (ForwardTcp / exec handler) - // and the supervisor-side target bridge. - // - // This rides the same TCP+TLS+HTTP/2 connection as ConnectSupervisor — - // no new TLS handshake, no reverse HTTP CONNECT. - RelayStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[RelayFrame, RelayFrame], error) - // Watch a sandbox and stream updates. - // - // This stream can include: - // - Sandbox status snapshots (phase/status) - // - OpenShell server process logs correlated by sandbox_id - // - Platform events correlated to the sandbox - WatchSandbox(ctx context.Context, in *WatchSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SandboxStreamEvent], error) - // Submit denial analysis results from sandbox (summaries + proposed chunks). - SubmitPolicyAnalysis(ctx context.Context, in *SubmitPolicyAnalysisRequest, opts ...grpc.CallOption) (*SubmitPolicyAnalysisResponse, error) - // Get draft policy recommendations for a sandbox. - GetDraftPolicy(ctx context.Context, in *GetDraftPolicyRequest, opts ...grpc.CallOption) (*GetDraftPolicyResponse, error) - // Approve a single draft policy chunk (merges into active policy). - ApproveDraftChunk(ctx context.Context, in *ApproveDraftChunkRequest, opts ...grpc.CallOption) (*ApproveDraftChunkResponse, error) - // Reject a single draft policy chunk. - RejectDraftChunk(ctx context.Context, in *RejectDraftChunkRequest, opts ...grpc.CallOption) (*RejectDraftChunkResponse, error) - // Approve all pending draft chunks (skips security-flagged unless forced). - ApproveAllDraftChunks(ctx context.Context, in *ApproveAllDraftChunksRequest, opts ...grpc.CallOption) (*ApproveAllDraftChunksResponse, error) - // Edit a pending draft chunk in-place (e.g. narrow allowed_ips). - EditDraftChunk(ctx context.Context, in *EditDraftChunkRequest, opts ...grpc.CallOption) (*EditDraftChunkResponse, error) - // Reverse an approval (remove merged rule from active policy). - UndoDraftChunk(ctx context.Context, in *UndoDraftChunkRequest, opts ...grpc.CallOption) (*UndoDraftChunkResponse, error) - // Clear all pending draft chunks for a sandbox. - ClearDraftChunks(ctx context.Context, in *ClearDraftChunksRequest, opts ...grpc.CallOption) (*ClearDraftChunksResponse, error) - // Get decision history for a sandbox's draft policy. - GetDraftHistory(ctx context.Context, in *GetDraftHistoryRequest, opts ...grpc.CallOption) (*GetDraftHistoryResponse, error) - // Exchange a sandbox-bootstrap credential (e.g. a Kubernetes projected - // ServiceAccount token) for a gateway-minted JWT bound to the calling - // sandbox's UUID. Used by the Kubernetes driver path; singleplayer - // drivers receive the gateway JWT directly from the create-sandbox flow - // and never call this RPC. - IssueSandboxToken(ctx context.Context, in *IssueSandboxTokenRequest, opts ...grpc.CallOption) (*IssueSandboxTokenResponse, error) - // Renew the calling sandbox's gateway JWT. Older tokens remain valid - // until their own expiry; deployments should keep token TTLs short to - // bound replay exposure. The supervisor calls this from a background - // task at ~80% of the token's lifetime; the new token is cached in - // memory only — the on-disk bootstrap file is intentionally not - // rewritten. - RefreshSandboxToken(ctx context.Context, in *RefreshSandboxTokenRequest, opts ...grpc.CallOption) (*RefreshSandboxTokenResponse, error) - // Create a workspace. - CreateWorkspace(ctx context.Context, in *CreateWorkspaceRequest, opts ...grpc.CallOption) (*CreateWorkspaceResponse, error) - // Fetch a workspace by name. - GetWorkspace(ctx context.Context, in *GetWorkspaceRequest, opts ...grpc.CallOption) (*GetWorkspaceResponse, error) - // List workspaces. - ListWorkspaces(ctx context.Context, in *ListWorkspacesRequest, opts ...grpc.CallOption) (*ListWorkspacesResponse, error) - // Delete a workspace by name. - DeleteWorkspace(ctx context.Context, in *DeleteWorkspaceRequest, opts ...grpc.CallOption) (*DeleteWorkspaceResponse, error) - // Add a member to a workspace. - AddWorkspaceMember(ctx context.Context, in *AddWorkspaceMemberRequest, opts ...grpc.CallOption) (*AddWorkspaceMemberResponse, error) - // Remove a member from a workspace. - RemoveWorkspaceMember(ctx context.Context, in *RemoveWorkspaceMemberRequest, opts ...grpc.CallOption) (*RemoveWorkspaceMemberResponse, error) - // List members of a workspace. - ListWorkspaceMembers(ctx context.Context, in *ListWorkspaceMembersRequest, opts ...grpc.CallOption) (*ListWorkspaceMembersResponse, error) -} - -type openShellClient struct { - cc grpc.ClientConnInterface -} - -func NewOpenShellClient(cc grpc.ClientConnInterface) OpenShellClient { - return &openShellClient{cc} -} - -func (c *openShellClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(HealthResponse) - err := c.cc.Invoke(ctx, OpenShell_Health_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetCurrentUserResponse) - err := c.cc.Invoke(ctx, OpenShell_GetCurrentUser_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetGatewayInfo(ctx context.Context, in *GetGatewayInfoRequest, opts ...grpc.CallOption) (*GetGatewayInfoResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetGatewayInfoResponse) - err := c.cc.Invoke(ctx, OpenShell_GetGatewayInfo_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateSandbox(ctx context.Context, in *CreateSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandbox(ctx context.Context, in *GetSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxes(ctx context.Context, in *ListSandboxesRequest, opts ...grpc.CallOption) (*ListSandboxesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxes_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxProviders(ctx context.Context, in *ListSandboxProvidersRequest, opts ...grpc.CallOption) (*ListSandboxProvidersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxProvidersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxProviders_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) AttachSandboxProvider(ctx context.Context, in *AttachSandboxProviderRequest, opts ...grpc.CallOption) (*AttachSandboxProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(AttachSandboxProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_AttachSandboxProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DetachSandboxProvider(ctx context.Context, in *DetachSandboxProviderRequest, opts ...grpc.CallOption) (*DetachSandboxProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DetachSandboxProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_DetachSandboxProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteSandbox(ctx context.Context, in *DeleteSandboxRequest, opts ...grpc.CallOption) (*DeleteSandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteSandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateSshSession(ctx context.Context, in *CreateSshSessionRequest, opts ...grpc.CallOption) (*CreateSshSessionResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(CreateSshSessionResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateSshSession_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ServiceEndpointResponse) - err := c.cc.Invoke(ctx, OpenShell_ExposeService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ServiceEndpointResponse) - err := c.cc.Invoke(ctx, OpenShell_GetService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListServices(ctx context.Context, in *ListServicesRequest, opts ...grpc.CallOption) (*ListServicesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListServicesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListServices_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteService(ctx context.Context, in *DeleteServiceRequest, opts ...grpc.CallOption) (*DeleteServiceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteServiceResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RevokeSshSession(ctx context.Context, in *RevokeSshSessionRequest, opts ...grpc.CallOption) (*RevokeSshSessionResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RevokeSshSessionResponse) - err := c.cc.Invoke(ctx, OpenShell_RevokeSshSession_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ExecSandbox(ctx context.Context, in *ExecSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExecSandboxEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[0], OpenShell_ExecSandbox_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[ExecSandboxRequest, ExecSandboxEvent]{ClientStream: stream} - if err := x.ClientStream.SendMsg(in); err != nil { - return nil, err - } - if err := x.ClientStream.CloseSend(); err != nil { - return nil, err - } - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxClient = grpc.ServerStreamingClient[ExecSandboxEvent] - -func (c *openShellClient) ForwardTcp(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[1], OpenShell_ForwardTcp_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[TcpForwardFrame, TcpForwardFrame]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ForwardTcpClient = grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame] - -func (c *openShellClient) ExecSandboxInteractive(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[2], OpenShell_ExecSandboxInteractive_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[ExecSandboxInput, ExecSandboxEvent]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxInteractiveClient = grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent] - -func (c *openShellClient) CreateProvider(ctx context.Context, in *CreateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProvider(ctx context.Context, in *GetProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListProviders(ctx context.Context, in *ListProvidersRequest, opts ...grpc.CallOption) (*ListProvidersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListProvidersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListProviders_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListProviderProfiles(ctx context.Context, in *ListProviderProfilesRequest, opts ...grpc.CallOption) (*ListProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProviderProfile(ctx context.Context, in *GetProviderProfileRequest, opts ...grpc.CallOption) (*ProviderProfileResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderProfileResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProviderProfile_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ImportProviderProfiles(ctx context.Context, in *ImportProviderProfilesRequest, opts ...grpc.CallOption) (*ImportProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ImportProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_ImportProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateProviderProfiles(ctx context.Context, in *UpdateProviderProfilesRequest, opts ...grpc.CallOption) (*UpdateProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UpdateProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) LintProviderProfiles(ctx context.Context, in *LintProviderProfilesRequest, opts ...grpc.CallOption) (*LintProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(LintProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_LintProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateProvider(ctx context.Context, in *UpdateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProviderRefreshStatus(ctx context.Context, in *GetProviderRefreshStatusRequest, opts ...grpc.CallOption) (*GetProviderRefreshStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetProviderRefreshStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProviderRefreshStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ConfigureProviderRefresh(ctx context.Context, in *ConfigureProviderRefreshRequest, opts ...grpc.CallOption) (*ConfigureProviderRefreshResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ConfigureProviderRefreshResponse) - err := c.cc.Invoke(ctx, OpenShell_ConfigureProviderRefresh_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RotateProviderCredential(ctx context.Context, in *RotateProviderCredentialRequest, opts ...grpc.CallOption) (*RotateProviderCredentialResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RotateProviderCredentialResponse) - err := c.cc.Invoke(ctx, OpenShell_RotateProviderCredential_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProviderRefresh(ctx context.Context, in *DeleteProviderRefreshRequest, opts ...grpc.CallOption) (*DeleteProviderRefreshResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderRefreshResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProviderRefresh_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProvider(ctx context.Context, in *DeleteProviderRequest, opts ...grpc.CallOption) (*DeleteProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProviderProfile(ctx context.Context, in *DeleteProviderProfileRequest, opts ...grpc.CallOption) (*DeleteProviderProfileResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderProfileResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProviderProfile_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxConfig(ctx context.Context, in *sandboxv1.GetSandboxConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetSandboxConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(sandboxv1.GetSandboxConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetGatewayConfig(ctx context.Context, in *sandboxv1.GetGatewayConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetGatewayConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(sandboxv1.GetGatewayConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_GetGatewayConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateConfig(ctx context.Context, in *UpdateConfigRequest, opts ...grpc.CallOption) (*UpdateConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UpdateConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxPolicyStatus(ctx context.Context, in *GetSandboxPolicyStatusRequest, opts ...grpc.CallOption) (*GetSandboxPolicyStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxPolicyStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxPolicyStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxPolicies(ctx context.Context, in *ListSandboxPoliciesRequest, opts ...grpc.CallOption) (*ListSandboxPoliciesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxPoliciesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxPolicies_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ReportPolicyStatus(ctx context.Context, in *ReportPolicyStatusRequest, opts ...grpc.CallOption) (*ReportPolicyStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ReportPolicyStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_ReportPolicyStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxProviderEnvironment(ctx context.Context, in *GetSandboxProviderEnvironmentRequest, opts ...grpc.CallOption) (*GetSandboxProviderEnvironmentResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxProviderEnvironmentResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxProviderEnvironment_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxLogs(ctx context.Context, in *GetSandboxLogsRequest, opts ...grpc.CallOption) (*GetSandboxLogsResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxLogsResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxLogs_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) PushSandboxLogs(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[3], OpenShell_PushSandboxLogs_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[PushSandboxLogsRequest, PushSandboxLogsResponse]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_PushSandboxLogsClient = grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse] - -func (c *openShellClient) ConnectSupervisor(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[4], OpenShell_ConnectSupervisor_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[SupervisorMessage, GatewayMessage]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ConnectSupervisorClient = grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage] - -func (c *openShellClient) RelayStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[RelayFrame, RelayFrame], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[5], OpenShell_RelayStream_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[RelayFrame, RelayFrame]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_RelayStreamClient = grpc.BidiStreamingClient[RelayFrame, RelayFrame] - -func (c *openShellClient) WatchSandbox(ctx context.Context, in *WatchSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SandboxStreamEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[6], OpenShell_WatchSandbox_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[WatchSandboxRequest, SandboxStreamEvent]{ClientStream: stream} - if err := x.ClientStream.SendMsg(in); err != nil { - return nil, err - } - if err := x.ClientStream.CloseSend(); err != nil { - return nil, err - } - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_WatchSandboxClient = grpc.ServerStreamingClient[SandboxStreamEvent] - -func (c *openShellClient) SubmitPolicyAnalysis(ctx context.Context, in *SubmitPolicyAnalysisRequest, opts ...grpc.CallOption) (*SubmitPolicyAnalysisResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SubmitPolicyAnalysisResponse) - err := c.cc.Invoke(ctx, OpenShell_SubmitPolicyAnalysis_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetDraftPolicy(ctx context.Context, in *GetDraftPolicyRequest, opts ...grpc.CallOption) (*GetDraftPolicyResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetDraftPolicyResponse) - err := c.cc.Invoke(ctx, OpenShell_GetDraftPolicy_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ApproveDraftChunk(ctx context.Context, in *ApproveDraftChunkRequest, opts ...grpc.CallOption) (*ApproveDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ApproveDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_ApproveDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RejectDraftChunk(ctx context.Context, in *RejectDraftChunkRequest, opts ...grpc.CallOption) (*RejectDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RejectDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_RejectDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ApproveAllDraftChunks(ctx context.Context, in *ApproveAllDraftChunksRequest, opts ...grpc.CallOption) (*ApproveAllDraftChunksResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ApproveAllDraftChunksResponse) - err := c.cc.Invoke(ctx, OpenShell_ApproveAllDraftChunks_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) EditDraftChunk(ctx context.Context, in *EditDraftChunkRequest, opts ...grpc.CallOption) (*EditDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(EditDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_EditDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UndoDraftChunk(ctx context.Context, in *UndoDraftChunkRequest, opts ...grpc.CallOption) (*UndoDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UndoDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_UndoDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ClearDraftChunks(ctx context.Context, in *ClearDraftChunksRequest, opts ...grpc.CallOption) (*ClearDraftChunksResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ClearDraftChunksResponse) - err := c.cc.Invoke(ctx, OpenShell_ClearDraftChunks_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetDraftHistory(ctx context.Context, in *GetDraftHistoryRequest, opts ...grpc.CallOption) (*GetDraftHistoryResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetDraftHistoryResponse) - err := c.cc.Invoke(ctx, OpenShell_GetDraftHistory_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) IssueSandboxToken(ctx context.Context, in *IssueSandboxTokenRequest, opts ...grpc.CallOption) (*IssueSandboxTokenResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(IssueSandboxTokenResponse) - err := c.cc.Invoke(ctx, OpenShell_IssueSandboxToken_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RefreshSandboxToken(ctx context.Context, in *RefreshSandboxTokenRequest, opts ...grpc.CallOption) (*RefreshSandboxTokenResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RefreshSandboxTokenResponse) - err := c.cc.Invoke(ctx, OpenShell_RefreshSandboxToken_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateWorkspace(ctx context.Context, in *CreateWorkspaceRequest, opts ...grpc.CallOption) (*CreateWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(CreateWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetWorkspace(ctx context.Context, in *GetWorkspaceRequest, opts ...grpc.CallOption) (*GetWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_GetWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListWorkspaces(ctx context.Context, in *ListWorkspacesRequest, opts ...grpc.CallOption) (*ListWorkspacesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListWorkspacesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListWorkspaces_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteWorkspace(ctx context.Context, in *DeleteWorkspaceRequest, opts ...grpc.CallOption) (*DeleteWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) AddWorkspaceMember(ctx context.Context, in *AddWorkspaceMemberRequest, opts ...grpc.CallOption) (*AddWorkspaceMemberResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(AddWorkspaceMemberResponse) - err := c.cc.Invoke(ctx, OpenShell_AddWorkspaceMember_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RemoveWorkspaceMember(ctx context.Context, in *RemoveWorkspaceMemberRequest, opts ...grpc.CallOption) (*RemoveWorkspaceMemberResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RemoveWorkspaceMemberResponse) - err := c.cc.Invoke(ctx, OpenShell_RemoveWorkspaceMember_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListWorkspaceMembers(ctx context.Context, in *ListWorkspaceMembersRequest, opts ...grpc.CallOption) (*ListWorkspaceMembersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListWorkspaceMembersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListWorkspaceMembers_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -// OpenShellServer is the server API for OpenShell service. -// All implementations must embed UnimplementedOpenShellServer -// for forward compatibility. -// -// OpenShell service provides sandbox, provider, and runtime management capabilities. -// -// Conventions: -// - This file owns the public API resource model exposed to OpenShell clients. -// - `Sandbox`, `SandboxSpec`, `SandboxStatus`, and `SandboxPhase` are gateway-owned -// public types. Internal compute drivers must not import or return them directly. -// - The gateway translates internal compute-driver observations into these public -// resource messages before persisting or returning them to clients. -type OpenShellServer interface { - // Check the health of the service. - Health(context.Context, *HealthRequest) (*HealthResponse, error) - // Return the authenticated caller identity established by the gateway. - GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error) - // Fetch elevated live gateway runtime metadata. - GetGatewayInfo(context.Context, *GetGatewayInfoRequest) (*GetGatewayInfoResponse, error) - // Create a new sandbox. - CreateSandbox(context.Context, *CreateSandboxRequest) (*SandboxResponse, error) - // Fetch a sandbox by name. - GetSandbox(context.Context, *GetSandboxRequest) (*SandboxResponse, error) - // List sandboxes. - ListSandboxes(context.Context, *ListSandboxesRequest) (*ListSandboxesResponse, error) - // List provider records attached to a sandbox. - ListSandboxProviders(context.Context, *ListSandboxProvidersRequest) (*ListSandboxProvidersResponse, error) - // Attach a provider record to an existing sandbox. - AttachSandboxProvider(context.Context, *AttachSandboxProviderRequest) (*AttachSandboxProviderResponse, error) - // Detach a provider record from an existing sandbox. - DetachSandboxProvider(context.Context, *DetachSandboxProviderRequest) (*DetachSandboxProviderResponse, error) - // Delete a sandbox by name. - DeleteSandbox(context.Context, *DeleteSandboxRequest) (*DeleteSandboxResponse, error) - // Create a short-lived SSH session for a sandbox. - CreateSshSession(context.Context, *CreateSshSessionRequest) (*CreateSshSessionResponse, error) - // Create or update a sandbox HTTP service endpoint for local routing. - ExposeService(context.Context, *ExposeServiceRequest) (*ServiceEndpointResponse, error) - // Fetch one sandbox HTTP service endpoint. - GetService(context.Context, *GetServiceRequest) (*ServiceEndpointResponse, error) - // List sandbox HTTP service endpoints. - ListServices(context.Context, *ListServicesRequest) (*ListServicesResponse, error) - // Delete one sandbox HTTP service endpoint. - DeleteService(context.Context, *DeleteServiceRequest) (*DeleteServiceResponse, error) - // Revoke a previously issued SSH session. - RevokeSshSession(context.Context, *RevokeSshSessionRequest) (*RevokeSshSessionResponse, error) - // Execute a command in a ready sandbox and stream output. - ExecSandbox(*ExecSandboxRequest, grpc.ServerStreamingServer[ExecSandboxEvent]) error - // Forward one CLI-side TCP connection to a loopback TCP target in a sandbox. - ForwardTcp(grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame]) error - // Execute an interactive command with bidirectional stdin/stdout streaming. - // The first client message MUST carry an ExecSandboxInput with the start - // variant. Subsequent messages carry stdin bytes or window resize events. - ExecSandboxInteractive(grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent]) error - // Create a provider. - CreateProvider(context.Context, *CreateProviderRequest) (*ProviderResponse, error) - // Fetch a provider by name. - GetProvider(context.Context, *GetProviderRequest) (*ProviderResponse, error) - // List providers. - ListProviders(context.Context, *ListProvidersRequest) (*ListProvidersResponse, error) - // List available provider type profiles. - ListProviderProfiles(context.Context, *ListProviderProfilesRequest) (*ListProviderProfilesResponse, error) - // Fetch one provider type profile by id. - GetProviderProfile(context.Context, *GetProviderProfileRequest) (*ProviderProfileResponse, error) - // Import custom provider type profiles. - ImportProviderProfiles(context.Context, *ImportProviderProfilesRequest) (*ImportProviderProfilesResponse, error) - // Update an existing custom provider type profile. - UpdateProviderProfiles(context.Context, *UpdateProviderProfilesRequest) (*UpdateProviderProfilesResponse, error) - // Validate provider type profiles without registering them. - LintProviderProfiles(context.Context, *LintProviderProfilesRequest) (*LintProviderProfilesResponse, error) - // Update an existing provider by name. - UpdateProvider(context.Context, *UpdateProviderRequest) (*ProviderResponse, error) - // Fetch refresh status for one provider or provider credential. - GetProviderRefreshStatus(context.Context, *GetProviderRefreshStatusRequest) (*GetProviderRefreshStatusResponse, error) - // Configure gateway-owned refresh material for one provider credential. - ConfigureProviderRefresh(context.Context, *ConfigureProviderRefreshRequest) (*ConfigureProviderRefreshResponse, error) - // Record a gateway-owned refresh request for one provider credential. - RotateProviderCredential(context.Context, *RotateProviderCredentialRequest) (*RotateProviderCredentialResponse, error) - // Delete gateway-owned refresh configuration for one provider credential. - DeleteProviderRefresh(context.Context, *DeleteProviderRefreshRequest) (*DeleteProviderRefreshResponse, error) - // Delete a provider by name. - DeleteProvider(context.Context, *DeleteProviderRequest) (*DeleteProviderResponse, error) - // Delete a custom provider type profile by id. - DeleteProviderProfile(context.Context, *DeleteProviderProfileRequest) (*DeleteProviderProfileResponse, error) - // Get sandbox settings by id (called by sandbox entrypoint and poll loop). - GetSandboxConfig(context.Context, *sandboxv1.GetSandboxConfigRequest) (*sandboxv1.GetSandboxConfigResponse, error) - // Get gateway-global settings (read-only feature flags; any authenticated - // user may read these so the CLI and TUI can discover capabilities like - // providers_v2_enabled without requiring Platform Admin). - // - // Scope-only (no role): scopes are granted by the IdP at token issuance, - // orthogonal to workspace membership. Deployments that enable scope - // enforcement configure the IdP to grant config:read (or openshell:all) - // to all sandbox users, so this does not block least-privilege flows. - GetGatewayConfig(context.Context, *sandboxv1.GetGatewayConfigRequest) (*sandboxv1.GetGatewayConfigResponse, error) - // Update settings or policy at sandbox or global scope. - UpdateConfig(context.Context, *UpdateConfigRequest) (*UpdateConfigResponse, error) - // Get the load status of a specific policy version. - GetSandboxPolicyStatus(context.Context, *GetSandboxPolicyStatusRequest) (*GetSandboxPolicyStatusResponse, error) - // List policy history for a sandbox. - ListSandboxPolicies(context.Context, *ListSandboxPoliciesRequest) (*ListSandboxPoliciesResponse, error) - // Report policy load result (called by sandbox after reload attempt). - ReportPolicyStatus(context.Context, *ReportPolicyStatusRequest) (*ReportPolicyStatusResponse, error) - // Get provider environment for a sandbox (called by sandbox supervisor at startup). - GetSandboxProviderEnvironment(context.Context, *GetSandboxProviderEnvironmentRequest) (*GetSandboxProviderEnvironmentResponse, error) - // Fetch recent sandbox logs (one-shot). - GetSandboxLogs(context.Context, *GetSandboxLogsRequest) (*GetSandboxLogsResponse, error) - // Push sandbox supervisor logs to the server (client-streaming). - PushSandboxLogs(grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse]) error - // Persistent supervisor-to-gateway session (bidirectional streaming). - // - // The supervisor opens this stream at startup and keeps it alive for the - // sandbox lifetime. The gateway uses it to coordinate relay channels for - // SSH connect, ExecSandbox, and targetable sandbox services. Raw service - // bytes flow over RelayStream calls (separate HTTP/2 streams on the same - // connection), not over this stream. - ConnectSupervisor(grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage]) error - // Raw byte relay between supervisor and gateway. - // - // The supervisor initiates this call after receiving a RelayOpen message - // on its ConnectSupervisor stream. The first RelayFrame carries a - // RelayInit with the channel_id to associate the new HTTP/2 stream with - // the pending relay slot on the gateway. Subsequent frames carry raw bytes in either - // direction between the gateway-side waiter (ForwardTcp / exec handler) - // and the supervisor-side target bridge. - // - // This rides the same TCP+TLS+HTTP/2 connection as ConnectSupervisor — - // no new TLS handshake, no reverse HTTP CONNECT. - RelayStream(grpc.BidiStreamingServer[RelayFrame, RelayFrame]) error - // Watch a sandbox and stream updates. - // - // This stream can include: - // - Sandbox status snapshots (phase/status) - // - OpenShell server process logs correlated by sandbox_id - // - Platform events correlated to the sandbox - WatchSandbox(*WatchSandboxRequest, grpc.ServerStreamingServer[SandboxStreamEvent]) error - // Submit denial analysis results from sandbox (summaries + proposed chunks). - SubmitPolicyAnalysis(context.Context, *SubmitPolicyAnalysisRequest) (*SubmitPolicyAnalysisResponse, error) - // Get draft policy recommendations for a sandbox. - GetDraftPolicy(context.Context, *GetDraftPolicyRequest) (*GetDraftPolicyResponse, error) - // Approve a single draft policy chunk (merges into active policy). - ApproveDraftChunk(context.Context, *ApproveDraftChunkRequest) (*ApproveDraftChunkResponse, error) - // Reject a single draft policy chunk. - RejectDraftChunk(context.Context, *RejectDraftChunkRequest) (*RejectDraftChunkResponse, error) - // Approve all pending draft chunks (skips security-flagged unless forced). - ApproveAllDraftChunks(context.Context, *ApproveAllDraftChunksRequest) (*ApproveAllDraftChunksResponse, error) - // Edit a pending draft chunk in-place (e.g. narrow allowed_ips). - EditDraftChunk(context.Context, *EditDraftChunkRequest) (*EditDraftChunkResponse, error) - // Reverse an approval (remove merged rule from active policy). - UndoDraftChunk(context.Context, *UndoDraftChunkRequest) (*UndoDraftChunkResponse, error) - // Clear all pending draft chunks for a sandbox. - ClearDraftChunks(context.Context, *ClearDraftChunksRequest) (*ClearDraftChunksResponse, error) - // Get decision history for a sandbox's draft policy. - GetDraftHistory(context.Context, *GetDraftHistoryRequest) (*GetDraftHistoryResponse, error) - // Exchange a sandbox-bootstrap credential (e.g. a Kubernetes projected - // ServiceAccount token) for a gateway-minted JWT bound to the calling - // sandbox's UUID. Used by the Kubernetes driver path; singleplayer - // drivers receive the gateway JWT directly from the create-sandbox flow - // and never call this RPC. - IssueSandboxToken(context.Context, *IssueSandboxTokenRequest) (*IssueSandboxTokenResponse, error) - // Renew the calling sandbox's gateway JWT. Older tokens remain valid - // until their own expiry; deployments should keep token TTLs short to - // bound replay exposure. The supervisor calls this from a background - // task at ~80% of the token's lifetime; the new token is cached in - // memory only — the on-disk bootstrap file is intentionally not - // rewritten. - RefreshSandboxToken(context.Context, *RefreshSandboxTokenRequest) (*RefreshSandboxTokenResponse, error) - // Create a workspace. - CreateWorkspace(context.Context, *CreateWorkspaceRequest) (*CreateWorkspaceResponse, error) - // Fetch a workspace by name. - GetWorkspace(context.Context, *GetWorkspaceRequest) (*GetWorkspaceResponse, error) - // List workspaces. - ListWorkspaces(context.Context, *ListWorkspacesRequest) (*ListWorkspacesResponse, error) - // Delete a workspace by name. - DeleteWorkspace(context.Context, *DeleteWorkspaceRequest) (*DeleteWorkspaceResponse, error) - // Add a member to a workspace. - AddWorkspaceMember(context.Context, *AddWorkspaceMemberRequest) (*AddWorkspaceMemberResponse, error) - // Remove a member from a workspace. - RemoveWorkspaceMember(context.Context, *RemoveWorkspaceMemberRequest) (*RemoveWorkspaceMemberResponse, error) - // List members of a workspace. - ListWorkspaceMembers(context.Context, *ListWorkspaceMembersRequest) (*ListWorkspaceMembersResponse, error) - mustEmbedUnimplementedOpenShellServer() -} - -// UnimplementedOpenShellServer must be embedded to have -// forward compatible implementations. -// -// NOTE: this should be embedded by value instead of pointer to avoid a nil -// pointer dereference when methods are called. -type UnimplementedOpenShellServer struct{} - -func (UnimplementedOpenShellServer) Health(context.Context, *HealthRequest) (*HealthResponse, error) { - return nil, status.Error(codes.Unimplemented, "method Health not implemented") -} -func (UnimplementedOpenShellServer) GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetCurrentUser not implemented") -} -func (UnimplementedOpenShellServer) GetGatewayInfo(context.Context, *GetGatewayInfoRequest) (*GetGatewayInfoResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetGatewayInfo not implemented") -} -func (UnimplementedOpenShellServer) CreateSandbox(context.Context, *CreateSandboxRequest) (*SandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateSandbox not implemented") -} -func (UnimplementedOpenShellServer) GetSandbox(context.Context, *GetSandboxRequest) (*SandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandbox not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxes(context.Context, *ListSandboxesRequest) (*ListSandboxesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxes not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxProviders(context.Context, *ListSandboxProvidersRequest) (*ListSandboxProvidersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxProviders not implemented") -} -func (UnimplementedOpenShellServer) AttachSandboxProvider(context.Context, *AttachSandboxProviderRequest) (*AttachSandboxProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method AttachSandboxProvider not implemented") -} -func (UnimplementedOpenShellServer) DetachSandboxProvider(context.Context, *DetachSandboxProviderRequest) (*DetachSandboxProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DetachSandboxProvider not implemented") -} -func (UnimplementedOpenShellServer) DeleteSandbox(context.Context, *DeleteSandboxRequest) (*DeleteSandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteSandbox not implemented") -} -func (UnimplementedOpenShellServer) CreateSshSession(context.Context, *CreateSshSessionRequest) (*CreateSshSessionResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateSshSession not implemented") -} -func (UnimplementedOpenShellServer) ExposeService(context.Context, *ExposeServiceRequest) (*ServiceEndpointResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ExposeService not implemented") -} -func (UnimplementedOpenShellServer) GetService(context.Context, *GetServiceRequest) (*ServiceEndpointResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetService not implemented") -} -func (UnimplementedOpenShellServer) ListServices(context.Context, *ListServicesRequest) (*ListServicesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListServices not implemented") -} -func (UnimplementedOpenShellServer) DeleteService(context.Context, *DeleteServiceRequest) (*DeleteServiceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteService not implemented") -} -func (UnimplementedOpenShellServer) RevokeSshSession(context.Context, *RevokeSshSessionRequest) (*RevokeSshSessionResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RevokeSshSession not implemented") -} -func (UnimplementedOpenShellServer) ExecSandbox(*ExecSandboxRequest, grpc.ServerStreamingServer[ExecSandboxEvent]) error { - return status.Error(codes.Unimplemented, "method ExecSandbox not implemented") -} -func (UnimplementedOpenShellServer) ForwardTcp(grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame]) error { - return status.Error(codes.Unimplemented, "method ForwardTcp not implemented") -} -func (UnimplementedOpenShellServer) ExecSandboxInteractive(grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent]) error { - return status.Error(codes.Unimplemented, "method ExecSandboxInteractive not implemented") -} -func (UnimplementedOpenShellServer) CreateProvider(context.Context, *CreateProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateProvider not implemented") -} -func (UnimplementedOpenShellServer) GetProvider(context.Context, *GetProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProvider not implemented") -} -func (UnimplementedOpenShellServer) ListProviders(context.Context, *ListProvidersRequest) (*ListProvidersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListProviders not implemented") -} -func (UnimplementedOpenShellServer) ListProviderProfiles(context.Context, *ListProviderProfilesRequest) (*ListProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) GetProviderProfile(context.Context, *GetProviderProfileRequest) (*ProviderProfileResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProviderProfile not implemented") -} -func (UnimplementedOpenShellServer) ImportProviderProfiles(context.Context, *ImportProviderProfilesRequest) (*ImportProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ImportProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) UpdateProviderProfiles(context.Context, *UpdateProviderProfilesRequest) (*UpdateProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) LintProviderProfiles(context.Context, *LintProviderProfilesRequest) (*LintProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method LintProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) UpdateProvider(context.Context, *UpdateProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateProvider not implemented") -} -func (UnimplementedOpenShellServer) GetProviderRefreshStatus(context.Context, *GetProviderRefreshStatusRequest) (*GetProviderRefreshStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProviderRefreshStatus not implemented") -} -func (UnimplementedOpenShellServer) ConfigureProviderRefresh(context.Context, *ConfigureProviderRefreshRequest) (*ConfigureProviderRefreshResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ConfigureProviderRefresh not implemented") -} -func (UnimplementedOpenShellServer) RotateProviderCredential(context.Context, *RotateProviderCredentialRequest) (*RotateProviderCredentialResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RotateProviderCredential not implemented") -} -func (UnimplementedOpenShellServer) DeleteProviderRefresh(context.Context, *DeleteProviderRefreshRequest) (*DeleteProviderRefreshResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProviderRefresh not implemented") -} -func (UnimplementedOpenShellServer) DeleteProvider(context.Context, *DeleteProviderRequest) (*DeleteProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProvider not implemented") -} -func (UnimplementedOpenShellServer) DeleteProviderProfile(context.Context, *DeleteProviderProfileRequest) (*DeleteProviderProfileResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProviderProfile not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxConfig(context.Context, *sandboxv1.GetSandboxConfigRequest) (*sandboxv1.GetSandboxConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxConfig not implemented") -} -func (UnimplementedOpenShellServer) GetGatewayConfig(context.Context, *sandboxv1.GetGatewayConfigRequest) (*sandboxv1.GetGatewayConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetGatewayConfig not implemented") -} -func (UnimplementedOpenShellServer) UpdateConfig(context.Context, *UpdateConfigRequest) (*UpdateConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateConfig not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxPolicyStatus(context.Context, *GetSandboxPolicyStatusRequest) (*GetSandboxPolicyStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxPolicyStatus not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxPolicies(context.Context, *ListSandboxPoliciesRequest) (*ListSandboxPoliciesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxPolicies not implemented") -} -func (UnimplementedOpenShellServer) ReportPolicyStatus(context.Context, *ReportPolicyStatusRequest) (*ReportPolicyStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ReportPolicyStatus not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxProviderEnvironment(context.Context, *GetSandboxProviderEnvironmentRequest) (*GetSandboxProviderEnvironmentResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxProviderEnvironment not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxLogs(context.Context, *GetSandboxLogsRequest) (*GetSandboxLogsResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxLogs not implemented") -} -func (UnimplementedOpenShellServer) PushSandboxLogs(grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse]) error { - return status.Error(codes.Unimplemented, "method PushSandboxLogs not implemented") -} -func (UnimplementedOpenShellServer) ConnectSupervisor(grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage]) error { - return status.Error(codes.Unimplemented, "method ConnectSupervisor not implemented") -} -func (UnimplementedOpenShellServer) RelayStream(grpc.BidiStreamingServer[RelayFrame, RelayFrame]) error { - return status.Error(codes.Unimplemented, "method RelayStream not implemented") -} -func (UnimplementedOpenShellServer) WatchSandbox(*WatchSandboxRequest, grpc.ServerStreamingServer[SandboxStreamEvent]) error { - return status.Error(codes.Unimplemented, "method WatchSandbox not implemented") -} -func (UnimplementedOpenShellServer) SubmitPolicyAnalysis(context.Context, *SubmitPolicyAnalysisRequest) (*SubmitPolicyAnalysisResponse, error) { - return nil, status.Error(codes.Unimplemented, "method SubmitPolicyAnalysis not implemented") -} -func (UnimplementedOpenShellServer) GetDraftPolicy(context.Context, *GetDraftPolicyRequest) (*GetDraftPolicyResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetDraftPolicy not implemented") -} -func (UnimplementedOpenShellServer) ApproveDraftChunk(context.Context, *ApproveDraftChunkRequest) (*ApproveDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ApproveDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) RejectDraftChunk(context.Context, *RejectDraftChunkRequest) (*RejectDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RejectDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) ApproveAllDraftChunks(context.Context, *ApproveAllDraftChunksRequest) (*ApproveAllDraftChunksResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ApproveAllDraftChunks not implemented") -} -func (UnimplementedOpenShellServer) EditDraftChunk(context.Context, *EditDraftChunkRequest) (*EditDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method EditDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) UndoDraftChunk(context.Context, *UndoDraftChunkRequest) (*UndoDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UndoDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) ClearDraftChunks(context.Context, *ClearDraftChunksRequest) (*ClearDraftChunksResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ClearDraftChunks not implemented") -} -func (UnimplementedOpenShellServer) GetDraftHistory(context.Context, *GetDraftHistoryRequest) (*GetDraftHistoryResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetDraftHistory not implemented") -} -func (UnimplementedOpenShellServer) IssueSandboxToken(context.Context, *IssueSandboxTokenRequest) (*IssueSandboxTokenResponse, error) { - return nil, status.Error(codes.Unimplemented, "method IssueSandboxToken not implemented") -} -func (UnimplementedOpenShellServer) RefreshSandboxToken(context.Context, *RefreshSandboxTokenRequest) (*RefreshSandboxTokenResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RefreshSandboxToken not implemented") -} -func (UnimplementedOpenShellServer) CreateWorkspace(context.Context, *CreateWorkspaceRequest) (*CreateWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateWorkspace not implemented") -} -func (UnimplementedOpenShellServer) GetWorkspace(context.Context, *GetWorkspaceRequest) (*GetWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetWorkspace not implemented") -} -func (UnimplementedOpenShellServer) ListWorkspaces(context.Context, *ListWorkspacesRequest) (*ListWorkspacesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListWorkspaces not implemented") -} -func (UnimplementedOpenShellServer) DeleteWorkspace(context.Context, *DeleteWorkspaceRequest) (*DeleteWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteWorkspace not implemented") -} -func (UnimplementedOpenShellServer) AddWorkspaceMember(context.Context, *AddWorkspaceMemberRequest) (*AddWorkspaceMemberResponse, error) { - return nil, status.Error(codes.Unimplemented, "method AddWorkspaceMember not implemented") -} -func (UnimplementedOpenShellServer) RemoveWorkspaceMember(context.Context, *RemoveWorkspaceMemberRequest) (*RemoveWorkspaceMemberResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RemoveWorkspaceMember not implemented") -} -func (UnimplementedOpenShellServer) ListWorkspaceMembers(context.Context, *ListWorkspaceMembersRequest) (*ListWorkspaceMembersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListWorkspaceMembers not implemented") -} -func (UnimplementedOpenShellServer) mustEmbedUnimplementedOpenShellServer() {} -func (UnimplementedOpenShellServer) testEmbeddedByValue() {} - -// UnsafeOpenShellServer may be embedded to opt out of forward compatibility for this service. -// Use of this interface is not recommended, as added methods to OpenShellServer will -// result in compilation errors. -type UnsafeOpenShellServer interface { - mustEmbedUnimplementedOpenShellServer() -} - -func RegisterOpenShellServer(s grpc.ServiceRegistrar, srv OpenShellServer) { - // If the following call panics, it indicates UnimplementedOpenShellServer was - // embedded by pointer and is nil. This will cause panics if an - // unimplemented method is ever invoked, so we test this at initialization - // time to prevent it from happening at runtime later due to I/O. - if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { - t.testEmbeddedByValue() - } - s.RegisterService(&OpenShell_ServiceDesc, srv) -} - -func _OpenShell_Health_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(HealthRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).Health(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_Health_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).Health(ctx, req.(*HealthRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetCurrentUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetCurrentUserRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetCurrentUser(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetCurrentUser_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetCurrentUser(ctx, req.(*GetCurrentUserRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetGatewayInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetGatewayInfoRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetGatewayInfo(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetGatewayInfo_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetGatewayInfo(ctx, req.(*GetGatewayInfoRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateSandbox(ctx, req.(*CreateSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandbox(ctx, req.(*GetSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxes(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxes_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxes(ctx, req.(*ListSandboxesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxProvidersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxProviders(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxProviders_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxProviders(ctx, req.(*ListSandboxProvidersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_AttachSandboxProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(AttachSandboxProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).AttachSandboxProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_AttachSandboxProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).AttachSandboxProvider(ctx, req.(*AttachSandboxProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DetachSandboxProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DetachSandboxProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DetachSandboxProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DetachSandboxProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DetachSandboxProvider(ctx, req.(*DetachSandboxProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteSandbox(ctx, req.(*DeleteSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateSshSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateSshSessionRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateSshSession(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateSshSession_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateSshSession(ctx, req.(*CreateSshSessionRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ExposeService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ExposeServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ExposeService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ExposeService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ExposeService(ctx, req.(*ExposeServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetService(ctx, req.(*GetServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListServices_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListServicesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListServices(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListServices_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListServices(ctx, req.(*ListServicesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteService(ctx, req.(*DeleteServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RevokeSshSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RevokeSshSessionRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RevokeSshSession(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RevokeSshSession_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RevokeSshSession(ctx, req.(*RevokeSshSessionRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ExecSandbox_Handler(srv interface{}, stream grpc.ServerStream) error { - m := new(ExecSandboxRequest) - if err := stream.RecvMsg(m); err != nil { - return err - } - return srv.(OpenShellServer).ExecSandbox(m, &grpc.GenericServerStream[ExecSandboxRequest, ExecSandboxEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxServer = grpc.ServerStreamingServer[ExecSandboxEvent] - -func _OpenShell_ForwardTcp_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ForwardTcp(&grpc.GenericServerStream[TcpForwardFrame, TcpForwardFrame]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ForwardTcpServer = grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame] - -func _OpenShell_ExecSandboxInteractive_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ExecSandboxInteractive(&grpc.GenericServerStream[ExecSandboxInput, ExecSandboxEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxInteractiveServer = grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent] - -func _OpenShell_CreateProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateProvider(ctx, req.(*CreateProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProvider(ctx, req.(*GetProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListProvidersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListProviders(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListProviders_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListProviders(ctx, req.(*ListProvidersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListProviderProfiles(ctx, req.(*ListProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProviderProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderProfileRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProviderProfile(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProviderProfile_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProviderProfile(ctx, req.(*GetProviderProfileRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ImportProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ImportProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ImportProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ImportProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ImportProviderProfiles(ctx, req.(*ImportProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateProviderProfiles(ctx, req.(*UpdateProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_LintProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(LintProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).LintProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_LintProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).LintProviderProfiles(ctx, req.(*LintProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateProvider(ctx, req.(*UpdateProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProviderRefreshStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderRefreshStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProviderRefreshStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProviderRefreshStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProviderRefreshStatus(ctx, req.(*GetProviderRefreshStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ConfigureProviderRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ConfigureProviderRefreshRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ConfigureProviderRefresh(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ConfigureProviderRefresh_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ConfigureProviderRefresh(ctx, req.(*ConfigureProviderRefreshRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RotateProviderCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RotateProviderCredentialRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RotateProviderCredential(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RotateProviderCredential_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RotateProviderCredential(ctx, req.(*RotateProviderCredentialRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProviderRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderRefreshRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProviderRefresh(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProviderRefresh_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProviderRefresh(ctx, req.(*DeleteProviderRefreshRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProvider(ctx, req.(*DeleteProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProviderProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderProfileRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProviderProfile(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProviderProfile_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProviderProfile(ctx, req.(*DeleteProviderProfileRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(sandboxv1.GetSandboxConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxConfig(ctx, req.(*sandboxv1.GetSandboxConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetGatewayConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(sandboxv1.GetGatewayConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetGatewayConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetGatewayConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetGatewayConfig(ctx, req.(*sandboxv1.GetGatewayConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateConfig(ctx, req.(*UpdateConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxPolicyStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxPolicyStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxPolicyStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxPolicyStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxPolicyStatus(ctx, req.(*GetSandboxPolicyStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxPolicies_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxPoliciesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxPolicies(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxPolicies_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxPolicies(ctx, req.(*ListSandboxPoliciesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ReportPolicyStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ReportPolicyStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ReportPolicyStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ReportPolicyStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ReportPolicyStatus(ctx, req.(*ReportPolicyStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxProviderEnvironment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxProviderEnvironmentRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxProviderEnvironment(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxProviderEnvironment_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxProviderEnvironment(ctx, req.(*GetSandboxProviderEnvironmentRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxLogs_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxLogsRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxLogs(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxLogs_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxLogs(ctx, req.(*GetSandboxLogsRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_PushSandboxLogs_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).PushSandboxLogs(&grpc.GenericServerStream[PushSandboxLogsRequest, PushSandboxLogsResponse]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_PushSandboxLogsServer = grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse] - -func _OpenShell_ConnectSupervisor_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ConnectSupervisor(&grpc.GenericServerStream[SupervisorMessage, GatewayMessage]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ConnectSupervisorServer = grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage] - -func _OpenShell_RelayStream_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).RelayStream(&grpc.GenericServerStream[RelayFrame, RelayFrame]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_RelayStreamServer = grpc.BidiStreamingServer[RelayFrame, RelayFrame] - -func _OpenShell_WatchSandbox_Handler(srv interface{}, stream grpc.ServerStream) error { - m := new(WatchSandboxRequest) - if err := stream.RecvMsg(m); err != nil { - return err - } - return srv.(OpenShellServer).WatchSandbox(m, &grpc.GenericServerStream[WatchSandboxRequest, SandboxStreamEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_WatchSandboxServer = grpc.ServerStreamingServer[SandboxStreamEvent] - -func _OpenShell_SubmitPolicyAnalysis_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(SubmitPolicyAnalysisRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).SubmitPolicyAnalysis(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_SubmitPolicyAnalysis_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).SubmitPolicyAnalysis(ctx, req.(*SubmitPolicyAnalysisRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetDraftPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetDraftPolicyRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetDraftPolicy(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetDraftPolicy_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetDraftPolicy(ctx, req.(*GetDraftPolicyRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ApproveDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ApproveDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ApproveDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ApproveDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ApproveDraftChunk(ctx, req.(*ApproveDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RejectDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RejectDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RejectDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RejectDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RejectDraftChunk(ctx, req.(*RejectDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ApproveAllDraftChunks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ApproveAllDraftChunksRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ApproveAllDraftChunks(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ApproveAllDraftChunks_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ApproveAllDraftChunks(ctx, req.(*ApproveAllDraftChunksRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_EditDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(EditDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).EditDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_EditDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).EditDraftChunk(ctx, req.(*EditDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UndoDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UndoDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UndoDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UndoDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UndoDraftChunk(ctx, req.(*UndoDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ClearDraftChunks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ClearDraftChunksRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ClearDraftChunks(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ClearDraftChunks_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ClearDraftChunks(ctx, req.(*ClearDraftChunksRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetDraftHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetDraftHistoryRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetDraftHistory(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetDraftHistory_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetDraftHistory(ctx, req.(*GetDraftHistoryRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_IssueSandboxToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(IssueSandboxTokenRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).IssueSandboxToken(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_IssueSandboxToken_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).IssueSandboxToken(ctx, req.(*IssueSandboxTokenRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RefreshSandboxToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RefreshSandboxTokenRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RefreshSandboxToken(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RefreshSandboxToken_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RefreshSandboxToken(ctx, req.(*RefreshSandboxTokenRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateWorkspace(ctx, req.(*CreateWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetWorkspace(ctx, req.(*GetWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListWorkspaces_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListWorkspacesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListWorkspaces(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListWorkspaces_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListWorkspaces(ctx, req.(*ListWorkspacesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteWorkspace(ctx, req.(*DeleteWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_AddWorkspaceMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(AddWorkspaceMemberRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).AddWorkspaceMember(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_AddWorkspaceMember_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).AddWorkspaceMember(ctx, req.(*AddWorkspaceMemberRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RemoveWorkspaceMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RemoveWorkspaceMemberRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RemoveWorkspaceMember(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RemoveWorkspaceMember_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RemoveWorkspaceMember(ctx, req.(*RemoveWorkspaceMemberRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListWorkspaceMembers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListWorkspaceMembersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListWorkspaceMembers(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListWorkspaceMembers_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListWorkspaceMembers(ctx, req.(*ListWorkspaceMembersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -// OpenShell_ServiceDesc is the grpc.ServiceDesc for OpenShell service. -// It's only intended for direct use with grpc.RegisterService, -// and not to be introspected or modified (even as a copy) -var OpenShell_ServiceDesc = grpc.ServiceDesc{ - ServiceName: "openshell.v1.OpenShell", - HandlerType: (*OpenShellServer)(nil), - Methods: []grpc.MethodDesc{ - { - MethodName: "Health", - Handler: _OpenShell_Health_Handler, - }, - { - MethodName: "GetCurrentUser", - Handler: _OpenShell_GetCurrentUser_Handler, - }, - { - MethodName: "GetGatewayInfo", - Handler: _OpenShell_GetGatewayInfo_Handler, - }, - { - MethodName: "CreateSandbox", - Handler: _OpenShell_CreateSandbox_Handler, - }, - { - MethodName: "GetSandbox", - Handler: _OpenShell_GetSandbox_Handler, - }, - { - MethodName: "ListSandboxes", - Handler: _OpenShell_ListSandboxes_Handler, - }, - { - MethodName: "ListSandboxProviders", - Handler: _OpenShell_ListSandboxProviders_Handler, - }, - { - MethodName: "AttachSandboxProvider", - Handler: _OpenShell_AttachSandboxProvider_Handler, - }, - { - MethodName: "DetachSandboxProvider", - Handler: _OpenShell_DetachSandboxProvider_Handler, - }, - { - MethodName: "DeleteSandbox", - Handler: _OpenShell_DeleteSandbox_Handler, - }, - { - MethodName: "CreateSshSession", - Handler: _OpenShell_CreateSshSession_Handler, - }, - { - MethodName: "ExposeService", - Handler: _OpenShell_ExposeService_Handler, - }, - { - MethodName: "GetService", - Handler: _OpenShell_GetService_Handler, - }, - { - MethodName: "ListServices", - Handler: _OpenShell_ListServices_Handler, - }, - { - MethodName: "DeleteService", - Handler: _OpenShell_DeleteService_Handler, - }, - { - MethodName: "RevokeSshSession", - Handler: _OpenShell_RevokeSshSession_Handler, - }, - { - MethodName: "CreateProvider", - Handler: _OpenShell_CreateProvider_Handler, - }, - { - MethodName: "GetProvider", - Handler: _OpenShell_GetProvider_Handler, - }, - { - MethodName: "ListProviders", - Handler: _OpenShell_ListProviders_Handler, - }, - { - MethodName: "ListProviderProfiles", - Handler: _OpenShell_ListProviderProfiles_Handler, - }, - { - MethodName: "GetProviderProfile", - Handler: _OpenShell_GetProviderProfile_Handler, - }, - { - MethodName: "ImportProviderProfiles", - Handler: _OpenShell_ImportProviderProfiles_Handler, - }, - { - MethodName: "UpdateProviderProfiles", - Handler: _OpenShell_UpdateProviderProfiles_Handler, - }, - { - MethodName: "LintProviderProfiles", - Handler: _OpenShell_LintProviderProfiles_Handler, - }, - { - MethodName: "UpdateProvider", - Handler: _OpenShell_UpdateProvider_Handler, - }, - { - MethodName: "GetProviderRefreshStatus", - Handler: _OpenShell_GetProviderRefreshStatus_Handler, - }, - { - MethodName: "ConfigureProviderRefresh", - Handler: _OpenShell_ConfigureProviderRefresh_Handler, - }, - { - MethodName: "RotateProviderCredential", - Handler: _OpenShell_RotateProviderCredential_Handler, - }, - { - MethodName: "DeleteProviderRefresh", - Handler: _OpenShell_DeleteProviderRefresh_Handler, - }, - { - MethodName: "DeleteProvider", - Handler: _OpenShell_DeleteProvider_Handler, - }, - { - MethodName: "DeleteProviderProfile", - Handler: _OpenShell_DeleteProviderProfile_Handler, - }, - { - MethodName: "GetSandboxConfig", - Handler: _OpenShell_GetSandboxConfig_Handler, - }, - { - MethodName: "GetGatewayConfig", - Handler: _OpenShell_GetGatewayConfig_Handler, - }, - { - MethodName: "UpdateConfig", - Handler: _OpenShell_UpdateConfig_Handler, - }, - { - MethodName: "GetSandboxPolicyStatus", - Handler: _OpenShell_GetSandboxPolicyStatus_Handler, - }, - { - MethodName: "ListSandboxPolicies", - Handler: _OpenShell_ListSandboxPolicies_Handler, - }, - { - MethodName: "ReportPolicyStatus", - Handler: _OpenShell_ReportPolicyStatus_Handler, - }, - { - MethodName: "GetSandboxProviderEnvironment", - Handler: _OpenShell_GetSandboxProviderEnvironment_Handler, - }, - { - MethodName: "GetSandboxLogs", - Handler: _OpenShell_GetSandboxLogs_Handler, - }, - { - MethodName: "SubmitPolicyAnalysis", - Handler: _OpenShell_SubmitPolicyAnalysis_Handler, - }, - { - MethodName: "GetDraftPolicy", - Handler: _OpenShell_GetDraftPolicy_Handler, - }, - { - MethodName: "ApproveDraftChunk", - Handler: _OpenShell_ApproveDraftChunk_Handler, - }, - { - MethodName: "RejectDraftChunk", - Handler: _OpenShell_RejectDraftChunk_Handler, - }, - { - MethodName: "ApproveAllDraftChunks", - Handler: _OpenShell_ApproveAllDraftChunks_Handler, - }, - { - MethodName: "EditDraftChunk", - Handler: _OpenShell_EditDraftChunk_Handler, - }, - { - MethodName: "UndoDraftChunk", - Handler: _OpenShell_UndoDraftChunk_Handler, - }, - { - MethodName: "ClearDraftChunks", - Handler: _OpenShell_ClearDraftChunks_Handler, - }, - { - MethodName: "GetDraftHistory", - Handler: _OpenShell_GetDraftHistory_Handler, - }, - { - MethodName: "IssueSandboxToken", - Handler: _OpenShell_IssueSandboxToken_Handler, - }, - { - MethodName: "RefreshSandboxToken", - Handler: _OpenShell_RefreshSandboxToken_Handler, - }, - { - MethodName: "CreateWorkspace", - Handler: _OpenShell_CreateWorkspace_Handler, - }, - { - MethodName: "GetWorkspace", - Handler: _OpenShell_GetWorkspace_Handler, - }, - { - MethodName: "ListWorkspaces", - Handler: _OpenShell_ListWorkspaces_Handler, - }, - { - MethodName: "DeleteWorkspace", - Handler: _OpenShell_DeleteWorkspace_Handler, - }, - { - MethodName: "AddWorkspaceMember", - Handler: _OpenShell_AddWorkspaceMember_Handler, - }, - { - MethodName: "RemoveWorkspaceMember", - Handler: _OpenShell_RemoveWorkspaceMember_Handler, - }, - { - MethodName: "ListWorkspaceMembers", - Handler: _OpenShell_ListWorkspaceMembers_Handler, - }, - }, - Streams: []grpc.StreamDesc{ - { - StreamName: "ExecSandbox", - Handler: _OpenShell_ExecSandbox_Handler, - ServerStreams: true, - }, - { - StreamName: "ForwardTcp", - Handler: _OpenShell_ForwardTcp_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "ExecSandboxInteractive", - Handler: _OpenShell_ExecSandboxInteractive_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "PushSandboxLogs", - Handler: _OpenShell_PushSandboxLogs_Handler, - ClientStreams: true, - }, - { - StreamName: "ConnectSupervisor", - Handler: _OpenShell_ConnectSupervisor_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "RelayStream", - Handler: _OpenShell_RelayStream_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "WatchSandbox", - Handler: _OpenShell_WatchSandbox_Handler, - ServerStreams: true, - }, - }, - Metadata: "openshell.proto", -} diff --git a/backend/gen/optionsv1/options.pb.go b/backend/gen/optionsv1/options.pb.go deleted file mode 100644 index bbfc7e07..00000000 --- a/backend/gen/optionsv1/options.pb.go +++ /dev/null @@ -1,204 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: options.proto - -package optionsv1 - -import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - descriptorpb "google.golang.org/protobuf/types/descriptorpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Per-method authorization rule. Consumed at runtime by the gateway's -// descriptor-pool-based auth table to enforce auth mode, role, and scope. -type AuthorizationRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Authentication mode: "bearer", "sandbox", "dual", or "unauthenticated". - AuthMode string `protobuf:"bytes,1,opt,name=auth_mode,json=authMode,proto3" json:"auth_mode,omitempty"` - // Minimum workspace-level role required (checked by handler via - // authorize_workspace): "user" or "admin". Mutually exclusive with - // global_role. - WorkspaceRole string `protobuf:"bytes,2,opt,name=workspace_role,json=workspaceRole,proto3" json:"workspace_role,omitempty"` - // Global role required (checked by middleware via OIDC claims): - // "platform_admin". Mutually exclusive with workspace_role. - GlobalRole string `protobuf:"bytes,3,opt,name=global_role,json=globalRole,proto3" json:"global_role,omitempty"` - // Required OIDC scope on the bearer path (e.g. "sandbox:read"). - Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AuthorizationRule) Reset() { - *x = AuthorizationRule{} - mi := &file_options_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AuthorizationRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AuthorizationRule) ProtoMessage() {} - -func (x *AuthorizationRule) ProtoReflect() protoreflect.Message { - mi := &file_options_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AuthorizationRule.ProtoReflect.Descriptor instead. -func (*AuthorizationRule) Descriptor() ([]byte, []int) { - return file_options_proto_rawDescGZIP(), []int{0} -} - -func (x *AuthorizationRule) GetAuthMode() string { - if x != nil { - return x.AuthMode - } - return "" -} - -func (x *AuthorizationRule) GetWorkspaceRole() string { - if x != nil { - return x.WorkspaceRole - } - return "" -} - -func (x *AuthorizationRule) GetGlobalRole() string { - if x != nil { - return x.GlobalRole - } - return "" -} - -func (x *AuthorizationRule) GetScope() string { - if x != nil { - return x.Scope - } - return "" -} - -var file_options_proto_extTypes = []protoimpl.ExtensionInfo{ - { - ExtendedType: (*descriptorpb.MethodOptions)(nil), - ExtensionType: (*AuthorizationRule)(nil), - Field: 50000, - Name: "openshell.options.v1.authorization", - Tag: "bytes,50000,opt,name=authorization", - Filename: "options.proto", - }, - { - ExtendedType: (*descriptorpb.FieldOptions)(nil), - ExtensionType: (*bool)(nil), - Field: 50001, - Name: "openshell.options.v1.secret", - Tag: "varint,50001,opt,name=secret", - Filename: "options.proto", - }, -} - -// Extension fields to descriptorpb.MethodOptions. -var ( - // Authorization metadata for a gRPC method. - // - // optional openshell.options.v1.AuthorizationRule authorization = 50000; - E_Authorization = &file_options_proto_extTypes[0] -) - -// Extension fields to descriptorpb.FieldOptions. -var ( - // optional bool secret = 50001; - E_Secret = &file_options_proto_extTypes[1] -) - -var File_options_proto protoreflect.FileDescriptor - -const file_options_proto_rawDesc = "" + - "\n" + - "\roptions.proto\x12\x14openshell.options.v1\x1a google/protobuf/descriptor.proto\"\x8e\x01\n" + - "\x11AuthorizationRule\x12\x1b\n" + - "\tauth_mode\x18\x01 \x01(\tR\bauthMode\x12%\n" + - "\x0eworkspace_role\x18\x02 \x01(\tR\rworkspaceRole\x12\x1f\n" + - "\vglobal_role\x18\x03 \x01(\tR\n" + - "globalRole\x12\x14\n" + - "\x05scope\x18\x04 \x01(\tR\x05scope:o\n" + - "\rauthorization\x12\x1e.google.protobuf.MethodOptions\x18І\x03 \x01(\v2'.openshell.options.v1.AuthorizationRuleR\rauthorization:7\n" + - "\x06secret\x12\x1d.google.protobuf.FieldOptions\x18ц\x03 \x01(\bR\x06secretb\x06proto3" - -var ( - file_options_proto_rawDescOnce sync.Once - file_options_proto_rawDescData []byte -) - -func file_options_proto_rawDescGZIP() []byte { - file_options_proto_rawDescOnce.Do(func() { - file_options_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_options_proto_rawDesc), len(file_options_proto_rawDesc))) - }) - return file_options_proto_rawDescData -} - -var file_options_proto_msgTypes = make([]protoimpl.MessageInfo, 1) -var file_options_proto_goTypes = []any{ - (*AuthorizationRule)(nil), // 0: openshell.options.v1.AuthorizationRule - (*descriptorpb.MethodOptions)(nil), // 1: google.protobuf.MethodOptions - (*descriptorpb.FieldOptions)(nil), // 2: google.protobuf.FieldOptions -} -var file_options_proto_depIdxs = []int32{ - 1, // 0: openshell.options.v1.authorization:extendee -> google.protobuf.MethodOptions - 2, // 1: openshell.options.v1.secret:extendee -> google.protobuf.FieldOptions - 0, // 2: openshell.options.v1.authorization:type_name -> openshell.options.v1.AuthorizationRule - 3, // [3:3] is the sub-list for method output_type - 3, // [3:3] is the sub-list for method input_type - 2, // [2:3] is the sub-list for extension type_name - 0, // [0:2] is the sub-list for extension extendee - 0, // [0:0] is the sub-list for field type_name -} - -func init() { file_options_proto_init() } -func file_options_proto_init() { - if File_options_proto != nil { - return - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_options_proto_rawDesc), len(file_options_proto_rawDesc)), - NumEnums: 0, - NumMessages: 1, - NumExtensions: 2, - NumServices: 0, - }, - GoTypes: file_options_proto_goTypes, - DependencyIndexes: file_options_proto_depIdxs, - MessageInfos: file_options_proto_msgTypes, - ExtensionInfos: file_options_proto_extTypes, - }.Build() - File_options_proto = out.File - file_options_proto_goTypes = nil - file_options_proto_depIdxs = nil -} diff --git a/backend/gen/sandboxv1/sandbox.pb.go b/backend/gen/sandboxv1/sandbox.pb.go deleted file mode 100644 index be6fa5e0..00000000 --- a/backend/gen/sandboxv1/sandbox.pb.go +++ /dev/null @@ -1,2222 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: sandbox.proto - -package sandboxv1 - -import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - structpb "google.golang.org/protobuf/types/known/structpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Scope that currently controls a setting. -type SettingScope int32 - -const ( - SettingScope_SETTING_SCOPE_UNSPECIFIED SettingScope = 0 - SettingScope_SETTING_SCOPE_SANDBOX SettingScope = 1 - SettingScope_SETTING_SCOPE_GLOBAL SettingScope = 2 -) - -// Enum value maps for SettingScope. -var ( - SettingScope_name = map[int32]string{ - 0: "SETTING_SCOPE_UNSPECIFIED", - 1: "SETTING_SCOPE_SANDBOX", - 2: "SETTING_SCOPE_GLOBAL", - } - SettingScope_value = map[string]int32{ - "SETTING_SCOPE_UNSPECIFIED": 0, - "SETTING_SCOPE_SANDBOX": 1, - "SETTING_SCOPE_GLOBAL": 2, - } -) - -func (x SettingScope) Enum() *SettingScope { - p := new(SettingScope) - *p = x - return p -} - -func (x SettingScope) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SettingScope) Descriptor() protoreflect.EnumDescriptor { - return file_sandbox_proto_enumTypes[0].Descriptor() -} - -func (SettingScope) Type() protoreflect.EnumType { - return &file_sandbox_proto_enumTypes[0] -} - -func (x SettingScope) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SettingScope.Descriptor instead. -func (SettingScope) EnumDescriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{0} -} - -// Source used for the policy payload in GetSandboxConfigResponse. -type PolicySource int32 - -const ( - PolicySource_POLICY_SOURCE_UNSPECIFIED PolicySource = 0 - PolicySource_POLICY_SOURCE_SANDBOX PolicySource = 1 - PolicySource_POLICY_SOURCE_GLOBAL PolicySource = 2 -) - -// Enum value maps for PolicySource. -var ( - PolicySource_name = map[int32]string{ - 0: "POLICY_SOURCE_UNSPECIFIED", - 1: "POLICY_SOURCE_SANDBOX", - 2: "POLICY_SOURCE_GLOBAL", - } - PolicySource_value = map[string]int32{ - "POLICY_SOURCE_UNSPECIFIED": 0, - "POLICY_SOURCE_SANDBOX": 1, - "POLICY_SOURCE_GLOBAL": 2, - } -) - -func (x PolicySource) Enum() *PolicySource { - p := new(PolicySource) - *p = x - return p -} - -func (x PolicySource) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (PolicySource) Descriptor() protoreflect.EnumDescriptor { - return file_sandbox_proto_enumTypes[1].Descriptor() -} - -func (PolicySource) Type() protoreflect.EnumType { - return &file_sandbox_proto_enumTypes[1] -} - -func (x PolicySource) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use PolicySource.Descriptor instead. -func (PolicySource) EnumDescriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{1} -} - -// Sandbox security policy configuration. -type SandboxPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Policy version. - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // Filesystem access policy. - Filesystem *FilesystemPolicy `protobuf:"bytes,2,opt,name=filesystem,proto3" json:"filesystem,omitempty"` - // Landlock configuration. - Landlock *LandlockPolicy `protobuf:"bytes,3,opt,name=landlock,proto3" json:"landlock,omitempty"` - // Process execution policy. - Process *ProcessPolicy `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"` - // Network access policies keyed by name (e.g. "claude_code", "gitlab"). - NetworkPolicies map[string]*NetworkPolicyRule `protobuf:"bytes,5,rep,name=network_policies,json=networkPolicies,proto3" json:"network_policies,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Reusable supervisor middleware configs for network egress, keyed by their - // policy-local names. At most 10 configs are accepted, and at most 10 stages - // can be selected per request. - NetworkMiddlewares map[string]*NetworkMiddlewareConfig `protobuf:"bytes,6,rep,name=network_middlewares,json=networkMiddlewares,proto3" json:"network_middlewares,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxPolicy) Reset() { - *x = SandboxPolicy{} - mi := &file_sandbox_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxPolicy) ProtoMessage() {} - -func (x *SandboxPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxPolicy.ProtoReflect.Descriptor instead. -func (*SandboxPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{0} -} - -func (x *SandboxPolicy) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SandboxPolicy) GetFilesystem() *FilesystemPolicy { - if x != nil { - return x.Filesystem - } - return nil -} - -func (x *SandboxPolicy) GetLandlock() *LandlockPolicy { - if x != nil { - return x.Landlock - } - return nil -} - -func (x *SandboxPolicy) GetProcess() *ProcessPolicy { - if x != nil { - return x.Process - } - return nil -} - -func (x *SandboxPolicy) GetNetworkPolicies() map[string]*NetworkPolicyRule { - if x != nil { - return x.NetworkPolicies - } - return nil -} - -func (x *SandboxPolicy) GetNetworkMiddlewares() map[string]*NetworkMiddlewareConfig { - if x != nil { - return x.NetworkMiddlewares - } - return nil -} - -// Filesystem access policy. -type FilesystemPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Automatically include the workdir as read-write. - IncludeWorkdir bool `protobuf:"varint,1,opt,name=include_workdir,json=includeWorkdir,proto3" json:"include_workdir,omitempty"` - // Read-only directory allow list. - ReadOnly []string `protobuf:"bytes,2,rep,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"` - // Read-write directory allow list. - ReadWrite []string `protobuf:"bytes,3,rep,name=read_write,json=readWrite,proto3" json:"read_write,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *FilesystemPolicy) Reset() { - *x = FilesystemPolicy{} - mi := &file_sandbox_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *FilesystemPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*FilesystemPolicy) ProtoMessage() {} - -func (x *FilesystemPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use FilesystemPolicy.ProtoReflect.Descriptor instead. -func (*FilesystemPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{1} -} - -func (x *FilesystemPolicy) GetIncludeWorkdir() bool { - if x != nil { - return x.IncludeWorkdir - } - return false -} - -func (x *FilesystemPolicy) GetReadOnly() []string { - if x != nil { - return x.ReadOnly - } - return nil -} - -func (x *FilesystemPolicy) GetReadWrite() []string { - if x != nil { - return x.ReadWrite - } - return nil -} - -// Landlock policy configuration. -type LandlockPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Compatibility mode (e.g. "best_effort", "hard_requirement"). - Compatibility string `protobuf:"bytes,1,opt,name=compatibility,proto3" json:"compatibility,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LandlockPolicy) Reset() { - *x = LandlockPolicy{} - mi := &file_sandbox_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LandlockPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LandlockPolicy) ProtoMessage() {} - -func (x *LandlockPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LandlockPolicy.ProtoReflect.Descriptor instead. -func (*LandlockPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{2} -} - -func (x *LandlockPolicy) GetCompatibility() string { - if x != nil { - return x.Compatibility - } - return "" -} - -// Process execution policy. -type ProcessPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // User name to run the sandboxed process as. - RunAsUser string `protobuf:"bytes,1,opt,name=run_as_user,json=runAsUser,proto3" json:"run_as_user,omitempty"` - // Group name to run the sandboxed process as. - RunAsGroup string `protobuf:"bytes,2,opt,name=run_as_group,json=runAsGroup,proto3" json:"run_as_group,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProcessPolicy) Reset() { - *x = ProcessPolicy{} - mi := &file_sandbox_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProcessPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProcessPolicy) ProtoMessage() {} - -func (x *ProcessPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProcessPolicy.ProtoReflect.Descriptor instead. -func (*ProcessPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{3} -} - -func (x *ProcessPolicy) GetRunAsUser() string { - if x != nil { - return x.RunAsUser - } - return "" -} - -func (x *ProcessPolicy) GetRunAsGroup() string { - if x != nil { - return x.RunAsGroup - } - return "" -} - -// A named network access policy rule. -type NetworkPolicyRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable name for this policy rule. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Allowed endpoint (host:port) pairs. - Endpoints []*NetworkEndpoint `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"` - // Allowed binary identities. - Binaries []*NetworkBinary `protobuf:"bytes,3,rep,name=binaries,proto3" json:"binaries,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkPolicyRule) Reset() { - *x = NetworkPolicyRule{} - mi := &file_sandbox_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkPolicyRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkPolicyRule) ProtoMessage() {} - -func (x *NetworkPolicyRule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkPolicyRule.ProtoReflect.Descriptor instead. -func (*NetworkPolicyRule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{4} -} - -func (x *NetworkPolicyRule) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *NetworkPolicyRule) GetEndpoints() []*NetworkEndpoint { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *NetworkPolicyRule) GetBinaries() []*NetworkBinary { - if x != nil { - return x.Binaries - } - return nil -} - -// A reusable middleware config selected for admitted egress by host. -type NetworkMiddlewareConfig struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable name for this middleware config. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Built-in middleware name or operator-owned registration name. - Middleware string `protobuf:"bytes,2,opt,name=middleware,proto3" json:"middleware,omitempty"` - // Service-specific configuration. - Config *structpb.Struct `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"` - // Failure behavior: "fail_closed" (default) or "fail_open". - OnError string `protobuf:"bytes,4,opt,name=on_error,json=onError,proto3" json:"on_error,omitempty"` - // Host selector controlling which admitted destinations use this config. - Endpoints *MiddlewareEndpointSelector `protobuf:"bytes,5,opt,name=endpoints,proto3" json:"endpoints,omitempty"` - // Execution order. Values must be unique within a policy; lower values run first. - Order int32 `protobuf:"varint,6,opt,name=order,proto3" json:"order,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkMiddlewareConfig) Reset() { - *x = NetworkMiddlewareConfig{} - mi := &file_sandbox_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkMiddlewareConfig) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkMiddlewareConfig) ProtoMessage() {} - -func (x *NetworkMiddlewareConfig) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkMiddlewareConfig.ProtoReflect.Descriptor instead. -func (*NetworkMiddlewareConfig) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{5} -} - -func (x *NetworkMiddlewareConfig) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetMiddleware() string { - if x != nil { - return x.Middleware - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetConfig() *structpb.Struct { - if x != nil { - return x.Config - } - return nil -} - -func (x *NetworkMiddlewareConfig) GetOnError() string { - if x != nil { - return x.OnError - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetEndpoints() *MiddlewareEndpointSelector { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *NetworkMiddlewareConfig) GetOrder() int32 { - if x != nil { - return x.Order - } - return 0 -} - -// Host selector controlling which admitted destinations use a middleware config. -type MiddlewareEndpointSelector struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Exact host or DNS glob patterns included in the selection. Include and - // exclude accept at most 32 combined patterns. - Include []string `protobuf:"bytes,1,rep,name=include,proto3" json:"include,omitempty"` - // Exact host or DNS glob patterns removed from the selection. - // Exclusions take precedence over inclusions. - Exclude []string `protobuf:"bytes,2,rep,name=exclude,proto3" json:"exclude,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *MiddlewareEndpointSelector) Reset() { - *x = MiddlewareEndpointSelector{} - mi := &file_sandbox_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *MiddlewareEndpointSelector) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*MiddlewareEndpointSelector) ProtoMessage() {} - -func (x *MiddlewareEndpointSelector) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use MiddlewareEndpointSelector.ProtoReflect.Descriptor instead. -func (*MiddlewareEndpointSelector) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{6} -} - -func (x *MiddlewareEndpointSelector) GetInclude() []string { - if x != nil { - return x.Include - } - return nil -} - -func (x *MiddlewareEndpointSelector) GetExclude() []string { - if x != nil { - return x.Exclude - } - return nil -} - -// A network endpoint (host + port) with optional L7 inspection config. -type NetworkEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Hostname or host glob pattern. Exact match is case-insensitive. - // Glob patterns use "." as delimiter: "*.example.com" matches a single - // subdomain label, "**.example.com" matches across labels. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Single port (backwards compat). Use `ports` for multiple ports. - // Mutually exclusive with `ports` — if both are set, `ports` takes precedence. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - // Application protocol for L7 inspection: "rest", "websocket", "graphql", "sql", or "" (L4-only). - Protocol string `protobuf:"bytes,3,opt,name=protocol,proto3" json:"protocol,omitempty"` - // TLS handling: "terminate" or "passthrough" (default). - Tls string `protobuf:"bytes,4,opt,name=tls,proto3" json:"tls,omitempty"` - // Enforcement mode: "enforce" or "audit" (default). - Enforcement string `protobuf:"bytes,5,opt,name=enforcement,proto3" json:"enforcement,omitempty"` - // Access preset shorthand: "read-only", "read-write", "full". - // Mutually exclusive with rules. - Access string `protobuf:"bytes,6,opt,name=access,proto3" json:"access,omitempty"` - // Explicit L7 rules (mutually exclusive with access). - Rules []*L7Rule `protobuf:"bytes,7,rep,name=rules,proto3" json:"rules,omitempty"` - // Allowed resolved IP addresses or CIDR ranges for this endpoint. - // When non-empty, the SSRF internal-IP check is replaced by an allowlist check: - // - If host is also set: domain must resolve to an IP in this list. - // - If host is empty: any domain is allowed as long as it resolves to an IP in this list. - // - // Supports exact IPs ("10.0.5.20") and CIDR notation ("10.0.5.0/24"). - // Loopback (127.0.0.0/8) and link-local (169.254.0.0/16) are always blocked - // regardless of this field. - AllowedIps []string `protobuf:"bytes,8,rep,name=allowed_ips,json=allowedIps,proto3" json:"allowed_ips,omitempty"` - // Multiple ports. When non-empty, this endpoint covers all listed ports. - // If `port` is set and `ports` is empty, `port` is normalized to `ports: [port]`. - // If both are set, `ports` takes precedence. - Ports []uint32 `protobuf:"varint,9,rep,packed,name=ports,proto3" json:"ports,omitempty"` - // Explicit L7 deny rules. When present, requests matching any deny rule - // are blocked even if they match an allow rule or access preset. - // Deny rules take precedence over allow rules. - DenyRules []*L7DenyRule `protobuf:"bytes,10,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"` - // When true, percent-encoded '/' (%2F) is preserved in path segments - // rather than rejected by the L7 path canonicalizer. Required for - // upstreams like GitLab that embed %2F in namespaced resource paths. - // Defaults to false (strict). - AllowEncodedSlash bool `protobuf:"varint,11,opt,name=allow_encoded_slash,json=allowEncodedSlash,proto3" json:"allow_encoded_slash,omitempty"` - // GraphQL persisted-query behavior for hash-only/saved-query requests: - // "deny" (default) or "allow_registered". - PersistedQueries string `protobuf:"bytes,12,opt,name=persisted_queries,json=persistedQueries,proto3" json:"persisted_queries,omitempty"` - // Trusted GraphQL persisted-query registry keyed by hash or service-specific ID. - // Only used when persisted_queries is "allow_registered". - GraphqlPersistedQueries map[string]*GraphqlOperation `protobuf:"bytes,13,rep,name=graphql_persisted_queries,json=graphqlPersistedQueries,proto3" json:"graphql_persisted_queries,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Maximum GraphQL request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - GraphqlMaxBodyBytes uint32 `protobuf:"varint,14,opt,name=graphql_max_body_bytes,json=graphqlMaxBodyBytes,proto3" json:"graphql_max_body_bytes,omitempty"` - // Optional HTTP path glob that scopes this L7 endpoint on shared host:port APIs. - // Example: use path "/graphql" for protocol "graphql" and "/repos/**" for - // protocol "rest" when both surfaces live under api.example.com:443. - // Empty means all paths. - Path string `protobuf:"bytes,15,opt,name=path,proto3" json:"path,omitempty"` - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside client-to-server WebSocket text messages after an allowed HTTP 101 - // upgrade. Defaults to false. - WebsocketCredentialRewrite bool `protobuf:"varint,16,opt,name=websocket_credential_rewrite,json=websocketCredentialRewrite,proto3" json:"websocket_credential_rewrite,omitempty"` - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside supported textual HTTP request bodies before forwarding upstream. - // Defaults to false. - RequestBodyCredentialRewrite bool `protobuf:"varint,17,opt,name=request_body_credential_rewrite,json=requestBodyCredentialRewrite,proto3" json:"request_body_credential_rewrite,omitempty"` - // Internal provenance marker for policy-advisor generated endpoints. - // Advisor-proposed endpoints must not satisfy exact-host SSRF trust unless - // they are converted through an explicit user-authored policy path. - AdvisorProposed bool `protobuf:"varint,18,opt,name=advisor_proposed,json=advisorProposed,proto3" json:"advisor_proposed,omitempty"` - // Proxy-side credential signing mode: "sigv4" for AWS SigV4 re-signing. - // When set, the proxy strips the client's Authorization header and computes - // a fresh SigV4 signature using real credentials from the provider. - CredentialSigning string `protobuf:"bytes,19,opt,name=credential_signing,json=credentialSigning,proto3" json:"credential_signing,omitempty"` - // AWS signing service name override. Required when credential_signing is - // "sigv4" — e.g. "bedrock" for bedrock-runtime endpoints. - SigningService string `protobuf:"bytes,20,opt,name=signing_service,json=signingService,proto3" json:"signing_service,omitempty"` - // AWS region override for SigV4 signing. When set, takes precedence over - // hostname-based region extraction. Required for non-standard endpoints. - SigningRegion string `protobuf:"bytes,21,opt,name=signing_region,json=signingRegion,proto3" json:"signing_region,omitempty"` - // Maximum JSON-RPC-over-HTTP request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - JsonRpcMaxBodyBytes uint32 `protobuf:"varint,22,opt,name=json_rpc_max_body_bytes,json=jsonRpcMaxBodyBytes,proto3" json:"json_rpc_max_body_bytes,omitempty"` - // MCP-only policy and inspection options. Only used when protocol is "mcp". - Mcp *McpOptions `protobuf:"bytes,23,opt,name=mcp,proto3" json:"mcp,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkEndpoint) Reset() { - *x = NetworkEndpoint{} - mi := &file_sandbox_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkEndpoint) ProtoMessage() {} - -func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead. -func (*NetworkEndpoint) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{7} -} - -func (x *NetworkEndpoint) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *NetworkEndpoint) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *NetworkEndpoint) GetProtocol() string { - if x != nil { - return x.Protocol - } - return "" -} - -func (x *NetworkEndpoint) GetTls() string { - if x != nil { - return x.Tls - } - return "" -} - -func (x *NetworkEndpoint) GetEnforcement() string { - if x != nil { - return x.Enforcement - } - return "" -} - -func (x *NetworkEndpoint) GetAccess() string { - if x != nil { - return x.Access - } - return "" -} - -func (x *NetworkEndpoint) GetRules() []*L7Rule { - if x != nil { - return x.Rules - } - return nil -} - -func (x *NetworkEndpoint) GetAllowedIps() []string { - if x != nil { - return x.AllowedIps - } - return nil -} - -func (x *NetworkEndpoint) GetPorts() []uint32 { - if x != nil { - return x.Ports - } - return nil -} - -func (x *NetworkEndpoint) GetDenyRules() []*L7DenyRule { - if x != nil { - return x.DenyRules - } - return nil -} - -func (x *NetworkEndpoint) GetAllowEncodedSlash() bool { - if x != nil { - return x.AllowEncodedSlash - } - return false -} - -func (x *NetworkEndpoint) GetPersistedQueries() string { - if x != nil { - return x.PersistedQueries - } - return "" -} - -func (x *NetworkEndpoint) GetGraphqlPersistedQueries() map[string]*GraphqlOperation { - if x != nil { - return x.GraphqlPersistedQueries - } - return nil -} - -func (x *NetworkEndpoint) GetGraphqlMaxBodyBytes() uint32 { - if x != nil { - return x.GraphqlMaxBodyBytes - } - return 0 -} - -func (x *NetworkEndpoint) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *NetworkEndpoint) GetWebsocketCredentialRewrite() bool { - if x != nil { - return x.WebsocketCredentialRewrite - } - return false -} - -func (x *NetworkEndpoint) GetRequestBodyCredentialRewrite() bool { - if x != nil { - return x.RequestBodyCredentialRewrite - } - return false -} - -func (x *NetworkEndpoint) GetAdvisorProposed() bool { - if x != nil { - return x.AdvisorProposed - } - return false -} - -func (x *NetworkEndpoint) GetCredentialSigning() string { - if x != nil { - return x.CredentialSigning - } - return "" -} - -func (x *NetworkEndpoint) GetSigningService() string { - if x != nil { - return x.SigningService - } - return "" -} - -func (x *NetworkEndpoint) GetSigningRegion() string { - if x != nil { - return x.SigningRegion - } - return "" -} - -func (x *NetworkEndpoint) GetJsonRpcMaxBodyBytes() uint32 { - if x != nil { - return x.JsonRpcMaxBodyBytes - } - return 0 -} - -func (x *NetworkEndpoint) GetMcp() *McpOptions { - if x != nil { - return x.Mcp - } - return nil -} - -// MCP options are grouped so MCP-specific policy can grow without adding more -// top-level NetworkEndpoint fields. Current enforcement targets the active -// 2025-11-25 Streamable HTTP/tools behavior, while preserving space for -// version-profile policy if OpenShell adopts 2026-07-28 draft behavior later. -// -// Planned policy extensions should use OpenShell-owned static definitions for -// MCP method/version profiles rather than treating dependency enums as the -// policy contract. Candidate profile checks include request metadata/header -// validation, response/SSE introspection, trusted annotation handling, -// resultType/cache metadata validation, x-mcp-header tool-definition checks, -// and subscriptions/listen handling. -// -// Sources: -// - https://modelcontextprotocol.io/specification/2025-11-25/server/tools -// - https://modelcontextprotocol.io/specification/draft/changelog -// - https://modelcontextprotocol.io/specification/draft/basic/transports/streamable-http -// - https://modelcontextprotocol.io/specification/draft/server/tools -type McpOptions struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Hardening boundary for tools/call params.name. When unset or true, the - // supervisor enforces the MCP recommended tool-name syntax - // ^[A-Za-z0-9_.-]{1,128}$ before policy evaluation. Set false only for - // compatibility with servers that intentionally use non-recommended names. - // - // Source: - // - https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names - StrictToolNames *bool `protobuf:"varint,1,opt,name=strict_tool_names,json=strictToolNames,proto3,oneof" json:"strict_tool_names,omitempty"` - // Method-layer default for MCP endpoints. When true, OpenShell allows parsed - // MCP-family methods at the method layer unless a tool-name policy narrows - // tools/call. When unset or false, explicit method rules are required. - AllowAllKnownMcpMethods *bool `protobuf:"varint,2,opt,name=allow_all_known_mcp_methods,json=allowAllKnownMcpMethods,proto3,oneof" json:"allow_all_known_mcp_methods,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *McpOptions) Reset() { - *x = McpOptions{} - mi := &file_sandbox_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *McpOptions) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*McpOptions) ProtoMessage() {} - -func (x *McpOptions) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use McpOptions.ProtoReflect.Descriptor instead. -func (*McpOptions) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{8} -} - -func (x *McpOptions) GetStrictToolNames() bool { - if x != nil && x.StrictToolNames != nil { - return *x.StrictToolNames - } - return false -} - -func (x *McpOptions) GetAllowAllKnownMcpMethods() bool { - if x != nil && x.AllowAllKnownMcpMethods != nil { - return *x.AllowAllKnownMcpMethods - } - return false -} - -// Trusted GraphQL operation classification. -type GraphqlOperation struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Operation type: "query", "mutation", or "subscription". - OperationType string `protobuf:"bytes,1,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // Operation name, if known. - OperationName string `protobuf:"bytes,2,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // Root field names selected by the operation. - Fields []string `protobuf:"bytes,3,rep,name=fields,proto3" json:"fields,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GraphqlOperation) Reset() { - *x = GraphqlOperation{} - mi := &file_sandbox_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GraphqlOperation) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GraphqlOperation) ProtoMessage() {} - -func (x *GraphqlOperation) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GraphqlOperation.ProtoReflect.Descriptor instead. -func (*GraphqlOperation) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{9} -} - -func (x *GraphqlOperation) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *GraphqlOperation) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *GraphqlOperation) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -// An L7 deny rule that blocks specific requests. -// Mirrors L7Allow — same fields, same matching semantics, inverted effect. -// Deny rules are evaluated after allow rules and take precedence. -type L7DenyRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // URL path glob pattern (REST): "/repos/*/pulls/*/reviews", "**" for any. - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"` - // Query parameter matcher map (REST). - // Same semantics as L7Allow.query. - Query map[string]*L7QueryMatcher `protobuf:"bytes,4,rep,name=query,proto3" json:"query,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // GraphQL operation name glob. "*" matches any operation name. - OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // GraphQL root field globs. Deny rules match when any selected root field - // matches any configured glob. - Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"` - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - Params map[string]*L7QueryMatcher `protobuf:"bytes,9,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7DenyRule) Reset() { - *x = L7DenyRule{} - mi := &file_sandbox_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7DenyRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7DenyRule) ProtoMessage() {} - -func (x *L7DenyRule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7DenyRule.ProtoReflect.Descriptor instead. -func (*L7DenyRule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{10} -} - -func (x *L7DenyRule) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7DenyRule) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7DenyRule) GetCommand() string { - if x != nil { - return x.Command - } - return "" -} - -func (x *L7DenyRule) GetQuery() map[string]*L7QueryMatcher { - if x != nil { - return x.Query - } - return nil -} - -func (x *L7DenyRule) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *L7DenyRule) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *L7DenyRule) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -func (x *L7DenyRule) GetParams() map[string]*L7QueryMatcher { - if x != nil { - return x.Params - } - return nil -} - -// An L7 policy rule (allow-only). -type L7Rule struct { - state protoimpl.MessageState `protogen:"open.v1"` - Allow *L7Allow `protobuf:"bytes,1,opt,name=allow,proto3" json:"allow,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7Rule) Reset() { - *x = L7Rule{} - mi := &file_sandbox_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7Rule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7Rule) ProtoMessage() {} - -func (x *L7Rule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7Rule.ProtoReflect.Descriptor instead. -func (*L7Rule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{11} -} - -func (x *L7Rule) GetAllow() *L7Allow { - if x != nil { - return x.Allow - } - return nil -} - -// Allowed action definition for L7 rules. -type L7Allow struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // URL path glob pattern (REST): "/repos/**", "**" for any. - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"` - // Query parameter matcher map (REST). - // Key is the decoded query parameter name (case-sensitive). - // Value supports either a single glob (`glob`) or a list (`any`). - Query map[string]*L7QueryMatcher `protobuf:"bytes,4,rep,name=query,proto3" json:"query,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // GraphQL operation name glob. "*" matches any operation name. - OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // GraphQL root field globs. Allow rules match only when every selected root - // field matches one of the configured globs. Omit to match all fields. - Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"` - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - Params map[string]*L7QueryMatcher `protobuf:"bytes,9,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7Allow) Reset() { - *x = L7Allow{} - mi := &file_sandbox_proto_msgTypes[12] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7Allow) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7Allow) ProtoMessage() {} - -func (x *L7Allow) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[12] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7Allow.ProtoReflect.Descriptor instead. -func (*L7Allow) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{12} -} - -func (x *L7Allow) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7Allow) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7Allow) GetCommand() string { - if x != nil { - return x.Command - } - return "" -} - -func (x *L7Allow) GetQuery() map[string]*L7QueryMatcher { - if x != nil { - return x.Query - } - return nil -} - -func (x *L7Allow) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *L7Allow) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *L7Allow) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -func (x *L7Allow) GetParams() map[string]*L7QueryMatcher { - if x != nil { - return x.Params - } - return nil -} - -// Query value matcher for one query parameter key. -type L7QueryMatcher struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Single glob pattern. - Glob string `protobuf:"bytes,1,opt,name=glob,proto3" json:"glob,omitempty"` - // Any-of glob patterns. - Any []string `protobuf:"bytes,2,rep,name=any,proto3" json:"any,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7QueryMatcher) Reset() { - *x = L7QueryMatcher{} - mi := &file_sandbox_proto_msgTypes[13] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7QueryMatcher) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7QueryMatcher) ProtoMessage() {} - -func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[13] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7QueryMatcher.ProtoReflect.Descriptor instead. -func (*L7QueryMatcher) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{13} -} - -func (x *L7QueryMatcher) GetGlob() string { - if x != nil { - return x.Glob - } - return "" -} - -func (x *L7QueryMatcher) GetAny() []string { - if x != nil { - return x.Any - } - return nil -} - -// A binary identity for network policy matching. -type NetworkBinary struct { - state protoimpl.MessageState `protogen:"open.v1"` - Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"` - // Deprecated: the harness concept has been removed. This field is ignored. - // - // Deprecated: Marked as deprecated in sandbox.proto. - Harness bool `protobuf:"varint,2,opt,name=harness,proto3" json:"harness,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkBinary) Reset() { - *x = NetworkBinary{} - mi := &file_sandbox_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkBinary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkBinary) ProtoMessage() {} - -func (x *NetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkBinary.ProtoReflect.Descriptor instead. -func (*NetworkBinary) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{14} -} - -func (x *NetworkBinary) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -// Deprecated: Marked as deprecated in sandbox.proto. -func (x *NetworkBinary) GetHarness() bool { - if x != nil { - return x.Harness - } - return false -} - -// Request to get sandbox settings by sandbox ID. -type GetSandboxConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxConfigRequest) Reset() { - *x = GetSandboxConfigRequest{} - mi := &file_sandbox_proto_msgTypes[15] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxConfigRequest) ProtoMessage() {} - -func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[15] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxConfigRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxConfigRequest) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{15} -} - -func (x *GetSandboxConfigRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Request to get gateway-global settings. -type GetGatewayConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayConfigRequest) Reset() { - *x = GetGatewayConfigRequest{} - mi := &file_sandbox_proto_msgTypes[16] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayConfigRequest) ProtoMessage() {} - -func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[16] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayConfigRequest.ProtoReflect.Descriptor instead. -func (*GetGatewayConfigRequest) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{16} -} - -// Response containing gateway-global settings. -type GetGatewayConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-global settings map excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty SettingValue. - Settings map[string]*SettingValue `protobuf:"bytes,1,rep,name=settings,proto3" json:"settings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Monotonically increasing revision for gateway-global settings. - SettingsRevision uint64 `protobuf:"varint,2,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayConfigResponse) Reset() { - *x = GetGatewayConfigResponse{} - mi := &file_sandbox_proto_msgTypes[17] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayConfigResponse) ProtoMessage() {} - -func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[17] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayConfigResponse.ProtoReflect.Descriptor instead. -func (*GetGatewayConfigResponse) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{17} -} - -func (x *GetGatewayConfigResponse) GetSettings() map[string]*SettingValue { - if x != nil { - return x.Settings - } - return nil -} - -func (x *GetGatewayConfigResponse) GetSettingsRevision() uint64 { - if x != nil { - return x.SettingsRevision - } - return 0 -} - -// Type-aware setting value for sandbox/gateway settings. -type SettingValue struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Value: - // - // *SettingValue_StringValue - // *SettingValue_BoolValue - // *SettingValue_IntValue - // *SettingValue_BytesValue - Value isSettingValue_Value `protobuf_oneof:"value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SettingValue) Reset() { - *x = SettingValue{} - mi := &file_sandbox_proto_msgTypes[18] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SettingValue) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SettingValue) ProtoMessage() {} - -func (x *SettingValue) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[18] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SettingValue.ProtoReflect.Descriptor instead. -func (*SettingValue) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{18} -} - -func (x *SettingValue) GetValue() isSettingValue_Value { - if x != nil { - return x.Value - } - return nil -} - -func (x *SettingValue) GetStringValue() string { - if x != nil { - if x, ok := x.Value.(*SettingValue_StringValue); ok { - return x.StringValue - } - } - return "" -} - -func (x *SettingValue) GetBoolValue() bool { - if x != nil { - if x, ok := x.Value.(*SettingValue_BoolValue); ok { - return x.BoolValue - } - } - return false -} - -func (x *SettingValue) GetIntValue() int64 { - if x != nil { - if x, ok := x.Value.(*SettingValue_IntValue); ok { - return x.IntValue - } - } - return 0 -} - -func (x *SettingValue) GetBytesValue() []byte { - if x != nil { - if x, ok := x.Value.(*SettingValue_BytesValue); ok { - return x.BytesValue - } - } - return nil -} - -type isSettingValue_Value interface { - isSettingValue_Value() -} - -type SettingValue_StringValue struct { - StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof"` -} - -type SettingValue_BoolValue struct { - BoolValue bool `protobuf:"varint,2,opt,name=bool_value,json=boolValue,proto3,oneof"` -} - -type SettingValue_IntValue struct { - IntValue int64 `protobuf:"varint,3,opt,name=int_value,json=intValue,proto3,oneof"` -} - -type SettingValue_BytesValue struct { - BytesValue []byte `protobuf:"bytes,4,opt,name=bytes_value,json=bytesValue,proto3,oneof"` -} - -func (*SettingValue_StringValue) isSettingValue_Value() {} - -func (*SettingValue_BoolValue) isSettingValue_Value() {} - -func (*SettingValue_IntValue) isSettingValue_Value() {} - -func (*SettingValue_BytesValue) isSettingValue_Value() {} - -// Effective setting value and the scope it was resolved from. -type EffectiveSetting struct { - state protoimpl.MessageState `protogen:"open.v1"` - Value *SettingValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"` - Scope SettingScope `protobuf:"varint,2,opt,name=scope,proto3,enum=openshell.sandbox.v1.SettingScope" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EffectiveSetting) Reset() { - *x = EffectiveSetting{} - mi := &file_sandbox_proto_msgTypes[19] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EffectiveSetting) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EffectiveSetting) ProtoMessage() {} - -func (x *EffectiveSetting) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[19] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EffectiveSetting.ProtoReflect.Descriptor instead. -func (*EffectiveSetting) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{19} -} - -func (x *EffectiveSetting) GetValue() *SettingValue { - if x != nil { - return x.Value - } - return nil -} - -func (x *EffectiveSetting) GetScope() SettingScope { - if x != nil { - return x.Scope - } - return SettingScope_SETTING_SCOPE_UNSPECIFIED -} - -// Response containing effective sandbox settings and policy. -type GetSandboxConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox policy configuration. - Policy *SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` - // Current policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,3,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Effective settings resolved for this sandbox, excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty EffectiveSetting.value. - Settings map[string]*EffectiveSetting `protobuf:"bytes,4,rep,name=settings,proto3" json:"settings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Fingerprint for effective config (policy + settings). Changes when any effective input changes. - ConfigRevision uint64 `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"` - // Source of the policy payload for this response. - PolicySource PolicySource `protobuf:"varint,6,opt,name=policy_source,json=policySource,proto3,enum=openshell.sandbox.v1.PolicySource" json:"policy_source,omitempty"` - // When policy_source is GLOBAL, the version of the global policy revision. - // Zero when no global policy is active or when policy_source is SANDBOX. - GlobalPolicyVersion uint32 `protobuf:"varint,7,opt,name=global_policy_version,json=globalPolicyVersion,proto3" json:"global_policy_version,omitempty"` - // Fingerprint for provider credential inputs attached to this sandbox. - // Changes when attached provider names or attached provider records change. - ProviderEnvRevision uint64 `protobuf:"varint,8,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` - // Operator-registered supervisor middleware services required by the - // effective policy. Built-in middleware is not included. - SupervisorMiddlewareServices []*SupervisorMiddlewareService `protobuf:"bytes,9,rep,name=supervisor_middleware_services,json=supervisorMiddlewareServices,proto3" json:"supervisor_middleware_services,omitempty"` - // Workspace the sandbox belongs to. Allows the supervisor to learn its - // workspace context for subsequent workspace-scoped RPCs. - Workspace string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxConfigResponse) Reset() { - *x = GetSandboxConfigResponse{} - mi := &file_sandbox_proto_msgTypes[20] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxConfigResponse) ProtoMessage() {} - -func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[20] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxConfigResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxConfigResponse) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{20} -} - -func (x *GetSandboxConfigResponse) GetPolicy() *SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *GetSandboxConfigResponse) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *GetSandboxConfigResponse) GetSettings() map[string]*EffectiveSetting { - if x != nil { - return x.Settings - } - return nil -} - -func (x *GetSandboxConfigResponse) GetConfigRevision() uint64 { - if x != nil { - return x.ConfigRevision - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetPolicySource() PolicySource { - if x != nil { - return x.PolicySource - } - return PolicySource_POLICY_SOURCE_UNSPECIFIED -} - -func (x *GetSandboxConfigResponse) GetGlobalPolicyVersion() uint32 { - if x != nil { - return x.GlobalPolicyVersion - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetProviderEnvRevision() uint64 { - if x != nil { - return x.ProviderEnvRevision - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetSupervisorMiddlewareServices() []*SupervisorMiddlewareService { - if x != nil { - return x.SupervisorMiddlewareServices - } - return nil -} - -func (x *GetSandboxConfigResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Connection details for one operator-registered supervisor middleware service. -// V1 supports plaintext and server-authenticated TLS gRPC. -type SupervisorMiddlewareService struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Operator-owned registration name used by policy attachments and diagnostics. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // gRPC endpoint reachable from the sandbox supervisor. - GrpcEndpoint string `protobuf:"bytes,2,opt,name=grpc_endpoint,json=grpcEndpoint,proto3" json:"grpc_endpoint,omitempty"` - // Operator-owned body limit applied to every binding exposed by the service. - MaxBodyBytes uint64 `protobuf:"varint,3,opt,name=max_body_bytes,json=maxBodyBytes,proto3" json:"max_body_bytes,omitempty"` - // Default RPC timeout for this service. Empty uses the platform default of - // 500ms. Values use an integer with an `ms` or `s` suffix and must be - // between 10ms and 30s. - Timeout string `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorMiddlewareService) Reset() { - *x = SupervisorMiddlewareService{} - mi := &file_sandbox_proto_msgTypes[21] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorMiddlewareService) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorMiddlewareService) ProtoMessage() {} - -func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[21] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorMiddlewareService.ProtoReflect.Descriptor instead. -func (*SupervisorMiddlewareService) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{21} -} - -func (x *SupervisorMiddlewareService) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *SupervisorMiddlewareService) GetGrpcEndpoint() string { - if x != nil { - return x.GrpcEndpoint - } - return "" -} - -func (x *SupervisorMiddlewareService) GetMaxBodyBytes() uint64 { - if x != nil { - return x.MaxBodyBytes - } - return 0 -} - -func (x *SupervisorMiddlewareService) GetTimeout() string { - if x != nil { - return x.Timeout - } - return "" -} - -var File_sandbox_proto protoreflect.FileDescriptor - -const file_sandbox_proto_rawDesc = "" + - "\n" + - "\rsandbox.proto\x12\x14openshell.sandbox.v1\x1a\x1cgoogle/protobuf/struct.proto\"\xa8\x05\n" + - "\rSandboxPolicy\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12F\n" + - "\n" + - "filesystem\x18\x02 \x01(\v2&.openshell.sandbox.v1.FilesystemPolicyR\n" + - "filesystem\x12@\n" + - "\blandlock\x18\x03 \x01(\v2$.openshell.sandbox.v1.LandlockPolicyR\blandlock\x12=\n" + - "\aprocess\x18\x04 \x01(\v2#.openshell.sandbox.v1.ProcessPolicyR\aprocess\x12c\n" + - "\x10network_policies\x18\x05 \x03(\v28.openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntryR\x0fnetworkPolicies\x12l\n" + - "\x13network_middlewares\x18\x06 \x03(\v2;.openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntryR\x12networkMiddlewares\x1ak\n" + - "\x14NetworkPoliciesEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12=\n" + - "\x05value\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x05value:\x028\x01\x1at\n" + - "\x17NetworkMiddlewaresEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12C\n" + - "\x05value\x18\x02 \x01(\v2-.openshell.sandbox.v1.NetworkMiddlewareConfigR\x05value:\x028\x01\"w\n" + - "\x10FilesystemPolicy\x12'\n" + - "\x0finclude_workdir\x18\x01 \x01(\bR\x0eincludeWorkdir\x12\x1b\n" + - "\tread_only\x18\x02 \x03(\tR\breadOnly\x12\x1d\n" + - "\n" + - "read_write\x18\x03 \x03(\tR\treadWrite\"6\n" + - "\x0eLandlockPolicy\x12$\n" + - "\rcompatibility\x18\x01 \x01(\tR\rcompatibility\"Q\n" + - "\rProcessPolicy\x12\x1e\n" + - "\vrun_as_user\x18\x01 \x01(\tR\trunAsUser\x12 \n" + - "\frun_as_group\x18\x02 \x01(\tR\n" + - "runAsGroup\"\xad\x01\n" + - "\x11NetworkPolicyRule\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12C\n" + - "\tendpoints\x18\x02 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" + - "\bbinaries\x18\x03 \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\"\xff\x01\n" + - "\x17NetworkMiddlewareConfig\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n" + - "\n" + - "middleware\x18\x02 \x01(\tR\n" + - "middleware\x12/\n" + - "\x06config\x18\x03 \x01(\v2\x17.google.protobuf.StructR\x06config\x12\x19\n" + - "\bon_error\x18\x04 \x01(\tR\aonError\x12N\n" + - "\tendpoints\x18\x05 \x01(\v20.openshell.sandbox.v1.MiddlewareEndpointSelectorR\tendpoints\x12\x14\n" + - "\x05order\x18\x06 \x01(\x05R\x05order\"P\n" + - "\x1aMiddlewareEndpointSelector\x12\x18\n" + - "\ainclude\x18\x01 \x03(\tR\ainclude\x12\x18\n" + - "\aexclude\x18\x02 \x03(\tR\aexclude\"\x84\t\n" + - "\x0fNetworkEndpoint\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12\x1a\n" + - "\bprotocol\x18\x03 \x01(\tR\bprotocol\x12\x10\n" + - "\x03tls\x18\x04 \x01(\tR\x03tls\x12 \n" + - "\venforcement\x18\x05 \x01(\tR\venforcement\x12\x16\n" + - "\x06access\x18\x06 \x01(\tR\x06access\x122\n" + - "\x05rules\x18\a \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\x12\x1f\n" + - "\vallowed_ips\x18\b \x03(\tR\n" + - "allowedIps\x12\x14\n" + - "\x05ports\x18\t \x03(\rR\x05ports\x12?\n" + - "\n" + - "deny_rules\x18\n" + - " \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\x12.\n" + - "\x13allow_encoded_slash\x18\v \x01(\bR\x11allowEncodedSlash\x12+\n" + - "\x11persisted_queries\x18\f \x01(\tR\x10persistedQueries\x12~\n" + - "\x19graphql_persisted_queries\x18\r \x03(\v2B.openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntryR\x17graphqlPersistedQueries\x123\n" + - "\x16graphql_max_body_bytes\x18\x0e \x01(\rR\x13graphqlMaxBodyBytes\x12\x12\n" + - "\x04path\x18\x0f \x01(\tR\x04path\x12@\n" + - "\x1cwebsocket_credential_rewrite\x18\x10 \x01(\bR\x1awebsocketCredentialRewrite\x12E\n" + - "\x1frequest_body_credential_rewrite\x18\x11 \x01(\bR\x1crequestBodyCredentialRewrite\x12)\n" + - "\x10advisor_proposed\x18\x12 \x01(\bR\x0fadvisorProposed\x12-\n" + - "\x12credential_signing\x18\x13 \x01(\tR\x11credentialSigning\x12'\n" + - "\x0fsigning_service\x18\x14 \x01(\tR\x0esigningService\x12%\n" + - "\x0esigning_region\x18\x15 \x01(\tR\rsigningRegion\x124\n" + - "\x17json_rpc_max_body_bytes\x18\x16 \x01(\rR\x13jsonRpcMaxBodyBytes\x122\n" + - "\x03mcp\x18\x17 \x01(\v2 .openshell.sandbox.v1.McpOptionsR\x03mcp\x1ar\n" + - "\x1cGraphqlPersistedQueriesEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12<\n" + - "\x05value\x18\x02 \x01(\v2&.openshell.sandbox.v1.GraphqlOperationR\x05value:\x028\x01\"\xb6\x01\n" + - "\n" + - "McpOptions\x12/\n" + - "\x11strict_tool_names\x18\x01 \x01(\bH\x00R\x0fstrictToolNames\x88\x01\x01\x12A\n" + - "\x1ballow_all_known_mcp_methods\x18\x02 \x01(\bH\x01R\x17allowAllKnownMcpMethods\x88\x01\x01B\x14\n" + - "\x12_strict_tool_namesB\x1e\n" + - "\x1c_allow_all_known_mcp_methods\"x\n" + - "\x10GraphqlOperation\x12%\n" + - "\x0eoperation_type\x18\x01 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x02 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\x03 \x03(\tR\x06fields\"\x88\x04\n" + - "\n" + - "L7DenyRule\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x18\n" + - "\acommand\x18\x03 \x01(\tR\acommand\x12A\n" + - "\x05query\x18\x04 \x03(\v2+.openshell.sandbox.v1.L7DenyRule.QueryEntryR\x05query\x12%\n" + - "\x0eoperation_type\x18\x05 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x06 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\a \x03(\tR\x06fields\x12D\n" + - "\x06params\x18\t \x03(\v2,.openshell.sandbox.v1.L7DenyRule.ParamsEntryR\x06params\x1a^\n" + - "\n" + - "QueryEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01\x1a_\n" + - "\vParamsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01J\x04\b\b\x10\t\"=\n" + - "\x06L7Rule\x123\n" + - "\x05allow\x18\x01 \x01(\v2\x1d.openshell.sandbox.v1.L7AllowR\x05allow\"\xff\x03\n" + - "\aL7Allow\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x18\n" + - "\acommand\x18\x03 \x01(\tR\acommand\x12>\n" + - "\x05query\x18\x04 \x03(\v2(.openshell.sandbox.v1.L7Allow.QueryEntryR\x05query\x12%\n" + - "\x0eoperation_type\x18\x05 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x06 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\a \x03(\tR\x06fields\x12A\n" + - "\x06params\x18\t \x03(\v2).openshell.sandbox.v1.L7Allow.ParamsEntryR\x06params\x1a^\n" + - "\n" + - "QueryEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01\x1a_\n" + - "\vParamsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01J\x04\b\b\x10\t\"6\n" + - "\x0eL7QueryMatcher\x12\x12\n" + - "\x04glob\x18\x01 \x01(\tR\x04glob\x12\x10\n" + - "\x03any\x18\x02 \x03(\tR\x03any\"A\n" + - "\rNetworkBinary\x12\x12\n" + - "\x04path\x18\x01 \x01(\tR\x04path\x12\x1c\n" + - "\aharness\x18\x02 \x01(\bB\x02\x18\x01R\aharness\"8\n" + - "\x17GetSandboxConfigRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x19\n" + - "\x17GetGatewayConfigRequest\"\x82\x02\n" + - "\x18GetGatewayConfigResponse\x12X\n" + - "\bsettings\x18\x01 \x03(\v2<.openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntryR\bsettings\x12+\n" + - "\x11settings_revision\x18\x02 \x01(\x04R\x10settingsRevision\x1a_\n" + - "\rSettingsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x128\n" + - "\x05value\x18\x02 \x01(\v2\".openshell.sandbox.v1.SettingValueR\x05value:\x028\x01\"\x9f\x01\n" + - "\fSettingValue\x12#\n" + - "\fstring_value\x18\x01 \x01(\tH\x00R\vstringValue\x12\x1f\n" + - "\n" + - "bool_value\x18\x02 \x01(\bH\x00R\tboolValue\x12\x1d\n" + - "\tint_value\x18\x03 \x01(\x03H\x00R\bintValue\x12!\n" + - "\vbytes_value\x18\x04 \x01(\fH\x00R\n" + - "bytesValueB\a\n" + - "\x05value\"\x86\x01\n" + - "\x10EffectiveSetting\x128\n" + - "\x05value\x18\x01 \x01(\v2\".openshell.sandbox.v1.SettingValueR\x05value\x128\n" + - "\x05scope\x18\x02 \x01(\x0e2\".openshell.sandbox.v1.SettingScopeR\x05scope\"\xc2\x05\n" + - "\x18GetSandboxConfigResponse\x12;\n" + - "\x06policy\x18\x01 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x03 \x01(\tR\n" + - "policyHash\x12X\n" + - "\bsettings\x18\x04 \x03(\v2<.openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntryR\bsettings\x12'\n" + - "\x0fconfig_revision\x18\x05 \x01(\x04R\x0econfigRevision\x12G\n" + - "\rpolicy_source\x18\x06 \x01(\x0e2\".openshell.sandbox.v1.PolicySourceR\fpolicySource\x122\n" + - "\x15global_policy_version\x18\a \x01(\rR\x13globalPolicyVersion\x122\n" + - "\x15provider_env_revision\x18\b \x01(\x04R\x13providerEnvRevision\x12w\n" + - "\x1esupervisor_middleware_services\x18\t \x03(\v21.openshell.sandbox.v1.SupervisorMiddlewareServiceR\x1csupervisorMiddlewareServices\x12\x1c\n" + - "\tworkspace\x18\n" + - " \x01(\tR\tworkspace\x1ac\n" + - "\rSettingsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12<\n" + - "\x05value\x18\x02 \x01(\v2&.openshell.sandbox.v1.EffectiveSettingR\x05value:\x028\x01\"\x96\x01\n" + - "\x1bSupervisorMiddlewareService\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12#\n" + - "\rgrpc_endpoint\x18\x02 \x01(\tR\fgrpcEndpoint\x12$\n" + - "\x0emax_body_bytes\x18\x03 \x01(\x04R\fmaxBodyBytes\x12\x18\n" + - "\atimeout\x18\x04 \x01(\tR\atimeout*b\n" + - "\fSettingScope\x12\x1d\n" + - "\x19SETTING_SCOPE_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15SETTING_SCOPE_SANDBOX\x10\x01\x12\x18\n" + - "\x14SETTING_SCOPE_GLOBAL\x10\x02*b\n" + - "\fPolicySource\x12\x1d\n" + - "\x19POLICY_SOURCE_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15POLICY_SOURCE_SANDBOX\x10\x01\x12\x18\n" + - "\x14POLICY_SOURCE_GLOBAL\x10\x02b\x06proto3" - -var ( - file_sandbox_proto_rawDescOnce sync.Once - file_sandbox_proto_rawDescData []byte -) - -func file_sandbox_proto_rawDescGZIP() []byte { - file_sandbox_proto_rawDescOnce.Do(func() { - file_sandbox_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc))) - }) - return file_sandbox_proto_rawDescData -} - -var file_sandbox_proto_enumTypes = make([]protoimpl.EnumInfo, 2) -var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 31) -var file_sandbox_proto_goTypes = []any{ - (SettingScope)(0), // 0: openshell.sandbox.v1.SettingScope - (PolicySource)(0), // 1: openshell.sandbox.v1.PolicySource - (*SandboxPolicy)(nil), // 2: openshell.sandbox.v1.SandboxPolicy - (*FilesystemPolicy)(nil), // 3: openshell.sandbox.v1.FilesystemPolicy - (*LandlockPolicy)(nil), // 4: openshell.sandbox.v1.LandlockPolicy - (*ProcessPolicy)(nil), // 5: openshell.sandbox.v1.ProcessPolicy - (*NetworkPolicyRule)(nil), // 6: openshell.sandbox.v1.NetworkPolicyRule - (*NetworkMiddlewareConfig)(nil), // 7: openshell.sandbox.v1.NetworkMiddlewareConfig - (*MiddlewareEndpointSelector)(nil), // 8: openshell.sandbox.v1.MiddlewareEndpointSelector - (*NetworkEndpoint)(nil), // 9: openshell.sandbox.v1.NetworkEndpoint - (*McpOptions)(nil), // 10: openshell.sandbox.v1.McpOptions - (*GraphqlOperation)(nil), // 11: openshell.sandbox.v1.GraphqlOperation - (*L7DenyRule)(nil), // 12: openshell.sandbox.v1.L7DenyRule - (*L7Rule)(nil), // 13: openshell.sandbox.v1.L7Rule - (*L7Allow)(nil), // 14: openshell.sandbox.v1.L7Allow - (*L7QueryMatcher)(nil), // 15: openshell.sandbox.v1.L7QueryMatcher - (*NetworkBinary)(nil), // 16: openshell.sandbox.v1.NetworkBinary - (*GetSandboxConfigRequest)(nil), // 17: openshell.sandbox.v1.GetSandboxConfigRequest - (*GetGatewayConfigRequest)(nil), // 18: openshell.sandbox.v1.GetGatewayConfigRequest - (*GetGatewayConfigResponse)(nil), // 19: openshell.sandbox.v1.GetGatewayConfigResponse - (*SettingValue)(nil), // 20: openshell.sandbox.v1.SettingValue - (*EffectiveSetting)(nil), // 21: openshell.sandbox.v1.EffectiveSetting - (*GetSandboxConfigResponse)(nil), // 22: openshell.sandbox.v1.GetSandboxConfigResponse - (*SupervisorMiddlewareService)(nil), // 23: openshell.sandbox.v1.SupervisorMiddlewareService - nil, // 24: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry - nil, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry - nil, // 26: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry - nil, // 27: openshell.sandbox.v1.L7DenyRule.QueryEntry - nil, // 28: openshell.sandbox.v1.L7DenyRule.ParamsEntry - nil, // 29: openshell.sandbox.v1.L7Allow.QueryEntry - nil, // 30: openshell.sandbox.v1.L7Allow.ParamsEntry - nil, // 31: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry - nil, // 32: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry - (*structpb.Struct)(nil), // 33: google.protobuf.Struct -} -var file_sandbox_proto_depIdxs = []int32{ - 3, // 0: openshell.sandbox.v1.SandboxPolicy.filesystem:type_name -> openshell.sandbox.v1.FilesystemPolicy - 4, // 1: openshell.sandbox.v1.SandboxPolicy.landlock:type_name -> openshell.sandbox.v1.LandlockPolicy - 5, // 2: openshell.sandbox.v1.SandboxPolicy.process:type_name -> openshell.sandbox.v1.ProcessPolicy - 24, // 3: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry - 25, // 4: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry - 9, // 5: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 16, // 6: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 33, // 7: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct - 8, // 8: openshell.sandbox.v1.NetworkMiddlewareConfig.endpoints:type_name -> openshell.sandbox.v1.MiddlewareEndpointSelector - 13, // 9: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule - 12, // 10: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 26, // 11: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry - 10, // 12: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions - 27, // 13: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry - 28, // 14: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry - 14, // 15: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow - 29, // 16: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry - 30, // 17: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry - 31, // 18: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry - 20, // 19: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue - 0, // 20: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope - 2, // 21: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 32, // 22: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry - 1, // 23: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource - 23, // 24: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService - 6, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 7, // 26: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig - 11, // 27: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation - 15, // 28: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 29: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 30: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 31: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 20, // 32: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue - 21, // 33: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting - 34, // [34:34] is the sub-list for method output_type - 34, // [34:34] is the sub-list for method input_type - 34, // [34:34] is the sub-list for extension type_name - 34, // [34:34] is the sub-list for extension extendee - 0, // [0:34] is the sub-list for field type_name -} - -func init() { file_sandbox_proto_init() } -func file_sandbox_proto_init() { - if File_sandbox_proto != nil { - return - } - file_sandbox_proto_msgTypes[8].OneofWrappers = []any{} - file_sandbox_proto_msgTypes[18].OneofWrappers = []any{ - (*SettingValue_StringValue)(nil), - (*SettingValue_BoolValue)(nil), - (*SettingValue_IntValue)(nil), - (*SettingValue_BytesValue)(nil), - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)), - NumEnums: 2, - NumMessages: 31, - NumExtensions: 0, - NumServices: 0, - }, - GoTypes: file_sandbox_proto_goTypes, - DependencyIndexes: file_sandbox_proto_depIdxs, - EnumInfos: file_sandbox_proto_enumTypes, - MessageInfos: file_sandbox_proto_msgTypes, - }.Build() - File_sandbox_proto = out.File - file_sandbox_proto_goTypes = nil - file_sandbox_proto_depIdxs = nil -} diff --git a/backend/go.mod b/backend/go.mod index f2de19e3..4d1579ce 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -3,15 +3,18 @@ module github.com/Gkrumbach07/openshell-dashboard/backend go 1.25.1 require ( + github.com/NVIDIA/OpenShell/sdk/go v0.0.0-20260814001211-c4b500a7de64 github.com/go-chi/chi/v5 v5.3.1 github.com/gorilla/websocket v1.5.3 google.golang.org/grpc v1.82.1 - google.golang.org/protobuf v1.36.11 ) require ( golang.org/x/net v0.53.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect + golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.43.0 // indirect golang.org/x/text v0.36.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/backend/go.sum b/backend/go.sum index 78149894..8df43756 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -1,5 +1,9 @@ +github.com/NVIDIA/OpenShell/sdk/go v0.0.0-20260814001211-c4b500a7de64 h1:1bxTs8ykTjWia0soV7vw6m/0ZhWDjcOD38kGOcH/7r4= +github.com/NVIDIA/OpenShell/sdk/go v0.0.0-20260814001211-c4b500a7de64/go.mod h1:PPbbhH5tmSfoWzVcb5CXurnMkuJOYpesZmUB1itrlFY= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8= github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= @@ -14,6 +18,10 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= @@ -28,6 +36,10 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= @@ -40,3 +52,5 @@ google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/backend/internal/api/app.go b/backend/internal/api/app.go index 7552c574..a8fec14b 100644 --- a/backend/internal/api/app.go +++ b/backend/internal/api/app.go @@ -2,6 +2,7 @@ package api import ( + "context" "net/http" "os" "path/filepath" @@ -10,14 +11,23 @@ import ( "github.com/go-chi/chi/v5" chimiddleware "github.com/go-chi/chi/v5/middleware" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/gateway" ) -// App wires the gateway client, auth middleware, and REST routes. +// StdinExecer runs a command in a sandbox with piped stdin and no TTY — the +// binary-safe exec path the SDK does not expose. Used only for file upload. +// Implemented by sdkclient.RawExecClient. +type StdinExecer interface { + ExecWithStdin(ctx context.Context, sandboxID string, command []string, stdin []byte) (string, int, error) +} + +// App wires the OpenShell SDK client, auth middleware, and REST routes. type App struct { //nolint:govet // fieldalignment: readability over padding - gateway gateway.Interface - auth *auth.Middleware + sdk openshell.ClientInterface + execUpload StdinExecer + auth *auth.Middleware // authConfig is serialized to the browser via GET /auth/config — never // put secrets in it. authConfig AuthConfigResponse @@ -27,9 +37,10 @@ type App struct { //nolint:govet // fieldalignment: readability over padding } // NewApp builds the application. -func NewApp(gw gateway.Interface, authMiddleware *auth.Middleware, staticDir string, authCfg AuthConfigResponse) *App { +func NewApp(sdkClient openshell.ClientInterface, execUpload StdinExecer, authMiddleware *auth.Middleware, staticDir string, authCfg AuthConfigResponse) *App { app := &App{ - gateway: gw, + sdk: sdkClient, + execUpload: execUpload, auth: authMiddleware, authConfig: authCfg, staticDir: staticDir, diff --git a/backend/internal/api/drafts_handler.go b/backend/internal/api/drafts_handler.go index 334d6d85..b04082f6 100644 --- a/backend/internal/api/drafts_handler.go +++ b/backend/internal/api/drafts_handler.go @@ -7,6 +7,8 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) @@ -30,24 +32,28 @@ func (app *App) GetDraftSummary(w http.ResponseWriter, _ *http.Request) { // GetDraftPolicy returns the draft-policy inbox for a sandbox. Optional // ?status=pending|approved|rejected filter. func (app *App) GetDraftPolicy(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetDraftPolicy(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), r.URL.Query().Get("status")) + var opts []openshell.GetDraftOption + if status := r.URL.Query().Get("status"); status != "" { + opts = append(opts, openshell.WithStatusFilter(status)) + } + draft, err := app.sdk.Policy().GetDraft(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromDraftPolicy(resp)) + writeJSON(w, http.StatusOK, models.FromSDKDraftPolicy(draft)) } // ApproveDraftChunk merges one proposed rule into the active policy. func (app *App) ApproveDraftChunk(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ApproveDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) + result, err := app.sdk.Policy().ApproveDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetPolicyVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.PolicyVersion, + PolicyHash: result.PolicyHash, }) } @@ -63,8 +69,8 @@ func (app *App) RejectDraftChunk(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - if _, err := app.gateway.RejectDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), body.Reason); err != nil { - writeGrpcError(w, err) + if err := app.sdk.Policy().RejectDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), body.Reason); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"rejected": true}) @@ -82,20 +88,24 @@ func (app *App) ApproveAllDraftChunks(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - resp, err := app.gateway.ApproveAllDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.IncludeSecurityFlagged) + var opts []openshell.ApproveAllOption + if body.IncludeSecurityFlagged { + opts = append(opts, openshell.WithIncludeSecurityFlagged()) + } + result, err := app.sdk.Policy().ApproveAllDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "policyVersion": resp.GetPolicyVersion(), - "policyHash": resp.GetPolicyHash(), - "chunksApproved": resp.GetChunksApproved(), - "chunksSkipped": resp.GetChunksSkipped(), + "policyVersion": result.PolicyVersion, + "policyHash": result.PolicyHash, + "chunksApproved": result.ChunksApproved, + "chunksSkipped": result.ChunksSkipped, }) } -// EditDraftChunkRequest carries the replacement proposed rule as protojson. +// EditDraftChunkRequest carries the replacement proposed rule as JSON. type EditDraftChunkRequest struct { ProposedRule json.RawMessage `json:"proposedRule"` } @@ -110,14 +120,14 @@ func (app *App) EditDraftChunk(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_rule", "proposedRule is required") return } - rule, err := models.ParseNetworkPolicyRule(body.ProposedRule) + rule, err := models.ParseSDKNetworkPolicyRule(body.ProposedRule) if err != nil { slog.Error("invalid network policy rule", "error", err) - writeError(w, http.StatusBadRequest, "invalid_rule", "invalid network policy rule") + writeError(w, http.StatusBadRequest, "invalid_rule", "proposedRule does not match NetworkPolicyRule schema: "+err.Error()) return } - if err := app.gateway.EditDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), rule); err != nil { - writeGrpcError(w, err) + if err := app.sdk.Policy().EditDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), rule); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"edited": true}) @@ -126,36 +136,36 @@ func (app *App) EditDraftChunk(w http.ResponseWriter, r *http.Request) { // UndoDraftChunk reverts an already-approved chunk, removing its rule from the // active policy. func (app *App) UndoDraftChunk(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.UndoDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) + result, err := app.sdk.Policy().UndoDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetPolicyVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.PolicyVersion, + PolicyHash: result.PolicyHash, }) } // ClearDraftChunks removes all pending draft chunks for a sandbox. func (app *App) ClearDraftChunks(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ClearDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + result, err := app.sdk.Policy().ClearDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "chunksCleared": resp.GetChunksCleared(), + "chunksCleared": result.ChunksCleared, }) } // GetDraftHistory returns the chronological decision history for a sandbox's // draft policy. func (app *App) GetDraftHistory(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetDraftHistory(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + entries, err := app.sdk.Policy().GetDraftHistory(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromDraftHistory(resp)) + writeJSON(w, http.StatusOK, models.FromSDKDraftHistory(entries)) } diff --git a/backend/internal/api/files_handler.go b/backend/internal/api/files_handler.go index e91ecc5d..4c8fa4b8 100644 --- a/backend/internal/api/files_handler.go +++ b/backend/internal/api/files_handler.go @@ -1,6 +1,7 @@ package api import ( + "context" "fmt" "io" "log/slog" @@ -8,6 +9,7 @@ import ( "path/filepath" "strconv" "strings" + "time" "github.com/go-chi/chi/v5" ) @@ -22,19 +24,45 @@ func validateFilePath(p string) bool { return filepath.IsAbs(cleaned) } +func (app *App) execContext(parent context.Context) (context.Context, context.CancelFunc) { + timeout := app.execTimeout + if timeout == 0 { + timeout = 30 + } + return context.WithTimeout(parent, time.Duration(timeout)*time.Second) +} + +func resolveUploadDest(w http.ResponseWriter, destQuery, filename string) (string, bool) { + if filename == "." || filename == ".." || filename == "/" { + writeError(w, http.StatusBadRequest, "invalid_filename", "invalid filename") + return "", false + } + dest := destQuery + if dest == "" { + dest = defaultUploadDir + } + if !validateFilePath(dest) { + writeError(w, http.StatusBadRequest, "invalid_path", "invalid destination directory") + return "", false + } + destPath := filepath.Join(dest, filename) + if !validateFilePath(destPath) { + writeError(w, http.StatusBadRequest, "invalid_path", "invalid destination path") + return "", false + } + return destPath, true +} + func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return + maxSize := app.maxUploadSize + if maxSize == 0 { + maxSize = 64 << 20 } - sandboxID := sandbox.GetMetadata().GetId() - - r.Body = http.MaxBytesReader(w, r.Body, app.maxUploadSize) - if parseErr := r.ParseMultipartForm(app.maxUploadSize); parseErr != nil { //nolint:gosec // bounded by MaxBytesReader + r.Body = http.MaxBytesReader(w, r.Body, maxSize) + if parseErr := r.ParseMultipartForm(maxSize); parseErr != nil { //nolint:gosec // bounded by MaxBytesReader writeError(w, http.StatusBadRequest, "invalid_upload", "failed to parse multipart form") return } @@ -45,23 +73,8 @@ func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { } defer file.Close() - filename := filepath.Base(header.Filename) - if filename == "." || filename == ".." || filename == "/" { - writeError(w, http.StatusBadRequest, "invalid_filename", "invalid filename") - return - } - - dest := r.URL.Query().Get("dest") - if dest == "" { - dest = defaultUploadDir - } - if !validateFilePath(dest) { - writeError(w, http.StatusBadRequest, "invalid_path", "invalid destination directory") - return - } - destPath := filepath.Join(dest, filename) - if !validateFilePath(destPath) { - writeError(w, http.StatusBadRequest, "invalid_path", "invalid destination path") + destPath, ok := resolveUploadDest(w, r.URL.Query().Get("dest"), filepath.Base(header.Filename)) + if !ok { return } @@ -71,23 +84,36 @@ func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { return } - stdout, stderr, exitCode, err := app.gateway.ExecSandbox(r.Context(), sandboxID, - []string{"dd", "of=" + destPath, "bs=4096"}, - fileBytes, "", app.execTimeout) + // The SDK exposes no non-TTY stdin exec (Run has no stdin; Interactive + // forces a PTY that corrupts binary payloads) and its file transport is a + // stub. Stream the bytes into `dd` over the gateway's non-TTY ExecSandbox + // RPC via the dedicated raw client, resolving name -> sandbox UUID first. + ctx, cancel := app.execContext(r.Context()) + defer cancel() + + sandbox, err := app.sdk.Sandboxes().Get(ctx, workspace, name) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - if len(stderr) > 0 { - slog.Warn("file upload stderr", "path", destPath, "stderr", string(stderr)) + stdout, exitCode, execErr := app.execUpload.ExecWithStdin(ctx, sandbox.ID, []string{"dd", "of=" + destPath, "bs=4096"}, fileBytes) + if execErr != nil { + writeSDKError(w, execErr) + return + } + if exitCode != 0 { + slog.Error("file upload failed", "path", destPath, "exitCode", exitCode, "stdout", stdout) + writeError(w, http.StatusBadGateway, "upload_failed", "file upload failed") + return } + writeJSON(w, http.StatusOK, map[string]any{ - "exitCode": exitCode, + "exitCode": 0, "path": destPath, "size": len(fileBytes), - "stdout": string(stdout), - "success": exitCode == 0, + "stdout": stdout, + "success": true, }) } @@ -101,21 +127,16 @@ func (app *App) DownloadFile(w http.ResponseWriter, r *http.Request) { return } - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() + ctx, cancel := app.execContext(r.Context()) + defer cancel() - stdout, stderr, exitCode, err := app.gateway.ExecSandbox(r.Context(), sandboxID, - []string{"cat", filePath}, nil, "", app.execTimeout) + result, err := app.sdk.Exec().Run(ctx, workspace, name, []string{"cat", filePath}) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - if exitCode != 0 { - slog.Error("file download failed", "path", filePath, "exitCode", exitCode, "stderr", string(stderr)) + if result.ExitCode != 0 { + slog.Error("file download failed", "path", filePath, "exitCode", result.ExitCode, "stderr", string(result.Stderr)) writeError(w, http.StatusNotFound, "file_not_found", "file download failed") return } @@ -123,6 +144,6 @@ func (app *App) DownloadFile(w http.ResponseWriter, r *http.Request) { filename := filepath.Base(filePath) w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename)) w.Header().Set("Content-Type", "application/octet-stream") - w.Header().Set("Content-Length", strconv.Itoa(len(stdout))) - _, _ = w.Write(stdout) //nolint:gosec // Content-Type is application/octet-stream, not HTML + w.Header().Set("Content-Length", strconv.Itoa(len(result.Stdout))) + _, _ = w.Write(result.Stdout) //nolint:gosec // Content-Type is application/octet-stream, not HTML } diff --git a/backend/internal/api/files_handler_test.go b/backend/internal/api/files_handler_test.go index ce14e63a..34d2c9fc 100644 --- a/backend/internal/api/files_handler_test.go +++ b/backend/internal/api/files_handler_test.go @@ -1,6 +1,20 @@ package api -import "testing" +import ( + "bytes" + "context" + "encoding/json" + "fmt" + "mime/multipart" + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/go-chi/chi/v5" + + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" +) func TestValidateFilePath(t *testing.T) { tests := []struct { @@ -30,3 +44,179 @@ func TestValidateFilePath(t *testing.T) { }) } } + +// mockUploader is a test double for the non-TTY stdin exec (StdinExecer). +type mockUploader struct { + fn func(ctx context.Context, sandboxID string, command []string, stdin []byte) (string, int, error) + gotID string + gotCmd []string + gotStdin []byte +} + +func (m *mockUploader) ExecWithStdin(ctx context.Context, sandboxID string, command []string, stdin []byte) (string, int, error) { + m.gotID = sandboxID + m.gotCmd = command + m.gotStdin = append([]byte(nil), stdin...) + if m.fn != nil { + return m.fn(ctx, sandboxID, command, stdin) + } + return "", 0, nil +} + +func uploadRequest(t *testing.T, filename, content string) *http.Request { + t.Helper() + body := &bytes.Buffer{} + mw := multipart.NewWriter(body) + part, err := mw.CreateFormFile("file", filename) + if err != nil { + t.Fatal(err) + } + if _, err := part.Write([]byte(content)); err != nil { + t.Fatal(err) + } + if err := mw.Close(); err != nil { + t.Fatal(err) + } + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/sb/files", body) + req.Header.Set("Content-Type", mw.FormDataContentType()) + return req +} + +func TestUploadFile(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getFn = func(_ context.Context, workspace, name string) (*openshell.Sandbox, error) { + if workspace != "default" || name != "sb" { + t.Errorf("Get(%q,%q), want (default,sb)", workspace, name) + } + return &openshell.Sandbox{ID: "sb-uuid-123"}, nil + } + up := &mockUploader{fn: func(_ context.Context, sandboxID string, command []string, _ []byte) (string, int, error) { + if sandboxID != "sb-uuid-123" { + t.Errorf("sandboxID = %q, want sb-uuid-123 (resolved UUID, not name)", sandboxID) + } + if len(command) != 3 || command[0] != "dd" || command[1] != "of=/sandbox/hello.txt" || command[2] != "bs=4096" { + t.Errorf("command = %v, want dd of=/sandbox/hello.txt bs=4096", command) + } + return "5+0 records in", 0, nil + }} + app := newTestAppWithSDK(sdk) + app.execUpload = up + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/files", app.UploadFile) + + // Include a control byte (0x04 = EOT) that a PTY path would corrupt/truncate. + content := "he\x04llo" + req := uploadRequest(t, "hello.txt", content) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + if string(up.gotStdin) != content { + t.Errorf("stdin = %q, want %q (raw bytes, no TTY mangling)", up.gotStdin, content) + } + var resp map[string]any + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatal(err) + } + if resp["path"] != "/sandbox/hello.txt" || resp["success"] != true { + t.Errorf("resp = %+v", resp) + } +} + +func TestUploadFileSandboxNotFound(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getFn = func(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"} + } + app := newTestAppWithSDK(sdk) + app.execUpload = &mockUploader{} + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/files", app.UploadFile) + w := httptest.NewRecorder() + r.ServeHTTP(w, uploadRequest(t, "hello.txt", "hi")) + if w.Code != http.StatusNotFound { + t.Fatalf("status = %d, want 404; body: %s", w.Code, w.Body.String()) + } +} + +func TestDownloadFile(t *testing.T) { + sdk := &mockSDK{} + sdk.exec.runFn = func(_ context.Context, _, _ string, command []string, _ ...openshell.ExecOptions) (*openshell.ExecResult, error) { + if len(command) != 2 || command[0] != "cat" || command[1] != "/sandbox/hello.txt" { + t.Errorf("command = %v", command) + } + return &openshell.ExecResult{ExitCode: 0, Stdout: []byte("hello")}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/files", app.DownloadFile) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/sb/files?path=/sandbox/hello.txt", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + if w.Body.String() != "hello" { + t.Errorf("body = %q, want hello", w.Body.String()) + } +} + +func TestDownloadFileNotFound(t *testing.T) { + sdk := &mockSDK{} + sdk.exec.runFn = func(_ context.Context, _, _ string, _ []string, _ ...openshell.ExecOptions) (*openshell.ExecResult, error) { + return &openshell.ExecResult{ExitCode: 1, Stderr: []byte("cat: no such file")}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/files", app.DownloadFile) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/sb/files?path=/sandbox/missing.txt", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusNotFound { + t.Fatalf("status = %d, want 404", w.Code) + } +} + +func TestUploadFileFailed(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getFn = func(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + return &openshell.Sandbox{ID: "sb-uuid-123"}, nil + } + up := &mockUploader{fn: func(_ context.Context, _ string, _ []string, _ []byte) (string, int, error) { + return "dd: write error", 1, nil + }} + app := newTestAppWithSDK(sdk) + app.execUpload = up + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/files", app.UploadFile) + + w := httptest.NewRecorder() + r.ServeHTTP(w, uploadRequest(t, "hello.txt", "hello")) + if w.Code != http.StatusBadGateway { + t.Fatalf("status = %d, want 502; body: %s", w.Code, w.Body.String()) + } + if !strings.Contains(w.Body.String(), "upload_failed") { + t.Errorf("body = %s, want upload_failed", w.Body.String()) + } +} + +func TestUploadFileExecError(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getFn = func(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + return &openshell.Sandbox{ID: "sb-uuid-123"}, nil + } + up := &mockUploader{fn: func(_ context.Context, _ string, _ []string, _ []byte) (string, int, error) { + return "", 0, fmt.Errorf("exec unavailable") + }} + app := newTestAppWithSDK(sdk) + app.execUpload = up + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/files", app.UploadFile) + + w := httptest.NewRecorder() + r.ServeHTTP(w, uploadRequest(t, "hello.txt", "hello")) + if w.Code != http.StatusInternalServerError { + t.Fatalf("status = %d, want 500; body: %s", w.Code, w.Body.String()) + } +} diff --git a/backend/internal/api/gateway_handler.go b/backend/internal/api/gateway_handler.go index 07606339..3cfe4241 100644 --- a/backend/internal/api/gateway_handler.go +++ b/backend/internal/api/gateway_handler.go @@ -14,12 +14,12 @@ func (app *App) GetHealthz(w http.ResponseWriter, _ *http.Request) { // GetGateway returns gateway status, version, and compute drivers. func (app *App) GetGateway(w http.ResponseWriter, r *http.Request) { - info, err := app.gateway.GetGatewayInfo(r.Context()) + info, err := app.sdk.Health().GetGatewayInfo(r.Context()) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromGatewayInfo(info)) + writeJSON(w, http.StatusOK, models.FromSDKGatewayInfo(info)) } // FeatureFlags controls which optional features the frontend should render. @@ -44,8 +44,7 @@ type AuthConfigResponse struct { // GetReadyz checks gateway reachability — used by orchestrators for readiness probes. func (app *App) GetReadyz(w http.ResponseWriter, r *http.Request) { - _, err := app.gateway.Health(r.Context()) - if err != nil { + if _, err := app.sdk.Health().Check(r.Context()); err != nil { writeError(w, http.StatusServiceUnavailable, "not_ready", "gateway unreachable") return } @@ -73,20 +72,20 @@ func (app *App) GetWhoAmI(w http.ResponseWriter, r *http.Request) { return } - resp, err := app.gateway.GetCurrentUser(r.Context()) + user, err := app.sdk.Health().GetCurrentUser(r.Context()) if err == nil { - writeJSON(w, http.StatusOK, models.FromCurrentUser(resp)) + writeJSON(w, http.StatusOK, models.FromSDKCurrentUser(user)) return } - user := auth.UserFromContext(r.Context()) - if user != "" { + proxyUser := auth.UserFromContext(r.Context()) + if proxyUser != "" { writeJSON(w, http.StatusOK, models.CurrentUser{ - Subject: user, - DisplayName: user, + Subject: proxyUser, + DisplayName: proxyUser, }) return } - writeGrpcError(w, err) + writeSDKError(w, err) } diff --git a/backend/internal/api/gateway_handler_test.go b/backend/internal/api/gateway_handler_test.go index 2de4ba5d..a7768637 100644 --- a/backend/internal/api/gateway_handler_test.go +++ b/backend/internal/api/gateway_handler_test.go @@ -7,19 +7,16 @@ import ( "net/http/httptest" "testing" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" ) func TestGetHealthz(t *testing.T) { - app := newTestApp(&mockGateway{}) - + app := newTestAppWithSDK(&mockSDK{}) req := httptest.NewRequest(http.MethodGet, "/healthz", nil) w := httptest.NewRecorder() app.GetHealthz(w, req) - if w.Code != http.StatusOK { t.Fatalf("status = %d, want 200", w.Code) } @@ -30,130 +27,88 @@ func TestGetHealthz(t *testing.T) { if body["status"] != "ok" { t.Errorf("status = %q, want ok", body["status"]) } - if ct := w.Header().Get("Content-Type"); ct != "application/json" { - t.Errorf("Content-Type = %q, want application/json", ct) - } } func TestGetGateway(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) - wantFields map[string]string - name string - wantStatus int - }{ - { - name: "success with compute drivers", - mockFn: func(_ context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return &openshellv1.GetGatewayInfoResponse{ - Status: openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY, - GatewayVersion: "0.0.92", - ComputeDrivers: []*openshellv1.ComputeDriverInfo{ - { - Name: "podman", - Capabilities: &openshellv1.ComputeDriverCapabilities{ - DriverName: "podman", - DriverVersion: "5.0", - }, - }, - }, - }, nil - }, - wantStatus: http.StatusOK, - wantFields: map[string]string{ - "status": "HEALTHY", - "gatewayVersion": "0.0.92", - }, - }, - { - name: "gateway unavailable", - mockFn: func(_ context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return nil, status.Error(codes.Unavailable, "connection refused") + sdk := &mockSDK{} + sdk.health.getGatewayInfoFn = func(_ context.Context) (*openshell.GatewayInfo, error) { + return &openshell.GatewayInfo{ + Status: openshell.ServiceStatusHealthy, + Version: "0.0.92", + ComputeDrivers: []openshell.ComputeDriverInfo{ + {Name: "podman", DriverName: "podman", DriverVersion: "5.0"}, }, - wantStatus: http.StatusBadGateway, - }, - { - name: "permission denied", - mockFn: func(_ context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return nil, status.Error(codes.PermissionDenied, "not allowed") - }, - wantStatus: http.StatusForbidden, - }, + }, nil } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getGatewayInfoFn: tc.mockFn}) - - req := httptest.NewRequest(http.MethodGet, "/gateway", nil) - w := httptest.NewRecorder() - app.GetGateway(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) - } - if tc.wantFields != nil { - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - for k, want := range tc.wantFields { - if got, ok := body[k].(string); !ok || got != want { - t.Errorf("%s = %v, want %q", k, body[k], want) - } - } - } - }) + app := newTestAppWithSDK(sdk) + req := httptest.NewRequest(http.MethodGet, "/gateway", nil) + w := httptest.NewRecorder() + app.GetGateway(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + var body map[string]any + _ = json.NewDecoder(w.Body).Decode(&body) + if body["status"] != "HEALTHY" || body["gatewayVersion"] != "0.0.92" { + t.Errorf("body = %v", body) + } + drivers, _ := body["computeDrivers"].([]any) + if len(drivers) != 1 { + t.Fatalf("got %d drivers, want 1", len(drivers)) } } -func TestGetGatewayComputeDrivers(t *testing.T) { - app := newTestApp(&mockGateway{ - getGatewayInfoFn: func(_ context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return &openshellv1.GetGatewayInfoResponse{ - Status: openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY, - GatewayVersion: "0.0.92", - ComputeDrivers: []*openshellv1.ComputeDriverInfo{ - { - Name: "podman", - Capabilities: &openshellv1.ComputeDriverCapabilities{ - DriverName: "podman", - DriverVersion: "5.0", - }, - }, - { - Name: "kubernetes", - Capabilities: &openshellv1.ComputeDriverCapabilities{ - DriverName: "kubernetes", - }, - }, - }, - }, nil - }, - }) - +func TestGetGatewayUnavailable(t *testing.T) { + sdk := &mockSDK{} + sdk.health.getGatewayInfoFn = func(_ context.Context) (*openshell.GatewayInfo, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorUnavailable, Message: "down"} + } + app := newTestAppWithSDK(sdk) req := httptest.NewRequest(http.MethodGet, "/gateway", nil) w := httptest.NewRecorder() app.GetGateway(w, req) + if w.Code != http.StatusBadGateway { + t.Fatalf("status = %d, want 502", w.Code) + } +} +func TestGetReadyz(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + req := httptest.NewRequest(http.MethodGet, "/readyz", nil) + w := httptest.NewRecorder() + app.GetReadyz(w, req) if w.Code != http.StatusOK { t.Fatalf("status = %d", w.Code) } - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - drivers, ok := body["computeDrivers"].([]any) - if !ok { - t.Fatal("computeDrivers is not an array") +} + +func TestGetReadyzUnavailable(t *testing.T) { + sdk := &mockSDK{} + sdk.health.checkFn = func(_ context.Context) (*openshell.HealthResult, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorUnavailable, Message: "down"} } - if len(drivers) != 2 { - t.Fatalf("got %d drivers, want 2", len(drivers)) + app := newTestAppWithSDK(sdk) + req := httptest.NewRequest(http.MethodGet, "/readyz", nil) + w := httptest.NewRecorder() + app.GetReadyz(w, req) + if w.Code != http.StatusServiceUnavailable { + t.Fatalf("status = %d, want 503", w.Code) } - first, ok := drivers[0].(map[string]any) - if !ok { - t.Fatal("first driver is not a map") +} + +func TestGetWhoAmIAuthDisabled(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + app.auth = auth.New(auth.Config{Disabled: true}) + app.authConfig = AuthConfigResponse{AdminRole: "openshell-admin"} + req := httptest.NewRequest(http.MethodGet, "/auth/whoami", nil) + w := httptest.NewRecorder() + app.GetWhoAmI(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } - if first["name"] != "podman" { - t.Errorf("first driver name = %v, want podman", first["name"]) + var body map[string]any + _ = json.NewDecoder(w.Body).Decode(&body) + if body["subject"] != "dev-user" { + t.Errorf("subject = %v", body["subject"]) } } diff --git a/backend/internal/api/inference_handler.go b/backend/internal/api/inference_handler.go index 16075fd6..47ae4b53 100644 --- a/backend/internal/api/inference_handler.go +++ b/backend/internal/api/inference_handler.go @@ -5,18 +5,20 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // GetInferenceRoute fetches the workspace inference route. ?route=sandbox-system // targets the system route; default is the user-facing inference.local route. func (app *App) GetInferenceRoute(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) + route, err := app.sdk.Inference().GetRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromInferenceRoute(resp)) + writeJSON(w, http.StatusOK, models.FromSDKInferenceRoute(route)) } // SetInferenceRouteRequest configures how inference.local resolves for the @@ -39,20 +41,25 @@ func (app *App) SetInferenceRoute(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_route", "providerName and modelId are required") return } - resp, err := app.gateway.SetInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), body.RouteName, body.ProviderName, body.ModelID, body.TimeoutSecs, body.NoVerify) + route, err := app.sdk.Inference().SetRoute(r.Context(), chi.URLParam(r, "workspace"), &openshell.InferenceRouteConfig{ + RouteName: body.RouteName, + ProviderName: body.ProviderName, + ModelID: body.ModelID, + TimeoutSecs: body.TimeoutSecs, + NoVerify: body.NoVerify, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromSetInferenceRoute(resp)) + writeJSON(w, http.StatusOK, models.FromSDKInferenceRoute(route)) } // DeleteInferenceRoute removes the workspace inference route. func (app *App) DeleteInferenceRoute(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.DeleteInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Inference().DeleteRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": resp.GetDeleted()}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/inference_handler_test.go b/backend/internal/api/inference_handler_test.go index 76d449a9..779f07d2 100644 --- a/backend/internal/api/inference_handler_test.go +++ b/backend/internal/api/inference_handler_test.go @@ -9,207 +9,75 @@ import ( "testing" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestGetInferenceRoute(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) - name string - url string - wantStatus int - }{ - { - name: "success default route", - url: "/workspaces/default/inference", - mockFn: func(_ context.Context, _, _ string) (*inferencev1.GetInferenceRouteResponse, error) { - return &inferencev1.GetInferenceRouteResponse{ - RouteName: "inference.local", - ProviderName: "claude", - ModelId: "claude-sonnet-5", - Version: 1, - TimeoutSecs: 30, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "success system route", - url: "/workspaces/default/inference?route=sandbox-system", - mockFn: func(_ context.Context, _, route string) (*inferencev1.GetInferenceRouteResponse, error) { - if route != "sandbox-system" { - t.Errorf("route = %q, want sandbox-system", route) - } - return &inferencev1.GetInferenceRouteResponse{ - RouteName: "sandbox-system", - ProviderName: "nim", - ModelId: "llama-3", - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - url: "/workspaces/default/inference", - mockFn: func(_ context.Context, _, _ string) (*inferencev1.GetInferenceRouteResponse, error) { - return nil, status.Error(codes.NotFound, "no route configured") - }, - wantStatus: http.StatusNotFound, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getInferenceRouteFn: tc.mockFn}) - r := chi.NewRouter() - r.Get("/workspaces/{workspace}/inference", app.GetInferenceRoute) - - req := httptest.NewRequest(http.MethodGet, tc.url, nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + sdk := &mockSDK{} + sdk.inference.getFn = func(_ context.Context, _, routeName string) (*openshell.InferenceRoute, error) { + return &openshell.InferenceRoute{ + RouteName: routeName, + ProviderName: "claude", + ModelID: "claude-3", + Version: 7, + TimeoutSecs: 60, + }, nil } -} - -func TestGetInferenceRouteBody(t *testing.T) { - app := newTestApp(&mockGateway{ - getInferenceRouteFn: func(_ context.Context, _, _ string) (*inferencev1.GetInferenceRouteResponse, error) { - return &inferencev1.GetInferenceRouteResponse{ - RouteName: "inference.local", - ProviderName: "claude", - ModelId: "claude-sonnet-5", - Version: 2, - TimeoutSecs: 60, - }, nil - }, - }) + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/inference", app.GetInferenceRoute) - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/inference", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - if body["providerName"] != "claude" { - t.Errorf("providerName = %v", body["providerName"]) - } - if body["modelId"] != "claude-sonnet-5" { - t.Errorf("modelId = %v", body["modelId"]) - } - if v, ok := body["version"].(float64); !ok || v != 2 { - t.Errorf("version = %v, want 2", body["version"]) + _ = json.NewDecoder(w.Body).Decode(&body) + if body["providerName"] != "claude" || body["modelId"] != "claude-3" { + t.Errorf("body = %v", body) } } func TestSetInferenceRoute(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) name string body string - wantCode string wantStatus int }{ - { - name: "success", - body: `{"providerName":"claude","modelId":"claude-sonnet-5","timeoutSecs":30}`, - mockFn: func(_ context.Context, _, _, _, _ string, _ uint64, _ bool) (*inferencev1.SetInferenceRouteResponse, error) { - return &inferencev1.SetInferenceRouteResponse{ - RouteName: "inference.local", - ProviderName: "claude", - ModelId: "claude-sonnet-5", - Version: 1, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "missing provider", - body: `{"modelId":"model"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_route", - }, - { - name: "missing model", - body: `{"providerName":"claude"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_route", - }, + {name: "success", body: `{"providerName":"claude","modelId":"claude-3"}`, wantStatus: http.StatusOK}, + {name: "missing fields", body: `{"providerName":"claude"}`, wantStatus: http.StatusBadRequest}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{setInferenceRouteFn: tc.mockFn}) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Put("/workspaces/{workspace}/inference", app.SetInferenceRoute) - req := httptest.NewRequest(http.MethodPut, "/workspaces/default/inference", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } }) } } func TestDeleteInferenceRoute(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context, _, _ string) (*inferencev1.DeleteInferenceRouteResponse, error) { - return &inferencev1.DeleteInferenceRouteResponse{Deleted: true}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - mockFn: func(_ context.Context, _, _ string) (*inferencev1.DeleteInferenceRouteResponse, error) { - return nil, status.Error(codes.NotFound, "no route") - }, - wantStatus: http.StatusNotFound, - }, + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Delete("/workspaces/{workspace}/inference", app.DeleteInferenceRoute) + req := httptest.NewRequest(http.MethodDelete, "/workspaces/default/inference", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{deleteInferenceRouteFn: tc.mockFn}) - r := chi.NewRouter() - r.Delete("/workspaces/{workspace}/inference", app.DeleteInferenceRoute) - - req := httptest.NewRequest(http.MethodDelete, "/workspaces/default/inference", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + var body map[string]bool + _ = json.NewDecoder(w.Body).Decode(&body) + if !body["deleted"] { + t.Errorf("deleted = %v", body["deleted"]) } } diff --git a/backend/internal/api/logs_handler.go b/backend/internal/api/logs_handler.go index a18996d2..d5dff152 100644 --- a/backend/internal/api/logs_handler.go +++ b/backend/internal/api/logs_handler.go @@ -3,14 +3,17 @@ package api import ( "net/http" "strconv" + "time" "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) -// GetSandboxLogs serves the polled logs view. GetSandboxLogs (gRPC) takes -// sandbox_id, not name — the BFF resolves name → metadata.id via GetSandbox. +// GetSandboxLogs serves the polled logs view. The SDK resolves sandbox name +// to sandbox_id internally. // // Query params: lines (default 200), sinceMs, source (repeatable: // gateway|sandbox), level (min level, e.g. INFO). @@ -18,49 +21,47 @@ func (app *App) GetSandboxLogs(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - if sandboxID == "" { - writeError(w, http.StatusNotFound, "not_found", "sandbox has no id") - return - } - query := r.URL.Query() + var opts []openshell.LogOption + lines := uint32(200) if raw := query.Get("lines"); raw != "" { if parsed, parseErr := strconv.ParseUint(raw, 10, 32); parseErr == nil { lines = uint32(parsed) } } - var sinceMs int64 + opts = append(opts, openshell.WithLogLines(lines)) + if raw := query.Get("sinceMs"); raw != "" { - if parsed, parseErr := strconv.ParseInt(raw, 10, 64); parseErr == nil { - sinceMs = parsed + if ms, parseErr := strconv.ParseInt(raw, 10, 64); parseErr == nil { + opts = append(opts, openshell.WithLogSince(time.UnixMilli(ms))) } } + if sources := query["source"]; len(sources) > 0 { + opts = append(opts, openshell.WithLogSources(sources...)) + } + if level := query.Get("level"); level != "" { + opts = append(opts, openshell.WithLogMinLevel(level)) + } - resp, err := app.gateway.GetSandboxLogs(r.Context(), workspace, sandboxID, lines, sinceMs, query["source"], query.Get("level")) + result, err := app.sdk.Sandboxes().GetLogs(r.Context(), workspace, name, opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromSandboxLogs(resp)) + writeJSON(w, http.StatusOK, models.FromSDKSandboxLogs(result)) } // ListSandboxProviders lists provider records attached to a sandbox. func (app *App) ListSandboxProviders(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ListSandboxProviders(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + providers, err := app.sdk.Sandboxes().ListProviders(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - out := make([]models.Provider, 0, len(resp.GetProviders())) - for _, provider := range resp.GetProviders() { - out = append(out, models.FromProvider(provider)) + out := make([]models.Provider, 0, len(providers)) + for _, provider := range providers { + out = append(out, models.FromSDKProvider(provider)) } writeJSON(w, http.StatusOK, out) } @@ -77,15 +78,22 @@ func (app *App) AttachSandboxProvider(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - resp, err := app.gateway.AttachSandboxProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), body.ExpectedResourceVersion) + result, err := app.sdk.Sandboxes().AttachProvider( + r.Context(), + chi.URLParam(r, "workspace"), + chi.URLParam(r, "name"), + chi.URLParam(r, "provider"), + body.ExpectedResourceVersion, + ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]any{ - "attached": resp.GetAttached(), - "sandbox": models.FromSandbox(resp.GetSandbox()), - }) + out := map[string]any{"attached": result.Attached} + if result.Sandbox != nil { + out["sandbox"] = models.FromSDKSandbox(result.Sandbox) + } + writeJSON(w, http.StatusOK, out) } // DetachSandboxProvider detaches a provider from a sandbox. @@ -94,13 +102,20 @@ func (app *App) DetachSandboxProvider(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - resp, err := app.gateway.DetachSandboxProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), body.ExpectedResourceVersion) + result, err := app.sdk.Sandboxes().DetachProvider( + r.Context(), + chi.URLParam(r, "workspace"), + chi.URLParam(r, "name"), + chi.URLParam(r, "provider"), + body.ExpectedResourceVersion, + ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]any{ - "detached": resp.GetDetached(), - "sandbox": models.FromSandbox(resp.GetSandbox()), - }) + out := map[string]any{"detached": result.Detached} + if result.Sandbox != nil { + out["sandbox"] = models.FromSDKSandbox(result.Sandbox) + } + writeJSON(w, http.StatusOK, out) } diff --git a/backend/internal/api/logs_handler_test.go b/backend/internal/api/logs_handler_test.go index 0ba488c0..2f7f9832 100644 --- a/backend/internal/api/logs_handler_test.go +++ b/backend/internal/api/logs_handler_test.go @@ -5,174 +5,177 @@ import ( "encoding/json" "net/http" "net/http/httptest" + "strings" "testing" + "time" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types" ) func TestGetSandboxLogs(t *testing.T) { - tests := []struct { - getSandboxFn func(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) - getLogsFn func(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) - name string - url string - wantStatus int - }{ - { - name: "success with all filters", - url: "/workspaces/default/sandboxes/my-sandbox/logs?lines=50&sinceMs=1000&source=gateway&source=sandbox&level=INFO", - getSandboxFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "sandbox-uuid", Name: "my-sandbox"}, - }, nil - }, - getLogsFn: func(_ context.Context, _, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) { - if sandboxID != "sandbox-uuid" { - t.Errorf("sandboxID = %q, want sandbox-uuid", sandboxID) - } - if lines != 50 { - t.Errorf("lines = %d, want 50", lines) - } - if sinceMs != 1000 { - t.Errorf("sinceMs = %d, want 1000", sinceMs) - } - if len(sources) != 2 { - t.Errorf("sources = %v, want [gateway sandbox]", sources) - } - if minLevel != "INFO" { - t.Errorf("minLevel = %q, want INFO", minLevel) - } - return &openshellv1.GetSandboxLogsResponse{ - Logs: []*openshellv1.SandboxLogLine{ - {Message: "hello", Level: "INFO", TimestampMs: 1234}, - }, - BufferTotal: 100, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "success with no filters uses default lines", - url: "/workspaces/default/sandboxes/my-sandbox/logs", - getSandboxFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "sandbox-uuid", Name: "my-sandbox"}, - }, nil - }, - getLogsFn: func(_ context.Context, _, _ string, lines uint32, _ int64, _ []string, _ string) (*openshellv1.GetSandboxLogsResponse, error) { - if lines != 200 { - t.Errorf("default lines = %d, want 200", lines) - } - return &openshellv1.GetSandboxLogsResponse{}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "invalid lines param uses default", - url: "/workspaces/default/sandboxes/my-sandbox/logs?lines=notanumber", - getSandboxFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "sandbox-uuid", Name: "my-sandbox"}, - }, nil - }, - getLogsFn: func(_ context.Context, _, _ string, lines uint32, _ int64, _ []string, _ string) (*openshellv1.GetSandboxLogsResponse, error) { - if lines != 200 { - t.Errorf("default lines = %d, want 200 (invalid param ignored)", lines) - } - return &openshellv1.GetSandboxLogsResponse{}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "sandbox not found", - url: "/workspaces/default/sandboxes/missing/logs", - getSandboxFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return nil, status.Error(codes.NotFound, "sandbox not found") - }, - wantStatus: http.StatusNotFound, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{ - getSandboxFn: tc.getSandboxFn, - getSandboxLogsFn: tc.getLogsFn, - }) - r := chi.NewRouter() - r.Get("/workspaces/{workspace}/sandboxes/{name}/logs", app.GetSandboxLogs) + sdk := &mockSDK{} + sdk.sandboxes.getLogsFn = func(_ context.Context, workspace, name string, opts ...openshell.LogOption) (*openshell.LogResult, error) { + if workspace != "default" || name != "my-sandbox" { + t.Errorf("GetLogs(%s, %s), want (default, my-sandbox)", workspace, name) + } + cfg := types.ApplyLogOptions(opts) + if cfg.Lines() != 50 { + t.Errorf("lines = %d, want 50", cfg.Lines()) + } + if !cfg.Since().Equal(time.UnixMilli(1000)) { + t.Errorf("since = %v, want unix milli 1000", cfg.Since()) + } + if got := cfg.Sources(); len(got) != 2 { + t.Errorf("sources = %v, want [gateway sandbox]", got) + } + if cfg.MinLevel() != "INFO" { + t.Errorf("minLevel = %q, want INFO", cfg.MinLevel()) + } + return &openshell.LogResult{ + Lines: []openshell.LogLine{{Message: "hello", Level: "INFO", Timestamp: time.UnixMilli(1234)}}, + BufferTotal: 100, + }, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/logs", app.GetSandboxLogs) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/logs?lines=50&sinceMs=1000&source=gateway&source=sandbox&level=INFO", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + var body map[string]any + _ = json.NewDecoder(w.Body).Decode(&body) + if body["bufferTotal"] != float64(100) { + t.Errorf("bufferTotal = %v", body["bufferTotal"]) + } + logs, _ := body["logs"].([]any) + if len(logs) != 1 { + t.Fatalf("got %d logs, want 1", len(logs)) + } +} - req := httptest.NewRequest(http.MethodGet, tc.url, nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) +func TestGetSandboxLogsDefaults(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getLogsFn = func(_ context.Context, _, _ string, opts ...openshell.LogOption) (*openshell.LogResult, error) { + cfg := types.ApplyLogOptions(opts) + if cfg.Lines() != 200 { + t.Errorf("default lines = %d, want 200", cfg.Lines()) + } + return &openshell.LogResult{}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/logs", app.GetSandboxLogs) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/logs?lines=notanumber", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) + } +} - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) - } - }) +func TestGetSandboxLogsNotFound(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.getLogsFn = func(_ context.Context, _, _ string, _ ...openshell.LogOption) (*openshell.LogResult, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"} + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/logs", app.GetSandboxLogs) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/missing/logs", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusNotFound { + t.Fatalf("status = %d, want 404", w.Code) } } -func TestGetSandboxLogsBody(t *testing.T) { - app := newTestApp(&mockGateway{ - getSandboxFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "uuid-1", Name: "my-sandbox"}, - }, nil - }, - getSandboxLogsFn: func(_ context.Context, _, _ string, _ uint32, _ int64, _ []string, _ string) (*openshellv1.GetSandboxLogsResponse, error) { - return &openshellv1.GetSandboxLogsResponse{ - Logs: []*openshellv1.SandboxLogLine{ - { - Message: "network decision", - Level: "WARN", - Source: "gateway", - TimestampMs: 5000, - Fields: map[string]string{"dst_host": "api.example.com", "action": "deny"}, +func TestListSandboxProviders(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.listProvidersFn = func(_ context.Context, _, _ string) ([]*openshell.Provider, error) { + return []*openshell.Provider{ + { + Name: "claude-prov", + Type: "claude", + Spec: openshell.ProviderSpec{ + CredentialHandles: map[string]types.CredentialHandle{ + "api_key": {Driver: "vault", Handle: "vault://must-not-leak"}, }, }, - BufferTotal: 42, - }, nil - }, - }) + }, + }, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() - r.Get("/workspaces/{workspace}/sandboxes/{name}/logs", app.GetSandboxLogs) + r.Get("/workspaces/{workspace}/sandboxes/{name}/providers", app.ListSandboxProviders) - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/logs", nil) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/providers", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String()) } - - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + body := w.Body.String() + if strings.Contains(body, "must-not-leak") { + t.Errorf("leaked credential handle: %s", body) + } + var got []map[string]any + if err := json.Unmarshal([]byte(body), &got); err != nil { t.Fatalf("decode: %v", err) } - if v, ok := body["bufferTotal"].(float64); !ok || v != 42 { - t.Errorf("bufferTotal = %v, want 42", body["bufferTotal"]) + if len(got) != 1 { + t.Fatalf("got %d providers, want 1", len(got)) } - logs, ok := body["logs"].([]any) - if !ok || len(logs) != 1 { - t.Fatalf("logs length = %d, want 1", len(logs)) + names, _ := got[0]["credentialNames"].([]any) + if len(names) != 1 || names[0] != "api_key" { + t.Errorf("credentialNames = %v, want [api_key]", got[0]["credentialNames"]) } - line, ok := logs[0].(map[string]any) - if !ok { - t.Fatal("log entry is not a map") +} + +func TestAttachDetachSandboxProvider(t *testing.T) { + sdk := &mockSDK{} + sdk.sandboxes.attachFn = func(_ context.Context, workspace, sandboxName, providerName string, expectedRV uint64) (*openshell.AttachProviderResult, error) { + if workspace != "default" || sandboxName != "my-sandbox" || providerName != "claude-prov" { + t.Errorf("attach args = %s/%s/%s", workspace, sandboxName, providerName) + } + if expectedRV != 42 { + t.Errorf("expectedResourceVersion = %d, want 42", expectedRV) + } + return &openshell.AttachProviderResult{Attached: true, Sandbox: &openshell.Sandbox{Name: sandboxName}}, nil + } + sdk.sandboxes.detachFn = func(_ context.Context, _, sandboxName, _ string, _ uint64) (*openshell.DetachProviderResult, error) { + return &openshell.DetachProviderResult{Detached: true, Sandbox: &openshell.Sandbox{Name: sandboxName}}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/providers/{provider}", app.AttachSandboxProvider) + r.Delete("/workspaces/{workspace}/sandboxes/{name}/providers/{provider}", app.DetachSandboxProvider) + + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/providers/claude-prov", strings.NewReader(`{"expectedResourceVersion":42}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("attach status = %d, want 200; body: %s", w.Code, w.Body.String()) } - if line["message"] != "network decision" { - t.Errorf("message = %v", line["message"]) + var attach map[string]any + if err := json.NewDecoder(w.Body).Decode(&attach); err != nil { + t.Fatalf("decode attach: %v", err) } - fields, ok := line["fields"].(map[string]any) - if !ok { - t.Fatal("fields is not a map") + if attach["attached"] != true { + t.Errorf("attached = %v", attach["attached"]) } - if fields["dst_host"] != "api.example.com" { - t.Errorf("dst_host = %v", fields["dst_host"]) + + req = httptest.NewRequest(http.MethodDelete, "/workspaces/default/sandboxes/my-sandbox/providers/claude-prov", strings.NewReader(`{}`)) + req.Header.Set("Content-Type", "application/json") + w = httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("detach status = %d, want 200; body: %s", w.Code, w.Body.String()) } } diff --git a/backend/internal/api/mock_gateway_test.go b/backend/internal/api/mock_gateway_test.go deleted file mode 100644 index 86cb5ec8..00000000 --- a/backend/internal/api/mock_gateway_test.go +++ /dev/null @@ -1,248 +0,0 @@ -package api - -import ( - "context" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -// mockGateway implements gateway.Interface for handler tests. -// Each field is a function that the test can override to control behavior. -type mockGateway struct { - healthFn func(ctx context.Context) (*openshellv1.HealthResponse, error) - getGatewayInfoFn func(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) - getCurrentUserFn func(ctx context.Context) (*openshellv1.GetCurrentUserResponse, error) - execSandboxInteractiveFn func(ctx context.Context) (openshellv1.OpenShell_ExecSandboxInteractiveClient, error) - createSandboxFn func(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) - getSandboxFn func(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) - listSandboxesFn func(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) - execSandboxFn func(ctx context.Context, sandboxID string, command []string, stdin []byte, workdir string, timeoutSeconds uint32) ([]byte, []byte, int32, error) - deleteSandboxFn func(ctx context.Context, workspace, name string) (bool, error) - createWorkspaceFn func(ctx context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) - getWorkspaceFn func(ctx context.Context, name string) (*datamodelv1.Workspace, error) - listWorkspacesFn func(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) - deleteWorkspaceFn func(ctx context.Context, name string) (bool, error) - addWorkspaceMemberFn func(ctx context.Context, workspace, principalSubject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) - removeWorkspaceMemberFn func(ctx context.Context, workspace, principalSubject string) (bool, error) - listWorkspaceMembersFn func(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.WorkspaceMember, error) - createProviderFn func(ctx context.Context, workspace string, provider *datamodelv1.Provider) (*datamodelv1.Provider, error) - getProviderFn func(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) - listProvidersFn func(ctx context.Context, workspace string, limit, offset uint32) ([]*datamodelv1.Provider, error) - deleteProviderFn func(ctx context.Context, workspace, name string) (bool, error) - updateProviderFn func(ctx context.Context, workspace string, provider *datamodelv1.Provider, credentialExpiresAtMs map[string]int64) (*datamodelv1.Provider, error) - getProviderRefreshStatusFn func(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.GetProviderRefreshStatusResponse, error) - configureProviderRefreshFn func(ctx context.Context, workspace, provider, credentialKey string, strategy openshellv1.ProviderCredentialRefreshStrategy, material map[string]string, secretMaterialKeys []string, expiresAtMs *int64) (*openshellv1.ConfigureProviderRefreshResponse, error) - rotateProviderCredentialFn func(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.RotateProviderCredentialResponse, error) - deleteProviderRefreshFn func(ctx context.Context, workspace, provider, credentialKey string) (bool, error) - listProviderProfilesFn func(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.ProviderProfile, error) - getProviderProfileFn func(ctx context.Context, id, workspace string) (*openshellv1.ProviderProfile, error) - importProviderProfilesFn func(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) - updateProviderProfileFn func(ctx context.Context, workspace, id string, profile *openshellv1.ProviderProfileImportItem, expectedResourceVersion uint64) (*openshellv1.UpdateProviderProfilesResponse, error) - deleteProviderProfileFn func(ctx context.Context, id, workspace string) (bool, error) - lintProviderProfilesFn func(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.LintProviderProfilesResponse, error) - updateSandboxPolicyFn func(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) - setGlobalPolicyFn func(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) - deleteGlobalPolicyFn func(ctx context.Context) error - getSandboxPolicyStatusFn func(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) - listSandboxPoliciesFn func(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) - getDraftPolicyFn func(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) - approveDraftChunkFn func(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) - rejectDraftChunkFn func(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) - approveAllDraftChunksFn func(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) - getGatewaySettingsFn func(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) - setSettingFn func(ctx context.Context, key, value string) error - deleteSettingFn func(ctx context.Context, key string) error - editDraftChunkFn func(ctx context.Context, workspace, name, chunkID string, proposedRule *sandboxv1.NetworkPolicyRule) error - undoDraftChunkFn func(ctx context.Context, workspace, name, chunkID string) (*openshellv1.UndoDraftChunkResponse, error) - clearDraftChunksFn func(ctx context.Context, workspace, name string) (*openshellv1.ClearDraftChunksResponse, error) - getDraftHistoryFn func(ctx context.Context, workspace, name string) (*openshellv1.GetDraftHistoryResponse, error) - getSandboxLogsFn func(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) - listSandboxProvidersFn func(ctx context.Context, workspace, sandboxName string) (*openshellv1.ListSandboxProvidersResponse, error) - attachSandboxProviderFn func(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.AttachSandboxProviderResponse, error) - detachSandboxProviderFn func(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.DetachSandboxProviderResponse, error) - exposeServiceFn func(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) - listServicesFn func(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) - deleteServiceFn func(ctx context.Context, workspace, sandbox, service string) (bool, error) - setInferenceRouteFn func(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) - getInferenceRouteFn func(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) - deleteInferenceRouteFn func(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) -} - -func (m *mockGateway) Health(ctx context.Context) (*openshellv1.HealthResponse, error) { - return m.healthFn(ctx) -} -func (m *mockGateway) GetGatewayInfo(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return m.getGatewayInfoFn(ctx) -} -func (m *mockGateway) GetCurrentUser(ctx context.Context) (*openshellv1.GetCurrentUserResponse, error) { - return m.getCurrentUserFn(ctx) -} -func (m *mockGateway) ExecSandboxInteractive(ctx context.Context) (openshellv1.OpenShell_ExecSandboxInteractiveClient, error) { - return m.execSandboxInteractiveFn(ctx) -} -func (m *mockGateway) CreateSandbox(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) { - return m.createSandboxFn(ctx, workspace, name, spec, labels, annotations) -} -func (m *mockGateway) GetSandbox(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) { - return m.getSandboxFn(ctx, workspace, name) -} -func (m *mockGateway) ListSandboxes(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) { - return m.listSandboxesFn(ctx, workspace, limit, offset, labelSelector) -} -func (m *mockGateway) ExecSandbox(ctx context.Context, sandboxID string, command []string, stdin []byte, workdir string, timeoutSeconds uint32) ([]byte, []byte, int32, error) { - return m.execSandboxFn(ctx, sandboxID, command, stdin, workdir, timeoutSeconds) -} -func (m *mockGateway) DeleteSandbox(ctx context.Context, workspace, name string) (bool, error) { - return m.deleteSandboxFn(ctx, workspace, name) -} -func (m *mockGateway) CreateWorkspace(ctx context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) { - return m.createWorkspaceFn(ctx, name, labels) -} -func (m *mockGateway) GetWorkspace(ctx context.Context, name string) (*datamodelv1.Workspace, error) { - return m.getWorkspaceFn(ctx, name) -} -func (m *mockGateway) ListWorkspaces(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) { - return m.listWorkspacesFn(ctx, limit, offset, labelSelector) -} -func (m *mockGateway) DeleteWorkspace(ctx context.Context, name string) (bool, error) { - return m.deleteWorkspaceFn(ctx, name) -} -func (m *mockGateway) AddWorkspaceMember(ctx context.Context, workspace, principalSubject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) { - return m.addWorkspaceMemberFn(ctx, workspace, principalSubject, role) -} -func (m *mockGateway) RemoveWorkspaceMember(ctx context.Context, workspace, principalSubject string) (bool, error) { - return m.removeWorkspaceMemberFn(ctx, workspace, principalSubject) -} -func (m *mockGateway) ListWorkspaceMembers(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.WorkspaceMember, error) { - return m.listWorkspaceMembersFn(ctx, workspace, limit, offset) -} -func (m *mockGateway) CreateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider) (*datamodelv1.Provider, error) { - return m.createProviderFn(ctx, workspace, provider) -} -func (m *mockGateway) GetProvider(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) { - return m.getProviderFn(ctx, workspace, name) -} -func (m *mockGateway) ListProviders(ctx context.Context, workspace string, limit, offset uint32) ([]*datamodelv1.Provider, error) { - return m.listProvidersFn(ctx, workspace, limit, offset) -} -func (m *mockGateway) DeleteProvider(ctx context.Context, workspace, name string) (bool, error) { - return m.deleteProviderFn(ctx, workspace, name) -} -func (m *mockGateway) UpdateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider, credentialExpiresAtMs map[string]int64) (*datamodelv1.Provider, error) { - return m.updateProviderFn(ctx, workspace, provider, credentialExpiresAtMs) -} -func (m *mockGateway) GetProviderRefreshStatus(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.GetProviderRefreshStatusResponse, error) { - return m.getProviderRefreshStatusFn(ctx, workspace, provider, credentialKey) -} -func (m *mockGateway) ConfigureProviderRefresh(ctx context.Context, workspace, provider, credentialKey string, strategy openshellv1.ProviderCredentialRefreshStrategy, material map[string]string, secretMaterialKeys []string, expiresAtMs *int64) (*openshellv1.ConfigureProviderRefreshResponse, error) { - return m.configureProviderRefreshFn(ctx, workspace, provider, credentialKey, strategy, material, secretMaterialKeys, expiresAtMs) -} -func (m *mockGateway) RotateProviderCredential(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.RotateProviderCredentialResponse, error) { - return m.rotateProviderCredentialFn(ctx, workspace, provider, credentialKey) -} -func (m *mockGateway) DeleteProviderRefresh(ctx context.Context, workspace, provider, credentialKey string) (bool, error) { - return m.deleteProviderRefreshFn(ctx, workspace, provider, credentialKey) -} -func (m *mockGateway) ListProviderProfiles(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.ProviderProfile, error) { - return m.listProviderProfilesFn(ctx, workspace, limit, offset) -} -func (m *mockGateway) GetProviderProfile(ctx context.Context, id, workspace string) (*openshellv1.ProviderProfile, error) { - return m.getProviderProfileFn(ctx, id, workspace) -} -func (m *mockGateway) ImportProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) { - return m.importProviderProfilesFn(ctx, workspace, profiles) -} -func (m *mockGateway) UpdateProviderProfile(ctx context.Context, workspace, id string, profile *openshellv1.ProviderProfileImportItem, expectedResourceVersion uint64) (*openshellv1.UpdateProviderProfilesResponse, error) { - return m.updateProviderProfileFn(ctx, workspace, id, profile, expectedResourceVersion) -} -func (m *mockGateway) DeleteProviderProfile(ctx context.Context, id, workspace string) (bool, error) { - return m.deleteProviderProfileFn(ctx, id, workspace) -} -func (m *mockGateway) LintProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.LintProviderProfilesResponse, error) { - return m.lintProviderProfilesFn(ctx, workspace, profiles) -} -func (m *mockGateway) UpdateSandboxPolicy(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) { - return m.updateSandboxPolicyFn(ctx, workspace, name, policy, expectedResourceVersion) -} -func (m *mockGateway) SetGlobalPolicy(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) { - return m.setGlobalPolicyFn(ctx, policy) -} -func (m *mockGateway) DeleteGlobalPolicy(ctx context.Context) error { - return m.deleteGlobalPolicyFn(ctx) -} -func (m *mockGateway) GetSandboxPolicyStatus(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - return m.getSandboxPolicyStatusFn(ctx, workspace, name, version, global) -} -func (m *mockGateway) ListSandboxPolicies(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) { - return m.listSandboxPoliciesFn(ctx, workspace, name, limit, offset, global) -} -func (m *mockGateway) GetDraftPolicy(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) { - return m.getDraftPolicyFn(ctx, workspace, name, statusFilter) -} -func (m *mockGateway) ApproveDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) { - return m.approveDraftChunkFn(ctx, workspace, name, chunkID) -} -func (m *mockGateway) RejectDraftChunk(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) { - return m.rejectDraftChunkFn(ctx, workspace, name, chunkID, reason) -} -func (m *mockGateway) ApproveAllDraftChunks(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - return m.approveAllDraftChunksFn(ctx, workspace, name, includeSecurityFlagged) -} -func (m *mockGateway) GetGatewaySettings(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - return m.getGatewaySettingsFn(ctx) -} -func (m *mockGateway) SetSetting(ctx context.Context, key, value string) error { - return m.setSettingFn(ctx, key, value) -} -func (m *mockGateway) DeleteSetting(ctx context.Context, key string) error { - return m.deleteSettingFn(ctx, key) -} -func (m *mockGateway) EditDraftChunk(ctx context.Context, workspace, name, chunkID string, proposedRule *sandboxv1.NetworkPolicyRule) error { - return m.editDraftChunkFn(ctx, workspace, name, chunkID, proposedRule) -} -func (m *mockGateway) UndoDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.UndoDraftChunkResponse, error) { - return m.undoDraftChunkFn(ctx, workspace, name, chunkID) -} -func (m *mockGateway) ClearDraftChunks(ctx context.Context, workspace, name string) (*openshellv1.ClearDraftChunksResponse, error) { - return m.clearDraftChunksFn(ctx, workspace, name) -} -func (m *mockGateway) GetDraftHistory(ctx context.Context, workspace, name string) (*openshellv1.GetDraftHistoryResponse, error) { - return m.getDraftHistoryFn(ctx, workspace, name) -} -func (m *mockGateway) GetSandboxLogs(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) { - return m.getSandboxLogsFn(ctx, workspace, sandboxID, lines, sinceMs, sources, minLevel) -} -func (m *mockGateway) ListSandboxProviders(ctx context.Context, workspace, sandboxName string) (*openshellv1.ListSandboxProvidersResponse, error) { - return m.listSandboxProvidersFn(ctx, workspace, sandboxName) -} -func (m *mockGateway) AttachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.AttachSandboxProviderResponse, error) { - return m.attachSandboxProviderFn(ctx, workspace, sandboxName, providerName, expectedResourceVersion) -} -func (m *mockGateway) DetachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.DetachSandboxProviderResponse, error) { - return m.detachSandboxProviderFn(ctx, workspace, sandboxName, providerName, expectedResourceVersion) -} -func (m *mockGateway) ExposeService(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) { - return m.exposeServiceFn(ctx, workspace, sandbox, service, targetPort, domain) -} -func (m *mockGateway) ListServices(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) { - return m.listServicesFn(ctx, workspace, sandbox) -} -func (m *mockGateway) DeleteService(ctx context.Context, workspace, sandbox, service string) (bool, error) { - return m.deleteServiceFn(ctx, workspace, sandbox, service) -} -func (m *mockGateway) SetInferenceRoute(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) { - return m.setInferenceRouteFn(ctx, workspace, routeName, providerName, modelID, timeoutSecs, noVerify) -} -func (m *mockGateway) GetInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) { - return m.getInferenceRouteFn(ctx, workspace, routeName) -} -func (m *mockGateway) DeleteInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) { - return m.deleteInferenceRouteFn(ctx, workspace, routeName) -} - -func newTestApp(gw *mockGateway) *App { - return &App{gateway: gw} -} diff --git a/backend/internal/api/mock_sdk_test.go b/backend/internal/api/mock_sdk_test.go new file mode 100644 index 00000000..2b7d5b48 --- /dev/null +++ b/backend/internal/api/mock_sdk_test.go @@ -0,0 +1,638 @@ +package api + +import ( + "context" + "io" + "sync" + + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" +) + +// mockSDK is a mock of openshell.ClientInterface for testing. +type mockSDK struct { + sandboxes mockSDKSandboxes + providers mockSDKProviders + workspaces mockSDKWorkspaces + policy mockSDKPolicy + config mockSDKConfig + services mockSDKServices + inference mockSDKInference + health mockSDKHealth + exec mockSDKExec + files mockSDKFiles +} + +func (m *mockSDK) Sandboxes() openshell.SandboxInterface { return &m.sandboxes } +func (m *mockSDK) Providers() openshell.ProviderInterface { return &m.providers } +func (m *mockSDK) Services() openshell.ServiceInterface { return &m.services } +func (m *mockSDK) Exec() openshell.ExecInterface { return &m.exec } +func (m *mockSDK) Files() openshell.FileInterface { return &m.files } +func (m *mockSDK) Health() openshell.HealthInterface { return &m.health } +func (m *mockSDK) SSH() openshell.SSHInterface { panic("not implemented") } +func (m *mockSDK) TCP() openshell.TCPInterface { panic("not implemented") } +func (m *mockSDK) Config() openshell.ConfigInterface { return &m.config } +func (m *mockSDK) Policy() openshell.PolicyInterface { return &m.policy } +func (m *mockSDK) Workspaces() openshell.WorkspaceInterface { return &m.workspaces } +func (m *mockSDK) Inference() openshell.InferenceInterface { return &m.inference } +func (m *mockSDK) Close() error { return nil } + +// mockSDKSandboxes provides injectable sandbox operations. +type mockSDKSandboxes struct { + listFn func(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.Sandbox, error) + createFn func(ctx context.Context, workspace, name string, spec *openshell.SandboxSpec, labels map[string]string, opts ...openshell.CreateOptions) (*openshell.Sandbox, error) + getFn func(ctx context.Context, workspace, name string) (*openshell.Sandbox, error) + deleteFn func(ctx context.Context, workspace, name string) error + attachFn func(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshell.AttachProviderResult, error) + detachFn func(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshell.DetachProviderResult, error) + listProvidersFn func(ctx context.Context, workspace, sandboxName string) ([]*openshell.Provider, error) + getLogsFn func(ctx context.Context, workspace, name string, opts ...openshell.LogOption) (*openshell.LogResult, error) +} + +func (m *mockSDKSandboxes) List(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.Sandbox, error) { + if m.listFn != nil { + return m.listFn(ctx, workspace, opts...) + } + return nil, nil +} + +func (m *mockSDKSandboxes) Create(ctx context.Context, workspace, name string, spec *openshell.SandboxSpec, labels map[string]string, opts ...openshell.CreateOptions) (*openshell.Sandbox, error) { + if m.createFn != nil { + return m.createFn(ctx, workspace, name, spec, labels, opts...) + } + return &openshell.Sandbox{Name: name}, nil +} + +func (m *mockSDKSandboxes) Get(ctx context.Context, workspace, name string) (*openshell.Sandbox, error) { + if m.getFn != nil { + return m.getFn(ctx, workspace, name) + } + return &openshell.Sandbox{Name: name}, nil +} + +func (m *mockSDKSandboxes) Delete(ctx context.Context, workspace, name string) error { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, name) + } + return nil +} + +func (m *mockSDKSandboxes) AttachProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshell.AttachProviderResult, error) { + if m.attachFn != nil { + return m.attachFn(ctx, workspace, sandboxName, providerName, expectedResourceVersion) + } + return &openshell.AttachProviderResult{Attached: true, Sandbox: &openshell.Sandbox{Name: sandboxName}}, nil +} + +func (m *mockSDKSandboxes) DetachProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshell.DetachProviderResult, error) { + if m.detachFn != nil { + return m.detachFn(ctx, workspace, sandboxName, providerName, expectedResourceVersion) + } + return &openshell.DetachProviderResult{Detached: true, Sandbox: &openshell.Sandbox{Name: sandboxName}}, nil +} + +func (m *mockSDKSandboxes) ListProviders(ctx context.Context, workspace, sandboxName string) ([]*openshell.Provider, error) { + if m.listProvidersFn != nil { + return m.listProvidersFn(ctx, workspace, sandboxName) + } + return nil, nil +} + +func (m *mockSDKSandboxes) Watch(_ context.Context, _, _ string, _ ...openshell.WatchOptions) (openshell.WatchInterface[*openshell.Sandbox], error) { + panic("not implemented") +} + +func (m *mockSDKSandboxes) WaitReady(_ context.Context, _, _ string, _ ...openshell.WaitOptions) (*openshell.Sandbox, error) { + panic("not implemented") +} + +func (m *mockSDKSandboxes) GetLogs(ctx context.Context, workspace, name string, opts ...openshell.LogOption) (*openshell.LogResult, error) { + if m.getLogsFn != nil { + return m.getLogsFn(ctx, workspace, name, opts...) + } + return &openshell.LogResult{}, nil +} + +func (m *mockSDKSandboxes) Start(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + panic("not implemented") +} + +func (m *mockSDKSandboxes) Stop(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + panic("not implemented") +} + +func (m *mockSDKSandboxes) WaitStopped(_ context.Context, _, _ string, _ ...openshell.WaitOptions) (*openshell.Sandbox, error) { + panic("not implemented") +} + +type mockSDKProviders struct { + createFn func(ctx context.Context, workspace string, provider *openshell.Provider) (*openshell.Provider, error) + getFn func(ctx context.Context, workspace, name string) (*openshell.Provider, error) + listFn func(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.Provider, error) + updateFn func(ctx context.Context, workspace string, provider *openshell.Provider) (*openshell.Provider, error) + deleteFn func(ctx context.Context, workspace, name string) error + profiles mockSDKProfiles + refresh mockSDKRefresh +} + +func (m *mockSDKProviders) Profiles() openshell.ProfileInterface { return &m.profiles } +func (m *mockSDKProviders) Refresh() openshell.RefreshInterface { return &m.refresh } + +func (m *mockSDKProviders) Create(ctx context.Context, workspace string, provider *openshell.Provider) (*openshell.Provider, error) { + if m.createFn != nil { + return m.createFn(ctx, workspace, provider) + } + if provider != nil { + return provider, nil + } + return &openshell.Provider{}, nil +} + +func (m *mockSDKProviders) Get(ctx context.Context, workspace, name string) (*openshell.Provider, error) { + if m.getFn != nil { + return m.getFn(ctx, workspace, name) + } + return &openshell.Provider{Name: name, Workspace: workspace}, nil +} + +func (m *mockSDKProviders) List(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.Provider, error) { + if m.listFn != nil { + return m.listFn(ctx, workspace, opts...) + } + return nil, nil +} + +func (m *mockSDKProviders) Update(ctx context.Context, workspace string, provider *openshell.Provider) (*openshell.Provider, error) { + if m.updateFn != nil { + return m.updateFn(ctx, workspace, provider) + } + return provider, nil +} + +func (m *mockSDKProviders) Delete(ctx context.Context, workspace, name string) error { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, name) + } + return nil +} + +func (m *mockSDKProviders) Ensure(_ context.Context, _ string, _ *openshell.Provider) (*openshell.Provider, error) { + panic("not implemented") +} + +type mockSDKRefresh struct { + getStatusFn func(ctx context.Context, workspace, provider, credentialKey string) ([]*openshell.RefreshStatus, error) + configureFn func(ctx context.Context, workspace string, config *openshell.RefreshConfig) (*openshell.RefreshStatus, error) + rotateFn func(ctx context.Context, workspace, provider, credentialKey string) (*openshell.RefreshStatus, error) + deleteFn func(ctx context.Context, workspace, provider, credentialKey string) (bool, error) +} + +func (m *mockSDKRefresh) GetStatus(ctx context.Context, workspace, provider, credentialKey string) ([]*openshell.RefreshStatus, error) { + if m.getStatusFn != nil { + return m.getStatusFn(ctx, workspace, provider, credentialKey) + } + return nil, nil +} + +func (m *mockSDKRefresh) Configure(ctx context.Context, workspace string, config *openshell.RefreshConfig) (*openshell.RefreshStatus, error) { + if m.configureFn != nil { + return m.configureFn(ctx, workspace, config) + } + return &openshell.RefreshStatus{CredentialKey: config.CredentialKey, Strategy: config.Strategy}, nil +} + +func (m *mockSDKRefresh) Rotate(ctx context.Context, workspace, provider, credentialKey string) (*openshell.RefreshStatus, error) { + if m.rotateFn != nil { + return m.rotateFn(ctx, workspace, provider, credentialKey) + } + return &openshell.RefreshStatus{CredentialKey: credentialKey}, nil +} + +func (m *mockSDKRefresh) Delete(ctx context.Context, workspace, provider, credentialKey string) (bool, error) { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, provider, credentialKey) + } + return true, nil +} + +type mockSDKProfiles struct { + listFn func(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.ProviderProfile, error) + getFn func(ctx context.Context, workspace, id string) (*openshell.ProviderProfile, error) + importFn func(ctx context.Context, workspace string, items []openshell.ProfileImportItem) (*openshell.ImportResult, error) + updateFn func(ctx context.Context, workspace, id string, expectedResourceVersion uint64, item openshell.ProfileImportItem) (*openshell.UpdateResult, error) + lintFn func(ctx context.Context, workspace string, items []openshell.ProfileImportItem) (*openshell.LintResult, error) + deleteFn func(ctx context.Context, workspace, id string) (bool, error) +} + +func (m *mockSDKProfiles) List(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.ProviderProfile, error) { + if m.listFn != nil { + return m.listFn(ctx, workspace, opts...) + } + return nil, nil +} + +func (m *mockSDKProfiles) Get(ctx context.Context, workspace, id string) (*openshell.ProviderProfile, error) { + if m.getFn != nil { + return m.getFn(ctx, workspace, id) + } + return &openshell.ProviderProfile{ID: id}, nil +} + +func (m *mockSDKProfiles) Import(ctx context.Context, workspace string, items []openshell.ProfileImportItem) (*openshell.ImportResult, error) { + if m.importFn != nil { + return m.importFn(ctx, workspace, items) + } + result := &openshell.ImportResult{Imported: true} + for _, item := range items { + result.Profiles = append(result.Profiles, item.Profile) + } + return result, nil +} + +func (m *mockSDKProfiles) Update(ctx context.Context, workspace, id string, expectedResourceVersion uint64, item openshell.ProfileImportItem) (*openshell.UpdateResult, error) { + if m.updateFn != nil { + return m.updateFn(ctx, workspace, id, expectedResourceVersion, item) + } + profile := item.Profile + return &openshell.UpdateResult{Updated: true, Profile: &profile}, nil +} + +func (m *mockSDKProfiles) Lint(ctx context.Context, workspace string, items []openshell.ProfileImportItem) (*openshell.LintResult, error) { + if m.lintFn != nil { + return m.lintFn(ctx, workspace, items) + } + return &openshell.LintResult{Valid: true}, nil +} + +func (m *mockSDKProfiles) Delete(ctx context.Context, workspace, id string) (bool, error) { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, id) + } + return true, nil +} + +type mockSDKWorkspaces struct { + createFn func(ctx context.Context, name string, labels map[string]string) (*openshell.Workspace, error) + getFn func(ctx context.Context, name string) (*openshell.Workspace, error) + listFn func(ctx context.Context, opts ...openshell.ListOptions) ([]*openshell.Workspace, error) + deleteFn func(ctx context.Context, name string) error + addMemberFn func(ctx context.Context, workspace, principalSubject string, role openshell.WorkspaceRole) (*openshell.WorkspaceMember, error) + removeMemberFn func(ctx context.Context, workspace, principalSubject string) error + listMembersFn func(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.WorkspaceMember, error) +} + +func (m *mockSDKWorkspaces) Create(ctx context.Context, name string, labels map[string]string) (*openshell.Workspace, error) { + if m.createFn != nil { + return m.createFn(ctx, name, labels) + } + return &openshell.Workspace{Name: name, Labels: labels, Phase: openshell.WorkspaceActive}, nil +} + +func (m *mockSDKWorkspaces) Get(ctx context.Context, name string) (*openshell.Workspace, error) { + if m.getFn != nil { + return m.getFn(ctx, name) + } + return &openshell.Workspace{Name: name, Phase: openshell.WorkspaceActive}, nil +} + +func (m *mockSDKWorkspaces) List(ctx context.Context, opts ...openshell.ListOptions) ([]*openshell.Workspace, error) { + if m.listFn != nil { + return m.listFn(ctx, opts...) + } + return nil, nil +} + +func (m *mockSDKWorkspaces) Delete(ctx context.Context, name string) error { + if m.deleteFn != nil { + return m.deleteFn(ctx, name) + } + return nil +} + +func (m *mockSDKWorkspaces) AddMember(ctx context.Context, workspace, principalSubject string, role openshell.WorkspaceRole) (*openshell.WorkspaceMember, error) { + if m.addMemberFn != nil { + return m.addMemberFn(ctx, workspace, principalSubject, role) + } + return &openshell.WorkspaceMember{PrincipalSubject: principalSubject, Role: role}, nil +} + +func (m *mockSDKWorkspaces) RemoveMember(ctx context.Context, workspace, principalSubject string) error { + if m.removeMemberFn != nil { + return m.removeMemberFn(ctx, workspace, principalSubject) + } + return nil +} + +func (m *mockSDKWorkspaces) ListMembers(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.WorkspaceMember, error) { + if m.listMembersFn != nil { + return m.listMembersFn(ctx, workspace, opts...) + } + return nil, nil +} + +type mockSDKPolicy struct { + getDraftFn func(ctx context.Context, workspace, sandboxName string, opts ...openshell.GetDraftOption) (*openshell.DraftPolicy, error) + approveFn func(ctx context.Context, workspace, sandboxName, chunkID string) (*openshell.ApproveResult, error) + rejectFn func(ctx context.Context, workspace, sandboxName, chunkID, reason string) error + approveAllFn func(ctx context.Context, workspace, sandboxName string, opts ...openshell.ApproveAllOption) (*openshell.ApproveAllResult, error) + clearFn func(ctx context.Context, workspace, sandboxName string) (*openshell.ClearResult, error) + historyFn func(ctx context.Context, workspace, sandboxName string) ([]openshell.DraftHistoryEntry, error) + getStatusFn func(ctx context.Context, workspace, sandboxName string, opts ...openshell.GetStatusOption) (*openshell.PolicyStatusResult, error) + listFn func(ctx context.Context, workspace string, opts ...openshell.ListPolicyOption) ([]openshell.SandboxPolicyRevision, error) + editFn func(ctx context.Context, workspace, sandboxName, chunkID string, proposedRule *openshell.NetworkPolicyRule) error + undoFn func(ctx context.Context, workspace, sandboxName, chunkID string) (*openshell.UndoResult, error) +} + +func (m *mockSDKPolicy) GetDraft(ctx context.Context, workspace, sandboxName string, opts ...openshell.GetDraftOption) (*openshell.DraftPolicy, error) { + if m.getDraftFn != nil { + return m.getDraftFn(ctx, workspace, sandboxName, opts...) + } + return &openshell.DraftPolicy{}, nil +} + +func (m *mockSDKPolicy) ApproveDraftChunk(ctx context.Context, workspace, sandboxName, chunkID string) (*openshell.ApproveResult, error) { + if m.approveFn != nil { + return m.approveFn(ctx, workspace, sandboxName, chunkID) + } + return &openshell.ApproveResult{}, nil +} + +func (m *mockSDKPolicy) RejectDraftChunk(ctx context.Context, workspace, sandboxName, chunkID, reason string) error { + if m.rejectFn != nil { + return m.rejectFn(ctx, workspace, sandboxName, chunkID, reason) + } + return nil +} + +func (m *mockSDKPolicy) ApproveAllDraftChunks(ctx context.Context, workspace, sandboxName string, opts ...openshell.ApproveAllOption) (*openshell.ApproveAllResult, error) { + if m.approveAllFn != nil { + return m.approveAllFn(ctx, workspace, sandboxName, opts...) + } + return &openshell.ApproveAllResult{}, nil +} + +func (m *mockSDKPolicy) ClearDraftChunks(ctx context.Context, workspace, sandboxName string) (*openshell.ClearResult, error) { + if m.clearFn != nil { + return m.clearFn(ctx, workspace, sandboxName) + } + return &openshell.ClearResult{}, nil +} + +func (m *mockSDKPolicy) GetDraftHistory(ctx context.Context, workspace, sandboxName string) ([]openshell.DraftHistoryEntry, error) { + if m.historyFn != nil { + return m.historyFn(ctx, workspace, sandboxName) + } + return nil, nil +} + +func (m *mockSDKPolicy) GetStatus(ctx context.Context, workspace, sandboxName string, opts ...openshell.GetStatusOption) (*openshell.PolicyStatusResult, error) { + if m.getStatusFn != nil { + return m.getStatusFn(ctx, workspace, sandboxName, opts...) + } + return &openshell.PolicyStatusResult{}, nil +} + +func (m *mockSDKPolicy) List(ctx context.Context, workspace string, opts ...openshell.ListPolicyOption) ([]openshell.SandboxPolicyRevision, error) { + if m.listFn != nil { + return m.listFn(ctx, workspace, opts...) + } + return nil, nil +} + +func (m *mockSDKPolicy) EditDraftChunk(ctx context.Context, workspace, sandboxName, chunkID string, proposedRule *openshell.NetworkPolicyRule) error { + if m.editFn != nil { + return m.editFn(ctx, workspace, sandboxName, chunkID, proposedRule) + } + return nil +} + +func (m *mockSDKPolicy) UndoDraftChunk(ctx context.Context, workspace, sandboxName, chunkID string) (*openshell.UndoResult, error) { + if m.undoFn != nil { + return m.undoFn(ctx, workspace, sandboxName, chunkID) + } + return &openshell.UndoResult{}, nil +} + +type mockSDKConfig struct { + getSandboxFn func(ctx context.Context, workspace, sandboxName string) (*openshell.SandboxConfig, error) + getGatewayFn func(ctx context.Context) (*openshell.GatewayConfig, error) + updateFn func(ctx context.Context, workspace string, update *openshell.ConfigUpdate) (*openshell.ConfigUpdateResult, error) +} + +func (m *mockSDKConfig) GetSandbox(ctx context.Context, workspace, sandboxName string) (*openshell.SandboxConfig, error) { + if m.getSandboxFn != nil { + return m.getSandboxFn(ctx, workspace, sandboxName) + } + return &openshell.SandboxConfig{}, nil +} + +func (m *mockSDKConfig) GetGateway(ctx context.Context) (*openshell.GatewayConfig, error) { + if m.getGatewayFn != nil { + return m.getGatewayFn(ctx) + } + return &openshell.GatewayConfig{}, nil +} + +func (m *mockSDKConfig) Update(ctx context.Context, workspace string, update *openshell.ConfigUpdate) (*openshell.ConfigUpdateResult, error) { + if m.updateFn != nil { + return m.updateFn(ctx, workspace, update) + } + return &openshell.ConfigUpdateResult{}, nil +} + +type mockSDKServices struct { + exposeFn func(ctx context.Context, workspace, sandboxName, serviceName string, targetPort uint32, domain bool) (*openshell.ServiceEndpoint, error) + getFn func(ctx context.Context, workspace, sandboxName, serviceName string) (*openshell.ServiceEndpoint, error) + listFn func(ctx context.Context, workspace, sandboxName string, opts ...openshell.ListOptions) ([]*openshell.ServiceEndpoint, error) + deleteFn func(ctx context.Context, workspace, sandboxName, serviceName string) error +} + +func (m *mockSDKServices) Expose(ctx context.Context, workspace, sandboxName, serviceName string, targetPort uint32, domain bool) (*openshell.ServiceEndpoint, error) { + if m.exposeFn != nil { + return m.exposeFn(ctx, workspace, sandboxName, serviceName, targetPort, domain) + } + return &openshell.ServiceEndpoint{SandboxName: sandboxName, ServiceName: serviceName, TargetPort: targetPort, Domain: domain}, nil +} + +func (m *mockSDKServices) Get(ctx context.Context, workspace, sandboxName, serviceName string) (*openshell.ServiceEndpoint, error) { + if m.getFn != nil { + return m.getFn(ctx, workspace, sandboxName, serviceName) + } + return &openshell.ServiceEndpoint{SandboxName: sandboxName, ServiceName: serviceName}, nil +} + +func (m *mockSDKServices) List(ctx context.Context, workspace, sandboxName string, opts ...openshell.ListOptions) ([]*openshell.ServiceEndpoint, error) { + if m.listFn != nil { + return m.listFn(ctx, workspace, sandboxName, opts...) + } + return nil, nil +} + +func (m *mockSDKServices) Delete(ctx context.Context, workspace, sandboxName, serviceName string) error { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, sandboxName, serviceName) + } + return nil +} + +type mockSDKInference struct { + setFn func(ctx context.Context, workspace string, config *openshell.InferenceRouteConfig) (*openshell.InferenceRoute, error) + getFn func(ctx context.Context, workspace, routeName string) (*openshell.InferenceRoute, error) + deleteFn func(ctx context.Context, workspace, routeName string) error +} + +func (m *mockSDKInference) SetRoute(ctx context.Context, workspace string, config *openshell.InferenceRouteConfig) (*openshell.InferenceRoute, error) { + if m.setFn != nil { + return m.setFn(ctx, workspace, config) + } + return &openshell.InferenceRoute{ + RouteName: config.RouteName, + ProviderName: config.ProviderName, + ModelID: config.ModelID, + TimeoutSecs: config.TimeoutSecs, + Workspace: workspace, + }, nil +} + +func (m *mockSDKInference) GetRoute(ctx context.Context, workspace, routeName string) (*openshell.InferenceRoute, error) { + if m.getFn != nil { + return m.getFn(ctx, workspace, routeName) + } + return &openshell.InferenceRoute{RouteName: routeName, Workspace: workspace}, nil +} + +func (m *mockSDKInference) DeleteRoute(ctx context.Context, workspace, routeName string) error { + if m.deleteFn != nil { + return m.deleteFn(ctx, workspace, routeName) + } + return nil +} + +type mockSDKHealth struct { + checkFn func(ctx context.Context) (*openshell.HealthResult, error) + getGatewayInfoFn func(ctx context.Context) (*openshell.GatewayInfo, error) + getCurrentUserFn func(ctx context.Context) (*openshell.CurrentUser, error) +} + +func (m *mockSDKHealth) Check(ctx context.Context) (*openshell.HealthResult, error) { + if m.checkFn != nil { + return m.checkFn(ctx) + } + return &openshell.HealthResult{Healthy: true}, nil +} + +func (m *mockSDKHealth) GetGatewayInfo(ctx context.Context) (*openshell.GatewayInfo, error) { + if m.getGatewayInfoFn != nil { + return m.getGatewayInfoFn(ctx) + } + return &openshell.GatewayInfo{Status: openshell.ServiceStatusHealthy}, nil +} + +func (m *mockSDKHealth) GetCurrentUser(ctx context.Context) (*openshell.CurrentUser, error) { + if m.getCurrentUserFn != nil { + return m.getCurrentUserFn(ctx) + } + return &openshell.CurrentUser{Subject: "test-user"}, nil +} + +type mockInteractiveSession struct { + reads chan []byte + written []byte + resizes [][2]uint32 + exit int + closeReads sync.Once + mu sync.Mutex + closed bool +} + +func newTestAppWithSDK(sdk *mockSDK) *App { + return &App{sdk: sdk} +} + +func (m *mockInteractiveSession) Read(p []byte) (int, error) { + if m.reads == nil { + return 0, io.EOF + } + data, ok := <-m.reads + if !ok { + return 0, io.EOF + } + return copy(p, data), nil +} + +func (m *mockInteractiveSession) Write(p []byte) (int, error) { + m.mu.Lock() + defer m.mu.Unlock() + m.written = append(m.written, p...) + return len(p), nil +} + +func (m *mockInteractiveSession) Resize(cols, rows uint32) error { + m.mu.Lock() + defer m.mu.Unlock() + m.resizes = append(m.resizes, [2]uint32{cols, rows}) + return nil +} + +func (m *mockInteractiveSession) ExitCode() (int, error) { + m.mu.Lock() + defer m.mu.Unlock() + return m.exit, nil +} + +func (m *mockInteractiveSession) Close() error { + m.mu.Lock() + m.closed = true + m.mu.Unlock() + m.closeReads.Do(func() { + if m.reads != nil { + close(m.reads) + } + }) + return nil +} + +type mockSDKExec struct { + runFn func(ctx context.Context, workspace, sandboxName string, command []string, opts ...openshell.ExecOptions) (*openshell.ExecResult, error) + streamFn func(ctx context.Context, workspace, sandboxName string, command []string, opts ...openshell.ExecOptions) (openshell.ExecStream, error) + interactiveFn func(ctx context.Context, workspace, sandboxName string, command []string, cols, rows uint32, opts ...openshell.ExecOptions) (openshell.InteractiveSession, error) +} + +func (m *mockSDKExec) Run(ctx context.Context, workspace, sandboxName string, command []string, opts ...openshell.ExecOptions) (*openshell.ExecResult, error) { + if m.runFn != nil { + return m.runFn(ctx, workspace, sandboxName, command, opts...) + } + return &openshell.ExecResult{}, nil +} + +func (m *mockSDKExec) Stream(ctx context.Context, workspace, sandboxName string, command []string, opts ...openshell.ExecOptions) (openshell.ExecStream, error) { + if m.streamFn != nil { + return m.streamFn(ctx, workspace, sandboxName, command, opts...) + } + panic("not implemented") +} + +func (m *mockSDKExec) Interactive(ctx context.Context, workspace, sandboxName string, command []string, cols, rows uint32, opts ...openshell.ExecOptions) (openshell.InteractiveSession, error) { + if m.interactiveFn != nil { + return m.interactiveFn(ctx, workspace, sandboxName, command, cols, rows, opts...) + } + panic("not implemented") +} + +type mockSDKFiles struct { + uploadFn func(ctx context.Context, workspace, sandboxName, localPath, remotePath string) error + downloadFn func(ctx context.Context, workspace, sandboxName, remotePath, localPath string) error +} + +func (m *mockSDKFiles) Upload(ctx context.Context, workspace, sandboxName, localPath, remotePath string) error { + if m.uploadFn != nil { + return m.uploadFn(ctx, workspace, sandboxName, localPath, remotePath) + } + return nil +} + +func (m *mockSDKFiles) Download(ctx context.Context, workspace, sandboxName, remotePath, localPath string) error { + if m.downloadFn != nil { + return m.downloadFn(ctx, workspace, sandboxName, remotePath, localPath) + } + return nil +} diff --git a/backend/internal/api/policies_handler.go b/backend/internal/api/policies_handler.go index 221f572c..d790820e 100644 --- a/backend/internal/api/policies_handler.go +++ b/backend/internal/api/policies_handler.go @@ -4,44 +4,67 @@ import ( "encoding/json" "log/slog" "net/http" + "sync" "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // GetSandboxPolicy returns the latest revision, active version, and revision -// history for a sandbox (GetSandboxPolicyStatus + ListSandboxPolicies). +// history for a sandbox. Policy().List omits ListSandboxPoliciesRequest.Name +// (SDK gap), so history is reconstructed with GetStatus(WithVersion). func (app *App) GetSandboxPolicy(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") + ctx := r.Context() - status, err := app.gateway.GetSandboxPolicyStatus(r.Context(), workspace, name, 0, false) + status, err := app.sdk.Policy().GetStatus(ctx, workspace, name) if err != nil { - writeGrpcError(w, err) - return - } - list, err := app.gateway.ListSandboxPolicies(r.Context(), workspace, name, 0, 0, false) - if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - view := models.SandboxPolicyView{ - ActiveVersion: status.GetActiveVersion(), - Revisions: []models.PolicyRevision{}, - } - if status.GetRevision() != nil { - latest := models.FromPolicyRevision(status.GetRevision()) - view.Latest = &latest - } - for _, revision := range list.GetRevisions() { - view.Revisions = append(view.Revisions, models.FromPolicyRevision(revision)) + view := models.FromSDKPolicyStatus(status) + latest := models.FromSDKPolicyRevision(&status.Revision) + n := status.Revision.Version + view.Revisions = make([]models.PolicyRevision, 0, n) + + // Policy().List omits sandbox name, so history is GetStatus(WithVersion) + // per revision. Fetch older versions in parallel; keep latest from the + // first GetStatus to avoid a redundant round-trip. + if n > 1 { + historical := make([]models.PolicyRevision, n-1) + var wg sync.WaitGroup + for v := uint32(1); v < n; v++ { + wg.Add(1) + go func(v uint32) { + defer wg.Done() + revStatus, revErr := app.sdk.Policy().GetStatus(ctx, workspace, name, openshell.WithVersion(v)) + if revErr != nil { + slog.Warn("sandbox policy revision unavailable", + "workspace", workspace, "sandbox", name, "version", v, "error", revErr) + return + } + historical[v-1] = models.FromSDKPolicyRevision(&revStatus.Revision) + }(v) + } + wg.Wait() + for _, rev := range historical { + if rev.Version != 0 { + view.Revisions = append(view.Revisions, rev) + } + } + } + if n >= 1 { + view.Revisions = append(view.Revisions, latest) } writeJSON(w, http.StatusOK, view) } -// UpdatePolicyRequest carries the full replacement policy as protojson. +// UpdatePolicyRequest carries the full replacement policy as JSON. // Sandbox-scoped updates may only change network_policies and inference // fields — filesystem/landlock/process must match the create-time policy. type UpdatePolicyRequest struct { @@ -49,7 +72,7 @@ type UpdatePolicyRequest struct { ExpectedResourceVersion uint64 `json:"expectedResourceVersion,omitempty"` } -// UpdateSandboxPolicy applies a policy update to a sandbox via UpdateConfig. +// UpdateSandboxPolicy applies a policy update to a sandbox via Config.Update. func (app *App) UpdateSandboxPolicy(w http.ResponseWriter, r *http.Request) { var body UpdatePolicyRequest if !decodeBody(w, r, &body) { @@ -59,33 +82,37 @@ func (app *App) UpdateSandboxPolicy(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_policy", "policy is required") return } - policy, err := models.ParsePolicy(body.Policy) + policy, err := models.ParseSDKPolicy(body.Policy) if err != nil { slog.Error("invalid policy specification", "error", err) - writeError(w, http.StatusBadRequest, "invalid_policy", "invalid policy specification") + writeError(w, http.StatusBadRequest, "invalid_policy", "policy does not match the SandboxPolicy schema: "+err.Error()) return } - resp, err := app.gateway.UpdateSandboxPolicy(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), policy, body.ExpectedResourceVersion) + result, err := app.sdk.Config().Update(r.Context(), chi.URLParam(r, "workspace"), &openshell.ConfigUpdate{ + Name: chi.URLParam(r, "name"), + Policy: policy, + ExpectedResourceVersion: body.ExpectedResourceVersion, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.Version, + PolicyHash: result.PolicyHash, }) } // GetGlobalPolicy returns gateway-global policy revisions (Platform Admin). func (app *App) GetGlobalPolicy(w http.ResponseWriter, r *http.Request) { - list, err := app.gateway.ListSandboxPolicies(r.Context(), "", "", 0, 0, true) + revisions, err := app.sdk.Policy().List(r.Context(), "", openshell.WithListGlobal(true)) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } view := models.SandboxPolicyView{Revisions: []models.PolicyRevision{}} - for _, revision := range list.GetRevisions() { - view.Revisions = append(view.Revisions, models.FromPolicyRevision(revision)) + for i := range revisions { + view.Revisions = append(view.Revisions, models.FromSDKPolicyRevision(&revisions[i])) } if len(view.Revisions) > 0 { view.Latest = &view.Revisions[0] @@ -105,28 +132,35 @@ func (app *App) SetGlobalPolicy(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_policy", "policy is required") return } - policy, err := models.ParsePolicy(body.Policy) + policy, err := models.ParseSDKPolicy(body.Policy) if err != nil { slog.Error("invalid policy specification", "error", err) - writeError(w, http.StatusBadRequest, "invalid_policy", "invalid policy specification") + writeError(w, http.StatusBadRequest, "invalid_policy", "policy does not match the SandboxPolicy schema: "+err.Error()) return } - resp, err := app.gateway.SetGlobalPolicy(r.Context(), policy) + result, err := app.sdk.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + Policy: policy, + Global: true, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.Version, + PolicyHash: result.PolicyHash, }) } // DeleteGlobalPolicy removes the gateway-global policy lock, restoring // sandbox-level policy control. Platform Admin operation. func (app *App) DeleteGlobalPolicy(w http.ResponseWriter, r *http.Request) { - if err := app.gateway.DeleteGlobalPolicy(r.Context()); err != nil { - writeGrpcError(w, err) + if _, err := app.sdk.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + Global: true, + DeleteSetting: true, + SettingKey: "policy", + }); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) diff --git a/backend/internal/api/policies_handler_test.go b/backend/internal/api/policies_handler_test.go index d6e295a5..60f226a6 100644 --- a/backend/internal/api/policies_handler_test.go +++ b/backend/internal/api/policies_handler_test.go @@ -9,499 +9,316 @@ import ( "testing" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + sdktypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types" ) +func policyStatusVersion(opts []openshell.GetStatusOption) uint32 { + cfg := sdktypes.ApplyGetStatusOptions(opts) + return (&cfg).Version() +} + func TestGetSandboxPolicy(t *testing.T) { - tests := []struct { - statusFn func(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) - listFn func(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) - name string - wantStatus int - }{ - { - name: "success with latest and revisions", - statusFn: func(_ context.Context, _, _ string, _ uint32, _ bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - return &openshellv1.GetSandboxPolicyStatusResponse{ - ActiveVersion: 2, - Revision: &openshellv1.SandboxPolicyRevision{ - Version: 2, - PolicyHash: "abc123", - Status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED, - }, - }, nil - }, - listFn: func(_ context.Context, _, _ string, _, _ uint32, _ bool) (*openshellv1.ListSandboxPoliciesResponse, error) { - return &openshellv1.ListSandboxPoliciesResponse{ - Revisions: []*openshellv1.SandboxPolicyRevision{ - {Version: 2, Status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED}, - {Version: 1, Status: openshellv1.PolicyStatus_POLICY_STATUS_SUPERSEDED}, - }, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - statusFn: func(_ context.Context, _, _ string, _ uint32, _ bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - return nil, status.Error(codes.NotFound, "sandbox not found") - }, - wantStatus: http.StatusNotFound, - }, + sdk := &mockSDK{} + sdk.policy.getStatusFn = func(_ context.Context, _, _ string, opts ...openshell.GetStatusOption) (*openshell.PolicyStatusResult, error) { + switch policyStatusVersion(opts) { + case 1: + return &openshell.PolicyStatusResult{ + ActiveVersion: 2, + Revision: openshell.SandboxPolicyRevision{ + Version: 1, + PolicyHash: "old", + Status: openshell.PolicyLoadStatusLoaded, + }, + }, nil + default: + return &openshell.PolicyStatusResult{ + ActiveVersion: 2, + Revision: openshell.SandboxPolicyRevision{ + Version: 2, + PolicyHash: "abc123", + Status: openshell.PolicyLoadStatusLoaded, + }, + }, nil + } } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{ - getSandboxPolicyStatusFn: tc.statusFn, - listSandboxPoliciesFn: tc.listFn, - }) - r := chi.NewRouter() - r.Get("/workspaces/{workspace}/sandboxes/{name}/policy", app.GetSandboxPolicy) - - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/policy", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/policy", app.GetSandboxPolicy) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/policy", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + var body map[string]any + if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + t.Fatalf("decode: %v", err) + } + if body["activeVersion"] != float64(2) { + t.Errorf("activeVersion = %v, want 2", body["activeVersion"]) + } + revisions, _ := body["revisions"].([]any) + if len(revisions) != 2 { + t.Errorf("got %d revisions, want 2", len(revisions)) } } -func TestGetSandboxPolicyBody(t *testing.T) { - app := newTestApp(&mockGateway{ - getSandboxPolicyStatusFn: func(_ context.Context, _, _ string, _ uint32, _ bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - return &openshellv1.GetSandboxPolicyStatusResponse{ +func TestGetSandboxPolicySkipsMissingRevision(t *testing.T) { + sdk := &mockSDK{} + sdk.policy.getStatusFn = func(_ context.Context, _, _ string, opts ...openshell.GetStatusOption) (*openshell.PolicyStatusResult, error) { + switch policyStatusVersion(opts) { + case 1: + return &openshell.PolicyStatusResult{ ActiveVersion: 3, - Revision: &openshellv1.SandboxPolicyRevision{ - Version: 3, - PolicyHash: "hash3", - Status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED, + Revision: openshell.SandboxPolicyRevision{ + Version: 1, + PolicyHash: "v1", + Status: openshell.PolicyLoadStatusLoaded, }, }, nil - }, - listSandboxPoliciesFn: func(_ context.Context, _, _ string, _, _ uint32, _ bool) (*openshellv1.ListSandboxPoliciesResponse, error) { - return &openshellv1.ListSandboxPoliciesResponse{ - Revisions: []*openshellv1.SandboxPolicyRevision{ - {Version: 3, Status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED}, + case 2: + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "revision 2 gone"} + default: + return &openshell.PolicyStatusResult{ + ActiveVersion: 3, + Revision: openshell.SandboxPolicyRevision{ + Version: 3, + PolicyHash: "v3", + Status: openshell.PolicyLoadStatusLoaded, }, }, nil - }, - }) + } + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/sandboxes/{name}/policy", app.GetSandboxPolicy) - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/policy", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) } - var body map[string]any if err := json.NewDecoder(w.Body).Decode(&body); err != nil { t.Fatalf("decode: %v", err) } - if v, ok := body["activeVersion"].(float64); !ok || v != 3 { - t.Errorf("activeVersion = %v, want 3", body["activeVersion"]) + revisions, _ := body["revisions"].([]any) + if len(revisions) != 2 { + t.Fatalf("got %d revisions, want 2 (v1 + latest; v2 skipped)", len(revisions)) } - latest, ok := body["latest"].(map[string]any) - if !ok { - t.Fatal("latest is not a map") + first, _ := revisions[0].(map[string]any) + if first["policyHash"] != "v1" { + t.Errorf("first revision hash = %v, want v1", first["policyHash"]) } - if latest["policyHash"] != "hash3" { - t.Errorf("policyHash = %v, want hash3", latest["policyHash"]) + second, _ := revisions[1].(map[string]any) + if second["policyHash"] != "v3" { + t.Errorf("last revision hash = %v, want v3", second["policyHash"]) + } +} + +func TestGetSandboxPolicyNotFound(t *testing.T) { + sdk := &mockSDK{} + sdk.policy.getStatusFn = func(_ context.Context, _, _ string, _ ...openshell.GetStatusOption) (*openshell.PolicyStatusResult, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"} + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/policy", app.GetSandboxPolicy) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/missing/policy", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusNotFound { + t.Fatalf("status = %d, want 404", w.Code) } } func TestUpdateSandboxPolicy(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) name string body string - wantCode string wantStatus int }{ - { - name: "success", - body: `{"policy":{"version":1,"networkPolicies":{"test":{"endpoints":[{"host":"example.com","port":443}]}}},"expectedResourceVersion":5}`, - mockFn: func(_ context.Context, _, _ string, _ *sandboxv1.SandboxPolicy, _ uint64) (*openshellv1.UpdateConfigResponse, error) { - return &openshellv1.UpdateConfigResponse{Version: 2, PolicyHash: "newhash"}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "missing policy", - body: `{"expectedResourceVersion":5}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_policy", - }, - { - name: "invalid policy schema", - body: `{"policy":{"notAField":true}}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_policy", - }, + {name: "success", body: `{"policy":{"version":1}}`, wantStatus: http.StatusOK}, + {name: "missing policy", body: `{}`, wantStatus: http.StatusBadRequest}, + {name: "invalid json", body: `not-json`, wantStatus: http.StatusBadRequest}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{updateSandboxPolicyFn: tc.mockFn}) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Put("/workspaces/{workspace}/sandboxes/{name}/policy", app.UpdateSandboxPolicy) - req := httptest.NewRequest(http.MethodPut, "/workspaces/default/sandboxes/my-sandbox/policy", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } }) } } func TestSetGlobalPolicy(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) - name string - body string - wantStatus int - }{ - { - name: "success", - body: `{"policy":{"version":1,"filesystem":{"includeWorkdir":true}}}`, - mockFn: func(_ context.Context, _ *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) { - return &openshellv1.UpdateConfigResponse{Version: 1, PolicyHash: "globalhash"}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "missing policy", - body: `{}`, - wantStatus: http.StatusBadRequest, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{setGlobalPolicyFn: tc.mockFn}) - r := chi.NewRouter() - r.Put("/global-policy", app.SetGlobalPolicy) - - req := httptest.NewRequest(http.MethodPut, "/global-policy", strings.NewReader(tc.body)) - req.Header.Set("Content-Type", "application/json") - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) - } - }) + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Put("/global-policy", app.SetGlobalPolicy) + req := httptest.NewRequest(http.MethodPut, "/global-policy", strings.NewReader(`{"policy":{"version":1}}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) } } func TestDeleteGlobalPolicy(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context) error - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context) error { - return nil - }, - wantStatus: http.StatusOK, - }, - { - name: "gateway error", - mockFn: func(_ context.Context) error { - return status.Error(codes.PermissionDenied, "not an admin") - }, - wantStatus: http.StatusForbidden, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{deleteGlobalPolicyFn: tc.mockFn}) - r := chi.NewRouter() - r.Delete("/global-policy", app.DeleteGlobalPolicy) - - req := httptest.NewRequest(http.MethodDelete, "/global-policy", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + app := newTestAppWithSDK(&mockSDK{}) + req := httptest.NewRequest(http.MethodDelete, "/global-policy", nil) + w := httptest.NewRecorder() + app.DeleteGlobalPolicy(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } } func TestGetDraftPolicy(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) - name string - url string - wantStatus int - }{ - { - name: "success without filter", - url: "/workspaces/default/sandboxes/my-sandbox/drafts", - mockFn: func(_ context.Context, _, _, _ string) (*openshellv1.GetDraftPolicyResponse, error) { - return &openshellv1.GetDraftPolicyResponse{ - DraftVersion: 1, - Chunks: []*openshellv1.PolicyChunk{ - {Id: "chunk-1", Status: "pending", RuleName: "rule-a"}, - }, - }, nil + sdk := &mockSDK{} + sdk.policy.getDraftFn = func(_ context.Context, _, _ string, _ ...openshell.GetDraftOption) (*openshell.DraftPolicy, error) { + return &openshell.DraftPolicy{ + DraftVersion: 3, + Chunks: []openshell.PolicyChunk{ + {ID: "c1", Status: "pending", RuleName: "allow-api"}, }, - wantStatus: http.StatusOK, - }, - { - name: "with status filter", - url: "/workspaces/default/sandboxes/my-sandbox/drafts?status=pending", - mockFn: func(_ context.Context, _, _, filter string) (*openshellv1.GetDraftPolicyResponse, error) { - if filter != "pending" { - return nil, status.Error(codes.InvalidArgument, "unexpected filter") - } - return &openshellv1.GetDraftPolicyResponse{DraftVersion: 1}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - url: "/workspaces/default/sandboxes/missing/drafts", - mockFn: func(_ context.Context, _, _, _ string) (*openshellv1.GetDraftPolicyResponse, error) { - return nil, status.Error(codes.NotFound, "sandbox not found") - }, - wantStatus: http.StatusNotFound, - }, + }, nil } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getDraftPolicyFn: tc.mockFn}) - r := chi.NewRouter() - r.Get("/workspaces/{workspace}/sandboxes/{name}/drafts", app.GetDraftPolicy) - - req := httptest.NewRequest(http.MethodGet, tc.url, nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/drafts", app.GetDraftPolicy) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/drafts", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + var body map[string]any + _ = json.NewDecoder(w.Body).Decode(&body) + if body["draftVersion"] != float64(3) { + t.Errorf("draftVersion = %v", body["draftVersion"]) } } func TestApproveDraftChunk(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context, _, _, _ string) (*openshellv1.ApproveDraftChunkResponse, error) { - return &openshellv1.ApproveDraftChunkResponse{PolicyVersion: 3, PolicyHash: "h3"}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - mockFn: func(_ context.Context, _, _, _ string) (*openshellv1.ApproveDraftChunkResponse, error) { - return nil, status.Error(codes.NotFound, "chunk not found") - }, - wantStatus: http.StatusNotFound, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{approveDraftChunkFn: tc.mockFn}) - r := chi.NewRouter() - r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}/approve", app.ApproveDraftChunk) - - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/chunk-1/approve", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}/approve", app.ApproveDraftChunk) + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/c1/approve", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } } func TestRejectDraftChunk(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) - name string - body string - wantStatus int - }{ - { - name: "with reason", - body: `{"reason":"too broad"}`, - mockFn: func(_ context.Context, _, _, _, reason string) (*openshellv1.RejectDraftChunkResponse, error) { - if reason != "too broad" { - return nil, status.Error(codes.InvalidArgument, "unexpected reason") - } - return &openshellv1.RejectDraftChunkResponse{}, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "without reason", - body: "", - mockFn: func(_ context.Context, _, _, _, _ string) (*openshellv1.RejectDraftChunkResponse, error) { - return &openshellv1.RejectDraftChunkResponse{}, nil - }, - wantStatus: http.StatusOK, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{rejectDraftChunkFn: tc.mockFn}) - r := chi.NewRouter() - r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}/reject", app.RejectDraftChunk) - - var bodyReader *strings.Reader - if tc.body != "" { - bodyReader = strings.NewReader(tc.body) - } else { - bodyReader = strings.NewReader("") - } - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/chunk-1/reject", bodyReader) - if tc.body != "" { - req.Header.Set("Content-Type", "application/json") - } else { - req.ContentLength = 0 - } - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) - } - }) + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}/reject", app.RejectDraftChunk) + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/c1/reject", strings.NewReader(`{"reason":"nope"}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } } func TestApproveAllDraftChunks(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) - name string - body string - wantStatus int - }{ - { - name: "without security flagged", - body: "", - mockFn: func(_ context.Context, _, _ string, include bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - if include { - return nil, status.Error(codes.InvalidArgument, "should not include security flagged") - } - return &openshellv1.ApproveAllDraftChunksResponse{ - PolicyVersion: 4, - PolicyHash: "h4", - ChunksApproved: 3, - ChunksSkipped: 1, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "with security flagged", - body: `{"includeSecurityFlagged":true}`, - mockFn: func(_ context.Context, _, _ string, include bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - if !include { - return nil, status.Error(codes.InvalidArgument, "should include security flagged") - } - return &openshellv1.ApproveAllDraftChunksResponse{ - PolicyVersion: 4, - PolicyHash: "h4", - ChunksApproved: 4, - ChunksSkipped: 0, - }, nil - }, - wantStatus: http.StatusOK, - }, + sdk := &mockSDK{} + sdk.policy.approveAllFn = func(_ context.Context, _, _ string, _ ...openshell.ApproveAllOption) (*openshell.ApproveAllResult, error) { + return &openshell.ApproveAllResult{PolicyVersion: 4, ChunksApproved: 2, ChunksSkipped: 1}, nil } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{approveAllDraftChunksFn: tc.mockFn}) - r := chi.NewRouter() - r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/approve-all", app.ApproveAllDraftChunks) - - var bodyReader *strings.Reader - if tc.body != "" { - bodyReader = strings.NewReader(tc.body) - } else { - bodyReader = strings.NewReader("") - } - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/approve-all", bodyReader) - if tc.body != "" { - req.Header.Set("Content-Type", "application/json") - } else { - req.ContentLength = 0 - } - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) - } - }) + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/approve-all", app.ApproveAllDraftChunks) + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/approve-all", strings.NewReader(`{"includeSecurityFlagged":true}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } + var body map[string]any + _ = json.NewDecoder(w.Body).Decode(&body) + if body["chunksApproved"] != float64(2) { + t.Errorf("chunksApproved = %v", body["chunksApproved"]) } } -func TestApproveAllDraftChunksBody(t *testing.T) { - app := newTestApp(&mockGateway{ - approveAllDraftChunksFn: func(_ context.Context, _, _ string, _ bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - return &openshellv1.ApproveAllDraftChunksResponse{ - PolicyVersion: 5, - PolicyHash: "h5", - ChunksApproved: 3, - ChunksSkipped: 1, - }, nil - }, - }) +func TestEditDraftChunk(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() - r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/approve-all", app.ApproveAllDraftChunks) + r.Put("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}", app.EditDraftChunk) + req := httptest.NewRequest(http.MethodPut, "/workspaces/default/sandboxes/my-sandbox/drafts/c1", strings.NewReader(`{"proposedRule":{"name":"allow-api"}}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) + } +} - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/approve-all", strings.NewReader("")) - req.ContentLength = 0 +func TestUndoDraftChunk(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/{chunk}/undo", app.UndoDraftChunk) + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/c1/undo", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) + } +} +func TestClearDraftChunks(t *testing.T) { + sdk := &mockSDK{} + sdk.policy.clearFn = func(_ context.Context, _, _ string) (*openshell.ClearResult, error) { + return &openshell.ClearResult{ChunksCleared: 3}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/sandboxes/{name}/drafts/clear", app.ClearDraftChunks) + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/drafts/clear", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } +} - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) +func TestGetDraftHistory(t *testing.T) { + sdk := &mockSDK{} + sdk.policy.historyFn = func(_ context.Context, _, _ string) ([]openshell.DraftHistoryEntry, error) { + return []openshell.DraftHistoryEntry{{EventType: "approved", ChunkID: "c1"}}, nil } - if v, ok := body["chunksApproved"].(float64); !ok || v != 3 { - t.Errorf("chunksApproved = %v, want 3", body["chunksApproved"]) + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/drafts/history", app.GetDraftHistory) + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/drafts/history", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } - if v, ok := body["chunksSkipped"].(float64); !ok || v != 1 { - t.Errorf("chunksSkipped = %v, want 1", body["chunksSkipped"]) +} + +func TestGetDraftSummary(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + req := httptest.NewRequest(http.MethodGet, "/draft-summary", nil) + w := httptest.NewRecorder() + app.GetDraftSummary(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } } diff --git a/backend/internal/api/providers_handler.go b/backend/internal/api/providers_handler.go index 2e2bd2ec..d6bda707 100644 --- a/backend/internal/api/providers_handler.go +++ b/backend/internal/api/providers_handler.go @@ -2,24 +2,24 @@ package api import ( "net/http" + "time" "github.com/go-chi/chi/v5" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) func (app *App) ListProviders(w http.ResponseWriter, r *http.Request) { - providers, err := app.gateway.ListProviders(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + providers, err := app.sdk.Providers().List(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Provider, 0, len(providers)) for _, provider := range providers { - out = append(out, models.FromProvider(provider)) + out = append(out, models.FromSDKProvider(provider)) } writeJSON(w, http.StatusOK, out) } @@ -33,31 +33,40 @@ func (app *App) CreateProvider(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_provider", "name and type are required") return } - provider := models.ToProviderProto(body) - created, err := app.gateway.CreateProvider(r.Context(), chi.URLParam(r, "workspace"), provider) + provider := &openshell.Provider{ + Name: body.Name, + Type: body.Type, + Labels: body.Labels, + Spec: openshell.ProviderSpec{ + Credentials: body.Credentials, + Config: body.Config, + }, + } + created, err := app.sdk.Providers().Create(r.Context(), chi.URLParam(r, "workspace"), provider) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromProvider(created)) + writeJSON(w, http.StatusCreated, models.FromSDKProvider(created)) } func (app *App) GetProvider(w http.ResponseWriter, r *http.Request) { - provider, err := app.gateway.GetProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + provider, err := app.sdk.Providers().Get(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromProvider(provider)) + writeJSON(w, http.StatusOK, models.FromSDKProvider(provider)) } func (app *App) DeleteProvider(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Providers().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + // SDK Delete returns nil error only on successful deletion. If the provider + // doesn't exist, NotFound is returned (mapped to 404 by writeSDKError). + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } // UpdateProviderBody is the update-provider body. Only non-nil maps are @@ -76,48 +85,54 @@ func (app *App) UpdateProvider(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - existing, err := app.gateway.GetProvider(r.Context(), workspace, name) + provider, err := app.sdk.Providers().Get(r.Context(), workspace, name) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - provider := existing if body.Credentials != nil { - provider.Credentials = body.Credentials + provider.Spec.Credentials = body.Credentials } if body.Config != nil { - provider.Config = body.Config + provider.Spec.Config = body.Config + } + if body.CredentialExpiresAtMs != nil { + expires := make(map[string]time.Time, len(body.CredentialExpiresAtMs)) + for k, ms := range body.CredentialExpiresAtMs { + expires[k] = time.UnixMilli(ms) + } + provider.Spec.CredentialExpiresAt = expires } - updated, err := app.gateway.UpdateProvider(r.Context(), workspace, provider, body.CredentialExpiresAtMs) + updated, err := app.sdk.Providers().Update(r.Context(), workspace, provider) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromProvider(updated)) + writeJSON(w, http.StatusOK, models.FromSDKProvider(updated)) } func (app *App) GetProviderRefreshStatus(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetProviderRefreshStatus(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), "") + statuses, err := app.sdk.Providers().Refresh().GetStatus(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), "") if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - out := make([]models.CredentialRefreshStatus, 0, len(resp.GetCredentials())) - for _, cred := range resp.GetCredentials() { - out = append(out, models.FromCredentialRefreshStatus(cred)) + out := make([]models.CredentialRefreshStatus, 0, len(statuses)) + for _, s := range statuses { + out = append(out, models.FromSDKRefreshStatus(s)) } writeJSON(w, http.StatusOK, out) } -var refreshStrategyMap = map[string]openshellv1.ProviderCredentialRefreshStrategy{ - "oauth2-refresh-token": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN, - "oauth2-client-credentials": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS, - "google-service-account-jwt": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT, - "aws-sts-assume-role": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE, - "static": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC, - "external": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL, +var refreshStrategyMap = map[string]openshell.RefreshStrategy{ + "oauth2-refresh-token": openshell.RefreshStrategyOAuth2RefreshToken, + "oauth2-client-credentials": openshell.RefreshStrategyOAuth2ClientCredentials, + "google-service-account-jwt": openshell.RefreshStrategyGoogleServiceAccountJWT, + "aws-sts-assume-role": models.RefreshStrategyAWSStsAssumeRole, + "static": openshell.RefreshStrategyStatic, + "external": openshell.RefreshStrategyExternal, } type ConfigureProviderRefreshBody struct { @@ -142,21 +157,23 @@ func (app *App) ConfigureProviderRefresh(w http.ResponseWriter, r *http.Request) writeError(w, http.StatusBadRequest, "invalid_strategy", "unknown refresh strategy: "+body.Strategy) return } - resp, err := app.gateway.ConfigureProviderRefresh( - r.Context(), - chi.URLParam(r, "workspace"), - chi.URLParam(r, "name"), - body.CredentialKey, - strategy, - body.Material, - body.SecretMaterialKeys, - body.ExpiresAtMs, - ) + cfg := &openshell.RefreshConfig{ + Provider: chi.URLParam(r, "name"), + CredentialKey: body.CredentialKey, + Strategy: strategy, + Material: body.Material, + SecretMaterialKeys: body.SecretMaterialKeys, + } + if body.ExpiresAtMs != nil { + t := time.UnixMilli(*body.ExpiresAtMs) + cfg.ExpiresAt = &t + } + status, err := app.sdk.Providers().Refresh().Configure(r.Context(), chi.URLParam(r, "workspace"), cfg) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(resp.GetStatus())) + writeJSON(w, http.StatusOK, models.FromSDKRefreshStatus(status)) } type RotateProviderCredentialBody struct { @@ -172,17 +189,17 @@ func (app *App) RotateProviderCredential(w http.ResponseWriter, r *http.Request) writeError(w, http.StatusBadRequest, "invalid_request", "credentialKey is required") return } - resp, err := app.gateway.RotateProviderCredential( + status, err := app.sdk.Providers().Refresh().Rotate( r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.CredentialKey, ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(resp.GetStatus())) + writeJSON(w, http.StatusOK, models.FromSDKRefreshStatus(status)) } func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { @@ -191,14 +208,14 @@ func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_request", "credentialKey query parameter is required") return } - deleted, err := app.gateway.DeleteProviderRefresh( + deleted, err := app.sdk.Providers().Refresh().Delete( r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), credentialKey, ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) @@ -207,25 +224,25 @@ func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { // ListProviderProfiles returns the provider type profiles whose credential // schemas drive the Add Provider form. func (app *App) ListProviderProfiles(w http.ResponseWriter, r *http.Request) { - profiles, err := app.gateway.ListProviderProfiles(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + profiles, err := app.sdk.Providers().Profiles().List(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.ProviderProfile, 0, len(profiles)) for _, profile := range profiles { - out = append(out, models.FromProviderProfile(profile)) + out = append(out, models.FromSDKProviderProfile(profile)) } writeJSON(w, http.StatusOK, out) } func (app *App) GetProviderProfile(w http.ResponseWriter, r *http.Request) { - profile, err := app.gateway.GetProviderProfile(r.Context(), chi.URLParam(r, "profileId"), chi.URLParam(r, "workspace")) + profile, err := app.sdk.Providers().Profiles().Get(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "profileId")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromProviderProfile(profile)) + writeJSON(w, http.StatusOK, models.FromSDKProviderProfile(profile)) } type ImportProfileCredentialBody struct { @@ -256,20 +273,10 @@ type ImportProviderProfilesBody struct { Profiles []ImportProfileBody `json:"profiles"` } -var profileCategoryMap = map[string]openshellv1.ProviderProfileCategory{ - "OTHER": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER, - "INFERENCE": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE, - "AGENT": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT, - "SOURCE_CONTROL": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL, - "MESSAGING": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING, - "DATA": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA, - "KNOWLEDGE": openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE, -} - -func toProfileImportItem(body ImportProfileBody) *openshellv1.ProviderProfileImportItem { - creds := make([]*openshellv1.ProviderProfileCredential, 0, len(body.Credentials)) +func toSDKProfileImportItem(body ImportProfileBody) openshell.ProfileImportItem { + creds := make([]openshell.ProfileCredential, 0, len(body.Credentials)) for _, c := range body.Credentials { - creds = append(creds, &openshellv1.ProviderProfileCredential{ + creds = append(creds, openshell.ProfileCredential{ Name: c.Name, Description: c.Description, EnvVars: c.EnvVars, @@ -277,23 +284,19 @@ func toProfileImportItem(body ImportProfileBody) *openshellv1.ProviderProfileImp AuthStyle: c.AuthStyle, }) } - endpoints := make([]*sandboxv1.NetworkEndpoint, 0, len(body.Endpoints)) + endpoints := make([]openshell.NetworkEndpoint, 0, len(body.Endpoints)) for _, e := range body.Endpoints { - endpoints = append(endpoints, &sandboxv1.NetworkEndpoint{ + endpoints = append(endpoints, openshell.NetworkEndpoint{ Host: e.Host, Port: e.Port, }) } - cat := openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER - if c, ok := profileCategoryMap[body.Category]; ok { - cat = c - } - return &openshellv1.ProviderProfileImportItem{ - Profile: &openshellv1.ProviderProfile{ - Id: body.ID, + return openshell.ProfileImportItem{ + Profile: openshell.ProviderProfile{ + ID: body.ID, DisplayName: body.DisplayName, Description: body.Description, - Category: cat, + Category: models.ParseSDKProfileCategory(body.Category), Credentials: creds, Endpoints: endpoints, InferenceCapable: body.InferenceCapable, @@ -311,27 +314,27 @@ func (app *App) ImportProviderProfiles(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_request", "at least one profile is required") return } - items := make([]*openshellv1.ProviderProfileImportItem, 0, len(body.Profiles)) + items := make([]openshell.ProfileImportItem, 0, len(body.Profiles)) for _, p := range body.Profiles { if p.ID == "" || p.DisplayName == "" { writeError(w, http.StatusBadRequest, "invalid_profile", "id and displayName are required") return } - items = append(items, toProfileImportItem(p)) + items = append(items, toSDKProfileImportItem(p)) } - resp, err := app.gateway.ImportProviderProfiles(r.Context(), chi.URLParam(r, "workspace"), items) + resp, err := app.sdk.Providers().Profiles().Import(r.Context(), chi.URLParam(r, "workspace"), items) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - profiles := make([]models.ProviderProfile, 0, len(resp.GetProfiles())) - for _, p := range resp.GetProfiles() { - profiles = append(profiles, models.FromProviderProfile(p)) + profiles := make([]models.ProviderProfile, 0, len(resp.Profiles)) + for i := range resp.Profiles { + profiles = append(profiles, models.FromSDKProviderProfile(&resp.Profiles[i])) } writeJSON(w, http.StatusCreated, models.ImportProviderProfilesResult{ - Diagnostics: models.FromDiagnostics(resp.GetDiagnostics()), + Diagnostics: models.FromSDKDiagnostics(resp.Diagnostics), Profiles: profiles, - Imported: resp.GetImported(), + Imported: resp.Imported, }) } @@ -351,28 +354,33 @@ func (app *App) UpdateProviderProfile(w http.ResponseWriter, r *http.Request) { return } body.Profile.ID = profileID - item := toProfileImportItem(body.Profile) - resp, err := app.gateway.UpdateProviderProfile(r.Context(), chi.URLParam(r, "workspace"), profileID, item, body.ExpectedResourceVersion) + resp, err := app.sdk.Providers().Profiles().Update( + r.Context(), + chi.URLParam(r, "workspace"), + profileID, + body.ExpectedResourceVersion, + toSDKProfileImportItem(body.Profile), + ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } var profile *models.ProviderProfile - if resp.GetProfile() != nil { - p := models.FromProviderProfile(resp.GetProfile()) + if resp.Profile != nil { + p := models.FromSDKProviderProfile(resp.Profile) profile = &p } writeJSON(w, http.StatusOK, models.UpdateProviderProfileResult{ - Diagnostics: models.FromDiagnostics(resp.GetDiagnostics()), + Diagnostics: models.FromSDKDiagnostics(resp.Diagnostics), Profile: profile, - Updated: resp.GetUpdated(), + Updated: resp.Updated, }) } func (app *App) DeleteProviderProfile(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteProviderProfile(r.Context(), chi.URLParam(r, "profileId"), chi.URLParam(r, "workspace")) + deleted, err := app.sdk.Providers().Profiles().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "profileId")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) @@ -387,17 +395,17 @@ func (app *App) LintProviderProfiles(w http.ResponseWriter, r *http.Request) { if !decodeBody(w, r, &body) { return } - items := make([]*openshellv1.ProviderProfileImportItem, 0, len(body.Profiles)) + items := make([]openshell.ProfileImportItem, 0, len(body.Profiles)) for _, p := range body.Profiles { - items = append(items, toProfileImportItem(p)) + items = append(items, toSDKProfileImportItem(p)) } - resp, err := app.gateway.LintProviderProfiles(r.Context(), chi.URLParam(r, "workspace"), items) + resp, err := app.sdk.Providers().Profiles().Lint(r.Context(), chi.URLParam(r, "workspace"), items) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.LintProviderProfilesResult{ - Diagnostics: models.FromDiagnostics(resp.GetDiagnostics()), - Valid: resp.GetValid(), + Diagnostics: models.FromSDKDiagnostics(resp.Diagnostics), + Valid: resp.Valid, }) } diff --git a/backend/internal/api/providers_handler_test.go b/backend/internal/api/providers_handler_test.go index 12fd3608..8634acb8 100644 --- a/backend/internal/api/providers_handler_test.go +++ b/backend/internal/api/providers_handler_test.go @@ -9,26 +9,26 @@ import ( "testing" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - grpcstatus "google.golang.org/grpc/status" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types" ) func TestListProviders(t *testing.T) { - app := newTestApp(&mockGateway{ - listProvidersFn: func(_ context.Context, _ string, _, _ uint32) ([]*datamodelv1.Provider, error) { - return []*datamodelv1.Provider{ - { - Metadata: &datamodelv1.ObjectMeta{Name: "claude-prov"}, - Type: "claude", + sdk := &mockSDK{} + sdk.providers.listFn = func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Provider, error) { + return []*openshell.Provider{ + { + Name: "claude-prov", + Type: "claude", + Spec: openshell.ProviderSpec{ Credentials: map[string]string{"api_key": "secret"}, Config: map[string]string{"region": "us"}, }, - }, nil - }, - }) + }, + }, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/providers", app.ListProviders) @@ -47,7 +47,6 @@ func TestListProviders(t *testing.T) { if len(body) != 1 { t.Fatalf("got %d providers, want 1", len(body)) } - // Credentials should be stripped — only names appear raw, _ := json.Marshal(body[0]) if strings.Contains(string(raw), "secret") { t.Errorf("response leaked credential value: %s", raw) @@ -61,10 +60,29 @@ func TestListProviders(t *testing.T) { } } +func TestListProvidersUnavailable(t *testing.T) { + sdk := &mockSDK{} + sdk.providers.listFn = func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Provider, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorUnavailable, Message: "gateway down"} + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/providers", app.ListProviders) + + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/providers", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + + if w.Code != http.StatusBadGateway { + t.Fatalf("status = %d, want 502", w.Code) + } +} + func TestCreateProvider(t *testing.T) { tests := []struct { name string body string + createFn func(ctx context.Context, workspace string, provider *openshell.Provider) (*openshell.Provider, error) wantCode string wantStatus int }{ @@ -91,15 +109,21 @@ func TestCreateProvider(t *testing.T) { wantStatus: http.StatusBadRequest, wantCode: "invalid_body", }, + { + name: "already exists", + body: `{"name":"my-provider","type":"claude"}`, + createFn: func(_ context.Context, _ string, _ *openshell.Provider) (*openshell.Provider, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorAlreadyExists, Message: "exists"} + }, + wantStatus: http.StatusConflict, + wantCode: "already_exists", + }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{ - createProviderFn: func(_ context.Context, _ string, prov *datamodelv1.Provider) (*datamodelv1.Provider, error) { - return prov, nil - }, - } - app := newTestApp(mock) + sdk := &mockSDK{} + sdk.providers.createFn = tc.createFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Post("/workspaces/{workspace}/providers", app.CreateProvider) @@ -126,31 +150,45 @@ func TestCreateProvider(t *testing.T) { func TestGetProvider(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) + getFn func(ctx context.Context, workspace, name string) (*openshell.Provider, error) name string wantStatus int }{ { name: "success", - mockFn: func(_ context.Context, _, name string) (*datamodelv1.Provider, error) { - return &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{Name: name}, - Type: "claude", + getFn: func(_ context.Context, _, name string) (*openshell.Provider, error) { + return &openshell.Provider{Name: name, Type: "claude"}, nil + }, + wantStatus: http.StatusOK, + }, + { + name: "handles-only returns credentialNames", + getFn: func(_ context.Context, _, name string) (*openshell.Provider, error) { + return &openshell.Provider{ + Name: name, + Type: "claude", + Spec: openshell.ProviderSpec{ + CredentialHandles: map[string]types.CredentialHandle{ + "api_key": {Driver: "vault", Handle: "vault://must-not-leak"}, + }, + }, }, nil }, wantStatus: http.StatusOK, }, { name: "not found", - mockFn: func(_ context.Context, _, _ string) (*datamodelv1.Provider, error) { - return nil, grpcstatus.Error(codes.NotFound, "provider not found") + getFn: func(_ context.Context, _, _ string) (*openshell.Provider, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "provider not found"} }, wantStatus: http.StatusNotFound, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getProviderFn: tc.mockFn}) + sdk := &mockSDK{} + sdk.providers.getFn = tc.getFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/providers/{name}", app.GetProvider) @@ -161,24 +199,52 @@ func TestGetProvider(t *testing.T) { if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) } + if tc.name == "handles-only returns credentialNames" && w.Code == http.StatusOK { + var body map[string]any + if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + t.Fatalf("decode: %v", err) + } + names, _ := body["credentialNames"].([]any) + if len(names) != 1 || names[0] != "api_key" { + t.Errorf("credentialNames = %v, want [api_key]", body["credentialNames"]) + } + raw, _ := json.Marshal(body) + if strings.Contains(string(raw), "must-not-leak") { + t.Errorf("leaked credential handle: %s", raw) + } + } }) } } func TestUpdateProvider(t *testing.T) { - mock := &mockGateway{ - getProviderFn: func(_ context.Context, _, _ string) (*datamodelv1.Provider, error) { - return &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{Name: "claude-prov"}, - Type: "claude", - Config: map[string]string{"region": "us"}, - }, nil - }, - updateProviderFn: func(_ context.Context, _ string, prov *datamodelv1.Provider, _ map[string]int64) (*datamodelv1.Provider, error) { - return prov, nil - }, - } - app := newTestApp(mock) + sdk := &mockSDK{} + sdk.providers.getFn = func(_ context.Context, _, _ string) (*openshell.Provider, error) { + return &openshell.Provider{ + Name: "claude-prov", + Type: "claude", + Spec: openshell.ProviderSpec{ + Config: map[string]string{"region": "us"}, + Credentials: map[string]string{"api_key": "existing-secret"}, + CredentialHandles: map[string]types.CredentialHandle{ + "api_key": {Driver: "vault", Handle: "vault://existing"}, + }, + }, + }, nil + } + sdk.providers.updateFn = func(_ context.Context, _ string, prov *openshell.Provider) (*openshell.Provider, error) { + if prov.Spec.Config["region"] != "eu" { + t.Errorf("merged config region = %q, want eu", prov.Spec.Config["region"]) + } + if prov.Spec.Credentials["api_key"] != "existing-secret" { + t.Errorf("credentials wiped: %v", prov.Spec.Credentials) + } + if _, ok := prov.Spec.CredentialHandles["api_key"]; !ok { + t.Errorf("handles wiped: %v", prov.Spec.CredentialHandles) + } + return prov, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Put("/workspaces/{workspace}/providers/{name}", app.UpdateProvider) @@ -194,11 +260,7 @@ func TestUpdateProvider(t *testing.T) { } func TestDeleteProvider(t *testing.T) { - app := newTestApp(&mockGateway{ - deleteProviderFn: func(_ context.Context, _, _ string) (bool, error) { - return true, nil - }, - }) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Delete("/workspaces/{workspace}/providers/{name}", app.DeleteProvider) @@ -209,36 +271,139 @@ func TestDeleteProvider(t *testing.T) { if w.Code != http.StatusOK { t.Fatalf("status = %d, want 200", w.Code) } + var resp map[string]any + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("decode: %v", err) + } + if resp["deleted"] != true { + t.Errorf("deleted = %v, want true", resp["deleted"]) + } +} + +func TestConfigureProviderRefresh(t *testing.T) { + tests := []struct { + name string + body string + wantCode string + wantStatus int + }{ + { + name: "success oauth2", + body: `{"credentialKey":"api_key","strategy":"oauth2-refresh-token"}`, + wantStatus: http.StatusOK, + }, + { + name: "aws sts accepted", + body: `{"credentialKey":"role","strategy":"aws-sts-assume-role"}`, + wantStatus: http.StatusOK, + }, + { + name: "missing key", + body: `{"credentialKey":"","strategy":"static"}`, + wantStatus: http.StatusBadRequest, + wantCode: "invalid_request", + }, + { + name: "unknown strategy", + body: `{"credentialKey":"api_key","strategy":"nope"}`, + wantStatus: http.StatusBadRequest, + wantCode: "invalid_strategy", + }, + } + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/providers/{name}/refresh", app.ConfigureProviderRefresh) + + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/providers/claude-prov/refresh", strings.NewReader(tc.body)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + + if w.Code != tc.wantStatus { + t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) + } + if tc.wantCode != "" { + var errResp ErrorResponse + if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { + t.Fatalf("decode error response: %v", err) + } + if errResp.Code != tc.wantCode { + t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) + } + } + }) + } +} + +func TestRotateAndDeleteProviderRefresh(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Post("/workspaces/{workspace}/providers/{name}/refresh/rotate", app.RotateProviderCredential) + r.Delete("/workspaces/{workspace}/providers/{name}/refresh", app.DeleteProviderRefresh) + + req := httptest.NewRequest(http.MethodPost, "/workspaces/default/providers/claude-prov/refresh/rotate", strings.NewReader(`{}`)) + req.Header.Set("Content-Type", "application/json") + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusBadRequest { + t.Errorf("rotate missing key status = %d, want 400", w.Code) + } + + req = httptest.NewRequest(http.MethodDelete, "/workspaces/default/providers/claude-prov/refresh", nil) + w = httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusBadRequest { + t.Errorf("delete missing key status = %d, want 400", w.Code) + } + + req = httptest.NewRequest(http.MethodPost, "/workspaces/default/providers/claude-prov/refresh/rotate", strings.NewReader(`{"credentialKey":"api_key"}`)) + req.Header.Set("Content-Type", "application/json") + w = httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Errorf("rotate status = %d, want 200; body: %s", w.Code, w.Body.String()) + } + + req = httptest.NewRequest(http.MethodDelete, "/workspaces/default/providers/claude-prov/refresh?credentialKey=api_key", nil) + w = httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Errorf("delete status = %d, want 200; body: %s", w.Code, w.Body.String()) + } } func TestGetProviderProfile(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, id, workspace string) (*openshellv1.ProviderProfile, error) + getFn func(ctx context.Context, workspace, id string) (*openshell.ProviderProfile, error) name string wantStatus int }{ { name: "success", - mockFn: func(_ context.Context, id, _ string) (*openshellv1.ProviderProfile, error) { - return &openshellv1.ProviderProfile{ - Id: id, + getFn: func(_ context.Context, _, id string) (*openshell.ProviderProfile, error) { + return &openshell.ProviderProfile{ + ID: id, DisplayName: "Claude", - Category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE, + Category: openshell.ProfileCategoryInference, }, nil }, wantStatus: http.StatusOK, }, { name: "not found", - mockFn: func(_ context.Context, _, _ string) (*openshellv1.ProviderProfile, error) { - return nil, grpcstatus.Error(codes.NotFound, "profile not found") + getFn: func(_ context.Context, _, _ string) (*openshell.ProviderProfile, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "profile not found"} }, wantStatus: http.StatusNotFound, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getProviderProfileFn: tc.mockFn}) + sdk := &mockSDK{} + sdk.providers.profiles.getFn = tc.getFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/provider-profiles/{profileId}", app.GetProviderProfile) @@ -253,6 +418,26 @@ func TestGetProviderProfile(t *testing.T) { } } +func TestGetProviderProfileArgOrder(t *testing.T) { + sdk := &mockSDK{} + sdk.providers.profiles.getFn = func(_ context.Context, workspace, id string) (*openshell.ProviderProfile, error) { + if workspace != "default" || id != "claude" { + t.Errorf("Get args workspace=%q id=%q, want default/claude", workspace, id) + } + return &openshell.ProviderProfile{ID: id, DisplayName: "Claude"}, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/provider-profiles/{profileId}", app.GetProviderProfile) + + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/provider-profiles/claude", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want 200", w.Code) + } +} + func TestImportProviderProfiles(t *testing.T) { tests := []struct { name string @@ -292,19 +477,7 @@ func TestImportProviderProfiles(t *testing.T) { } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{ - importProviderProfilesFn: func(_ context.Context, _ string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) { - result := make([]*openshellv1.ProviderProfile, 0, len(profiles)) - for _, item := range profiles { - result = append(result, item.Profile) - } - return &openshellv1.ImportProviderProfilesResponse{ - Profiles: result, - Imported: true, - }, nil - }, - } - app := newTestApp(mock) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Post("/workspaces/{workspace}/provider-profiles", app.ImportProviderProfiles) @@ -330,18 +503,17 @@ func TestImportProviderProfiles(t *testing.T) { } func TestImportProviderProfilesResponse(t *testing.T) { - mock := &mockGateway{ - importProviderProfilesFn: func(_ context.Context, _ string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) { - return &openshellv1.ImportProviderProfilesResponse{ - Profiles: []*openshellv1.ProviderProfile{profiles[0].Profile}, - Imported: true, - Diagnostics: []*openshellv1.ProviderProfileDiagnostic{ - {ProfileId: "custom-llm", Field: "credentials", Message: "consider adding env_vars", Severity: "warning"}, - }, - }, nil - }, + sdk := &mockSDK{} + sdk.providers.profiles.importFn = func(_ context.Context, _ string, items []openshell.ProfileImportItem) (*openshell.ImportResult, error) { + return &openshell.ImportResult{ + Profiles: []openshell.ProviderProfile{items[0].Profile}, + Imported: true, + Diagnostics: []openshell.ProfileDiagnostic{ + {ProfileID: "custom-llm", Field: "credentials", Message: "consider adding env_vars", Severity: "warning"}, + }, + }, nil } - app := newTestApp(mock) + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Post("/workspaces/{workspace}/provider-profiles", app.ImportProviderProfiles) @@ -393,15 +565,7 @@ func TestUpdateProviderProfile(t *testing.T) { } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{ - updateProviderProfileFn: func(_ context.Context, _, _ string, item *openshellv1.ProviderProfileImportItem, _ uint64) (*openshellv1.UpdateProviderProfilesResponse, error) { - return &openshellv1.UpdateProviderProfilesResponse{ - Profile: item.Profile, - Updated: true, - }, nil - }, - } - app := newTestApp(mock) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Put("/workspaces/{workspace}/provider-profiles/{profileId}", app.UpdateProviderProfile) @@ -427,11 +591,14 @@ func TestUpdateProviderProfile(t *testing.T) { } func TestDeleteProviderProfile(t *testing.T) { - app := newTestApp(&mockGateway{ - deleteProviderProfileFn: func(_ context.Context, _, _ string) (bool, error) { - return true, nil - }, - }) + sdk := &mockSDK{} + sdk.providers.profiles.deleteFn = func(_ context.Context, workspace, id string) (bool, error) { + if workspace != "default" || id != "custom-llm" { + t.Errorf("Delete args workspace=%q id=%q, want default/custom-llm", workspace, id) + } + return true, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Delete("/workspaces/{workspace}/provider-profiles/{profileId}", app.DeleteProviderProfile) @@ -452,14 +619,7 @@ func TestDeleteProviderProfile(t *testing.T) { } func TestLintProviderProfiles(t *testing.T) { - mock := &mockGateway{ - lintProviderProfilesFn: func(_ context.Context, _ string, _ []*openshellv1.ProviderProfileImportItem) (*openshellv1.LintProviderProfilesResponse, error) { - return &openshellv1.LintProviderProfilesResponse{ - Valid: true, - }, nil - }, - } - app := newTestApp(mock) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Post("/workspaces/{workspace}/provider-profiles/lint", app.LintProviderProfiles) @@ -480,3 +640,58 @@ func TestLintProviderProfiles(t *testing.T) { t.Errorf("valid = %v, want true", resp["valid"]) } } + +func TestGetProviderRefreshStatus(t *testing.T) { + sdk := &mockSDK{} + sdk.providers.refresh.getStatusFn = func(_ context.Context, _, _, _ string) ([]*openshell.RefreshStatus, error) { + return []*openshell.RefreshStatus{ + {CredentialKey: "api_key", Strategy: openshell.RefreshStrategyStatic, Status: "active"}, + }, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/providers/{name}/refresh-status", app.GetProviderRefreshStatus) + + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/providers/claude-prov/refresh-status", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String()) + } + var body []map[string]any + if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + t.Fatalf("decode: %v", err) + } + if len(body) != 1 || body[0]["credentialKey"] != "api_key" || body[0]["strategy"] != "STATIC" { + t.Errorf("body = %v", body) + } +} + +func TestListProviderProfiles(t *testing.T) { + sdk := &mockSDK{} + sdk.providers.profiles.listFn = func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.ProviderProfile, error) { + return []*openshell.ProviderProfile{ + {ID: "claude", DisplayName: "Claude", Category: openshell.ProfileCategoryInference}, + }, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/provider-profiles", app.ListProviderProfiles) + + req := httptest.NewRequest(http.MethodGet, "/workspaces/default/provider-profiles", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want 200; body: %s", w.Code, w.Body.String()) + } + var profiles []map[string]any + if err := json.NewDecoder(w.Body).Decode(&profiles); err != nil { + t.Fatalf("decode: %v", err) + } + if len(profiles) != 1 { + t.Fatalf("got %d profiles, want 1", len(profiles)) + } + if profiles[0]["id"] != "claude" || profiles[0]["category"] != "INFERENCE" { + t.Errorf("profile = %v, want id=claude category=INFERENCE", profiles[0]) + } +} diff --git a/backend/internal/api/respond.go b/backend/internal/api/respond.go index d4f9d198..70428e7e 100644 --- a/backend/internal/api/respond.go +++ b/backend/internal/api/respond.go @@ -7,6 +7,7 @@ import ( "net/http" "regexp" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" ) @@ -69,6 +70,61 @@ func writeGrpcError(w http.ResponseWriter, err error) { } } +// writeSDKError maps an SDK StatusError onto a safe HTTP error response. +// Uses the SDK's typed error helpers for classification and extracts the +// clean message from StatusError.Message (no error chain prefix). +func writeSDKError(w http.ResponseWriter, err error) { + var se *openshell.StatusError + var msg string + if errors.As(err, &se) { + msg = se.Message + } else { + msg = err.Error() + } + + switch { + case openshell.IsNotFound(err): + slog.Warn("gateway error", "code", "NotFound", "message", msg) + writeError(w, http.StatusNotFound, "not_found", msg) + case openshell.IsAlreadyExists(err): + slog.Warn("gateway error", "code", "AlreadyExists", "message", msg) + writeError(w, http.StatusConflict, "already_exists", msg) + case openshell.IsInvalidArgument(err): + slog.Warn("gateway error", "code", "InvalidArgument", "message", msg) + writeError(w, http.StatusBadRequest, "invalid_argument", msg) + case openshell.IsPermissionDenied(err): + slog.Warn("gateway error", "code", "PermissionDenied", "message", msg) + writeError(w, http.StatusForbidden, "permission_denied", msg) + case openshell.IsUnauthenticated(err): + slog.Warn("gateway error", "code", "Unauthenticated", "message", msg) + writeError(w, http.StatusUnauthorized, "unauthenticated", msg) + case openshell.IsConflict(err): + slog.Warn("gateway error", "code", "Conflict", "message", msg) + writeError(w, http.StatusConflict, "conflict", msg) + case openshell.IsUnavailable(err) || openshell.IsDeadlineExceeded(err): + slog.Warn("gateway error", "code", "Unavailable", "message", msg) + writeError(w, http.StatusBadGateway, "gateway_unavailable", "OpenShell gateway is unreachable") + default: + // Fallback: check for raw gRPC status codes not covered by SDK helpers + // (FailedPrecondition, OutOfRange, ResourceExhausted). + st, ok := status.FromError(err) + if ok { + switch st.Code() { + case codes.FailedPrecondition, codes.OutOfRange: + slog.Warn("gateway error", "code", st.Code().String(), "message", st.Message()) + writeError(w, http.StatusBadRequest, "invalid_argument", st.Message()) + return + case codes.ResourceExhausted: + slog.Warn("gateway error", "code", "ResourceExhausted", "message", st.Message()) + writeError(w, http.StatusTooManyRequests, "resource_exhausted", st.Message()) + return + } + } + slog.Error("gateway call failed", "error", err) + writeError(w, http.StatusInternalServerError, "internal", "internal error") + } +} + const maxJSONBodyBytes int64 = 1 << 20 // 1 MB func decodeBody(w http.ResponseWriter, r *http.Request, dst any) bool { diff --git a/backend/internal/api/respond_ext_test.go b/backend/internal/api/respond_ext_test.go index 82fe994f..c4352347 100644 --- a/backend/internal/api/respond_ext_test.go +++ b/backend/internal/api/respond_ext_test.go @@ -8,6 +8,7 @@ import ( "strings" "testing" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" ) @@ -218,3 +219,104 @@ func TestWriteError(t *testing.T) { t.Errorf("message = %q, want test message", body.Message) } } + +func TestWriteSDKError(t *testing.T) { + tests := []struct { + err error + name string + wantCode string + wantMessage string + wantHTTP int + }{ + { + name: "NotFound", + err: &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"}, + wantHTTP: http.StatusNotFound, + wantCode: "not_found", + wantMessage: "sandbox not found", + }, + { + name: "AlreadyExists", + err: &openshell.StatusError{Code: openshell.ErrorAlreadyExists, Message: "already exists"}, + wantHTTP: http.StatusConflict, + wantCode: "already_exists", + wantMessage: "already exists", + }, + { + name: "InvalidArgument", + err: &openshell.StatusError{Code: openshell.ErrorInvalidArgument, Message: "bad input"}, + wantHTTP: http.StatusBadRequest, + wantCode: "invalid_argument", + wantMessage: "bad input", + }, + { + name: "PermissionDenied", + err: &openshell.StatusError{Code: openshell.ErrorPermissionDenied, Message: "denied"}, + wantHTTP: http.StatusForbidden, + wantCode: "permission_denied", + wantMessage: "denied", + }, + { + name: "Unauthenticated", + err: &openshell.StatusError{Code: openshell.ErrorUnauthenticated, Message: "no token"}, + wantHTTP: http.StatusUnauthorized, + wantCode: "unauthenticated", + wantMessage: "no token", + }, + { + name: "Unavailable uses generic message", + err: &openshell.StatusError{Code: openshell.ErrorUnavailable, Message: "connection refused"}, + wantHTTP: http.StatusBadGateway, + wantCode: "gateway_unavailable", + wantMessage: "OpenShell gateway is unreachable", + }, + { + name: "Conflict", + err: &openshell.StatusError{Code: openshell.ErrorConflict, Message: "version mismatch"}, + wantHTTP: http.StatusConflict, + wantCode: "conflict", + wantMessage: "version mismatch", + }, + { + name: "fallback FailedPrecondition via raw gRPC", + err: status.Error(codes.FailedPrecondition, "sandbox not ready"), + wantHTTP: http.StatusBadRequest, + wantCode: "invalid_argument", + wantMessage: "sandbox not ready", + }, + { + name: "fallback ResourceExhausted via raw gRPC", + err: status.Error(codes.ResourceExhausted, "rate limited"), + wantHTTP: http.StatusTooManyRequests, + wantCode: "resource_exhausted", + wantMessage: "rate limited", + }, + { + name: "unknown error returns 500", + err: fmt.Errorf("something unexpected"), + wantHTTP: http.StatusInternalServerError, + wantCode: "internal", + wantMessage: "internal error", + }, + } + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + w := httptest.NewRecorder() + writeSDKError(w, tc.err) + + if w.Code != tc.wantHTTP { + t.Errorf("HTTP status = %d, want %d", w.Code, tc.wantHTTP) + } + var body ErrorResponse + if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + t.Fatalf("decode: %v", err) + } + if body.Code != tc.wantCode { + t.Errorf("error code = %q, want %q", body.Code, tc.wantCode) + } + if body.Message != tc.wantMessage { + t.Errorf("message = %q, want %q", body.Message, tc.wantMessage) + } + }) + } +} diff --git a/backend/internal/api/sandboxes_handler.go b/backend/internal/api/sandboxes_handler.go index d3fbf84a..de988331 100644 --- a/backend/internal/api/sandboxes_handler.go +++ b/backend/internal/api/sandboxes_handler.go @@ -6,18 +6,24 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) func (app *App) ListSandboxes(w http.ResponseWriter, r *http.Request) { - sandboxes, err := app.gateway.ListSandboxes(r.Context(), chi.URLParam(r, "workspace"), 0, 0, r.URL.Query().Get("labelSelector")) + var opts []openshell.ListOptions + if sel := r.URL.Query().Get("labelSelector"); sel != "" { + opts = append(opts, openshell.ListOptions{LabelSelector: sel}) + } + sandboxes, err := app.sdk.Sandboxes().List(r.Context(), chi.URLParam(r, "workspace"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Sandbox, 0, len(sandboxes)) for _, sandbox := range sandboxes { - out = append(out, models.FromSandbox(sandbox)) + out = append(out, models.FromSDKSandbox(sandbox)) } writeJSON(w, http.StatusOK, out) } @@ -39,34 +45,41 @@ func (app *App) CreateSandbox(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_policy", "policy is required — SandboxSpec.policy is a required field") return } - spec, err := models.BuildSandboxSpec(body) + spec, err := models.BuildSDKSandboxSpec(body) if err != nil { slog.Error("invalid sandbox specification", "error", err) writeError(w, http.StatusBadRequest, "invalid_policy", "invalid sandbox specification") return } - sandbox, err := app.gateway.CreateSandbox(r.Context(), chi.URLParam(r, "workspace"), body.Name, spec, body.Labels, body.Annotations) + + var createOpts []openshell.CreateOptions + if len(body.Annotations) > 0 { + createOpts = append(createOpts, openshell.CreateOptions{Annotations: body.Annotations}) + } + + sandbox, err := app.sdk.Sandboxes().Create(r.Context(), chi.URLParam(r, "workspace"), body.Name, spec, body.Labels, createOpts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromSandbox(sandbox)) + writeJSON(w, http.StatusCreated, models.FromSDKSandbox(sandbox)) } func (app *App) GetSandbox(w http.ResponseWriter, r *http.Request) { - sandbox, err := app.gateway.GetSandbox(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + sandbox, err := app.sdk.Sandboxes().Get(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromSandbox(sandbox)) + writeJSON(w, http.StatusOK, models.FromSDKSandbox(sandbox)) } func (app *App) DeleteSandbox(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteSandbox(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Sandboxes().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + // SDK Delete returns nil error only on successful deletion. If the sandbox + // doesn't exist, NotFound is returned (mapped to 404 by writeSDKError). + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/sandboxes_handler_test.go b/backend/internal/api/sandboxes_handler_test.go index 52945f7b..f88614a0 100644 --- a/backend/internal/api/sandboxes_handler_test.go +++ b/backend/internal/api/sandboxes_handler_test.go @@ -7,51 +7,48 @@ import ( "net/http/httptest" "strings" "testing" + "time" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestListSandboxes(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) + listFn func(ctx context.Context, workspace string, opts ...openshell.ListOptions) ([]*openshell.Sandbox, error) name string wantStatus int }{ { name: "success returns sandbox list", - mockFn: func(_ context.Context, _ string, _, _ uint32, _ string) ([]*openshellv1.Sandbox, error) { - return []*openshellv1.Sandbox{ - { - Metadata: &datamodelv1.ObjectMeta{Id: "id-1", Name: "my-sandbox"}, - Status: &openshellv1.SandboxStatus{Phase: openshellv1.SandboxPhase_SANDBOX_PHASE_READY}, - }, + listFn: func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Sandbox, error) { + return []*openshell.Sandbox{ + {ID: "id-1", Name: "my-sandbox", Status: openshell.SandboxStatus{Phase: openshell.SandboxReady}}, }, nil }, wantStatus: http.StatusOK, }, { name: "empty list returns empty array", - mockFn: func(_ context.Context, _ string, _, _ uint32, _ string) ([]*openshellv1.Sandbox, error) { + listFn: func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Sandbox, error) { return nil, nil }, wantStatus: http.StatusOK, }, { name: "gateway unavailable returns 502", - mockFn: func(_ context.Context, _ string, _, _ uint32, _ string) ([]*openshellv1.Sandbox, error) { - return nil, status.Error(codes.Unavailable, "gateway down") + listFn: func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Sandbox, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorUnavailable, Message: "gateway down"} }, wantStatus: http.StatusBadGateway, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{listSandboxesFn: tc.mockFn}) + sdk := &mockSDK{} + sdk.sandboxes.listFn = tc.listFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/sandboxes", app.ListSandboxes) @@ -60,24 +57,25 @@ func TestListSandboxes(t *testing.T) { r.ServeHTTP(w, req) if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) + t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } }) } } func TestListSandboxesBody(t *testing.T) { - app := newTestApp(&mockGateway{ - listSandboxesFn: func(_ context.Context, _ string, _, _ uint32, _ string) ([]*openshellv1.Sandbox, error) { - return []*openshellv1.Sandbox{ - { - Metadata: &datamodelv1.ObjectMeta{Id: "id-1", Name: "my-sandbox", Workspace: "default"}, - Spec: &openshellv1.SandboxSpec{Template: &openshellv1.SandboxTemplate{Image: "ubuntu:latest"}}, - Status: &openshellv1.SandboxStatus{Phase: openshellv1.SandboxPhase_SANDBOX_PHASE_READY}, - }, - }, nil - }, - }) + sdk := &mockSDK{} + sdk.sandboxes.listFn = func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.Sandbox, error) { + return []*openshell.Sandbox{ + { + ID: "id-1", Name: "my-sandbox", Workspace: "default", + CreatedAt: time.Unix(1700000000, 0), + Spec: openshell.SandboxSpec{Template: &openshell.SandboxTemplate{Image: "ubuntu:latest"}}, + Status: openshell.SandboxStatus{Phase: openshell.SandboxReady}, + }, + }, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/sandboxes", app.ListSandboxes) @@ -114,7 +112,7 @@ func TestListSandboxesBody(t *testing.T) { func TestCreateSandbox(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) + createFn func(ctx context.Context, workspace, name string, spec *openshell.SandboxSpec, labels map[string]string, opts ...openshell.CreateOptions) (*openshell.Sandbox, error) name string body string wantCode string @@ -123,11 +121,8 @@ func TestCreateSandbox(t *testing.T) { { name: "success", body: `{"name":"my-sandbox","image":"ubuntu:latest","policy":{"version":1,"filesystem":{"includeWorkdir":true}}}`, - mockFn: func(_ context.Context, _, _ string, _ *openshellv1.SandboxSpec, _, _ map[string]string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "id-1", Name: "my-sandbox"}, - Status: &openshellv1.SandboxStatus{Phase: openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING}, - }, nil + createFn: func(_ context.Context, _, name string, _ *openshell.SandboxSpec, _ map[string]string, _ ...openshell.CreateOptions) (*openshell.Sandbox, error) { + return &openshell.Sandbox{ID: "id-1", Name: name, Status: openshell.SandboxStatus{Phase: openshell.SandboxProvisioning}}, nil }, wantStatus: http.StatusCreated, }, @@ -161,23 +156,11 @@ func TestCreateSandbox(t *testing.T) { wantStatus: http.StatusBadRequest, wantCode: "invalid_body", }, - { - name: "unknown field in body", - body: `{"name":"ok","image":"img","policy":{"version":1},"bogus":true}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_body", - }, - { - name: "invalid policy schema", - body: `{"name":"ok","image":"img","policy":{"notAField":true}}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_policy", - }, { name: "gateway already exists", body: `{"name":"dup","image":"ubuntu:latest","policy":{"version":1,"filesystem":{"includeWorkdir":true}}}`, - mockFn: func(_ context.Context, _, _ string, _ *openshellv1.SandboxSpec, _, _ map[string]string) (*openshellv1.Sandbox, error) { - return nil, status.Error(codes.AlreadyExists, "sandbox already exists") + createFn: func(_ context.Context, _, _ string, _ *openshell.SandboxSpec, _ map[string]string, _ ...openshell.CreateOptions) (*openshell.Sandbox, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorAlreadyExists, Message: "sandbox already exists"} }, wantStatus: http.StatusConflict, wantCode: "already_exists", @@ -185,8 +168,9 @@ func TestCreateSandbox(t *testing.T) { } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{createSandboxFn: tc.mockFn} - app := newTestApp(mock) + sdk := &mockSDK{} + sdk.sandboxes.createFn = tc.createFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Post("/workspaces/{workspace}/sandboxes", app.CreateSandbox) @@ -213,31 +197,30 @@ func TestCreateSandbox(t *testing.T) { func TestGetSandbox(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) + getFn func(ctx context.Context, workspace, name string) (*openshell.Sandbox, error) name string wantStatus int }{ { name: "success", - mockFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "id-1", Name: "my-sandbox"}, - Status: &openshellv1.SandboxStatus{Phase: openshellv1.SandboxPhase_SANDBOX_PHASE_READY}, - }, nil + getFn: func(_ context.Context, _, name string) (*openshell.Sandbox, error) { + return &openshell.Sandbox{ID: "id-1", Name: name, Status: openshell.SandboxStatus{Phase: openshell.SandboxReady}}, nil }, wantStatus: http.StatusOK, }, { name: "not found", - mockFn: func(_ context.Context, _, _ string) (*openshellv1.Sandbox, error) { - return nil, status.Error(codes.NotFound, "sandbox not found") + getFn: func(_ context.Context, _, _ string) (*openshell.Sandbox, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"} }, wantStatus: http.StatusNotFound, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getSandboxFn: tc.mockFn}) + sdk := &mockSDK{} + sdk.sandboxes.getFn = tc.getFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/sandboxes/{name}", app.GetSandbox) @@ -254,35 +237,37 @@ func TestGetSandbox(t *testing.T) { func TestDeleteSandbox(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, name string) (bool, error) + deleteFn func(ctx context.Context, workspace, name string) error name string wantStatus int }{ { name: "success", - mockFn: func(_ context.Context, _, _ string) (bool, error) { - return true, nil + deleteFn: func(_ context.Context, _, _ string) error { + return nil }, wantStatus: http.StatusOK, }, { name: "not found", - mockFn: func(_ context.Context, _, _ string) (bool, error) { - return false, status.Error(codes.NotFound, "sandbox not found") + deleteFn: func(_ context.Context, _, _ string) error { + return &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "sandbox not found"} }, wantStatus: http.StatusNotFound, }, { name: "permission denied", - mockFn: func(_ context.Context, _, _ string) (bool, error) { - return false, status.Error(codes.PermissionDenied, "access denied") + deleteFn: func(_ context.Context, _, _ string) error { + return &openshell.StatusError{Code: openshell.ErrorPermissionDenied, Message: "access denied"} }, wantStatus: http.StatusForbidden, }, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{deleteSandboxFn: tc.mockFn}) + sdk := &mockSDK{} + sdk.sandboxes.deleteFn = tc.deleteFn + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Delete("/workspaces/{workspace}/sandboxes/{name}", app.DeleteSandbox) @@ -296,38 +281,3 @@ func TestDeleteSandbox(t *testing.T) { }) } } - -func TestCreateSandboxWithGPUAndResources(t *testing.T) { - var capturedSpec *openshellv1.SandboxSpec - mock := &mockGateway{ - createSandboxFn: func(_ context.Context, _, _ string, spec *openshellv1.SandboxSpec, _, _ map[string]string) (*openshellv1.Sandbox, error) { - capturedSpec = spec - return &openshellv1.Sandbox{ - Metadata: &datamodelv1.ObjectMeta{Id: "id-1", Name: "gpu-sandbox"}, - Status: &openshellv1.SandboxStatus{Phase: openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING}, - }, nil - }, - } - app := newTestApp(mock) - r := chi.NewRouter() - r.Post("/workspaces/{workspace}/sandboxes", app.CreateSandbox) - - body := `{"name":"gpu-sandbox","image":"nvidia/cuda","gpuCount":2,"cpu":"4","memory":"8Gi","policy":{"version":1,"filesystem":{"includeWorkdir":true}}}` - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes", strings.NewReader(body)) - req.Header.Set("Content-Type", "application/json") - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != http.StatusCreated { - t.Fatalf("status = %d, want 201; body: %s", w.Code, w.Body.String()) - } - if capturedSpec.ResourceRequirements == nil || capturedSpec.ResourceRequirements.Gpu == nil { - t.Fatal("expected GPU resource requirements to be set") - } - if capturedSpec.ResourceRequirements.Gpu.GetCount() != 2 { - t.Errorf("gpu count = %d, want 2", capturedSpec.ResourceRequirements.Gpu.GetCount()) - } - if capturedSpec.Template.Resources == nil { - t.Fatal("expected template resources to be set for cpu/memory") - } -} diff --git a/backend/internal/api/services_handler.go b/backend/internal/api/services_handler.go index a95e7054..c1e47064 100644 --- a/backend/internal/api/services_handler.go +++ b/backend/internal/api/services_handler.go @@ -15,14 +15,14 @@ type ExposeServiceRequest struct { } func (app *App) ListServices(w http.ResponseWriter, r *http.Request) { - services, err := app.gateway.ListServices(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + services, err := app.sdk.Services().List(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.ServiceEndpoint, 0, len(services)) for _, svc := range services { - out = append(out, models.FromServiceEndpointResponse(svc)) + out = append(out, models.FromSDKServiceEndpoint(svc)) } writeJSON(w, http.StatusOK, out) } @@ -40,19 +40,18 @@ func (app *App) ExposeService(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_port", "targetPort must be greater than 0") return } - resp, err := app.gateway.ExposeService(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.Service, body.TargetPort, body.Domain) + svc, err := app.sdk.Services().Expose(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.Service, body.TargetPort, body.Domain) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromServiceEndpointResponse(resp)) + writeJSON(w, http.StatusCreated, models.FromSDKServiceEndpoint(svc)) } func (app *App) DeleteService(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteService(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "svc")) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Services().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "svc")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/services_handler_test.go b/backend/internal/api/services_handler_test.go index a192001a..f20fc759 100644 --- a/backend/internal/api/services_handler_test.go +++ b/backend/internal/api/services_handler_test.go @@ -9,206 +9,72 @@ import ( "testing" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestListServices(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context, _, _ string) ([]*openshellv1.ServiceEndpointResponse, error) { - return []*openshellv1.ServiceEndpointResponse{ - { - Endpoint: &openshellv1.ServiceEndpoint{ - SandboxName: "my-sandbox", - ServiceName: "web", - TargetPort: 8080, - }, - Url: "https://web.example.com", - }, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "empty list", - mockFn: func(_ context.Context, _, _ string) ([]*openshellv1.ServiceEndpointResponse, error) { - return nil, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "gateway error", - mockFn: func(_ context.Context, _, _ string) ([]*openshellv1.ServiceEndpointResponse, error) { - return nil, status.Error(codes.Unavailable, "gateway down") - }, - wantStatus: http.StatusBadGateway, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{listServicesFn: tc.mockFn}) - r := chi.NewRouter() - r.Get("/workspaces/{workspace}/sandboxes/{name}/services", app.ListServices) - - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/services", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + sdk := &mockSDK{} + sdk.services.listFn = func(_ context.Context, _, _ string, _ ...openshell.ListOptions) ([]*openshell.ServiceEndpoint, error) { + return []*openshell.ServiceEndpoint{ + {SandboxName: "my-sandbox", ServiceName: "web", TargetPort: 8080, URL: "https://web.example"}, + }, nil } -} - -func TestListServicesBody(t *testing.T) { - app := newTestApp(&mockGateway{ - listServicesFn: func(_ context.Context, _, _ string) ([]*openshellv1.ServiceEndpointResponse, error) { - return []*openshellv1.ServiceEndpointResponse{ - { - Endpoint: &openshellv1.ServiceEndpoint{ - SandboxName: "my-sandbox", - ServiceName: "web", - TargetPort: 8080, - Domain: true, - }, - Url: "https://web.example.com", - }, - }, nil - }, - }) + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/sandboxes/{name}/services", app.ListServices) - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/sandboxes/my-sandbox/services", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } - var body []map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - if len(body) != 1 { - t.Fatalf("got %d services, want 1", len(body)) - } - if body[0]["serviceName"] != "web" { - t.Errorf("serviceName = %v", body[0]["serviceName"]) - } - if body[0]["url"] != "https://web.example.com" { - t.Errorf("url = %v", body[0]["url"]) + _ = json.NewDecoder(w.Body).Decode(&body) + if len(body) != 1 || body[0]["serviceName"] != "web" { + t.Errorf("body = %v", body) } } func TestExposeService(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) name string body string - wantCode string wantStatus int }{ - { - name: "success", - body: `{"service":"web","targetPort":8080,"domain":true}`, - mockFn: func(_ context.Context, _, _, _ string, _ uint32, _ bool) (*openshellv1.ServiceEndpointResponse, error) { - return &openshellv1.ServiceEndpointResponse{ - Endpoint: &openshellv1.ServiceEndpoint{ - SandboxName: "my-sandbox", - ServiceName: "web", - TargetPort: 8080, - Domain: true, - }, - Url: "https://web.example.com", - }, nil - }, - wantStatus: http.StatusCreated, - }, - { - name: "missing service name", - body: `{"targetPort":8080}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_service", - }, - { - name: "missing target port", - body: `{"service":"web"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_port", - }, + {name: "success", body: `{"service":"web","targetPort":8080}`, wantStatus: http.StatusCreated}, + {name: "missing service", body: `{"service":"","targetPort":8080}`, wantStatus: http.StatusBadRequest}, + {name: "zero port", body: `{"service":"web","targetPort":0}`, wantStatus: http.StatusBadRequest}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{exposeServiceFn: tc.mockFn}) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Post("/workspaces/{workspace}/sandboxes/{name}/services", app.ExposeService) - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/sandboxes/my-sandbox/services", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } }) } } func TestDeleteService(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, workspace, sandbox, service string) (bool, error) - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context, _, _, _ string) (bool, error) { - return true, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "not found", - mockFn: func(_ context.Context, _, _, _ string) (bool, error) { - return false, status.Error(codes.NotFound, "service not found") - }, - wantStatus: http.StatusNotFound, - }, + app := newTestAppWithSDK(&mockSDK{}) + r := chi.NewRouter() + r.Delete("/workspaces/{workspace}/sandboxes/{name}/services/{svc}", app.DeleteService) + req := httptest.NewRequest(http.MethodDelete, "/workspaces/default/sandboxes/my-sandbox/services/web", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{deleteServiceFn: tc.mockFn}) - r := chi.NewRouter() - r.Delete("/workspaces/{workspace}/sandboxes/{name}/services/{svc}", app.DeleteService) - - req := httptest.NewRequest(http.MethodDelete, "/workspaces/default/sandboxes/my-sandbox/services/web", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + var body map[string]bool + _ = json.NewDecoder(w.Body).Decode(&body) + if !body["deleted"] { + t.Errorf("deleted = %v", body["deleted"]) } } diff --git a/backend/internal/api/settings_handler.go b/backend/internal/api/settings_handler.go index 7c16894d..76cfc1c6 100644 --- a/backend/internal/api/settings_handler.go +++ b/backend/internal/api/settings_handler.go @@ -3,16 +3,18 @@ package api import ( "net/http" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) func (app *App) GetGlobalSettings(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetGatewaySettings(r.Context()) + config, err := app.sdk.Config().GetGateway(r.Context()) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromGatewaySettings(resp)) + writeJSON(w, http.StatusOK, models.FromSDKGatewaySettings(config)) } type SetSettingRequest struct { @@ -29,8 +31,12 @@ func (app *App) SetGlobalSetting(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_setting", "key is required") return } - if err := app.gateway.SetSetting(r.Context(), body.Key, body.Value); err != nil { - writeGrpcError(w, err) + if _, err := app.sdk.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + SettingKey: body.Key, + SettingValue: &openshell.SettingValue{Type: openshell.SettingValueString, StringVal: body.Value}, + Global: true, + }); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"updated": true}) @@ -42,8 +48,12 @@ func (app *App) DeleteGlobalSetting(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_setting", "key query parameter is required") return } - if err := app.gateway.DeleteSetting(r.Context(), key); err != nil { - writeGrpcError(w, err) + if _, err := app.sdk.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + SettingKey: key, + DeleteSetting: true, + Global: true, + }); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) diff --git a/backend/internal/api/settings_handler_test.go b/backend/internal/api/settings_handler_test.go index de3376fd..a0559926 100644 --- a/backend/internal/api/settings_handler_test.go +++ b/backend/internal/api/settings_handler_test.go @@ -8,205 +8,77 @@ import ( "strings" "testing" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestGetGlobalSettings(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) - name string - wantStatus int - }{ - { - name: "success", - mockFn: func(_ context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - return &sandboxv1.GetGatewayConfigResponse{ - Settings: map[string]*sandboxv1.SettingValue{ - "max_sandboxes": {Value: &sandboxv1.SettingValue_IntValue{IntValue: 100}}, - "debug": {Value: &sandboxv1.SettingValue_BoolValue{BoolValue: true}}, - }, - SettingsRevision: 5, - }, nil - }, - wantStatus: http.StatusOK, - }, - { - name: "gateway error", - mockFn: func(_ context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - return nil, status.Error(codes.PermissionDenied, "not admin") + sdk := &mockSDK{} + sdk.config.getGatewayFn = func(_ context.Context) (*openshell.GatewayConfig, error) { + return &openshell.GatewayConfig{ + SettingsRevision: 9, + Settings: map[string]openshell.SettingValue{ + "log_level": {Type: openshell.SettingValueString, StringVal: "info"}, + "enabled": {Type: openshell.SettingValueBool, BoolVal: true}, }, - wantStatus: http.StatusForbidden, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{getGatewaySettingsFn: tc.mockFn}) - - req := httptest.NewRequest(http.MethodGet, "/settings/global", nil) - w := httptest.NewRecorder() - app.GetGlobalSettings(w, req) - - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - }) + }, nil } -} - -func TestGetGlobalSettingsBody(t *testing.T) { - app := newTestApp(&mockGateway{ - getGatewaySettingsFn: func(_ context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - return &sandboxv1.GetGatewayConfigResponse{ - Settings: map[string]*sandboxv1.SettingValue{ - "debug": {Value: &sandboxv1.SettingValue_BoolValue{BoolValue: true}}, - "max_sandboxes": {Value: &sandboxv1.SettingValue_IntValue{IntValue: 100}}, - }, - SettingsRevision: 7, - }, nil - }, - }) - + app := newTestAppWithSDK(sdk) req := httptest.NewRequest(http.MethodGet, "/settings/global", nil) w := httptest.NewRecorder() app.GetGlobalSettings(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d; body: %s", w.Code, w.Body.String()) } - var body map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - if v, ok := body["settingsRevision"].(float64); !ok || v != 7 { - t.Errorf("settingsRevision = %v, want 7", body["settingsRevision"]) - } - settings, ok := body["settings"].([]any) - if !ok { - t.Fatal("settings is not an array") + _ = json.NewDecoder(w.Body).Decode(&body) + if body["settingsRevision"] != float64(9) { + t.Errorf("settingsRevision = %v", body["settingsRevision"]) } + settings, _ := body["settings"].([]any) if len(settings) != 2 { t.Fatalf("got %d settings, want 2", len(settings)) } - first, ok := settings[0].(map[string]any) - if !ok { - t.Fatal("first setting is not a map") - } - if first["key"] != "debug" { - t.Errorf("first key = %v, want debug (sorted)", first["key"]) - } } func TestSetGlobalSetting(t *testing.T) { tests := []struct { - mockFn func(ctx context.Context, key, value string) error name string body string - wantCode string wantStatus int }{ - { - name: "success", - body: `{"key":"max_sandboxes","value":"200"}`, - mockFn: func(_ context.Context, _, _ string) error { - return nil - }, - wantStatus: http.StatusOK, - }, - { - name: "missing key", - body: `{"value":"200"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_setting", - }, - { - name: "gateway error", - body: `{"key":"readonly","value":"x"}`, - mockFn: func(_ context.Context, _, _ string) error { - return status.Error(codes.PermissionDenied, "not admin") - }, - wantStatus: http.StatusForbidden, - }, + {name: "success", body: `{"key":"log_level","value":"debug"}`, wantStatus: http.StatusOK}, + {name: "missing key", body: `{"key":"","value":"x"}`, wantStatus: http.StatusBadRequest}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{setSettingFn: tc.mockFn}) - + app := newTestAppWithSDK(&mockSDK{}) req := httptest.NewRequest(http.MethodPut, "/settings/global", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() app.SetGlobalSetting(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } }) } } func TestDeleteGlobalSetting(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, key string) error - name string - url string - wantCode string - wantStatus int - }{ - { - name: "success", - url: "/settings/global?key=max_sandboxes", - mockFn: func(_ context.Context, _ string) error { - return nil - }, - wantStatus: http.StatusOK, - }, - { - name: "missing key", - url: "/settings/global", - wantStatus: http.StatusBadRequest, - wantCode: "invalid_setting", - }, - { - name: "gateway error", - url: "/settings/global?key=readonly", - mockFn: func(_ context.Context, _ string) error { - return status.Error(codes.PermissionDenied, "not admin") - }, - wantStatus: http.StatusForbidden, - }, + app := newTestAppWithSDK(&mockSDK{}) + req := httptest.NewRequest(http.MethodDelete, "/settings/global?key=log_level", nil) + w := httptest.NewRecorder() + app.DeleteGlobalSetting(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d", w.Code) } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{deleteSettingFn: tc.mockFn}) - - req := httptest.NewRequest(http.MethodDelete, tc.url, nil) - w := httptest.NewRecorder() - app.DeleteGlobalSetting(w, req) +} - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } - }) +func TestDeleteGlobalSettingMissingKey(t *testing.T) { + app := newTestAppWithSDK(&mockSDK{}) + req := httptest.NewRequest(http.MethodDelete, "/settings/global", nil) + w := httptest.NewRecorder() + app.DeleteGlobalSetting(w, req) + if w.Code != http.StatusBadRequest { + t.Fatalf("status = %d, want 400", w.Code) } } diff --git a/backend/internal/api/terminal_handler.go b/backend/internal/api/terminal_handler.go index db32d26a..db29c520 100644 --- a/backend/internal/api/terminal_handler.go +++ b/backend/internal/api/terminal_handler.go @@ -3,6 +3,7 @@ package api import ( "context" "encoding/json" + "io" "log/slog" "net/http" "strconv" @@ -10,7 +11,7 @@ import ( "github.com/go-chi/chi/v5" "github.com/gorilla/websocket" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) const ( @@ -37,21 +38,20 @@ func parseDimensions(r *http.Request) (cols, rows uint32) { return cols, rows } -func relayGRPCToWS(ws *websocket.Conn, stream openshellv1.OpenShell_ExecSandboxInteractiveClient, cancel context.CancelFunc) { +func relaySessionToWS(ws *websocket.Conn, session openshell.InteractiveSession, cancel context.CancelFunc) { defer cancel() + buf := make([]byte, 32*1024) for { - event, recvErr := stream.Recv() - if recvErr != nil { - return + n, err := session.Read(buf) + if n > 0 { + _ = ws.WriteMessage(websocket.BinaryMessage, buf[:n]) } - switch p := event.Payload.(type) { - case *openshellv1.ExecSandboxEvent_Stdout: - _ = ws.WriteMessage(websocket.BinaryMessage, p.Stdout.Data) - case *openshellv1.ExecSandboxEvent_Stderr: - _ = ws.WriteMessage(websocket.BinaryMessage, p.Stderr.Data) - case *openshellv1.ExecSandboxEvent_Exit: - msg := websocket.FormatCloseMessage(websocket.CloseNormalClosure, - strconv.Itoa(int(p.Exit.ExitCode))) + if err != nil { + code := 0 + if exitCode, exitErr := session.ExitCode(); exitErr == nil { + code = exitCode + } + msg := websocket.FormatCloseMessage(websocket.CloseNormalClosure, strconv.Itoa(code)) _ = ws.WriteMessage(websocket.CloseMessage, msg) return } @@ -61,14 +61,6 @@ func relayGRPCToWS(ws *websocket.Conn, stream openshellv1.OpenShell_ExecSandboxI func (app *App) Terminal(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - cols, rows := parseDimensions(r) upgrader := websocket.Upgrader{ @@ -85,37 +77,19 @@ func (app *App) Terminal(w http.ResponseWriter, r *http.Request) { ctx, cancel := context.WithCancel(r.Context()) defer cancel() - slog.Info("opening exec stream", "sandbox_id", sandboxID, "cols", cols, "rows", rows) - stream, err := app.gateway.ExecSandboxInteractive(ctx) + slog.Info("opening interactive session", "workspace", workspace, "name", name, "cols", cols, "rows", rows) + session, err := app.sdk.Exec().Interactive(ctx, workspace, name, []string{defaultShell}, cols, rows) if err != nil { - slog.Error("exec stream open failed", "error", err) + slog.Error("interactive session open failed", "error", err) _ = ws.WriteMessage(websocket.CloseMessage, websocket.FormatCloseMessage(websocket.CloseInternalServerErr, "failed to open exec stream")) return } - slog.Info("exec stream opened, sending start") + defer session.Close() + slog.Info("interactive session opened, entering relay loop") - if err := stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Start{ - Start: &openshellv1.ExecSandboxRequest{ - SandboxId: sandboxID, - Command: []string{defaultShell}, - Tty: true, - Cols: cols, - Rows: rows, - }, - }, - }); err != nil { - slog.Error("exec start failed", "error", err) - _ = ws.WriteMessage(websocket.CloseMessage, - websocket.FormatCloseMessage(websocket.CloseInternalServerErr, "failed to start exec")) - return - } - slog.Info("exec start sent, entering relay loop") - - go relayGRPCToWS(ws, stream, cancel) + go relaySessionToWS(ws, session, cancel) - // WS -> gRPC for { msgType, data, readErr := ws.ReadMessage() if readErr != nil { @@ -125,22 +99,14 @@ func (app *App) Terminal(w http.ResponseWriter, r *http.Request) { if msgType == websocket.TextMessage { var resize resizeMessage if json.Unmarshal(data, &resize) == nil && resize.Type == "resize" { - _ = stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Resize{ - Resize: &openshellv1.ExecSandboxWindowResize{ - Cols: resize.Cols, - Rows: resize.Rows, - }, - }, - }) + _ = session.Resize(resize.Cols, resize.Rows) continue } } - _ = stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Stdin{ - Stdin: data, - }, - }) + if _, writeErr := session.Write(data); writeErr != nil && writeErr != io.EOF { + cancel() + return + } } } diff --git a/backend/internal/api/terminal_handler_test.go b/backend/internal/api/terminal_handler_test.go index 8df79615..645f97e5 100644 --- a/backend/internal/api/terminal_handler_test.go +++ b/backend/internal/api/terminal_handler_test.go @@ -1,8 +1,17 @@ package api import ( + "context" "net/http" + "net/http/httptest" + "strings" "testing" + "time" + + "github.com/go-chi/chi/v5" + "github.com/gorilla/websocket" + + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestCheckWebSocketOrigin(t *testing.T) { @@ -60,3 +69,82 @@ func TestCheckWebSocketOrigin(t *testing.T) { }) } } + +func stubInteractive(t *testing.T, session openshell.InteractiveSession, gotCols, gotRows *uint32) func(context.Context, string, string, []string, uint32, uint32, ...openshell.ExecOptions) (openshell.InteractiveSession, error) { + t.Helper() + return func(_ context.Context, workspace, name string, command []string, cols, rows uint32, _ ...openshell.ExecOptions) (openshell.InteractiveSession, error) { + if workspace != "default" || name != "sb" { + t.Errorf("sandbox = %s/%s", workspace, name) + } + if len(command) != 1 || command[0] != defaultShell { + t.Errorf("command = %v", command) + } + *gotCols, *gotRows = cols, rows + return session, nil + } +} + +func waitSessionIO(session *mockInteractiveSession, timeout time.Duration) (string, [][2]uint32) { + deadline := time.Now().Add(timeout) + for time.Now().Before(deadline) { + session.mu.Lock() + ok := string(session.written) == "ls\n" && len(session.resizes) == 1 + session.mu.Unlock() + if ok { + break + } + time.Sleep(10 * time.Millisecond) + } + session.mu.Lock() + defer session.mu.Unlock() + return string(session.written), append([][2]uint32(nil), session.resizes...) +} + +func TestTerminalRelay(t *testing.T) { + session := &mockInteractiveSession{reads: make(chan []byte, 1)} + session.reads <- []byte("hi") + + var gotCols, gotRows uint32 + sdk := &mockSDK{} + sdk.exec.interactiveFn = stubInteractive(t, session, &gotCols, &gotRows) + + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces/{workspace}/sandboxes/{name}/terminal", app.Terminal) + srv := httptest.NewServer(r) + t.Cleanup(srv.Close) + + u := "ws" + strings.TrimPrefix(srv.URL, "http") + "/workspaces/default/sandboxes/sb/terminal?cols=100&rows=30" + ws, _, err := websocket.DefaultDialer.Dial(u, nil) + if err != nil { + t.Fatalf("dial: %v", err) + } + t.Cleanup(func() { _ = ws.Close() }) + + _ = ws.SetReadDeadline(time.Now().Add(2 * time.Second)) + msgType, data, err := ws.ReadMessage() + if err != nil { + t.Fatalf("read: %v", err) + } + if msgType != websocket.BinaryMessage || string(data) != "hi" { + t.Fatalf("got type=%d data=%q, want binary hi", msgType, data) + } + + if err := ws.WriteMessage(websocket.BinaryMessage, []byte("ls\n")); err != nil { + t.Fatal(err) + } + if err := ws.WriteMessage(websocket.TextMessage, []byte(`{"type":"resize","cols":120,"rows":40}`)); err != nil { + t.Fatal(err) + } + + written, resizes := waitSessionIO(session, 2*time.Second) + if written != "ls\n" { + t.Errorf("written = %q, want ls\\n", written) + } + if len(resizes) != 1 || resizes[0] != [2]uint32{120, 40} { + t.Errorf("resizes = %v, want [120 40]", resizes) + } + if gotCols != 100 || gotRows != 30 { + t.Errorf("dims = %d x %d, want 100x30", gotCols, gotRows) + } +} diff --git a/backend/internal/api/workspaces_handler.go b/backend/internal/api/workspaces_handler.go index b7f4e720..e981ddce 100644 --- a/backend/internal/api/workspaces_handler.go +++ b/backend/internal/api/workspaces_handler.go @@ -6,6 +6,8 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) @@ -16,14 +18,18 @@ type CreateWorkspaceRequest struct { } func (app *App) ListWorkspaces(w http.ResponseWriter, r *http.Request) { - workspaces, err := app.gateway.ListWorkspaces(r.Context(), 0, 0, r.URL.Query().Get("labelSelector")) + var opts []openshell.ListOptions + if sel := r.URL.Query().Get("labelSelector"); sel != "" { + opts = append(opts, openshell.ListOptions{LabelSelector: sel}) + } + workspaces, err := app.sdk.Workspaces().List(r.Context(), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Workspace, 0, len(workspaces)) for _, ws := range workspaces { - out = append(out, models.FromWorkspace(ws)) + out = append(out, models.FromSDKWorkspace(ws)) } writeJSON(w, http.StatusOK, out) } @@ -37,30 +43,29 @@ func (app *App) CreateWorkspace(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_name", "workspace name must be a valid DNS-1123 label") return } - workspace, err := app.gateway.CreateWorkspace(r.Context(), body.Name, body.Labels) + workspace, err := app.sdk.Workspaces().Create(r.Context(), body.Name, body.Labels) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromWorkspace(workspace)) + writeJSON(w, http.StatusCreated, models.FromSDKWorkspace(workspace)) } func (app *App) GetWorkspace(w http.ResponseWriter, r *http.Request) { - workspace, err := app.gateway.GetWorkspace(r.Context(), chi.URLParam(r, "workspace")) + workspace, err := app.sdk.Workspaces().Get(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromWorkspace(workspace)) + writeJSON(w, http.StatusOK, models.FromSDKWorkspace(workspace)) } func (app *App) DeleteWorkspace(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteWorkspace(r.Context(), chi.URLParam(r, "workspace")) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Workspaces().Delete(r.Context(), chi.URLParam(r, "workspace")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } // AddMemberRequest is the add-member body. Role is USER or ADMIN. @@ -70,14 +75,14 @@ type AddMemberRequest struct { } func (app *App) ListMembers(w http.ResponseWriter, r *http.Request) { - members, err := app.gateway.ListWorkspaceMembers(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + members, err := app.sdk.Workspaces().ListMembers(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.WorkspaceMember, 0, len(members)) for _, member := range members { - out = append(out, models.FromWorkspaceMember(member)) + out = append(out, models.FromSDKWorkspaceMember(member)) } writeJSON(w, http.StatusOK, out) } @@ -91,17 +96,17 @@ func (app *App) AddMember(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_subject", "principalSubject is required") return } - role, ok := models.WorkspaceRoleFromString(body.Role) + role, ok := models.SDKWorkspaceRoleFromString(body.Role) if !ok { writeError(w, http.StatusBadRequest, "invalid_role", "role must be USER or ADMIN") return } - member, err := app.gateway.AddWorkspaceMember(r.Context(), chi.URLParam(r, "workspace"), body.PrincipalSubject, role) + member, err := app.sdk.Workspaces().AddMember(r.Context(), chi.URLParam(r, "workspace"), body.PrincipalSubject, role) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromWorkspaceMember(member)) + writeJSON(w, http.StatusCreated, models.FromSDKWorkspaceMember(member)) } func (app *App) RemoveMember(w http.ResponseWriter, r *http.Request) { @@ -111,10 +116,9 @@ func (app *App) RemoveMember(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_subject", "invalid member subject") return } - removed, err := app.gateway.RemoveWorkspaceMember(r.Context(), chi.URLParam(r, "workspace"), subject) - if err != nil { - writeGrpcError(w, err) + if err := app.sdk.Workspaces().RemoveMember(r.Context(), chi.URLParam(r, "workspace"), subject); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"removed": removed}) + writeJSON(w, http.StatusOK, map[string]bool{"removed": true}) } diff --git a/backend/internal/api/workspaces_handler_test.go b/backend/internal/api/workspaces_handler_test.go index 26788abb..20d8699e 100644 --- a/backend/internal/api/workspaces_handler_test.go +++ b/backend/internal/api/workspaces_handler_test.go @@ -9,76 +9,53 @@ import ( "testing" "github.com/go-chi/chi/v5" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" ) func TestListWorkspaces(t *testing.T) { - tests := []struct { - mockFn func(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) - name string - wantStatus int - wantLen int - }{ - { - name: "returns workspaces", - mockFn: func(_ context.Context, _, _ uint32, _ string) ([]*datamodelv1.Workspace, error) { - return []*datamodelv1.Workspace{ - { - Metadata: &datamodelv1.ObjectMeta{Name: "team-a"}, - Status: &datamodelv1.WorkspaceStatus{Phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE}, - }, - { - Metadata: &datamodelv1.ObjectMeta{Name: "team-b"}, - Status: &datamodelv1.WorkspaceStatus{Phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_TERMINATING}, - }, - }, nil - }, - wantStatus: http.StatusOK, - wantLen: 2, - }, - { - name: "empty list", - mockFn: func(_ context.Context, _, _ uint32, _ string) ([]*datamodelv1.Workspace, error) { - return nil, nil - }, - wantStatus: http.StatusOK, - wantLen: 0, - }, - { - name: "unauthenticated", - mockFn: func(_ context.Context, _, _ uint32, _ string) ([]*datamodelv1.Workspace, error) { - return nil, status.Error(codes.Unauthenticated, "missing token") - }, - wantStatus: http.StatusUnauthorized, - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - app := newTestApp(&mockGateway{listWorkspacesFn: tc.mockFn}) - r := chi.NewRouter() - r.Get("/workspaces", app.ListWorkspaces) + sdk := &mockSDK{} + sdk.workspaces.listFn = func(_ context.Context, _ ...openshell.ListOptions) ([]*openshell.Workspace, error) { + return []*openshell.Workspace{ + {Name: "team-a", Phase: openshell.WorkspaceActive}, + {Name: "team-b", Phase: openshell.WorkspaceTerminating}, + }, nil + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces", app.ListWorkspaces) - req := httptest.NewRequest(http.MethodGet, "/workspaces", nil) - w := httptest.NewRecorder() - r.ServeHTTP(w, req) + req := httptest.NewRequest(http.MethodGet, "/workspaces", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusOK { + t.Fatalf("status = %d, want 200", w.Code) + } + var body []map[string]any + if err := json.NewDecoder(w.Body).Decode(&body); err != nil { + t.Fatalf("decode: %v", err) + } + if len(body) != 2 { + t.Fatalf("got %d workspaces, want 2", len(body)) + } + if body[0]["phase"] != "ACTIVE" { + t.Errorf("phase = %v, want ACTIVE", body[0]["phase"]) + } +} - if w.Code != tc.wantStatus { - t.Errorf("status = %d, want %d", w.Code, tc.wantStatus) - } - if tc.wantStatus == http.StatusOK { - var body []json.RawMessage - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - if len(body) != tc.wantLen { - t.Errorf("got %d workspaces, want %d", len(body), tc.wantLen) - } - } - }) +func TestListWorkspacesUnavailable(t *testing.T) { + sdk := &mockSDK{} + sdk.workspaces.listFn = func(_ context.Context, _ ...openshell.ListOptions) ([]*openshell.Workspace, error) { + return nil, &openshell.StatusError{Code: openshell.ErrorUnauthenticated, Message: "missing token"} + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Get("/workspaces", app.ListWorkspaces) + req := httptest.NewRequest(http.MethodGet, "/workspaces", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusUnauthorized { + t.Fatalf("status = %d, want 401", w.Code) } } @@ -89,65 +66,28 @@ func TestCreateWorkspace(t *testing.T) { wantCode string wantStatus int }{ - { - name: "success", - body: `{"name":"team-a"}`, - wantStatus: http.StatusCreated, - }, - { - name: "missing name", - body: `{"name":""}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_name", - }, - { - name: "invalid name - uppercase", - body: `{"name":"Team-A"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_name", - }, - { - name: "invalid name - underscore", - body: `{"name":"team_a"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_name", - }, - { - name: "invalid JSON", - body: `not-json`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_body", - }, + {name: "success", body: `{"name":"team-a"}`, wantStatus: http.StatusCreated}, + {name: "missing name", body: `{"name":""}`, wantStatus: http.StatusBadRequest, wantCode: "invalid_name"}, + {name: "invalid name - uppercase", body: `{"name":"Team-A"}`, wantStatus: http.StatusBadRequest, wantCode: "invalid_name"}, + {name: "invalid JSON", body: `not-json`, wantStatus: http.StatusBadRequest, wantCode: "invalid_body"}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{ - createWorkspaceFn: func(_ context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) { - return &datamodelv1.Workspace{ - Metadata: &datamodelv1.ObjectMeta{Name: name, Labels: labels}, - Status: &datamodelv1.WorkspaceStatus{Phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE}, - }, nil - }, - } - app := newTestApp(mock) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Post("/workspaces", app.CreateWorkspace) - req := httptest.NewRequest(http.MethodPost, "/workspaces", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) + var errBody ErrorResponse + _ = json.NewDecoder(w.Body).Decode(&errBody) + if errBody.Code != tc.wantCode { + t.Errorf("code = %q, want %q", errBody.Code, tc.wantCode) } } }) @@ -155,62 +95,55 @@ func TestCreateWorkspace(t *testing.T) { } func TestGetWorkspace(t *testing.T) { - app := newTestApp(&mockGateway{ - getWorkspaceFn: func(_ context.Context, name string) (*datamodelv1.Workspace, error) { - return &datamodelv1.Workspace{ - Metadata: &datamodelv1.ObjectMeta{Name: name}, - Status: &datamodelv1.WorkspaceStatus{Phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE}, - }, nil - }, - }) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Get("/workspaces/{workspace}", app.GetWorkspace) - req := httptest.NewRequest(http.MethodGet, "/workspaces/team-a", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } var body map[string]any if err := json.NewDecoder(w.Body).Decode(&body); err != nil { t.Fatalf("decode: %v", err) } - meta, ok := body["metadata"].(map[string]any) - if !ok { - t.Fatal("metadata is not a map") - } + meta, _ := body["metadata"].(map[string]any) if meta["name"] != "team-a" { t.Errorf("name = %v, want team-a", meta["name"]) } - if body["phase"] != "ACTIVE" { - t.Errorf("phase = %v, want ACTIVE", body["phase"]) - } } func TestDeleteWorkspace(t *testing.T) { - app := newTestApp(&mockGateway{ - deleteWorkspaceFn: func(_ context.Context, _ string) (bool, error) { - return true, nil - }, - }) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Delete("/workspaces/{workspace}", app.DeleteWorkspace) - req := httptest.NewRequest(http.MethodDelete, "/workspaces/team-a", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } var body map[string]bool - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } + _ = json.NewDecoder(w.Body).Decode(&body) if !body["deleted"] { - t.Error("expected deleted=true") + t.Errorf("deleted = %v, want true", body["deleted"]) + } +} + +func TestDeleteWorkspaceNotFound(t *testing.T) { + sdk := &mockSDK{} + sdk.workspaces.deleteFn = func(_ context.Context, _ string) error { + return &openshell.StatusError{Code: openshell.ErrorNotFound, Message: "missing"} + } + app := newTestAppWithSDK(sdk) + r := chi.NewRouter() + r.Delete("/workspaces/{workspace}", app.DeleteWorkspace) + req := httptest.NewRequest(http.MethodDelete, "/workspaces/missing", nil) + w := httptest.NewRecorder() + r.ServeHTTP(w, req) + if w.Code != http.StatusNotFound { + t.Fatalf("status = %d, want 404", w.Code) } } @@ -218,116 +151,64 @@ func TestAddMember(t *testing.T) { tests := []struct { name string body string - wantCode string wantStatus int }{ - { - name: "success", - body: `{"principalSubject":"user@example.com","role":"USER"}`, - wantStatus: http.StatusCreated, - }, - { - name: "missing subject", - body: `{"principalSubject":"","role":"USER"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_subject", - }, - { - name: "invalid role", - body: `{"principalSubject":"user@example.com","role":"SUPERADMIN"}`, - wantStatus: http.StatusBadRequest, - wantCode: "invalid_role", - }, - { - name: "admin role accepted", - body: `{"principalSubject":"admin@example.com","role":"ADMIN"}`, - wantStatus: http.StatusCreated, - }, + {name: "success", body: `{"principalSubject":"user@example.com","role":"USER"}`, wantStatus: http.StatusCreated}, + {name: "missing subject", body: `{"principalSubject":"","role":"USER"}`, wantStatus: http.StatusBadRequest}, + {name: "invalid role", body: `{"principalSubject":"u","role":"SUPER"}`, wantStatus: http.StatusBadRequest}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - mock := &mockGateway{ - addWorkspaceMemberFn: func(_ context.Context, _, subject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) { - return &openshellv1.WorkspaceMember{ - Metadata: &datamodelv1.ObjectMeta{Name: subject}, - PrincipalSubject: subject, - Role: role, - }, nil - }, - } - app := newTestApp(mock) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Post("/workspaces/{workspace}/members", app.AddMember) - - req := httptest.NewRequest(http.MethodPost, "/workspaces/default/members", strings.NewReader(tc.body)) + req := httptest.NewRequest(http.MethodPost, "/workspaces/team-a/members", strings.NewReader(tc.body)) req.Header.Set("Content-Type", "application/json") w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != tc.wantStatus { t.Errorf("status = %d, want %d; body: %s", w.Code, tc.wantStatus, w.Body.String()) } - if tc.wantCode != "" { - var errResp ErrorResponse - if err := json.NewDecoder(w.Body).Decode(&errResp); err != nil { - t.Fatalf("decode: %v", err) - } - if errResp.Code != tc.wantCode { - t.Errorf("code = %q, want %q", errResp.Code, tc.wantCode) - } - } }) } } func TestRemoveMember(t *testing.T) { - app := newTestApp(&mockGateway{ - removeWorkspaceMemberFn: func(_ context.Context, _, _ string) (bool, error) { - return true, nil - }, - }) + app := newTestAppWithSDK(&mockSDK{}) r := chi.NewRouter() r.Delete("/workspaces/{workspace}/members/{subject}", app.RemoveMember) - - req := httptest.NewRequest(http.MethodDelete, "/workspaces/default/members/user@example.com", nil) + req := httptest.NewRequest(http.MethodDelete, "/workspaces/team-a/members/user%40example.com", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) + } + var body map[string]bool + _ = json.NewDecoder(w.Body).Decode(&body) + if !body["removed"] { + t.Errorf("removed = %v, want true", body["removed"]) } } func TestListMembers(t *testing.T) { - app := newTestApp(&mockGateway{ - listWorkspaceMembersFn: func(_ context.Context, _ string, _, _ uint32) ([]*openshellv1.WorkspaceMember, error) { - return []*openshellv1.WorkspaceMember{ - { - Metadata: &datamodelv1.ObjectMeta{Name: "user1"}, - PrincipalSubject: "user1@example.com", - Role: openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER, - }, - }, nil - }, - }) + sdk := &mockSDK{} + sdk.workspaces.listMembersFn = func(_ context.Context, _ string, _ ...openshell.ListOptions) ([]*openshell.WorkspaceMember, error) { + return []*openshell.WorkspaceMember{ + {PrincipalSubject: "user@example.com", Role: openshell.WorkspaceRoleUser}, + }, nil + } + app := newTestAppWithSDK(sdk) r := chi.NewRouter() r.Get("/workspaces/{workspace}/members", app.ListMembers) - - req := httptest.NewRequest(http.MethodGet, "/workspaces/default/members", nil) + req := httptest.NewRequest(http.MethodGet, "/workspaces/team-a/members", nil) w := httptest.NewRecorder() r.ServeHTTP(w, req) - if w.Code != http.StatusOK { - t.Fatalf("status = %d, want 200", w.Code) + t.Fatalf("status = %d", w.Code) } var body []map[string]any - if err := json.NewDecoder(w.Body).Decode(&body); err != nil { - t.Fatalf("decode: %v", err) - } - if len(body) != 1 { - t.Fatalf("got %d members, want 1", len(body)) - } - if body[0]["role"] != "USER" { - t.Errorf("role = %v, want USER", body[0]["role"]) + _ = json.NewDecoder(w.Body).Decode(&body) + if len(body) != 1 || body[0]["role"] != "USER" { + t.Errorf("body = %v", body) } } diff --git a/backend/internal/gateway/client.go b/backend/internal/gateway/client.go deleted file mode 100644 index 74ae2344..00000000 --- a/backend/internal/gateway/client.go +++ /dev/null @@ -1,148 +0,0 @@ -// Package gateway is a thin wrapper over the protoc-generated OpenShell gRPC -// stubs. It wraps only the user-facing RPCs the dashboard needs (Phase 1) and -// forwards the caller's OIDC bearer token on every RPC. -package gateway - -import ( - "context" - "crypto/tls" - "crypto/x509" - "fmt" - "os" - "strings" - - "google.golang.org/grpc" - "google.golang.org/grpc/credentials" - "google.golang.org/grpc/credentials/insecure" - - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// Client wraps the OpenShell gateway gRPC connection. -type Client struct { - conn *grpc.ClientConn - openshell openshellv1.OpenShellClient - inference inferencev1.InferenceClient -} - -// tokenCredentials implements grpc.PerRPCCredentials by forwarding the OIDC -// bearer token stored on the request context by the auth middleware. -type tokenCredentials struct { - requireTLS bool -} - -func (c tokenCredentials) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) { - token := auth.TokenFromContext(ctx) - if token == "" { - return nil, nil - } - return map[string]string{"authorization": "Bearer " + token}, nil -} - -func (c tokenCredentials) RequireTransportSecurity() bool { - return c.requireTLS -} - -// New connects to the OpenShell gateway. The URL may be a bare host:port -// (plaintext) or prefixed with grpcs:// / https:// for TLS. If caCertPath -// is non-empty, the PEM file is loaded into the TLS RootCAs pool for -// trusting self-signed certificates. clientCertPath and clientKeyPath enable -// mutual TLS and must be configured together for a TLS endpoint. -func New(gatewayURL, caCertPath, clientCertPath, clientKeyPath string) (*Client, error) { - target := gatewayURL - useTLS := false - for _, prefix := range []string{"grpcs://", "https://"} { - if strings.HasPrefix(target, prefix) { - target = strings.TrimPrefix(target, prefix) - useTLS = true - } - } - for _, prefix := range []string{"grpc://", "http://"} { - target = strings.TrimPrefix(target, prefix) - } - hasClientCert := clientCertPath != "" - hasClientKey := clientKeyPath != "" - if hasClientCert != hasClientKey { - return nil, fmt.Errorf("gateway client certificate and key must be configured together") - } - if hasClientCert && !useTLS { - return nil, fmt.Errorf("gateway client certificate requires a TLS gateway URL") - } - - transport := insecure.NewCredentials() - if useTLS { - tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12} - if caCertPath != "" { - caCert, err := os.ReadFile(caCertPath) - if err != nil { - return nil, fmt.Errorf("read CA cert %q: %w", caCertPath, err) - } - pool := x509.NewCertPool() - if !pool.AppendCertsFromPEM(caCert) { - return nil, fmt.Errorf("failed to parse CA cert %q", caCertPath) - } - tlsCfg.RootCAs = pool - } - if hasClientCert { - clientCertificate, err := tls.LoadX509KeyPair(clientCertPath, clientKeyPath) - if err != nil { - return nil, fmt.Errorf("load gateway client certificate: %w", err) - } - tlsCfg.Certificates = []tls.Certificate{clientCertificate} - } - transport = credentials.NewTLS(tlsCfg) - } - - conn, err := grpc.NewClient(target, - grpc.WithTransportCredentials(transport), - grpc.WithPerRPCCredentials(tokenCredentials{requireTLS: useTLS}), - ) - if err != nil { - return nil, fmt.Errorf("connect to gateway %q: %w", gatewayURL, err) - } - - return &Client{ - conn: conn, - openshell: openshellv1.NewOpenShellClient(conn), - inference: inferencev1.NewInferenceClient(conn), - }, nil -} - -// Close tears down the gRPC connection. -func (c *Client) Close() error { - return c.conn.Close() -} - -// Health checks gateway health (unauthenticated RPC). -func (c *Client) Health(ctx context.Context) (*openshellv1.HealthResponse, error) { - resp, err := c.openshell.Health(ctx, &openshellv1.HealthRequest{}) - if err != nil { - return nil, fmt.Errorf("health check: %w", err) - } - return resp, nil -} - -// GetGatewayInfo fetches gateway status, version, and compute drivers. -func (c *Client) GetGatewayInfo(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - resp, err := c.openshell.GetGatewayInfo(ctx, &openshellv1.GetGatewayInfoRequest{}) - if err != nil { - return nil, fmt.Errorf("get gateway info: %w", err) - } - return resp, nil -} - -// GetCurrentUser returns the authenticated user's identity from the gateway. -func (c *Client) GetCurrentUser(ctx context.Context) (*openshellv1.GetCurrentUserResponse, error) { - resp, err := c.openshell.GetCurrentUser(ctx, &openshellv1.GetCurrentUserRequest{}) - if err != nil { - return nil, fmt.Errorf("get current user: %w", err) - } - return resp, nil -} - -func (c *Client) ExecSandboxInteractive(ctx context.Context) (openshellv1.OpenShell_ExecSandboxInteractiveClient, error) { - return c.openshell.ExecSandboxInteractive(ctx) -} diff --git a/backend/internal/gateway/client_test.go b/backend/internal/gateway/client_test.go deleted file mode 100644 index d3e531f5..00000000 --- a/backend/internal/gateway/client_test.go +++ /dev/null @@ -1,149 +0,0 @@ -package gateway - -import ( - "context" - "crypto/x509" - "encoding/pem" - "net/http/httptest" - "os" - "path/filepath" - "strings" - "testing" - - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" -) - -func TestNewClientCertificateValidation(t *testing.T) { - tests := []struct { - name string - gatewayURL string - certPath string - keyPath string - wantError string - }{ - { - name: "certificate without key", - gatewayURL: "https://localhost:17670", - certPath: "client.crt", - wantError: "must be configured together", - }, - { - name: "key without certificate", - gatewayURL: "https://localhost:17670", - keyPath: "client.key", - wantError: "must be configured together", - }, - { - name: "client certificate on plaintext connection", - gatewayURL: "localhost:50051", - certPath: "client.crt", - keyPath: "client.key", - wantError: "requires a TLS gateway URL", - }, - } - - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - client, err := New(tc.gatewayURL, "", tc.certPath, tc.keyPath) - if client != nil { - client.Close() - } - if err == nil || !strings.Contains(err.Error(), tc.wantError) { - t.Fatalf("New() error = %v, want error containing %q", err, tc.wantError) - } - }) - } -} - -func TestNewLoadsClientCertificate(t *testing.T) { - server := httptest.NewTLSServer(nil) - defer server.Close() - - tempDir := t.TempDir() - certPath := filepath.Join(tempDir, "tls.crt") - keyPath := filepath.Join(tempDir, "tls.key") - caPath := filepath.Join(tempDir, "ca.crt") - certificate := server.TLS.Certificates[0] - certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certificate.Certificate[0]}) - keyDER, err := x509.MarshalPKCS8PrivateKey(certificate.PrivateKey) - if err != nil { - t.Fatalf("marshal private key: %v", err) - } - keyPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER}) - for path, contents := range map[string][]byte{ - certPath: certPEM, - keyPath: keyPEM, - caPath: certPEM, - } { - if writeErr := os.WriteFile(path, contents, 0o600); writeErr != nil { - t.Fatalf("write %s: %v", path, writeErr) - } - } - - client, err := New(server.URL, caPath, certPath, keyPath) - if err != nil { - t.Fatalf("New() with client certificate: %v", err) - } - client.Close() -} - -func TestTokenCredentialsGetRequestMetadata(t *testing.T) { - tests := []struct { - name string - token string - wantValue string - wantNil bool - }{ - { - name: "no token in context", - token: "", - wantNil: true, - }, - { - name: "token present", - token: "test-jwt-value", //nolint:gosec // test fixture, not a real credential - wantValue: "Bearer test-jwt-value", - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - ctx := context.Background() - if tc.token != "" { - ctx = auth.WithToken(ctx, tc.token) - } - creds := tokenCredentials{requireTLS: false} - md, err := creds.GetRequestMetadata(ctx) - if err != nil { - t.Fatalf("GetRequestMetadata: %v", err) - } - if tc.wantNil { - if md != nil { - t.Errorf("expected nil metadata, got %v", md) - } - return - } - if md["authorization"] != tc.wantValue { - t.Errorf("authorization = %q, want %q", md["authorization"], tc.wantValue) - } - }) - } -} - -func TestTokenCredentialsRequireTransportSecurity(t *testing.T) { - tests := []struct { - name string - requireTLS bool - want bool - }{ - {"TLS required", true, true}, - {"TLS not required", false, false}, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - creds := tokenCredentials{requireTLS: tc.requireTLS} - if got := creds.RequireTransportSecurity(); got != tc.want { - t.Errorf("RequireTransportSecurity() = %v, want %v", got, tc.want) - } - }) - } -} diff --git a/backend/internal/gateway/inference.go b/backend/internal/gateway/inference.go deleted file mode 100644 index c9354688..00000000 --- a/backend/internal/gateway/inference.go +++ /dev/null @@ -1,50 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" -) - -// SetInferenceRoute configures how inference.local routes for a workspace. -// routeName "" targets the user-facing route; "sandbox-system" targets the -// system route used by platform functions. -func (c *Client) SetInferenceRoute(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) { - resp, err := c.inference.SetInferenceRoute(ctx, &inferencev1.SetInferenceRouteRequest{ - ProviderName: providerName, - ModelId: modelID, - RouteName: routeName, - NoVerify: noVerify, - TimeoutSecs: timeoutSecs, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("set inference route %q in workspace %q: %w", routeName, workspace, err) - } - return resp, nil -} - -// GetInferenceRoute fetches the configured route for a workspace. -func (c *Client) GetInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) { - resp, err := c.inference.GetInferenceRoute(ctx, &inferencev1.GetInferenceRouteRequest{ - RouteName: routeName, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get inference route %q in workspace %q: %w", routeName, workspace, err) - } - return resp, nil -} - -// DeleteInferenceRoute removes a route from a workspace. -func (c *Client) DeleteInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) { - resp, err := c.inference.DeleteInferenceRoute(ctx, &inferencev1.DeleteInferenceRouteRequest{ - RouteName: routeName, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("delete inference route %q in workspace %q: %w", routeName, workspace, err) - } - return resp, nil -} diff --git a/backend/internal/gateway/interface.go b/backend/internal/gateway/interface.go deleted file mode 100644 index 1a468f4f..00000000 --- a/backend/internal/gateway/interface.go +++ /dev/null @@ -1,89 +0,0 @@ -package gateway - -import ( - "context" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -// Interface defines the gateway operations the API handlers depend on. -// The concrete *Client implements it; tests provide stubs. -type Interface interface { - Health(ctx context.Context) (*openshellv1.HealthResponse, error) - GetGatewayInfo(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) - GetCurrentUser(ctx context.Context) (*openshellv1.GetCurrentUserResponse, error) - ExecSandboxInteractive(ctx context.Context) (openshellv1.OpenShell_ExecSandboxInteractiveClient, error) - - // Sandboxes - CreateSandbox(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) - GetSandbox(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) - ListSandboxes(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) - ExecSandbox(ctx context.Context, sandboxID string, command []string, stdin []byte, workdir string, timeoutSeconds uint32) ([]byte, []byte, int32, error) - DeleteSandbox(ctx context.Context, workspace, name string) (bool, error) - - // Workspaces - CreateWorkspace(ctx context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) - GetWorkspace(ctx context.Context, name string) (*datamodelv1.Workspace, error) - ListWorkspaces(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) - DeleteWorkspace(ctx context.Context, name string) (bool, error) - AddWorkspaceMember(ctx context.Context, workspace, principalSubject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) - RemoveWorkspaceMember(ctx context.Context, workspace, principalSubject string) (bool, error) - ListWorkspaceMembers(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.WorkspaceMember, error) - - // Providers - CreateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider) (*datamodelv1.Provider, error) - GetProvider(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) - ListProviders(ctx context.Context, workspace string, limit, offset uint32) ([]*datamodelv1.Provider, error) - DeleteProvider(ctx context.Context, workspace, name string) (bool, error) - UpdateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider, credentialExpiresAtMs map[string]int64) (*datamodelv1.Provider, error) - GetProviderRefreshStatus(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.GetProviderRefreshStatusResponse, error) - ConfigureProviderRefresh(ctx context.Context, workspace, provider, credentialKey string, strategy openshellv1.ProviderCredentialRefreshStrategy, material map[string]string, secretMaterialKeys []string, expiresAtMs *int64) (*openshellv1.ConfigureProviderRefreshResponse, error) - RotateProviderCredential(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.RotateProviderCredentialResponse, error) - DeleteProviderRefresh(ctx context.Context, workspace, provider, credentialKey string) (bool, error) - ListProviderProfiles(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.ProviderProfile, error) - GetProviderProfile(ctx context.Context, id, workspace string) (*openshellv1.ProviderProfile, error) - ImportProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) - UpdateProviderProfile(ctx context.Context, workspace, id string, profile *openshellv1.ProviderProfileImportItem, expectedResourceVersion uint64) (*openshellv1.UpdateProviderProfilesResponse, error) - DeleteProviderProfile(ctx context.Context, id, workspace string) (bool, error) - LintProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.LintProviderProfilesResponse, error) - - // Policies - UpdateSandboxPolicy(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) - SetGlobalPolicy(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) - DeleteGlobalPolicy(ctx context.Context) error - GetSandboxPolicyStatus(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) - ListSandboxPolicies(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) - GetDraftPolicy(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) - ApproveDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) - RejectDraftChunk(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) - ApproveAllDraftChunks(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) - GetGatewaySettings(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) - SetSetting(ctx context.Context, key, value string) error - DeleteSetting(ctx context.Context, key string) error - EditDraftChunk(ctx context.Context, workspace, name, chunkID string, proposedRule *sandboxv1.NetworkPolicyRule) error - UndoDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.UndoDraftChunkResponse, error) - ClearDraftChunks(ctx context.Context, workspace, name string) (*openshellv1.ClearDraftChunksResponse, error) - GetDraftHistory(ctx context.Context, workspace, name string) (*openshellv1.GetDraftHistoryResponse, error) - - // Logs / sandbox providers - GetSandboxLogs(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) - ListSandboxProviders(ctx context.Context, workspace, sandboxName string) (*openshellv1.ListSandboxProvidersResponse, error) - AttachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.AttachSandboxProviderResponse, error) - DetachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.DetachSandboxProviderResponse, error) - - // Services - ExposeService(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) - ListServices(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) - DeleteService(ctx context.Context, workspace, sandbox, service string) (bool, error) - - // Inference - SetInferenceRoute(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) - GetInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) - DeleteInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) -} - -// Verify *Client implements Interface at compile time. -var _ Interface = (*Client)(nil) diff --git a/backend/internal/gateway/logs.go b/backend/internal/gateway/logs.go deleted file mode 100644 index ef095484..00000000 --- a/backend/internal/gateway/logs.go +++ /dev/null @@ -1,67 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// GetSandboxLogs fetches recent logs one-shot (the dashboard polls this; no -// streaming). NOTE: the RPC takes sandbox_id (UUID from metadata.id), not the -// sandbox name — callers resolve name → id via GetSandbox first. -func (c *Client) GetSandboxLogs(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) { - resp, err := c.openshell.GetSandboxLogs(ctx, &openshellv1.GetSandboxLogsRequest{ - SandboxId: sandboxID, - Lines: lines, - SinceMs: sinceMs, - Sources: sources, - MinLevel: minLevel, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get sandbox logs %q in workspace %q: %w", sandboxID, workspace, err) - } - return resp, nil -} - -// ListSandboxProviders lists provider records attached to a sandbox (by name). -func (c *Client) ListSandboxProviders(ctx context.Context, workspace, sandboxName string) (*openshellv1.ListSandboxProvidersResponse, error) { - resp, err := c.openshell.ListSandboxProviders(ctx, &openshellv1.ListSandboxProvidersRequest{ - SandboxName: sandboxName, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list sandbox providers %q in workspace %q: %w", sandboxName, workspace, err) - } - return resp, nil -} - -// AttachSandboxProvider attaches a provider to a sandbox with optimistic -// concurrency (expectedResourceVersion 0 = skip the check). -func (c *Client) AttachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.AttachSandboxProviderResponse, error) { - resp, err := c.openshell.AttachSandboxProvider(ctx, &openshellv1.AttachSandboxProviderRequest{ - SandboxName: sandboxName, - ProviderName: providerName, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("attach provider %q to sandbox %q in workspace %q: %w", providerName, sandboxName, workspace, err) - } - return resp, nil -} - -// DetachSandboxProvider detaches a provider from a sandbox. -func (c *Client) DetachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.DetachSandboxProviderResponse, error) { - resp, err := c.openshell.DetachSandboxProvider(ctx, &openshellv1.DetachSandboxProviderRequest{ - SandboxName: sandboxName, - ProviderName: providerName, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("detach provider %q from sandbox %q in workspace %q: %w", providerName, sandboxName, workspace, err) - } - return resp, nil -} diff --git a/backend/internal/gateway/policies.go b/backend/internal/gateway/policies.go deleted file mode 100644 index e9876b8b..00000000 --- a/backend/internal/gateway/policies.go +++ /dev/null @@ -1,218 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -// UpdateSandboxPolicy replaces a sandbox's policy via UpdateConfig. Only -// network_policies and inference fields may differ from the create-time -// policy — filesystem/landlock/process are immutable and must match version 1. -func (c *Client) UpdateSandboxPolicy(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) { - resp, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Name: name, - Policy: policy, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("update sandbox policy %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -// SetGlobalPolicy applies a gateway-global policy to all sandboxes (no -// merge). Platform Admin operation. -func (c *Client) SetGlobalPolicy(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) { - resp, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Policy: policy, - Global: true, - }) - if err != nil { - return nil, fmt.Errorf("set global policy: %w", err) - } - return resp, nil -} - -// DeleteGlobalPolicy removes the gateway-global policy lock, restoring -// sandbox-level policy control. -func (c *Client) DeleteGlobalPolicy(ctx context.Context) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Global: true, - DeleteSetting: true, - SettingKey: "policy", - }) - if err != nil { - return fmt.Errorf("delete global policy: %w", err) - } - return nil -} - -// GetSandboxPolicyStatus fetches one policy revision and the active version. -// version 0 means latest. global=true queries global revisions (name ignored). -func (c *Client) GetSandboxPolicyStatus(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - resp, err := c.openshell.GetSandboxPolicyStatus(ctx, &openshellv1.GetSandboxPolicyStatusRequest{ - Name: name, - Version: version, - Global: global, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get sandbox policy status %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -// ListSandboxPolicies lists policy revision history for a sandbox, or the -// global policy revisions when global=true. -func (c *Client) ListSandboxPolicies(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) { - resp, err := c.openshell.ListSandboxPolicies(ctx, &openshellv1.ListSandboxPoliciesRequest{ - Name: name, - Limit: limit, - Offset: offset, - Global: global, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list sandbox policies %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -// GetDraftPolicy fetches draft policy recommendations for a sandbox. -// statusFilter is "pending", "approved", "rejected", or "" for all. -func (c *Client) GetDraftPolicy(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) { - resp, err := c.openshell.GetDraftPolicy(ctx, &openshellv1.GetDraftPolicyRequest{ - Name: name, - StatusFilter: statusFilter, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get draft policy for sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -// ApproveDraftChunk merges one draft chunk into the active policy. -func (c *Client) ApproveDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) { - resp, err := c.openshell.ApproveDraftChunk(ctx, &openshellv1.ApproveDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("approve draft chunk %q for sandbox %q: %w", chunkID, name, err) - } - return resp, nil -} - -// RejectDraftChunk rejects one draft chunk; the optional reason is surfaced -// back to the in-sandbox agent. -func (c *Client) RejectDraftChunk(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) { - resp, err := c.openshell.RejectDraftChunk(ctx, &openshellv1.RejectDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Reason: reason, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("reject draft chunk %q for sandbox %q: %w", chunkID, name, err) - } - return resp, nil -} - -// ApproveAllDraftChunks approves all pending chunks; security-flagged chunks -// are skipped unless includeSecurityFlagged is set. -func (c *Client) ApproveAllDraftChunks(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - resp, err := c.openshell.ApproveAllDraftChunks(ctx, &openshellv1.ApproveAllDraftChunksRequest{ - Name: name, - IncludeSecurityFlagged: includeSecurityFlagged, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("approve all draft chunks for sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -func (c *Client) GetGatewaySettings(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - resp, err := c.openshell.GetGatewayConfig(ctx, &sandboxv1.GetGatewayConfigRequest{}) - if err != nil { - return nil, fmt.Errorf("get gateway settings: %w", err) - } - return resp, nil -} - -func (c *Client) SetSetting(ctx context.Context, key, value string) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - SettingKey: key, - SettingValue: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_StringValue{StringValue: value}}, - Global: true, - }) - if err != nil { - return fmt.Errorf("set setting %q: %w", key, err) - } - return nil -} - -func (c *Client) DeleteSetting(ctx context.Context, key string) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - SettingKey: key, - DeleteSetting: true, - Global: true, - }) - if err != nil { - return fmt.Errorf("delete setting %q: %w", key, err) - } - return nil -} - -func (c *Client) EditDraftChunk(ctx context.Context, workspace, name, chunkID string, proposedRule *sandboxv1.NetworkPolicyRule) error { - _, err := c.openshell.EditDraftChunk(ctx, &openshellv1.EditDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - ProposedRule: proposedRule, - Workspace: workspace, - }) - if err != nil { - return fmt.Errorf("edit draft chunk %q for sandbox %q: %w", chunkID, name, err) - } - return nil -} - -func (c *Client) UndoDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.UndoDraftChunkResponse, error) { - resp, err := c.openshell.UndoDraftChunk(ctx, &openshellv1.UndoDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("undo draft chunk %q for sandbox %q: %w", chunkID, name, err) - } - return resp, nil -} - -func (c *Client) ClearDraftChunks(ctx context.Context, workspace, name string) (*openshellv1.ClearDraftChunksResponse, error) { - resp, err := c.openshell.ClearDraftChunks(ctx, &openshellv1.ClearDraftChunksRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("clear draft chunks for sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} - -func (c *Client) GetDraftHistory(ctx context.Context, workspace, name string) (*openshellv1.GetDraftHistoryResponse, error) { - resp, err := c.openshell.GetDraftHistory(ctx, &openshellv1.GetDraftHistoryRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get draft history for sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp, nil -} diff --git a/backend/internal/gateway/providers.go b/backend/internal/gateway/providers.go deleted file mode 100644 index 12dab9ee..00000000 --- a/backend/internal/gateway/providers.go +++ /dev/null @@ -1,209 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateProvider registers a provider in a workspace. Credentials are secret -// fields — callers must never echo them back to the browser. -func (c *Client) CreateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider) (*datamodelv1.Provider, error) { - resp, err := c.openshell.CreateProvider(ctx, &openshellv1.CreateProviderRequest{ - Provider: provider, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("create provider in workspace %q: %w", workspace, err) - } - return resp.Provider, nil -} - -// GetProvider fetches a provider by name within a workspace. -func (c *Client) GetProvider(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) { - resp, err := c.openshell.GetProvider(ctx, &openshellv1.GetProviderRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get provider %q in workspace %q: %w", name, workspace, err) - } - return resp.Provider, nil -} - -// ListProviders lists providers in a workspace. -func (c *Client) ListProviders(ctx context.Context, workspace string, limit, offset uint32) ([]*datamodelv1.Provider, error) { - resp, err := c.openshell.ListProviders(ctx, &openshellv1.ListProvidersRequest{ - Limit: limit, - Offset: offset, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list providers in workspace %q: %w", workspace, err) - } - return resp.Providers, nil -} - -// DeleteProvider deletes a provider by name. -func (c *Client) DeleteProvider(ctx context.Context, workspace, name string) (bool, error) { - resp, err := c.openshell.DeleteProvider(ctx, &openshellv1.DeleteProviderRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return false, fmt.Errorf("delete provider %q in workspace %q: %w", name, workspace, err) - } - return resp.Deleted, nil -} - -// UpdateProvider updates a provider's credentials and config. -func (c *Client) UpdateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider, credentialExpiresAtMs map[string]int64) (*datamodelv1.Provider, error) { - resp, err := c.openshell.UpdateProvider(ctx, &openshellv1.UpdateProviderRequest{ - Provider: provider, - CredentialExpiresAtMs: credentialExpiresAtMs, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("update provider in workspace %q: %w", workspace, err) - } - return resp.Provider, nil -} - -// GetProviderRefreshStatus returns credential refresh status for a provider. -func (c *Client) GetProviderRefreshStatus(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.GetProviderRefreshStatusResponse, error) { - resp, err := c.openshell.GetProviderRefreshStatus(ctx, &openshellv1.GetProviderRefreshStatusRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get provider refresh status %q in workspace %q: %w", provider, workspace, err) - } - return resp, nil -} - -// ConfigureProviderRefresh sets up automatic credential refresh for a provider. -func (c *Client) ConfigureProviderRefresh(ctx context.Context, workspace, provider, credentialKey string, strategy openshellv1.ProviderCredentialRefreshStrategy, material map[string]string, secretMaterialKeys []string, expiresAtMs *int64) (*openshellv1.ConfigureProviderRefreshResponse, error) { - req := &openshellv1.ConfigureProviderRefreshRequest{ - Provider: provider, - CredentialKey: credentialKey, - Strategy: strategy, - Material: material, - SecretMaterialKeys: secretMaterialKeys, - Workspace: workspace, - } - if expiresAtMs != nil { - req.ExpiresAtMs = expiresAtMs - } - resp, err := c.openshell.ConfigureProviderRefresh(ctx, req) - if err != nil { - return nil, fmt.Errorf("configure provider refresh %q in workspace %q: %w", provider, workspace, err) - } - return resp, nil -} - -// RotateProviderCredential triggers an immediate credential rotation. -func (c *Client) RotateProviderCredential(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.RotateProviderCredentialResponse, error) { - resp, err := c.openshell.RotateProviderCredential(ctx, &openshellv1.RotateProviderCredentialRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("rotate provider credential %q in workspace %q: %w", provider, workspace, err) - } - return resp, nil -} - -// DeleteProviderRefresh removes credential refresh configuration. -func (c *Client) DeleteProviderRefresh(ctx context.Context, workspace, provider, credentialKey string) (bool, error) { - resp, err := c.openshell.DeleteProviderRefresh(ctx, &openshellv1.DeleteProviderRefreshRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) - if err != nil { - return false, fmt.Errorf("delete provider refresh %q in workspace %q: %w", provider, workspace, err) - } - return resp.Deleted, nil -} - -// ListProviderProfiles lists provider type profiles visible in a workspace -// (workspace-scoped + built-in when workspace is set; platform + built-in when -// empty). Profile ids are the valid Provider.type slugs. -func (c *Client) ListProviderProfiles(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.ProviderProfile, error) { - resp, err := c.openshell.ListProviderProfiles(ctx, &openshellv1.ListProviderProfilesRequest{ - Limit: limit, - Offset: offset, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list provider profiles in workspace %q: %w", workspace, err) - } - return resp.Profiles, nil -} - -// GetProviderProfile fetches a single profile with two-tier resolution -// (workspace → platform → built-in). -func (c *Client) GetProviderProfile(ctx context.Context, id, workspace string) (*openshellv1.ProviderProfile, error) { - resp, err := c.openshell.GetProviderProfile(ctx, &openshellv1.GetProviderProfileRequest{ - Id: id, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get provider profile %q in workspace %q: %w", id, workspace, err) - } - return resp.Profile, nil -} - -// ImportProviderProfiles batch-imports custom profiles (admin only). -func (c *Client) ImportProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.ImportProviderProfilesResponse, error) { - resp, err := c.openshell.ImportProviderProfiles(ctx, &openshellv1.ImportProviderProfilesRequest{ - Profiles: profiles, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("import provider profiles in workspace %q: %w", workspace, err) - } - return resp, nil -} - -// UpdateProviderProfile updates a single custom profile with optimistic concurrency. -func (c *Client) UpdateProviderProfile(ctx context.Context, workspace, id string, profile *openshellv1.ProviderProfileImportItem, expectedResourceVersion uint64) (*openshellv1.UpdateProviderProfilesResponse, error) { - resp, err := c.openshell.UpdateProviderProfiles(ctx, &openshellv1.UpdateProviderProfilesRequest{ - Profile: profile, - ExpectedResourceVersion: expectedResourceVersion, - Id: id, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("update provider profile %q in workspace %q: %w", id, workspace, err) - } - return resp, nil -} - -// DeleteProviderProfile deletes a custom profile by id. -func (c *Client) DeleteProviderProfile(ctx context.Context, id, workspace string) (bool, error) { - resp, err := c.openshell.DeleteProviderProfile(ctx, &openshellv1.DeleteProviderProfileRequest{ - Id: id, - Workspace: workspace, - }) - if err != nil { - return false, fmt.Errorf("delete provider profile %q in workspace %q: %w", id, workspace, err) - } - return resp.Deleted, nil -} - -// LintProviderProfiles validates profiles without persisting. -func (c *Client) LintProviderProfiles(ctx context.Context, workspace string, profiles []*openshellv1.ProviderProfileImportItem) (*openshellv1.LintProviderProfilesResponse, error) { - resp, err := c.openshell.LintProviderProfiles(ctx, &openshellv1.LintProviderProfilesRequest{ - Profiles: profiles, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("lint provider profiles in workspace %q: %w", workspace, err) - } - return resp, nil -} diff --git a/backend/internal/gateway/sandboxes.go b/backend/internal/gateway/sandboxes.go deleted file mode 100644 index 8088a8ae..00000000 --- a/backend/internal/gateway/sandboxes.go +++ /dev/null @@ -1,99 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - "io" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateSandbox creates a sandbox. spec.policy is required by the gateway. -func (c *Client) CreateSandbox(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) { - resp, err := c.openshell.CreateSandbox(ctx, &openshellv1.CreateSandboxRequest{ - Spec: spec, - Name: name, - Labels: labels, - Annotations: annotations, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("create sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp.Sandbox, nil -} - -// GetSandbox fetches a sandbox by name within a workspace. -func (c *Client) GetSandbox(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) { - resp, err := c.openshell.GetSandbox(ctx, &openshellv1.GetSandboxRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("get sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp.Sandbox, nil -} - -// ListSandboxes lists sandboxes in a workspace. -func (c *Client) ListSandboxes(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) { - resp, err := c.openshell.ListSandboxes(ctx, &openshellv1.ListSandboxesRequest{ - Limit: limit, - Offset: offset, - LabelSelector: labelSelector, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list sandboxes in workspace %q: %w", workspace, err) - } - return resp.Sandboxes, nil -} - -// ExecSandbox runs a non-interactive command inside a sandbox and collects the -// streamed stdout/stderr/exit. Uses sandbox_id (not name). -func (c *Client) ExecSandbox(ctx context.Context, sandboxID string, command []string, stdin []byte, workdir string, timeoutSeconds uint32) ([]byte, []byte, int32, error) { - stream, err := c.openshell.ExecSandbox(ctx, &openshellv1.ExecSandboxRequest{ - SandboxId: sandboxID, - Command: command, - Stdin: stdin, - Workdir: workdir, - TimeoutSeconds: timeoutSeconds, - }) - if err != nil { - return nil, nil, -1, fmt.Errorf("exec sandbox %q: %w", sandboxID, err) - } - - var stdout, stderr []byte - var exitCode int32 = -1 - for { - event, err := stream.Recv() - if err != nil { - if err == io.EOF { - break - } - return stdout, stderr, exitCode, err - } - switch p := event.Payload.(type) { - case *openshellv1.ExecSandboxEvent_Stdout: - stdout = append(stdout, p.Stdout.Data...) - case *openshellv1.ExecSandboxEvent_Stderr: - stderr = append(stderr, p.Stderr.Data...) - case *openshellv1.ExecSandboxEvent_Exit: - exitCode = p.Exit.ExitCode - } - } - return stdout, stderr, exitCode, nil -} - -// DeleteSandbox deletes a sandbox by name. This is the only lifecycle -// operation besides create — the gateway API has no stop/start. -func (c *Client) DeleteSandbox(ctx context.Context, workspace, name string) (bool, error) { - resp, err := c.openshell.DeleteSandbox(ctx, &openshellv1.DeleteSandboxRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return false, fmt.Errorf("delete sandbox %q in workspace %q: %w", name, workspace, err) - } - return resp.Deleted, nil -} diff --git a/backend/internal/gateway/services.go b/backend/internal/gateway/services.go deleted file mode 100644 index fdf935fb..00000000 --- a/backend/internal/gateway/services.go +++ /dev/null @@ -1,45 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -func (c *Client) ExposeService(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) { - resp, err := c.openshell.ExposeService(ctx, &openshellv1.ExposeServiceRequest{ - Sandbox: sandbox, - Service: service, - TargetPort: targetPort, - Domain: domain, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("expose service %q on sandbox %q in workspace %q: %w", service, sandbox, workspace, err) - } - return resp, nil -} - -func (c *Client) ListServices(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) { - resp, err := c.openshell.ListServices(ctx, &openshellv1.ListServicesRequest{ - Sandbox: sandbox, - Workspace: workspace, - }) - if err != nil { - return nil, fmt.Errorf("list services for sandbox %q in workspace %q: %w", sandbox, workspace, err) - } - return resp.Services, nil -} - -func (c *Client) DeleteService(ctx context.Context, workspace, sandbox, service string) (bool, error) { - resp, err := c.openshell.DeleteService(ctx, &openshellv1.DeleteServiceRequest{ - Sandbox: sandbox, - Service: service, - Workspace: workspace, - }) - if err != nil { - return false, fmt.Errorf("delete service %q on sandbox %q in workspace %q: %w", service, sandbox, workspace, err) - } - return resp.Deleted, nil -} diff --git a/backend/internal/gateway/workspaces.go b/backend/internal/gateway/workspaces.go deleted file mode 100644 index 307b6972..00000000 --- a/backend/internal/gateway/workspaces.go +++ /dev/null @@ -1,91 +0,0 @@ -package gateway - -import ( - "context" - "fmt" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateWorkspace creates a workspace. Name must be a valid DNS-1123 label. -func (c *Client) CreateWorkspace(ctx context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) { - resp, err := c.openshell.CreateWorkspace(ctx, &openshellv1.CreateWorkspaceRequest{ - Name: name, - Labels: labels, - }) - if err != nil { - return nil, fmt.Errorf("create workspace %q: %w", name, err) - } - return resp.Workspace, nil -} - -// GetWorkspace fetches a workspace by name. -func (c *Client) GetWorkspace(ctx context.Context, name string) (*datamodelv1.Workspace, error) { - resp, err := c.openshell.GetWorkspace(ctx, &openshellv1.GetWorkspaceRequest{Name: name}) - if err != nil { - return nil, fmt.Errorf("get workspace %q: %w", name, err) - } - return resp.Workspace, nil -} - -// ListWorkspaces lists workspaces. -func (c *Client) ListWorkspaces(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) { - resp, err := c.openshell.ListWorkspaces(ctx, &openshellv1.ListWorkspacesRequest{ - Limit: limit, - Offset: offset, - LabelSelector: labelSelector, - }) - if err != nil { - return nil, fmt.Errorf("list workspaces: %w", err) - } - return resp.Workspaces, nil -} - -// DeleteWorkspace deletes a workspace by name. -func (c *Client) DeleteWorkspace(ctx context.Context, name string) (bool, error) { - resp, err := c.openshell.DeleteWorkspace(ctx, &openshellv1.DeleteWorkspaceRequest{Name: name}) - if err != nil { - return false, fmt.Errorf("delete workspace %q: %w", name, err) - } - return resp.Deleted, nil -} - -// AddWorkspaceMember adds a member (OIDC subject + role) to a workspace. -// There is no role-update RPC — a role change is remove + re-add. -func (c *Client) AddWorkspaceMember(ctx context.Context, workspace, principalSubject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) { - resp, err := c.openshell.AddWorkspaceMember(ctx, &openshellv1.AddWorkspaceMemberRequest{ - Workspace: workspace, - PrincipalSubject: principalSubject, - Role: role, - }) - if err != nil { - return nil, fmt.Errorf("add member %q to workspace %q: %w", principalSubject, workspace, err) - } - return resp.Member, nil -} - -// RemoveWorkspaceMember removes a member from a workspace. -func (c *Client) RemoveWorkspaceMember(ctx context.Context, workspace, principalSubject string) (bool, error) { - resp, err := c.openshell.RemoveWorkspaceMember(ctx, &openshellv1.RemoveWorkspaceMemberRequest{ - Workspace: workspace, - PrincipalSubject: principalSubject, - }) - if err != nil { - return false, fmt.Errorf("remove member %q from workspace %q: %w", principalSubject, workspace, err) - } - return resp.Removed, nil -} - -// ListWorkspaceMembers lists members of a workspace. -func (c *Client) ListWorkspaceMembers(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.WorkspaceMember, error) { - resp, err := c.openshell.ListWorkspaceMembers(ctx, &openshellv1.ListWorkspaceMembersRequest{ - Workspace: workspace, - Limit: limit, - Offset: offset, - }) - if err != nil { - return nil, fmt.Errorf("list members in workspace %q: %w", workspace, err) - } - return resp.Members, nil -} diff --git a/backend/internal/models/builders.go b/backend/internal/models/builders.go index 09df4df0..78480a78 100644 --- a/backend/internal/models/builders.go +++ b/backend/internal/models/builders.go @@ -1,20 +1,10 @@ package models -import ( - "encoding/json" - "fmt" - - "google.golang.org/protobuf/encoding/protojson" - "google.golang.org/protobuf/proto" - "google.golang.org/protobuf/types/known/structpb" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) +import "encoding/json" // CreateSandboxRequest is the create-sandbox body. Policy is required by the -// gateway (SandboxSpec.policy) and is validated here before the gRPC call. +// gateway (SandboxSpec.policy) and is validated in BuildSDKSandboxSpec before +// the SDK call. type CreateSandboxRequest struct { Labels map[string]string `json:"labels,omitempty"` Annotations map[string]string `json:"annotations,omitempty"` @@ -38,64 +28,3 @@ type CreateProviderRequest struct { Name string `json:"name"` Type string `json:"type"` } - -// BuildSandboxSpec constructs the proto SandboxSpec from a create request, -// handling template, policy, resources, and providers. -func BuildSandboxSpec(req CreateSandboxRequest) (*openshellv1.SandboxSpec, error) { - policy, err := ParsePolicy(req.Policy) - if err != nil { - return nil, fmt.Errorf("policy does not match the SandboxPolicy schema: %w", err) - } - - template := &openshellv1.SandboxTemplate{Image: req.Image} - if req.CPU != "" || req.Memory != "" { - limits := map[string]any{} - if req.CPU != "" { - limits["cpu"] = req.CPU - } - if req.Memory != "" { - limits["memory"] = req.Memory - } - resources, structErr := structpb.NewStruct(map[string]any{"limits": limits}) - if structErr != nil { - return nil, fmt.Errorf("invalid cpu/memory values: %w", structErr) - } - template.Resources = resources - } - - spec := &openshellv1.SandboxSpec{ - LogLevel: req.LogLevel, - Environment: req.Environment, - Template: template, - Policy: policy, - Providers: req.Providers, - } - if req.GpuCount > 0 { - spec.ResourceRequirements = &openshellv1.ResourceRequirements{ - Gpu: &openshellv1.GpuResourceRequirements{Count: proto.Uint32(req.GpuCount)}, - } - } - return spec, nil -} - -// ToProviderProto builds the proto Provider from a create request. -func ToProviderProto(req CreateProviderRequest) *datamodelv1.Provider { - return &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{ - Name: req.Name, - Labels: req.Labels, - }, - Type: req.Type, - Credentials: req.Credentials, - Config: req.Config, - } -} - -// ParseNetworkPolicyRule unmarshals protojson into a NetworkPolicyRule. -func ParseNetworkPolicyRule(raw json.RawMessage) (*sandboxv1.NetworkPolicyRule, error) { - rule := &sandboxv1.NetworkPolicyRule{} - if err := protojson.Unmarshal(raw, rule); err != nil { - return nil, err - } - return rule, nil -} diff --git a/backend/internal/models/models.go b/backend/internal/models/models.go index 483f814f..eca4ad3a 100644 --- a/backend/internal/models/models.go +++ b/backend/internal/models/models.go @@ -1,19 +1,11 @@ // Package models defines the JSON DTOs the BFF returns to the frontend and -// the converters from protoc-generated types. Proto fields marked -// [(openshell.options.v1.secret) = true] (provider credentials, tokens) are -// never serialized here — only credential key names are exposed. +// the converters from the OpenShell Go SDK types (see sdk_converters.go). +// Proto fields marked [(openshell.options.v1.secret) = true] (provider +// credentials, tokens) are never serialized here — only credential key names +// are exposed. package models -import ( - "encoding/json" - "fmt" - - "google.golang.org/protobuf/encoding/protojson" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) +import "encoding/json" // ObjectMeta mirrors openshell.datamodel.v1.ObjectMeta. type ObjectMeta struct { @@ -27,39 +19,12 @@ type ObjectMeta struct { DeletionTimestampMs int64 `json:"deletionTimestampMs,omitempty"` } -func FromObjectMeta(meta *datamodelv1.ObjectMeta) ObjectMeta { - if meta == nil { - return ObjectMeta{} - } - return ObjectMeta{ - ID: meta.Id, - Name: meta.Name, - Workspace: meta.Workspace, - Labels: meta.Labels, - Annotations: meta.Annotations, - CreatedAtMs: meta.CreatedAtMs, - ResourceVersion: meta.ResourceVersion, - DeletionTimestampMs: meta.DeletionTimestampMs, - } -} - // Workspace mirrors openshell.datamodel.v1.Workspace. type Workspace struct { Phase string `json:"phase"` Metadata ObjectMeta `json:"metadata"` } -func FromWorkspace(ws *datamodelv1.Workspace) Workspace { - out := Workspace{Metadata: FromObjectMeta(ws.GetMetadata()), Phase: "UNSPECIFIED"} - switch ws.GetStatus().GetPhase() { - case datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE: - out.Phase = "ACTIVE" - case datamodelv1.WorkspacePhase_WORKSPACE_PHASE_TERMINATING: - out.Phase = "TERMINATING" - } - return out -} - // WorkspaceMember mirrors openshell.v1.WorkspaceMember. type WorkspaceMember struct { PrincipalSubject string `json:"principalSubject"` @@ -67,32 +32,6 @@ type WorkspaceMember struct { Metadata ObjectMeta `json:"metadata"` } -func FromWorkspaceMember(member *openshellv1.WorkspaceMember) WorkspaceMember { - out := WorkspaceMember{ - Metadata: FromObjectMeta(member.GetMetadata()), - PrincipalSubject: member.GetPrincipalSubject(), - Role: "UNSPECIFIED", - } - switch member.GetRole() { - case openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER: - out.Role = "USER" - case openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN: - out.Role = "ADMIN" - } - return out -} - -// WorkspaceRoleFromString maps USER/ADMIN to the proto enum. -func WorkspaceRoleFromString(role string) (openshellv1.WorkspaceRole, bool) { - switch role { - case "USER": - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER, true - case "ADMIN": - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN, true - } - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED, false -} - // SandboxCondition mirrors openshell.v1.SandboxCondition. type SandboxCondition struct { Type string `json:"type"` @@ -129,70 +68,6 @@ type Sandbox struct { Metadata ObjectMeta `json:"metadata"` } -func sandboxPhaseString(phase openshellv1.SandboxPhase) string { - switch phase { - case openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING: - return "PROVISIONING" - case openshellv1.SandboxPhase_SANDBOX_PHASE_READY: - return "READY" - case openshellv1.SandboxPhase_SANDBOX_PHASE_ERROR: - return "ERROR" - case openshellv1.SandboxPhase_SANDBOX_PHASE_DELETING: - return "DELETING" - case openshellv1.SandboxPhase_SANDBOX_PHASE_UNKNOWN: - return "UNKNOWN" - } - return "UNSPECIFIED" -} - -var policyMarshaler = protojson.MarshalOptions{UseProtoNames: false} - -func FromSandbox(sandbox *openshellv1.Sandbox) Sandbox { - out := Sandbox{Metadata: FromObjectMeta(sandbox.GetMetadata())} - - if spec := sandbox.GetSpec(); spec != nil { - out.Spec = SandboxSpec{ - LogLevel: spec.LogLevel, - Environment: spec.Environment, - Image: spec.GetTemplate().GetImage(), - Providers: spec.Providers, - } - if spec.Policy != nil { - if raw, err := policyMarshaler.Marshal(spec.Policy); err == nil { - out.Spec.Policy = raw - } - } - } - - status := sandbox.GetStatus() - out.Status = SandboxStatus{ - SandboxName: status.GetSandboxName(), - AgentPod: status.GetAgentPod(), - Phase: sandboxPhaseString(status.GetPhase()), - CurrentPolicyVersion: status.GetCurrentPolicyVersion(), - } - for _, cond := range status.GetConditions() { - out.Status.Conditions = append(out.Status.Conditions, SandboxCondition{ - Type: cond.Type, - Status: cond.Status, - Reason: cond.Reason, - Message: cond.Message, - LastTransitionTime: cond.LastTransitionTime, - }) - } - return out -} - -// ParsePolicy converts protojson policy from the frontend into the proto -// message. spec.policy is a required field on CreateSandbox. -func ParsePolicy(raw json.RawMessage) (*sandboxv1.SandboxPolicy, error) { - policy := &sandboxv1.SandboxPolicy{} - if err := protojson.Unmarshal(raw, policy); err != nil { - return nil, err - } - return policy, nil -} - // Provider is the dashboard view of openshell.datamodel.v1.Provider. The // credentials map is secret-marked in proto and is intentionally absent — // only the credential key names are surfaced. @@ -205,20 +80,6 @@ type Provider struct { Metadata ObjectMeta `json:"metadata"` } -func FromProvider(provider *datamodelv1.Provider) Provider { - out := Provider{ - Metadata: FromObjectMeta(provider.GetMetadata()), - Type: provider.GetType(), - Config: provider.GetConfig(), - CredentialExpiresAtMs: provider.GetCredentialExpiresAtMs(), - ProfileWorkspace: provider.GetProfileWorkspace(), - } - for name := range provider.GetCredentials() { - out.CredentialNames = append(out.CredentialNames, name) - } - return out -} - // CredentialRefreshStatus mirrors openshell.v1.ProviderCredentialRefreshStatus. type CredentialRefreshStatus struct { CredentialKey string `json:"credentialKey"` @@ -230,36 +91,6 @@ type CredentialRefreshStatus struct { LastRefreshAtMs int64 `json:"lastRefreshAtMs,omitempty"` } -func refreshStrategyString(strategy openshellv1.ProviderCredentialRefreshStrategy) string { - switch strategy { - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC: - return "STATIC" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL: - return "EXTERNAL" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN: - return "OAUTH2_REFRESH_TOKEN" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS: - return "OAUTH2_CLIENT_CREDENTIALS" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT: - return "GOOGLE_SERVICE_ACCOUNT_JWT" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE: - return "AWS_STS_ASSUME_ROLE" - } - return "UNSPECIFIED" -} - -func FromCredentialRefreshStatus(status *openshellv1.ProviderCredentialRefreshStatus) CredentialRefreshStatus { - return CredentialRefreshStatus{ - CredentialKey: status.GetCredentialKey(), - Strategy: refreshStrategyString(status.GetStrategy()), - Status: status.GetStatus(), - ExpiresAtMs: status.GetExpiresAtMs(), - NextRefreshAtMs: status.GetNextRefreshAtMs(), - LastRefreshAtMs: status.GetLastRefreshAtMs(), - LastError: status.GetLastError(), - } -} - // ProfileCredential mirrors openshell.v1.ProviderProfileCredential — the // credential *schema* (no secret values), used to drive the Add Provider form. type ProfileCredential struct { @@ -284,62 +115,6 @@ type ProviderProfile struct { ResourceVersion uint64 `json:"resourceVersion"` } -func profileCategoryString(category openshellv1.ProviderProfileCategory) string { - switch category { - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER: - return "OTHER" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE: - return "INFERENCE" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT: - return "AGENT" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL: - return "SOURCE_CONTROL" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING: - return "MESSAGING" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA: - return "DATA" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE: - return "KNOWLEDGE" - } - return "UNSPECIFIED" -} - -func FromProviderProfile(profile *openshellv1.ProviderProfile) ProviderProfile { - out := ProviderProfile{ - ID: profile.GetId(), - DisplayName: profile.GetDisplayName(), - Description: profile.GetDescription(), - Category: profileCategoryString(profile.GetCategory()), - Credentials: []ProfileCredential{}, - InferenceCapable: profile.GetInferenceCapable(), - Source: profile.GetSource(), - Scope: profile.GetScope(), - ResourceVersion: profile.GetResourceVersion(), - } - for _, cred := range profile.GetCredentials() { - out.Credentials = append(out.Credentials, ProfileCredential{ - Name: cred.Name, - Description: cred.Description, - EnvVars: cred.EnvVars, - Required: cred.Required, - AuthStyle: cred.AuthStyle, - }) - } - for _, endpoint := range profile.GetEndpoints() { - host := endpoint.GetHost() - if len(endpoint.GetPorts()) > 0 { - for _, port := range endpoint.GetPorts() { - out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", host, port)) - } - } else if endpoint.GetPort() > 0 { - out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", host, endpoint.GetPort())) - } else if host != "" { - out.Endpoints = append(out.Endpoints, host) - } - } - return out -} - // ProviderProfileDiagnostic mirrors openshell.v1.ProviderProfileDiagnostic. type ProviderProfileDiagnostic struct { Source string `json:"source,omitempty"` @@ -369,20 +144,6 @@ type LintProviderProfilesResult struct { Valid bool `json:"valid"` } -func FromDiagnostics(diagnostics []*openshellv1.ProviderProfileDiagnostic) []ProviderProfileDiagnostic { - out := make([]ProviderProfileDiagnostic, 0, len(diagnostics)) - for _, d := range diagnostics { - out = append(out, ProviderProfileDiagnostic{ - Source: d.GetSource(), - ProfileID: d.GetProfileId(), - Field: d.GetField(), - Message: d.GetMessage(), - Severity: d.GetSeverity(), - }) - } - return out -} - // CurrentUser mirrors openshell.v1.GetCurrentUserResponse. type CurrentUser struct { Subject string `json:"subject"` @@ -393,16 +154,6 @@ type CurrentUser struct { Scopes []string `json:"scopes,omitempty"` } -func FromCurrentUser(resp *openshellv1.GetCurrentUserResponse) CurrentUser { - return CurrentUser{ - Subject: resp.GetSubject(), - DisplayName: resp.GetDisplayName(), - Roles: resp.GetRoles(), - Scopes: resp.GetScopes(), - IdentityProvider: resp.GetIdentityProvider(), - } -} - // ComputeDriver flattens openshell.v1.ComputeDriverInfo + capabilities. type ComputeDriver struct { Name string `json:"name"` @@ -417,31 +168,3 @@ type GatewayInfo struct { GatewayVersion string `json:"gatewayVersion"` ComputeDrivers []ComputeDriver `json:"computeDrivers"` } - -func serviceStatusString(status openshellv1.ServiceStatus) string { - switch status { - case openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY: - return "HEALTHY" - case openshellv1.ServiceStatus_SERVICE_STATUS_DEGRADED: - return "DEGRADED" - case openshellv1.ServiceStatus_SERVICE_STATUS_UNHEALTHY: - return "UNHEALTHY" - } - return "UNSPECIFIED" -} - -func FromGatewayInfo(info *openshellv1.GetGatewayInfoResponse) GatewayInfo { - out := GatewayInfo{ - Status: serviceStatusString(info.GetStatus()), - GatewayVersion: info.GetGatewayVersion(), - ComputeDrivers: []ComputeDriver{}, - } - for _, driver := range info.GetComputeDrivers() { - out.ComputeDrivers = append(out.ComputeDrivers, ComputeDriver{ - Name: driver.GetName(), - DriverName: driver.GetCapabilities().GetDriverName(), - DriverVersion: driver.GetCapabilities().GetDriverVersion(), - }) - } - return out -} diff --git a/backend/internal/models/models_ext_test.go b/backend/internal/models/models_ext_test.go deleted file mode 100644 index b2d68418..00000000 --- a/backend/internal/models/models_ext_test.go +++ /dev/null @@ -1,393 +0,0 @@ -package models - -import ( - "testing" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -func TestFromWorkspacePhaseMapping(t *testing.T) { - tests := []struct { - want string - phase datamodelv1.WorkspacePhase - }{ - {want: "ACTIVE", phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE}, - {want: "TERMINATING", phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_TERMINATING}, - {want: "UNSPECIFIED", phase: datamodelv1.WorkspacePhase_WORKSPACE_PHASE_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - ws := &datamodelv1.Workspace{ - Metadata: &datamodelv1.ObjectMeta{Name: "test-ws"}, - Status: &datamodelv1.WorkspaceStatus{Phase: tc.phase}, - } - got := FromWorkspace(ws) - if got.Phase != tc.want { - t.Errorf("phase = %q, want %q", got.Phase, tc.want) - } - if got.Metadata.Name != "test-ws" { - t.Errorf("name = %q, want test-ws", got.Metadata.Name) - } - }) - } -} - -func TestFromWorkspaceNilStatus(t *testing.T) { - ws := &datamodelv1.Workspace{ - Metadata: &datamodelv1.ObjectMeta{Name: "no-status"}, - } - got := FromWorkspace(ws) - if got.Phase != "UNSPECIFIED" { - t.Errorf("phase = %q, want UNSPECIFIED", got.Phase) - } -} - -func TestFromWorkspaceMemberRoleMapping(t *testing.T) { - tests := []struct { - want string - role openshellv1.WorkspaceRole - }{ - {want: "USER", role: openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER}, - {want: "ADMIN", role: openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN}, - {want: "UNSPECIFIED", role: openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - member := &openshellv1.WorkspaceMember{ - Metadata: &datamodelv1.ObjectMeta{Name: "m1"}, - PrincipalSubject: "user@example.com", - Role: tc.role, - } - got := FromWorkspaceMember(member) - if got.Role != tc.want { - t.Errorf("role = %q, want %q", got.Role, tc.want) - } - if got.PrincipalSubject != "user@example.com" { - t.Errorf("subject = %q", got.PrincipalSubject) - } - }) - } -} - -func TestWorkspaceRoleFromString(t *testing.T) { - tests := []struct { - input string - want openshellv1.WorkspaceRole - ok bool - }{ - {"USER", openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER, true}, - {"ADMIN", openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN, true}, - {"user", openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED, false}, - {"SUPERADMIN", openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED, false}, - {"", openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED, false}, - } - for _, tc := range tests { - t.Run(tc.input, func(t *testing.T) { - got, ok := WorkspaceRoleFromString(tc.input) - if ok != tc.ok { - t.Errorf("ok = %v, want %v", ok, tc.ok) - } - if got != tc.want { - t.Errorf("role = %v, want %v", got, tc.want) - } - }) - } -} - -func TestFromProviderProfile(t *testing.T) { - profile := &openshellv1.ProviderProfile{ - Id: "claude", - DisplayName: "Claude", - Description: "Anthropic Claude", - Category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE, - InferenceCapable: true, - Credentials: []*openshellv1.ProviderProfileCredential{ - {Name: "api_key", Description: "API key", Required: true, EnvVars: []string{"ANTHROPIC_API_KEY"}}, - {Name: "org_id", Description: "Organization ID", Required: false}, - }, - Endpoints: []*sandboxv1.NetworkEndpoint{ - {Host: "api.anthropic.com", Port: 443}, - {Host: "multi.example.com", Ports: []uint32{443, 8443}}, - {Host: "no-port.example.com"}, - }, - } - - got := FromProviderProfile(profile) - - if got.ID != "claude" { - t.Errorf("ID = %q, want claude", got.ID) - } - if got.Category != "INFERENCE" { - t.Errorf("category = %q, want INFERENCE", got.Category) - } - if !got.InferenceCapable { - t.Error("inferenceCapable should be true") - } - if len(got.Credentials) != 2 { - t.Fatalf("got %d credentials, want 2", len(got.Credentials)) - } - if !got.Credentials[0].Required { - t.Error("first credential should be required") - } - if got.Credentials[0].EnvVars[0] != "ANTHROPIC_API_KEY" { - t.Errorf("envVars = %v", got.Credentials[0].EnvVars) - } - - // Endpoints: api.anthropic.com:443, multi.example.com:443, multi.example.com:8443, no-port.example.com - if len(got.Endpoints) != 4 { - t.Fatalf("got %d endpoints, want 4; endpoints: %v", len(got.Endpoints), got.Endpoints) - } - if got.Endpoints[0] != "api.anthropic.com:443" { - t.Errorf("endpoint[0] = %q", got.Endpoints[0]) - } - if got.Endpoints[3] != "no-port.example.com" { - t.Errorf("endpoint[3] = %q, want no-port.example.com", got.Endpoints[3]) - } -} - -func TestFromProviderProfileCategoryMapping(t *testing.T) { - tests := []struct { - want string - category openshellv1.ProviderProfileCategory - }{ - {want: "OTHER", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER}, - {want: "INFERENCE", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE}, - {want: "AGENT", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT}, - {want: "SOURCE_CONTROL", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL}, - {want: "MESSAGING", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING}, - {want: "DATA", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA}, - {want: "KNOWLEDGE", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE}, - {want: "UNSPECIFIED", category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - got := profileCategoryString(tc.category) - if got != tc.want { - t.Errorf("got %q, want %q", got, tc.want) - } - }) - } -} - -func TestFromGatewayInfo(t *testing.T) { - tests := []struct { - want string - status openshellv1.ServiceStatus - }{ - {want: "HEALTHY", status: openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY}, - {want: "DEGRADED", status: openshellv1.ServiceStatus_SERVICE_STATUS_DEGRADED}, - {want: "UNHEALTHY", status: openshellv1.ServiceStatus_SERVICE_STATUS_UNHEALTHY}, - {want: "UNSPECIFIED", status: openshellv1.ServiceStatus_SERVICE_STATUS_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - info := &openshellv1.GetGatewayInfoResponse{ - Status: tc.status, - GatewayVersion: "1.0", - ComputeDrivers: []*openshellv1.ComputeDriverInfo{ - { - Name: "podman", - Capabilities: &openshellv1.ComputeDriverCapabilities{ - DriverName: "podman", - DriverVersion: "5.0", - }, - }, - }, - } - got := FromGatewayInfo(info) - if got.Status != tc.want { - t.Errorf("status = %q, want %q", got.Status, tc.want) - } - if got.GatewayVersion != "1.0" { - t.Errorf("version = %q", got.GatewayVersion) - } - if len(got.ComputeDrivers) != 1 { - t.Fatalf("got %d drivers, want 1", len(got.ComputeDrivers)) - } - if got.ComputeDrivers[0].DriverVersion != "5.0" { - t.Errorf("driver version = %q", got.ComputeDrivers[0].DriverVersion) - } - }) - } -} - -func TestFromGatewayInfoEmptyDrivers(t *testing.T) { - info := &openshellv1.GetGatewayInfoResponse{ - Status: openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY, - GatewayVersion: "0.1", - } - got := FromGatewayInfo(info) - if len(got.ComputeDrivers) != 0 { - t.Errorf("expected empty drivers, got %d", len(got.ComputeDrivers)) - } -} - -func TestFromCredentialRefreshStatus(t *testing.T) { - tests := []struct { - want string - strategy openshellv1.ProviderCredentialRefreshStrategy - }{ - {want: "STATIC", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC}, - {want: "EXTERNAL", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL}, - {want: "OAUTH2_REFRESH_TOKEN", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN}, - {want: "OAUTH2_CLIENT_CREDENTIALS", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS}, - {want: "GOOGLE_SERVICE_ACCOUNT_JWT", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT}, - {want: "AWS_STS_ASSUME_ROLE", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE}, - {want: "UNSPECIFIED", strategy: openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - status := &openshellv1.ProviderCredentialRefreshStatus{ - CredentialKey: "api_key", - Strategy: tc.strategy, - Status: "active", - ExpiresAtMs: 1000, - NextRefreshAtMs: 2000, - LastRefreshAtMs: 500, - LastError: "", - } - got := FromCredentialRefreshStatus(status) - if got.Strategy != tc.want { - t.Errorf("strategy = %q, want %q", got.Strategy, tc.want) - } - if got.CredentialKey != "api_key" { - t.Errorf("credentialKey = %q", got.CredentialKey) - } - if got.ExpiresAtMs != 1000 { - t.Errorf("expiresAtMs = %d", got.ExpiresAtMs) - } - }) - } -} - -func TestFromObjectMetaNil(t *testing.T) { - got := FromObjectMeta(nil) - if got.Name != "" || got.ID != "" { - t.Errorf("expected empty ObjectMeta, got %+v", got) - } -} - -func TestFromObjectMetaFields(t *testing.T) { - meta := &datamodelv1.ObjectMeta{ - Id: "uuid-123", - Name: "test-name", - Workspace: "ws1", - Labels: map[string]string{"env": "prod"}, - Annotations: map[string]string{"note": "important"}, - CreatedAtMs: 1234567890, - ResourceVersion: 5, - DeletionTimestampMs: 9999999999, - } - got := FromObjectMeta(meta) - if got.ID != "uuid-123" { - t.Errorf("ID = %q", got.ID) - } - if got.Name != "test-name" { - t.Errorf("Name = %q", got.Name) - } - if got.Workspace != "ws1" { - t.Errorf("Workspace = %q", got.Workspace) - } - if got.Labels["env"] != "prod" { - t.Errorf("Labels = %v", got.Labels) - } - if got.ResourceVersion != 5 { - t.Errorf("ResourceVersion = %d", got.ResourceVersion) - } - if got.DeletionTimestampMs != 9999999999 { - t.Errorf("DeletionTimestampMs = %d", got.DeletionTimestampMs) - } -} - -func TestFromCurrentUser(t *testing.T) { - resp := &openshellv1.GetCurrentUserResponse{ - Subject: "sub-123", - DisplayName: "Test User", - Roles: []string{"openshell-admin", "openshell-user"}, - Scopes: []string{"openid", "profile"}, - IdentityProvider: "keycloak", - } - got := FromCurrentUser(resp) - if got.Subject != "sub-123" { - t.Errorf("subject = %q", got.Subject) - } - if got.DisplayName != "Test User" { - t.Errorf("displayName = %q", got.DisplayName) - } - if len(got.Roles) != 2 { - t.Errorf("roles = %v", got.Roles) - } - if got.IdentityProvider != "keycloak" { - t.Errorf("idp = %q", got.IdentityProvider) - } -} - -func TestFromProviderProfileResourceVersion(t *testing.T) { - profile := &openshellv1.ProviderProfile{ - Id: "custom-llm", - DisplayName: "Custom LLM", - Category: openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE, - ResourceVersion: 42, - Source: "user", - Scope: "workspace", - } - got := FromProviderProfile(profile) - if got.ResourceVersion != 42 { - t.Errorf("resourceVersion = %d, want 42", got.ResourceVersion) - } - if got.Source != "user" { - t.Errorf("source = %q, want user", got.Source) - } - if got.Scope != "workspace" { - t.Errorf("scope = %q, want workspace", got.Scope) - } -} - -func TestFromDiagnostics(t *testing.T) { - diagnostics := []*openshellv1.ProviderProfileDiagnostic{ - { - Source: "import", - ProfileId: "custom-llm", - Field: "credentials[0].name", - Message: "name is required", - Severity: "error", - }, - { - ProfileId: "custom-llm", - Message: "consider adding endpoints", - Severity: "warning", - }, - } - - got := FromDiagnostics(diagnostics) - if len(got) != 2 { - t.Fatalf("got %d diagnostics, want 2", len(got)) - } - if got[0].Source != "import" { - t.Errorf("diagnostics[0].source = %q, want import", got[0].Source) - } - if got[0].ProfileID != "custom-llm" { - t.Errorf("diagnostics[0].profileId = %q", got[0].ProfileID) - } - if got[0].Field != "credentials[0].name" { - t.Errorf("diagnostics[0].field = %q", got[0].Field) - } - if got[0].Message != "name is required" { - t.Errorf("diagnostics[0].message = %q", got[0].Message) - } - if got[0].Severity != "error" { - t.Errorf("diagnostics[0].severity = %q", got[0].Severity) - } - if got[1].Source != "" { - t.Errorf("diagnostics[1].source should be empty, got %q", got[1].Source) - } -} - -func TestFromDiagnosticsEmpty(t *testing.T) { - got := FromDiagnostics(nil) - if len(got) != 0 { - t.Errorf("expected empty slice, got %d items", len(got)) - } -} diff --git a/backend/internal/models/models_test.go b/backend/internal/models/models_test.go deleted file mode 100644 index 84255718..00000000 --- a/backend/internal/models/models_test.go +++ /dev/null @@ -1,94 +0,0 @@ -package models - -import ( - "encoding/json" - "strings" - "testing" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// Provider credentials are secret-marked in proto; the DTO must never carry -// their values, only key names. -func TestFromProviderStripsCredentialValues(t *testing.T) { - provider := &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{Id: "p1", Name: "claude"}, - Type: "claude", - Credentials: map[string]string{ - "api_key": "sk-super-secret", - }, - Config: map[string]string{"region": "us"}, - } - - dto := FromProvider(provider) - raw, err := json.Marshal(dto) - if err != nil { - t.Fatalf("marshal: %v", err) - } - if strings.Contains(string(raw), "sk-super-secret") { - t.Fatalf("serialized provider leaked a credential value: %s", raw) - } - if len(dto.CredentialNames) != 1 || dto.CredentialNames[0] != "api_key" { - t.Fatalf("expected credential key names only, got %v", dto.CredentialNames) - } -} - -func TestSandboxPhaseMapping(t *testing.T) { - cases := []struct { - want string - phase openshellv1.SandboxPhase - }{ - {want: "PROVISIONING", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING}, - {want: "READY", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_READY}, - {want: "ERROR", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_ERROR}, - {want: "DELETING", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_DELETING}, - {want: "UNKNOWN", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_UNKNOWN}, - {want: "UNSPECIFIED", phase: openshellv1.SandboxPhase_SANDBOX_PHASE_UNSPECIFIED}, - } - for _, tc := range cases { - sandbox := &openshellv1.Sandbox{ - Status: &openshellv1.SandboxStatus{Phase: tc.phase}, - } - if got := FromSandbox(sandbox).Status.Phase; got != tc.want { - t.Errorf("phase %v: got %q, want %q", tc.phase, got, tc.want) - } - } -} - -func TestParsePolicyRoundTrip(t *testing.T) { - raw := json.RawMessage(`{ - "version": 1, - "filesystem": {"includeWorkdir": true, "readOnly": ["/usr"], "readWrite": ["/sandbox"]}, - "landlock": {"compatibility": "best_effort"}, - "process": {"runAsUser": "sandbox", "runAsGroup": "sandbox"}, - "networkPolicies": { - "anthropic": { - "endpoints": [{"host": "api.anthropic.com", "port": 443, "protocol": "rest", "enforcement": "enforce", "access": "read-write"}] - } - } - }`) - policy, err := ParsePolicy(raw) - if err != nil { - t.Fatalf("ParsePolicy: %v", err) - } - if policy.Version != 1 { - t.Errorf("version: got %d", policy.Version) - } - if !policy.Filesystem.IncludeWorkdir { - t.Error("filesystem.includeWorkdir not parsed") - } - rule, ok := policy.NetworkPolicies["anthropic"] - if !ok { - t.Fatal("networkPolicies.anthropic missing") - } - if len(rule.Endpoints) != 1 || rule.Endpoints[0].Host != "api.anthropic.com" || rule.Endpoints[0].Port != 443 { - t.Errorf("endpoint not parsed: %+v", rule.Endpoints) - } -} - -func TestParsePolicyRejectsUnknownFields(t *testing.T) { - if _, err := ParsePolicy(json.RawMessage(`{"notAField": true}`)); err == nil { - t.Fatal("expected error for unknown policy field") - } -} diff --git a/backend/internal/models/observability.go b/backend/internal/models/observability.go index 2eaa7cb4..30308748 100644 --- a/backend/internal/models/observability.go +++ b/backend/internal/models/observability.go @@ -1,14 +1,6 @@ package models -import ( - "encoding/json" - "fmt" - "sort" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) +import "encoding/json" // LogLine mirrors openshell.v1.SandboxLogLine. The fields map carries // structured network-decision context (dst_host, action, …) — the dashboard's @@ -29,22 +21,6 @@ type SandboxLogs struct { BufferTotal uint32 `json:"bufferTotal"` } -func FromSandboxLogs(resp *openshellv1.GetSandboxLogsResponse) SandboxLogs { - out := SandboxLogs{Logs: []LogLine{}, BufferTotal: resp.GetBufferTotal()} - for _, line := range resp.GetLogs() { - out.Logs = append(out.Logs, LogLine{ - SandboxID: line.SandboxId, - TimestampMs: line.TimestampMs, - Level: line.Level, - Target: line.Target, - Message: line.Message, - Source: line.Source, - Fields: line.Fields, - }) - } - return out -} - // PolicyRevision mirrors openshell.v1.SandboxPolicyRevision. Policy content // is protojson when the gateway populated it. type PolicyRevision struct { @@ -58,38 +34,6 @@ type PolicyRevision struct { Version uint32 `json:"version"` } -func policyStatusString(status openshellv1.PolicyStatus) string { - switch status { - case openshellv1.PolicyStatus_POLICY_STATUS_PENDING: - return "PENDING" - case openshellv1.PolicyStatus_POLICY_STATUS_LOADED: - return "LOADED" - case openshellv1.PolicyStatus_POLICY_STATUS_FAILED: - return "FAILED" - case openshellv1.PolicyStatus_POLICY_STATUS_SUPERSEDED: - return "SUPERSEDED" - } - return "UNSPECIFIED" -} - -func FromPolicyRevision(revision *openshellv1.SandboxPolicyRevision) PolicyRevision { - out := PolicyRevision{ - Version: revision.GetVersion(), - PolicyHash: revision.GetPolicyHash(), - Status: policyStatusString(revision.GetStatus()), - LoadError: revision.GetLoadError(), - CreatedAtMs: revision.GetCreatedAtMs(), - LoadedAtMs: revision.GetLoadedAtMs(), - Provenance: revision.GetProvenance(), - } - if revision.GetPolicy() != nil { - if raw, err := policyMarshaler.Marshal(revision.GetPolicy()); err == nil { - out.Policy = raw - } - } - return out -} - // SandboxPolicyView is the GET .../policy response: the latest revision, the // currently active version, and the revision history. type SandboxPolicyView struct { @@ -131,38 +75,6 @@ type DraftPolicy struct { LastAnalyzedAtMs int64 `json:"lastAnalyzedAtMs,omitempty"` } -func FromDraftPolicy(resp *openshellv1.GetDraftPolicyResponse) DraftPolicy { - out := DraftPolicy{ - Chunks: []PolicyChunk{}, - RollingSummary: resp.GetRollingSummary(), - DraftVersion: resp.GetDraftVersion(), - LastAnalyzedAtMs: resp.GetLastAnalyzedAtMs(), - } - for _, chunk := range resp.GetChunks() { - item := PolicyChunk{ - ID: chunk.Id, - Status: chunk.Status, - RuleName: chunk.RuleName, - Rationale: chunk.Rationale, - SecurityNotes: chunk.SecurityNotes, - Confidence: chunk.Confidence, - CreatedAtMs: chunk.CreatedAtMs, - DecidedAtMs: chunk.DecidedAtMs, - HitCount: chunk.HitCount, - Binary: chunk.Binary, - ValidationResult: chunk.ValidationResult, - RejectionReason: chunk.RejectionReason, - } - if chunk.ProposedRule != nil { - if raw, err := policyMarshaler.Marshal(chunk.ProposedRule); err == nil { - item.ProposedRule = raw - } - } - out.Chunks = append(out.Chunks, item) - } - return out -} - // DraftHistoryEntry mirrors openshell.v1.DraftHistoryEntry. type DraftHistoryEntry struct { EventType string `json:"eventType"` @@ -171,19 +83,6 @@ type DraftHistoryEntry struct { TimestampMs int64 `json:"timestampMs"` } -func FromDraftHistory(resp *openshellv1.GetDraftHistoryResponse) []DraftHistoryEntry { - out := make([]DraftHistoryEntry, 0, len(resp.GetEntries())) - for _, e := range resp.GetEntries() { - out = append(out, DraftHistoryEntry{ - TimestampMs: e.GetTimestampMs(), - EventType: e.GetEventType(), - Description: e.GetDescription(), - ChunkID: e.GetChunkId(), - }) - } - return out -} - // ServiceEndpoint mirrors openshell.v1.ServiceEndpointResponse. type ServiceEndpoint struct { SandboxName string `json:"sandboxName"` @@ -193,17 +92,6 @@ type ServiceEndpoint struct { Domain bool `json:"domain"` } -func FromServiceEndpointResponse(resp *openshellv1.ServiceEndpointResponse) ServiceEndpoint { - ep := resp.GetEndpoint() - return ServiceEndpoint{ - SandboxName: ep.GetSandboxName(), - ServiceName: ep.GetServiceName(), - TargetPort: ep.GetTargetPort(), - Domain: ep.GetDomain(), - URL: resp.GetUrl(), - } -} - // SettingEntry is one key/value pair from the gateway config map. type SettingEntry struct { Key string `json:"key"` @@ -216,40 +104,6 @@ type GatewaySettings struct { SettingsRevision uint64 `json:"settingsRevision"` } -func settingValueString(sv *sandboxv1.SettingValue) string { - if sv == nil { - return "" - } - switch v := sv.Value.(type) { - case *sandboxv1.SettingValue_StringValue: - return v.StringValue - case *sandboxv1.SettingValue_BoolValue: - return fmt.Sprintf("%t", v.BoolValue) - case *sandboxv1.SettingValue_IntValue: - return fmt.Sprintf("%d", v.IntValue) - case *sandboxv1.SettingValue_BytesValue: - return fmt.Sprintf("%x", v.BytesValue) - } - return "" -} - -func FromGatewaySettings(resp *sandboxv1.GetGatewayConfigResponse) GatewaySettings { - out := GatewaySettings{ - Settings: []SettingEntry{}, - SettingsRevision: resp.GetSettingsRevision(), - } - for key, val := range resp.GetSettings() { - out.Settings = append(out.Settings, SettingEntry{ - Key: key, - Value: settingValueString(val), - }) - } - sort.Slice(out.Settings, func(i, j int) bool { - return out.Settings[i].Key < out.Settings[j].Key - }) - return out -} - // InferenceRoute mirrors GetInferenceRouteResponse. Route "" is the // user-facing inference.local route; "sandbox-system" is the system route. type InferenceRoute struct { @@ -259,23 +113,3 @@ type InferenceRoute struct { Version uint64 `json:"version"` TimeoutSecs uint64 `json:"timeoutSecs"` } - -func FromInferenceRoute(resp *inferencev1.GetInferenceRouteResponse) InferenceRoute { - return InferenceRoute{ - RouteName: resp.GetRouteName(), - ProviderName: resp.GetProviderName(), - ModelID: resp.GetModelId(), - Version: resp.GetVersion(), - TimeoutSecs: resp.GetTimeoutSecs(), - } -} - -func FromSetInferenceRoute(resp *inferencev1.SetInferenceRouteResponse) InferenceRoute { - return InferenceRoute{ - RouteName: resp.GetRouteName(), - ProviderName: resp.GetProviderName(), - ModelID: resp.GetModelId(), - Version: resp.GetVersion(), - TimeoutSecs: resp.GetTimeoutSecs(), - } -} diff --git a/backend/internal/models/observability_test.go b/backend/internal/models/observability_test.go deleted file mode 100644 index e2533fce..00000000 --- a/backend/internal/models/observability_test.go +++ /dev/null @@ -1,422 +0,0 @@ -package models - -import ( - "testing" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -func TestFromLogLine(t *testing.T) { - resp := &openshellv1.GetSandboxLogsResponse{ - Logs: []*openshellv1.SandboxLogLine{ - { - SandboxId: "sb-1", - TimestampMs: 12345, - Level: "WARN", - Target: "policy", - Message: "deny egress to 1.2.3.4", - Source: "gateway", - Fields: map[string]string{"dst_host": "1.2.3.4", "action": "deny"}, - }, - { - SandboxId: "sb-1", - TimestampMs: 12346, - Level: "INFO", - Message: "sandbox started", - Source: "sandbox", - }, - }, - BufferTotal: 200, - } - - result := FromSandboxLogs(resp) - - if result.BufferTotal != 200 { - t.Errorf("bufferTotal = %d, want 200", result.BufferTotal) - } - if len(result.Logs) != 2 { - t.Fatalf("got %d logs, want 2", len(result.Logs)) - } - - line := result.Logs[0] - if line.SandboxID != "sb-1" { - t.Errorf("sandboxId = %q", line.SandboxID) - } - if line.TimestampMs != 12345 { - t.Errorf("timestampMs = %d", line.TimestampMs) - } - if line.Level != "WARN" { - t.Errorf("level = %q", line.Level) - } - if line.Target != "policy" { - t.Errorf("target = %q", line.Target) - } - if line.Message != "deny egress to 1.2.3.4" { - t.Errorf("message = %q", line.Message) - } - if line.Source != "gateway" { - t.Errorf("source = %q", line.Source) - } - if line.Fields["dst_host"] != "1.2.3.4" { - t.Errorf("fields.dst_host = %q", line.Fields["dst_host"]) - } - if line.Fields["action"] != "deny" { - t.Errorf("fields.action = %q", line.Fields["action"]) - } - - if len(result.Logs[1].Fields) > 0 { - t.Errorf("expected nil/empty fields on line 2, got %v", result.Logs[1].Fields) - } -} - -func TestFromSandboxLogsEmpty(t *testing.T) { - resp := &openshellv1.GetSandboxLogsResponse{} - result := FromSandboxLogs(resp) - - if len(result.Logs) != 0 { - t.Errorf("expected empty logs, got %d", len(result.Logs)) - } - if result.BufferTotal != 0 { - t.Errorf("bufferTotal = %d, want 0", result.BufferTotal) - } -} - -func TestPolicyStatusString(t *testing.T) { - tests := []struct { - want string - status openshellv1.PolicyStatus - }{ - {want: "PENDING", status: openshellv1.PolicyStatus_POLICY_STATUS_PENDING}, - {want: "LOADED", status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED}, - {want: "FAILED", status: openshellv1.PolicyStatus_POLICY_STATUS_FAILED}, - {want: "SUPERSEDED", status: openshellv1.PolicyStatus_POLICY_STATUS_SUPERSEDED}, - {want: "UNSPECIFIED", status: openshellv1.PolicyStatus_POLICY_STATUS_UNSPECIFIED}, - } - for _, tc := range tests { - t.Run(tc.want, func(t *testing.T) { - revision := &openshellv1.SandboxPolicyRevision{ - Version: 1, - Status: tc.status, - } - got := FromPolicyRevision(revision) - if got.Status != tc.want { - t.Errorf("status = %q, want %q", got.Status, tc.want) - } - }) - } -} - -func TestFromPolicyRevisionFields(t *testing.T) { - revision := &openshellv1.SandboxPolicyRevision{ - Version: 3, - PolicyHash: "abc123", - Status: openshellv1.PolicyStatus_POLICY_STATUS_LOADED, - LoadError: "", - CreatedAtMs: 1000, - LoadedAtMs: 1500, - Provenance: map[string]string{"source": "admin"}, - } - - got := FromPolicyRevision(revision) - - if got.Version != 3 { - t.Errorf("version = %d", got.Version) - } - if got.PolicyHash != "abc123" { - t.Errorf("policyHash = %q", got.PolicyHash) - } - if got.CreatedAtMs != 1000 { - t.Errorf("createdAtMs = %d", got.CreatedAtMs) - } - if got.LoadedAtMs != 1500 { - t.Errorf("loadedAtMs = %d", got.LoadedAtMs) - } - if got.Provenance["source"] != "admin" { - t.Errorf("provenance = %v", got.Provenance) - } -} - -func TestFromDraftPolicy(t *testing.T) { - resp := &openshellv1.GetDraftPolicyResponse{ - DraftVersion: 2, - RollingSummary: "network access requested", - LastAnalyzedAtMs: 9000, - Chunks: []*openshellv1.PolicyChunk{ - { - Id: "c-1", - Status: "pending", - RuleName: "allow-api", - Rationale: "needs API access", - SecurityNotes: "broad port range", - Confidence: 0.85, - CreatedAtMs: 5000, - HitCount: 3, - Binary: "agent", - ValidationResult: "PASS", - }, - { - Id: "c-2", - Status: "rejected", - RuleName: "allow-all", - RejectionReason: "too broad", - DecidedAtMs: 6000, - }, - }, - } - - got := FromDraftPolicy(resp) - - if got.DraftVersion != 2 { - t.Errorf("draftVersion = %d", got.DraftVersion) - } - if got.RollingSummary != "network access requested" { - t.Errorf("rollingSummary = %q", got.RollingSummary) - } - if got.LastAnalyzedAtMs != 9000 { - t.Errorf("lastAnalyzedAtMs = %d", got.LastAnalyzedAtMs) - } - if len(got.Chunks) != 2 { - t.Fatalf("got %d chunks, want 2", len(got.Chunks)) - } - - c1 := got.Chunks[0] - if c1.ID != "c-1" { - t.Errorf("chunk[0].id = %q", c1.ID) - } - if c1.Status != "pending" { - t.Errorf("chunk[0].status = %q", c1.Status) - } - if c1.RuleName != "allow-api" { - t.Errorf("chunk[0].ruleName = %q", c1.RuleName) - } - if c1.Confidence != 0.85 { - t.Errorf("chunk[0].confidence = %f", c1.Confidence) - } - if c1.ValidationResult != "PASS" { - t.Errorf("chunk[0].validationResult = %q", c1.ValidationResult) - } - if c1.Binary != "agent" { - t.Errorf("chunk[0].binary = %q", c1.Binary) - } - if c1.HitCount != 3 { - t.Errorf("chunk[0].hitCount = %d", c1.HitCount) - } - - c2 := got.Chunks[1] - if c2.RejectionReason != "too broad" { - t.Errorf("chunk[1].rejectionReason = %q", c2.RejectionReason) - } - if c2.DecidedAtMs != 6000 { - t.Errorf("chunk[1].decidedAtMs = %d", c2.DecidedAtMs) - } -} - -func TestFromDraftPolicyEmpty(t *testing.T) { - resp := &openshellv1.GetDraftPolicyResponse{} - got := FromDraftPolicy(resp) - - if len(got.Chunks) != 0 { - t.Errorf("expected empty chunks, got %d", len(got.Chunks)) - } -} - -func TestFromDraftHistory(t *testing.T) { - resp := &openshellv1.GetDraftHistoryResponse{ - Entries: []*openshellv1.DraftHistoryEntry{ - { - TimestampMs: 1000, - EventType: "approved", - Description: "chunk c-1 approved", - ChunkId: "c-1", - }, - { - TimestampMs: 2000, - EventType: "rejected", - Description: "chunk c-2 rejected", - ChunkId: "c-2", - }, - }, - } - - got := FromDraftHistory(resp) - - if len(got) != 2 { - t.Fatalf("got %d entries, want 2", len(got)) - } - if got[0].EventType != "approved" { - t.Errorf("entry[0].eventType = %q", got[0].EventType) - } - if got[0].ChunkID != "c-1" { - t.Errorf("entry[0].chunkId = %q", got[0].ChunkID) - } - if got[1].TimestampMs != 2000 { - t.Errorf("entry[1].timestampMs = %d", got[1].TimestampMs) - } -} - -func TestFromDraftHistoryEmpty(t *testing.T) { - resp := &openshellv1.GetDraftHistoryResponse{} - got := FromDraftHistory(resp) - - if len(got) != 0 { - t.Errorf("expected empty history, got %d", len(got)) - } -} - -func TestFromServiceEndpointResponse(t *testing.T) { - resp := &openshellv1.ServiceEndpointResponse{ - Endpoint: &openshellv1.ServiceEndpoint{ - SandboxName: "my-sb", - ServiceName: "web", - TargetPort: 8080, - Domain: true, - }, - Url: "https://web.sb.example.com", - } - - got := FromServiceEndpointResponse(resp) - - if got.SandboxName != "my-sb" { - t.Errorf("sandboxName = %q", got.SandboxName) - } - if got.ServiceName != "web" { - t.Errorf("serviceName = %q", got.ServiceName) - } - if got.TargetPort != 8080 { - t.Errorf("targetPort = %d", got.TargetPort) - } - if !got.Domain { - t.Error("domain should be true") - } - if got.URL != "https://web.sb.example.com" { - t.Errorf("url = %q", got.URL) - } -} - -func TestSettingValueString(t *testing.T) { - tests := []struct { - value *sandboxv1.SettingValue - name string - want string - }{ - { - name: "string value", - value: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_StringValue{StringValue: "hello"}}, - want: "hello", - }, - { - name: "bool value", - value: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_BoolValue{BoolValue: true}}, - want: "true", - }, - { - name: "int value", - value: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_IntValue{IntValue: 42}}, - want: "42", - }, - { - name: "bytes value", - value: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_BytesValue{BytesValue: []byte{0xde, 0xad}}}, - want: "dead", - }, - { - name: "nil value", - value: nil, - want: "", - }, - } - for _, tc := range tests { - t.Run(tc.name, func(t *testing.T) { - got := settingValueString(tc.value) - if got != tc.want { - t.Errorf("settingValueString = %q, want %q", got, tc.want) - } - }) - } -} - -func TestFromGatewaySettings(t *testing.T) { - resp := &sandboxv1.GetGatewayConfigResponse{ - Settings: map[string]*sandboxv1.SettingValue{ - "beta_features": {Value: &sandboxv1.SettingValue_BoolValue{BoolValue: false}}, - "admin_email": {Value: &sandboxv1.SettingValue_StringValue{StringValue: "admin@example.com"}}, - }, - SettingsRevision: 10, - } - - got := FromGatewaySettings(resp) - - if got.SettingsRevision != 10 { - t.Errorf("settingsRevision = %d", got.SettingsRevision) - } - if len(got.Settings) != 2 { - t.Fatalf("got %d settings, want 2", len(got.Settings)) - } - if got.Settings[0].Key != "admin_email" { - t.Errorf("settings[0].key = %q, want admin_email (sorted)", got.Settings[0].Key) - } - if got.Settings[1].Key != "beta_features" { - t.Errorf("settings[1].key = %q", got.Settings[1].Key) - } -} - -func TestFromGatewaySettingsEmpty(t *testing.T) { - resp := &sandboxv1.GetGatewayConfigResponse{} - got := FromGatewaySettings(resp) - - if len(got.Settings) != 0 { - t.Errorf("expected empty settings, got %d", len(got.Settings)) - } -} - -func TestFromInferenceRoute(t *testing.T) { - resp := &inferencev1.GetInferenceRouteResponse{ - RouteName: "inference.local", - ProviderName: "claude", - ModelId: "claude-sonnet-5", - Version: 3, - TimeoutSecs: 60, - } - - got := FromInferenceRoute(resp) - - if got.RouteName != "inference.local" { - t.Errorf("routeName = %q", got.RouteName) - } - if got.ProviderName != "claude" { - t.Errorf("providerName = %q", got.ProviderName) - } - if got.ModelID != "claude-sonnet-5" { - t.Errorf("modelId = %q", got.ModelID) - } - if got.Version != 3 { - t.Errorf("version = %d", got.Version) - } - if got.TimeoutSecs != 60 { - t.Errorf("timeoutSecs = %d", got.TimeoutSecs) - } -} - -func TestFromSetInferenceRoute(t *testing.T) { - resp := &inferencev1.SetInferenceRouteResponse{ - RouteName: "sandbox-system", - ProviderName: "nim", - ModelId: "llama-3", - Version: 1, - TimeoutSecs: 30, - } - - got := FromSetInferenceRoute(resp) - - if got.RouteName != "sandbox-system" { - t.Errorf("routeName = %q", got.RouteName) - } - if got.ProviderName != "nim" { - t.Errorf("providerName = %q", got.ProviderName) - } - if got.Version != 1 { - t.Errorf("version = %d", got.Version) - } -} diff --git a/backend/internal/models/policyproto.go b/backend/internal/models/policyproto.go new file mode 100644 index 00000000..5e37bb05 --- /dev/null +++ b/backend/internal/models/policyproto.go @@ -0,0 +1,501 @@ +package models + +// This file bridges the SDK's domain policy types (which carry no JSON tags) +// and the proto SandboxPolicy, so we can (de)serialize policies with protojson +// — reproducing the exact camelCase, full-fidelity JSON contract the frontend +// spoke before the SDK migration. +// +// The SDK's own domain<->proto converter lives in an internal package and is +// not importable, so the conversion below is a faithful port of +// openshell/v1/internal/converter/{policy,network_policy}.go (Apache-2.0). +// It covers EVERY field of the policy tree (L7 allow/deny rules, IP allowlists, +// multi-port, GraphQL persisted queries, MCP options, credential binding, +// signing, middleware, ...). If OpenShell adds a policy field upstream, add it +// here too — the round-trip test in policyproto_test.go guards the known set. + +import ( + ostypes "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types" + sbv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1" + "google.golang.org/protobuf/types/known/structpb" +) + +func copyStringSlice(in []string) []string { + if len(in) == 0 { + return nil + } + out := make([]string, len(in)) + copy(out, in) + return out +} + +func copyBoolPtr(in *bool) *bool { + if in == nil { + return nil + } + v := *in + return &v +} + +// --- SandboxPolicy --- + +func sandboxPolicyFromProto(p *sbv1.SandboxPolicy) *ostypes.SandboxPolicy { + if p == nil { + return nil + } + result := &ostypes.SandboxPolicy{ + Version: p.GetVersion(), + Filesystem: filesystemPolicyFromProto(p.GetFilesystem()), + Landlock: landlockPolicyFromProto(p.GetLandlock()), + Process: processPolicyFromProto(p.GetProcess()), + } + if np := p.GetNetworkPolicies(); np != nil { + result.NetworkPolicies = make(map[string]ostypes.NetworkPolicyRule, len(np)) + for k, v := range np { + if converted := networkPolicyRuleFromProto(v); converted != nil { + result.NetworkPolicies[k] = *converted + } + } + } + if mw := p.GetNetworkMiddlewares(); mw != nil { + result.NetworkMiddlewares = make(map[string]ostypes.NetworkMiddlewareConfig, len(mw)) + for k, v := range mw { + if v != nil { + result.NetworkMiddlewares[k] = middlewareConfigFromProto(v) + } + } + } + return result +} + +func sandboxPolicyToProto(p *ostypes.SandboxPolicy) *sbv1.SandboxPolicy { + if p == nil { + return nil + } + result := &sbv1.SandboxPolicy{ + Version: p.Version, + Filesystem: filesystemPolicyToProto(p.Filesystem), + Landlock: landlockPolicyToProto(p.Landlock), + Process: processPolicyToProto(p.Process), + } + if p.NetworkPolicies != nil { + result.NetworkPolicies = make(map[string]*sbv1.NetworkPolicyRule, len(p.NetworkPolicies)) + for k, v := range p.NetworkPolicies { + rule := v + result.NetworkPolicies[k] = networkPolicyRuleToProto(&rule) + } + } + if p.NetworkMiddlewares != nil { + result.NetworkMiddlewares = make(map[string]*sbv1.NetworkMiddlewareConfig, len(p.NetworkMiddlewares)) + for k, v := range p.NetworkMiddlewares { + mw := v + result.NetworkMiddlewares[k] = middlewareConfigToProto(&mw) + } + } + return result +} + +func middlewareConfigFromProto(m *sbv1.NetworkMiddlewareConfig) ostypes.NetworkMiddlewareConfig { + result := ostypes.NetworkMiddlewareConfig{ + Name: m.GetName(), + Middleware: m.GetMiddleware(), + OnError: m.GetOnError(), + Order: m.GetOrder(), + } + if c := m.GetConfig(); c != nil { + result.Config = c.AsMap() + } + if ep := m.GetEndpoints(); ep != nil { + result.Endpoints = &ostypes.MiddlewareEndpointSelector{ + Include: copyStringSlice(ep.GetInclude()), + Exclude: copyStringSlice(ep.GetExclude()), + } + } + return result +} + +func middlewareConfigToProto(m *ostypes.NetworkMiddlewareConfig) *sbv1.NetworkMiddlewareConfig { + result := &sbv1.NetworkMiddlewareConfig{ + Name: m.Name, + Middleware: m.Middleware, + OnError: m.OnError, + Order: m.Order, + } + if m.Config != nil { + // Config originates from frontend JSON (structpb.AsMap round-trips), so + // it is always re-serializable; drop silently on the rare error. + if s, err := structpb.NewStruct(m.Config); err == nil { + result.Config = s + } + } + if m.Endpoints != nil { + result.Endpoints = &sbv1.MiddlewareEndpointSelector{ + Include: copyStringSlice(m.Endpoints.Include), + Exclude: copyStringSlice(m.Endpoints.Exclude), + } + } + return result +} + +func filesystemPolicyFromProto(f *sbv1.FilesystemPolicy) *ostypes.FilesystemPolicy { + if f == nil { + return nil + } + return &ostypes.FilesystemPolicy{ + IncludeWorkdir: f.GetIncludeWorkdir(), + ReadOnly: copyStringSlice(f.GetReadOnly()), + ReadWrite: copyStringSlice(f.GetReadWrite()), + } +} + +func filesystemPolicyToProto(f *ostypes.FilesystemPolicy) *sbv1.FilesystemPolicy { + if f == nil { + return nil + } + return &sbv1.FilesystemPolicy{ + IncludeWorkdir: f.IncludeWorkdir, + ReadOnly: copyStringSlice(f.ReadOnly), + ReadWrite: copyStringSlice(f.ReadWrite), + } +} + +func landlockPolicyFromProto(l *sbv1.LandlockPolicy) *ostypes.LandlockPolicy { + if l == nil { + return nil + } + return &ostypes.LandlockPolicy{Compatibility: l.GetCompatibility()} +} + +func landlockPolicyToProto(l *ostypes.LandlockPolicy) *sbv1.LandlockPolicy { + if l == nil { + return nil + } + return &sbv1.LandlockPolicy{Compatibility: l.Compatibility} +} + +func processPolicyFromProto(p *sbv1.ProcessPolicy) *ostypes.ProcessPolicy { + if p == nil { + return nil + } + return &ostypes.ProcessPolicy{ + RunAsUser: p.GetRunAsUser(), + RunAsGroup: p.GetRunAsGroup(), + } +} + +func processPolicyToProto(p *ostypes.ProcessPolicy) *sbv1.ProcessPolicy { + if p == nil { + return nil + } + return &sbv1.ProcessPolicy{ + RunAsUser: p.RunAsUser, + RunAsGroup: p.RunAsGroup, + } +} + +// --- NetworkPolicyRule --- + +func networkPolicyRuleFromProto(r *sbv1.NetworkPolicyRule) *ostypes.NetworkPolicyRule { + if r == nil { + return nil + } + result := &ostypes.NetworkPolicyRule{Name: r.GetName()} + if eps := r.GetEndpoints(); len(eps) > 0 { + result.Endpoints = make([]ostypes.PolicyNetworkEndpoint, len(eps)) + for i, ep := range eps { + if ep != nil { + result.Endpoints[i] = policyNetworkEndpointFromProto(ep) + } + } + } + if bins := r.GetBinaries(); len(bins) > 0 { + result.Binaries = make([]ostypes.PolicyNetworkBinary, len(bins)) + for i, b := range bins { + if b != nil { + result.Binaries[i] = ostypes.PolicyNetworkBinary{Path: b.GetPath()} + } + } + } + return result +} + +func networkPolicyRuleToProto(r *ostypes.NetworkPolicyRule) *sbv1.NetworkPolicyRule { + if r == nil { + return nil + } + result := &sbv1.NetworkPolicyRule{Name: r.Name} + if len(r.Endpoints) > 0 { + result.Endpoints = make([]*sbv1.NetworkEndpoint, len(r.Endpoints)) + for i := range r.Endpoints { + result.Endpoints[i] = policyNetworkEndpointToProto(&r.Endpoints[i]) + } + } + if len(r.Binaries) > 0 { + result.Binaries = make([]*sbv1.NetworkBinary, len(r.Binaries)) + for i := range r.Binaries { + result.Binaries[i] = &sbv1.NetworkBinary{Path: r.Binaries[i].Path} + } + } + return result +} + +// --- PolicyNetworkEndpoint --- + +func policyNetworkEndpointFromProto(ep *sbv1.NetworkEndpoint) ostypes.PolicyNetworkEndpoint { + result := ostypes.PolicyNetworkEndpoint{ + Host: ep.GetHost(), + Port: ep.GetPort(), + Protocol: ep.GetProtocol(), + TLS: ep.GetTls(), + Enforcement: ep.GetEnforcement(), + Access: ep.GetAccess(), + AllowEncodedSlash: ep.GetAllowEncodedSlash(), + PersistedQueries: ep.GetPersistedQueries(), + GraphqlMaxBodyBytes: ep.GetGraphqlMaxBodyBytes(), + Path: ep.GetPath(), + WebsocketCredentialRewrite: ep.GetWebsocketCredentialRewrite(), + RequestBodyCredentialRewrite: ep.GetRequestBodyCredentialRewrite(), + AdvisorProposed: ep.GetAdvisorProposed(), + CredentialSigning: ep.GetCredentialSigning(), + SigningService: ep.GetSigningService(), + SigningRegion: ep.GetSigningRegion(), + JSONRPCMaxBodyBytes: ep.GetJsonRpcMaxBodyBytes(), + } + if binding := ep.GetCredentialBinding(); binding != nil { + result.CredentialBinding = &ostypes.NetworkCredentialBinding{Provider: binding.GetProvider()} + } + if ports := ep.GetPorts(); len(ports) > 0 { + result.Ports = make([]uint32, len(ports)) + copy(result.Ports, ports) + } + if ips := ep.GetAllowedIps(); len(ips) > 0 { + result.AllowedIPs = copyStringSlice(ips) + } + if rules := ep.GetRules(); len(rules) > 0 { + result.Rules = make([]ostypes.L7Rule, len(rules)) + for i, r := range rules { + if r != nil { + result.Rules[i] = l7RuleFromProto(r) + } + } + } + if deny := ep.GetDenyRules(); len(deny) > 0 { + result.DenyRules = make([]ostypes.L7DenyRule, len(deny)) + for i, r := range deny { + if r != nil { + result.DenyRules[i] = l7DenyRuleFromProto(r) + } + } + } + if gql := ep.GetGraphqlPersistedQueries(); len(gql) > 0 { + result.GraphqlPersistedQueries = make(map[string]ostypes.GraphqlOperation, len(gql)) + for k, v := range gql { + if v != nil { + result.GraphqlPersistedQueries[k] = graphqlOperationFromProto(v) + } + } + } + result.Mcp = mcpOptionsFromProto(ep.GetMcp()) + return result +} + +func policyNetworkEndpointToProto(ep *ostypes.PolicyNetworkEndpoint) *sbv1.NetworkEndpoint { + result := &sbv1.NetworkEndpoint{ + Host: ep.Host, + Port: ep.Port, + Protocol: ep.Protocol, + Tls: ep.TLS, + Enforcement: ep.Enforcement, + Access: ep.Access, + AllowEncodedSlash: ep.AllowEncodedSlash, + PersistedQueries: ep.PersistedQueries, + GraphqlMaxBodyBytes: ep.GraphqlMaxBodyBytes, + Path: ep.Path, + WebsocketCredentialRewrite: ep.WebsocketCredentialRewrite, + RequestBodyCredentialRewrite: ep.RequestBodyCredentialRewrite, + AdvisorProposed: ep.AdvisorProposed, + CredentialSigning: ep.CredentialSigning, + SigningService: ep.SigningService, + SigningRegion: ep.SigningRegion, + JsonRpcMaxBodyBytes: ep.JSONRPCMaxBodyBytes, + } + if ep.CredentialBinding != nil { + result.CredentialBinding = &sbv1.NetworkCredentialBinding{Provider: ep.CredentialBinding.Provider} + } + if len(ep.Ports) > 0 { + result.Ports = make([]uint32, len(ep.Ports)) + copy(result.Ports, ep.Ports) + } + if len(ep.AllowedIPs) > 0 { + result.AllowedIps = copyStringSlice(ep.AllowedIPs) + } + if len(ep.Rules) > 0 { + result.Rules = make([]*sbv1.L7Rule, len(ep.Rules)) + for i := range ep.Rules { + result.Rules[i] = l7RuleToProto(&ep.Rules[i]) + } + } + if len(ep.DenyRules) > 0 { + result.DenyRules = make([]*sbv1.L7DenyRule, len(ep.DenyRules)) + for i := range ep.DenyRules { + result.DenyRules[i] = l7DenyRuleToProto(&ep.DenyRules[i]) + } + } + if len(ep.GraphqlPersistedQueries) > 0 { + result.GraphqlPersistedQueries = make(map[string]*sbv1.GraphqlOperation, len(ep.GraphqlPersistedQueries)) + for k, v := range ep.GraphqlPersistedQueries { + op := v + result.GraphqlPersistedQueries[k] = graphqlOperationToProto(&op) + } + } + result.Mcp = mcpOptionsToProto(ep.Mcp) + return result +} + +// --- McpOptions --- + +func mcpOptionsFromProto(m *sbv1.McpOptions) *ostypes.McpOptions { + if m == nil { + return nil + } + return &ostypes.McpOptions{ + StrictToolNames: copyBoolPtr(m.StrictToolNames), + AllowAllKnownMcpMethods: copyBoolPtr(m.AllowAllKnownMcpMethods), + } +} + +func mcpOptionsToProto(m *ostypes.McpOptions) *sbv1.McpOptions { + if m == nil { + return nil + } + return &sbv1.McpOptions{ + StrictToolNames: copyBoolPtr(m.StrictToolNames), + AllowAllKnownMcpMethods: copyBoolPtr(m.AllowAllKnownMcpMethods), + } +} + +// --- L7Rule --- + +func l7RuleFromProto(r *sbv1.L7Rule) ostypes.L7Rule { + result := ostypes.L7Rule{} + if a := r.GetAllow(); a != nil { + result.Allow = &ostypes.L7Allow{ + Method: a.GetMethod(), + Path: a.GetPath(), + Command: a.GetCommand(), + OperationType: a.GetOperationType(), + OperationName: a.GetOperationName(), + Fields: copyStringSlice(a.GetFields()), + } + if q := a.GetQuery(); len(q) > 0 { + result.Allow.Query = l7QueryMapFromProto(q) + } + if p := a.GetParams(); len(p) > 0 { + result.Allow.Params = l7QueryMapFromProto(p) + } + } + return result +} + +func l7RuleToProto(r *ostypes.L7Rule) *sbv1.L7Rule { + result := &sbv1.L7Rule{} + if r.Allow != nil { + result.Allow = &sbv1.L7Allow{ + Method: r.Allow.Method, + Path: r.Allow.Path, + Command: r.Allow.Command, + OperationType: r.Allow.OperationType, + OperationName: r.Allow.OperationName, + Fields: copyStringSlice(r.Allow.Fields), + } + if len(r.Allow.Query) > 0 { + result.Allow.Query = l7QueryMapToProto(r.Allow.Query) + } + if len(r.Allow.Params) > 0 { + result.Allow.Params = l7QueryMapToProto(r.Allow.Params) + } + } + return result +} + +// --- L7DenyRule --- + +func l7DenyRuleFromProto(r *sbv1.L7DenyRule) ostypes.L7DenyRule { + return ostypes.L7DenyRule{ + Method: r.GetMethod(), + Path: r.GetPath(), + Command: r.GetCommand(), + OperationType: r.GetOperationType(), + OperationName: r.GetOperationName(), + Fields: copyStringSlice(r.GetFields()), + Query: l7QueryMapFromProto(r.GetQuery()), + Params: l7QueryMapFromProto(r.GetParams()), + } +} + +func l7DenyRuleToProto(r *ostypes.L7DenyRule) *sbv1.L7DenyRule { + result := &sbv1.L7DenyRule{ + Method: r.Method, + Path: r.Path, + Command: r.Command, + OperationType: r.OperationType, + OperationName: r.OperationName, + Fields: copyStringSlice(r.Fields), + } + if len(r.Query) > 0 { + result.Query = l7QueryMapToProto(r.Query) + } + if len(r.Params) > 0 { + result.Params = l7QueryMapToProto(r.Params) + } + return result +} + +// --- L7QueryMatcher helpers --- + +func l7QueryMapFromProto(m map[string]*sbv1.L7QueryMatcher) map[string]ostypes.L7QueryMatcher { + if len(m) == 0 { + return nil + } + result := make(map[string]ostypes.L7QueryMatcher, len(m)) + for k, v := range m { + if v != nil { + result[k] = ostypes.L7QueryMatcher{ + Glob: v.GetGlob(), + Any: copyStringSlice(v.GetAny()), + } + } + } + return result +} + +func l7QueryMapToProto(m map[string]ostypes.L7QueryMatcher) map[string]*sbv1.L7QueryMatcher { + if len(m) == 0 { + return nil + } + result := make(map[string]*sbv1.L7QueryMatcher, len(m)) + for k, v := range m { + result[k] = &sbv1.L7QueryMatcher{ + Glob: v.Glob, + Any: copyStringSlice(v.Any), + } + } + return result +} + +// --- GraphqlOperation --- + +func graphqlOperationFromProto(op *sbv1.GraphqlOperation) ostypes.GraphqlOperation { + return ostypes.GraphqlOperation{ + OperationType: op.GetOperationType(), + OperationName: op.GetOperationName(), + Fields: copyStringSlice(op.GetFields()), + } +} + +func graphqlOperationToProto(op *ostypes.GraphqlOperation) *sbv1.GraphqlOperation { + return &sbv1.GraphqlOperation{ + OperationType: op.OperationType, + OperationName: op.OperationName, + Fields: copyStringSlice(op.Fields), + } +} diff --git a/backend/internal/models/policyproto_test.go b/backend/internal/models/policyproto_test.go new file mode 100644 index 00000000..5f57cece --- /dev/null +++ b/backend/internal/models/policyproto_test.go @@ -0,0 +1,134 @@ +package models + +import ( + "encoding/json" + "reflect" + "testing" +) + +// fullPolicyJSON exercises every advanced policy field that the pre-SDK +// protojson contract carried. If the converter drops any of these, the +// round-trip below stops being the identity and the test fails. +const fullPolicyJSON = `{ + "version": 3, + "filesystem": {"includeWorkdir": true, "readOnly": ["/etc"], "readWrite": ["/tmp", "/work"]}, + "landlock": {"compatibility": "best_effort"}, + "process": {"runAsUser": "agent", "runAsGroup": "agents"}, + "networkPolicies": { + "anthropic": { + "name": "anthropic", + "endpoints": [ + { + "host": "api.anthropic.com", + "port": 443, + "ports": [443, 8443], + "protocol": "https", + "tls": "verify", + "enforcement": "enforce", + "access": "allow", + "allowedIps": ["1.2.3.4", "5.6.7.8"], + "allowEncodedSlash": true, + "persistedQueries": "strict", + "graphqlMaxBodyBytes": 1048576, + "path": "/v1", + "websocketCredentialRewrite": true, + "requestBodyCredentialRewrite": true, + "advisorProposed": true, + "credentialSigning": "aws-sigv4", + "signingService": "bedrock", + "signingRegion": "us-east-1", + "jsonRpcMaxBodyBytes": 65536, + "credentialBinding": {"provider": "claude-code"}, + "mcp": {"strictToolNames": true, "allowAllKnownMcpMethods": false}, + "rules": [ + {"allow": {"method": "POST", "path": "/v1/messages", "command": "chat", "operationType": "query", "operationName": "Msg", "fields": ["a", "b"], "query": {"q": {"glob": "x*", "any": ["1", "2"]}}, "params": {"p": {"glob": "y*"}}}} + ], + "denyRules": [ + {"method": "DELETE", "path": "/v1/admin", "fields": ["secret"], "query": {"z": {"any": ["9"]}}} + ] + } + ], + "binaries": [{"path": "/usr/bin/claude"}] + } + }, + "networkMiddlewares": { + "redact": {"name": "redact", "middleware": "body-redactor", "onError": "deny", "order": 5, "config": {"pattern": "sk-.*"}, "endpoints": {"include": ["*.anthropic.com"], "exclude": ["logs.*"]}} + } +}` + +func normalizeJSON(t *testing.T, raw []byte) map[string]any { + t.Helper() + var m map[string]any + if err := json.Unmarshal(raw, &m); err != nil { + t.Fatalf("unmarshal: %v\n%s", err, raw) + } + return m +} + +func TestSandboxPolicyRoundTripFullFidelity(t *testing.T) { + // JSON -> domain -> JSON must be the identity for a fully-populated policy. + policy, err := ParseSDKPolicy([]byte(fullPolicyJSON)) + if err != nil { + t.Fatalf("ParseSDKPolicy: %v", err) + } + got := marshalSDKPolicy(policy) + if got == nil { + t.Fatal("marshalSDKPolicy returned nil") + } + + want := normalizeJSON(t, []byte(fullPolicyJSON)) + have := normalizeJSON(t, got) + if !reflect.DeepEqual(want, have) { + t.Fatalf("policy round-trip lost or changed fields.\nwant: %s\n\ngot: %s", fullPolicyJSON, got) + } +} + +func TestSandboxPolicyRoundTripAdvancedFieldsSurvive(t *testing.T) { + // Explicit guard for the fields the pre-fix hand-rolled converter dropped. + policy, err := ParseSDKPolicy([]byte(fullPolicyJSON)) + if err != nil { + t.Fatalf("ParseSDKPolicy: %v", err) + } + ep := policy.NetworkPolicies["anthropic"].Endpoints[0] + checks := []struct { + name string + ok bool + }{ + {"ports", len(ep.Ports) == 2}, + {"allowedIps", len(ep.AllowedIPs) == 2}, + {"L7 allow rules", len(ep.Rules) == 1 && ep.Rules[0].Allow != nil && ep.Rules[0].Allow.Method == "POST"}, + {"L7 deny rules", len(ep.DenyRules) == 1 && ep.DenyRules[0].Method == "DELETE"}, + {"mcp options", ep.Mcp != nil && ep.Mcp.StrictToolNames != nil && *ep.Mcp.StrictToolNames}, + {"credentialBinding", ep.CredentialBinding != nil && ep.CredentialBinding.Provider == "claude-code"}, + {"jsonRpcMaxBodyBytes", ep.JSONRPCMaxBodyBytes == 65536}, + {"graphqlPersistedQueries + graphqlMaxBodyBytes", ep.GraphqlMaxBodyBytes == 1048576}, + {"networkMiddlewares", len(policy.NetworkMiddlewares) == 1}, + } + for _, c := range checks { + if !c.ok { + t.Errorf("advanced field dropped: %s", c.name) + } + } +} + +func TestNetworkPolicyRuleRoundTrip(t *testing.T) { + const ruleJSON = `{"name":"gh","endpoints":[{"host":"api.github.com","port":443,"protocol":"https","access":"allow","allowedIps":["140.82.0.0"],"denyRules":[{"method":"POST","path":"/graphql"}]}],"binaries":[{"path":"/usr/bin/gh"}]}` + rule, err := ParseSDKNetworkPolicyRule([]byte(ruleJSON)) + if err != nil { + t.Fatalf("ParseSDKNetworkPolicyRule: %v", err) + } + got := MarshalSDKNetworkPolicyRule(rule) + if got == nil { + t.Fatal("MarshalSDKNetworkPolicyRule returned nil") + } + if !reflect.DeepEqual(normalizeJSON(t, []byte(ruleJSON)), normalizeJSON(t, got)) { + t.Fatalf("rule round-trip changed fields.\nwant: %s\ngot: %s", ruleJSON, got) + } +} + +func TestParseSDKPolicyRejectsUnknownField(t *testing.T) { + // protojson rejects unknown fields, preserving the pre-SDK validation. + if _, err := ParseSDKPolicy([]byte(`{"version":1,"bogusField":true}`)); err == nil { + t.Fatal("expected error for unknown policy field, got nil") + } +} diff --git a/backend/internal/models/sdk_converters.go b/backend/internal/models/sdk_converters.go new file mode 100644 index 00000000..e97bcc25 --- /dev/null +++ b/backend/internal/models/sdk_converters.go @@ -0,0 +1,624 @@ +package models + +import ( + "encoding/json" + "fmt" + "slices" + "sort" + "strings" + "time" + + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + sbv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1" + "google.golang.org/protobuf/encoding/protojson" +) + +// policyProtoMarshaler emits camelCase JSON matching the pre-SDK protojson +// contract the frontend consumes. +var policyProtoMarshaler = protojson.MarshalOptions{UseProtoNames: false} + +// FromSDKSandbox converts an SDK Sandbox to the JSON DTO the frontend expects. +func FromSDKSandbox(sandbox *openshell.Sandbox) Sandbox { + if sandbox == nil { + return Sandbox{} + } + out := Sandbox{ + Metadata: ObjectMeta{ + ID: sandbox.ID, + Name: sandbox.Name, + Workspace: sandbox.Workspace, + Labels: sandbox.Labels, + Annotations: sandbox.Annotations, + CreatedAtMs: timeToMs(sandbox.CreatedAt), + ResourceVersion: sandbox.ResourceVersion, + }, + } + if sandbox.DeletionTimestamp != nil { + out.Metadata.DeletionTimestampMs = sandbox.DeletionTimestamp.UnixMilli() + } + + out.Spec = SandboxSpec{ + LogLevel: sandbox.Spec.LogLevel, + Environment: sandbox.Spec.Environment, + Providers: sandbox.Spec.Providers, + } + if sandbox.Spec.Template != nil { + out.Spec.Image = sandbox.Spec.Template.Image + } + if sandbox.Spec.Policy != nil { + out.Spec.Policy = marshalSDKPolicy(sandbox.Spec.Policy) + } + + out.Status = SandboxStatus{ + SandboxName: sandbox.Status.SandboxName, + AgentPod: sandbox.Status.AgentPod, + Phase: strings.ToUpper(string(sandbox.Status.Phase)), + CurrentPolicyVersion: sandbox.Status.CurrentPolicyVersion, + } + for _, cond := range sandbox.Status.Conditions { + out.Status.Conditions = append(out.Status.Conditions, SandboxCondition{ + Type: cond.Type, + Status: cond.Status, + Reason: cond.Reason, + Message: cond.Message, + LastTransitionTime: cond.LastTransitionTime, + }) + } + return out +} + +// BuildSDKSandboxSpec constructs an SDK SandboxSpec from a create request. +func BuildSDKSandboxSpec(req CreateSandboxRequest) (*openshell.SandboxSpec, error) { + policy, err := ParseSDKPolicy(req.Policy) + if err != nil { + return nil, fmt.Errorf("policy does not match the SandboxPolicy schema: %w", err) + } + + spec := &openshell.SandboxSpec{ + LogLevel: req.LogLevel, + Environment: req.Environment, + Template: &openshell.SandboxTemplate{ + Image: req.Image, + }, + Policy: policy, + Providers: req.Providers, + } + + if req.CPU != "" || req.Memory != "" { + resources := map[string]any{} + limits := map[string]any{} + if req.CPU != "" { + limits["cpu"] = req.CPU + } + if req.Memory != "" { + limits["memory"] = req.Memory + } + resources["limits"] = limits + spec.Template.Resources = resources + } + + if req.GpuCount > 0 { + gpu := req.GpuCount + spec.GPUCount = &gpu + } + return spec, nil +} + +// ParseSDKPolicy converts camelCase JSON from the frontend into the SDK +// SandboxPolicy. It round-trips through the proto with protojson so every +// policy field (L7 rules, deny rules, IP allowlists, multi-port, MCP, +// middleware, ...) is preserved — protojson rejects unknown fields, matching +// the pre-SDK validation behavior. +func ParseSDKPolicy(raw json.RawMessage) (*openshell.SandboxPolicy, error) { + var pb sbv1.SandboxPolicy + if err := protojson.Unmarshal(raw, &pb); err != nil { + return nil, err + } + return sandboxPolicyFromProto(&pb), nil +} + +func timeToMs(t time.Time) int64 { + if t.IsZero() { + return 0 + } + return t.UnixMilli() +} + +// marshalSDKPolicy converts an SDK SandboxPolicy into camelCase JSON for the +// frontend, round-tripping through the proto with protojson for full fidelity. +func marshalSDKPolicy(p *openshell.SandboxPolicy) json.RawMessage { + raw, err := policyProtoMarshaler.Marshal(sandboxPolicyToProto(p)) + if err != nil { + return nil + } + return raw +} + +// RefreshStrategyAWSStsAssumeRole is defined in SDK types but not re-exported +// from openshell/v1. +const RefreshStrategyAWSStsAssumeRole openshell.RefreshStrategy = "AWSStsAssumeRole" + +// FromSDKProvider converts an SDK Provider to the JSON DTO. Credential values +// and handles are secret — only key names are surfaced. +func FromSDKProvider(provider *openshell.Provider) Provider { + if provider == nil { + return Provider{} + } + out := Provider{ + Metadata: ObjectMeta{ + ID: provider.ID, + Name: provider.Name, + Workspace: provider.Workspace, + Labels: provider.Labels, + Annotations: provider.Annotations, + CreatedAtMs: timeToMs(provider.CreatedAt), + ResourceVersion: provider.ResourceVersion, + }, + Type: provider.Type, + Config: provider.Spec.Config, + ProfileWorkspace: provider.Spec.ProfileWorkspace, + } + if provider.DeletionTimestamp != nil { + out.Metadata.DeletionTimestampMs = provider.DeletionTimestamp.UnixMilli() + } + if len(provider.Spec.CredentialExpiresAt) > 0 { + out.CredentialExpiresAtMs = make(map[string]int64, len(provider.Spec.CredentialExpiresAt)) + for k, t := range provider.Spec.CredentialExpiresAt { + out.CredentialExpiresAtMs[k] = timeToMs(t) + } + } + // Gateway responses omit Spec.Credentials (write-only). Names live on + // CredentialHandles after create. Union both so mocks and live reads work. + names := make(map[string]struct{}, len(provider.Spec.Credentials)+len(provider.Spec.CredentialHandles)) + for name := range provider.Spec.Credentials { + names[name] = struct{}{} + } + for name := range provider.Spec.CredentialHandles { + names[name] = struct{}{} + } + if len(names) > 0 { + out.CredentialNames = make([]string, 0, len(names)) + for name := range names { + out.CredentialNames = append(out.CredentialNames, name) + } + slices.Sort(out.CredentialNames) + } + return out +} + +// FromSDKRefreshStatus converts an SDK RefreshStatus to the JSON DTO. +func FromSDKRefreshStatus(status *openshell.RefreshStatus) CredentialRefreshStatus { + if status == nil { + return CredentialRefreshStatus{} + } + return CredentialRefreshStatus{ + CredentialKey: status.CredentialKey, + Strategy: sdkRefreshStrategyString(status.Strategy), + Status: status.Status, + ExpiresAtMs: timeToMs(status.ExpiresAt), + NextRefreshAtMs: timeToMs(status.NextRefreshAt), + LastRefreshAtMs: timeToMs(status.LastRefreshAt), + LastError: status.LastError, + } +} + +func sdkRefreshStrategyString(s openshell.RefreshStrategy) string { + switch s { + case openshell.RefreshStrategyStatic: + return "STATIC" + case openshell.RefreshStrategyExternal: + return "EXTERNAL" + case openshell.RefreshStrategyOAuth2RefreshToken: + return "OAUTH2_REFRESH_TOKEN" + case openshell.RefreshStrategyOAuth2ClientCredentials: + return "OAUTH2_CLIENT_CREDENTIALS" + case openshell.RefreshStrategyGoogleServiceAccountJWT: + return "GOOGLE_SERVICE_ACCOUNT_JWT" + case RefreshStrategyAWSStsAssumeRole: + return "AWS_STS_ASSUME_ROLE" + } + return "UNSPECIFIED" +} + +// FromSDKProviderProfile converts an SDK ProviderProfile to the JSON DTO. +func FromSDKProviderProfile(profile *openshell.ProviderProfile) ProviderProfile { + if profile == nil { + return ProviderProfile{Credentials: []ProfileCredential{}} + } + out := ProviderProfile{ + ID: profile.ID, + DisplayName: profile.DisplayName, + Description: profile.Description, + Category: sdkProfileCategoryString(profile.Category), + Credentials: []ProfileCredential{}, + InferenceCapable: profile.InferenceCapable, + Source: profile.Source, + Scope: profile.Scope, + ResourceVersion: profile.ResourceVersion, + } + for _, cred := range profile.Credentials { + out.Credentials = append(out.Credentials, ProfileCredential{ + Name: cred.Name, + Description: cred.Description, + EnvVars: cred.EnvVars, + Required: cred.Required, + AuthStyle: cred.AuthStyle, + }) + } + for _, endpoint := range profile.Endpoints { + if endpoint.Port > 0 { + out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", endpoint.Host, endpoint.Port)) + } else if endpoint.Host != "" { + out.Endpoints = append(out.Endpoints, endpoint.Host) + } + } + return out +} + +func sdkProfileCategoryString(c openshell.ProfileCategory) string { + switch c { + case openshell.ProfileCategoryOther: + return "OTHER" + case openshell.ProfileCategoryInference: + return "INFERENCE" + case openshell.ProfileCategoryAgent: + return "AGENT" + case openshell.ProfileCategorySourceControl: + return "SOURCE_CONTROL" + case openshell.ProfileCategoryMessaging: + return "MESSAGING" + case openshell.ProfileCategoryData: + return "DATA" + case openshell.ProfileCategoryKnowledge: + return "KNOWLEDGE" + } + return "UNSPECIFIED" +} + +// ParseSDKProfileCategory maps the frontend UPPER_SNAKE category to the SDK type. +func ParseSDKProfileCategory(s string) openshell.ProfileCategory { + switch s { + case "INFERENCE": + return openshell.ProfileCategoryInference + case "AGENT": + return openshell.ProfileCategoryAgent + case "SOURCE_CONTROL": + return openshell.ProfileCategorySourceControl + case "MESSAGING": + return openshell.ProfileCategoryMessaging + case "DATA": + return openshell.ProfileCategoryData + case "KNOWLEDGE": + return openshell.ProfileCategoryKnowledge + default: + return openshell.ProfileCategoryOther + } +} + +// FromSDKDiagnostics converts SDK profile diagnostics to JSON DTOs. +func FromSDKDiagnostics(diagnostics []openshell.ProfileDiagnostic) []ProviderProfileDiagnostic { + out := make([]ProviderProfileDiagnostic, 0, len(diagnostics)) + for _, d := range diagnostics { + out = append(out, ProviderProfileDiagnostic{ + Source: d.Source, + ProfileID: d.ProfileID, + Field: d.Field, + Message: d.Message, + Severity: d.Severity, + }) + } + return out +} + +func timePtrToMs(t *time.Time) int64 { + if t == nil { + return 0 + } + return t.UnixMilli() +} + +// FromSDKWorkspace converts an SDK Workspace to the JSON DTO. +func FromSDKWorkspace(ws *openshell.Workspace) Workspace { + if ws == nil { + return Workspace{Phase: "UNSPECIFIED"} + } + phase := strings.ToUpper(string(ws.Phase)) + if phase == "" || phase == "UNKNOWN" { + phase = "UNSPECIFIED" + } + return Workspace{ + Metadata: ObjectMeta{ + ID: ws.ID, + Name: ws.Name, + Workspace: ws.Workspace, + Labels: ws.Labels, + Annotations: ws.Annotations, + CreatedAtMs: timeToMs(ws.CreatedAt), + ResourceVersion: ws.ResourceVersion, + DeletionTimestampMs: timePtrToMs(ws.DeletionTimestamp), + }, + Phase: phase, + } +} + +// FromSDKWorkspaceMember converts an SDK WorkspaceMember to the JSON DTO. +func FromSDKWorkspaceMember(member *openshell.WorkspaceMember) WorkspaceMember { + if member == nil { + return WorkspaceMember{Role: "UNSPECIFIED"} + } + role := strings.ToUpper(string(member.Role)) + if role == "" || role == "UNKNOWN" { + role = "UNSPECIFIED" + } + return WorkspaceMember{ + Metadata: ObjectMeta{ + ID: member.ID, + Name: member.Name, + Labels: member.Labels, + Annotations: member.Annotations, + CreatedAtMs: timeToMs(member.CreatedAt), + ResourceVersion: member.ResourceVersion, + }, + PrincipalSubject: member.PrincipalSubject, + Role: role, + } +} + +// SDKWorkspaceRoleFromString maps USER/ADMIN to the SDK WorkspaceRole. +func SDKWorkspaceRoleFromString(role string) (openshell.WorkspaceRole, bool) { + switch role { + case "USER": + return openshell.WorkspaceRoleUser, true + case "ADMIN": + return openshell.WorkspaceRoleAdmin, true + } + return "", false +} + +func sdkPolicyLoadStatusString(status openshell.PolicyLoadStatus) string { + switch status { + case openshell.PolicyLoadStatusPending: + return "PENDING" + case openshell.PolicyLoadStatusLoaded: + return "LOADED" + case openshell.PolicyLoadStatusFailed: + return "FAILED" + case openshell.PolicyLoadStatusSuperseded: + return "SUPERSEDED" + } + return "UNSPECIFIED" +} + +// FromSDKPolicyRevision converts an SDK policy revision to the JSON DTO. +func FromSDKPolicyRevision(revision *openshell.SandboxPolicyRevision) PolicyRevision { + if revision == nil { + return PolicyRevision{Status: "UNSPECIFIED"} + } + out := PolicyRevision{ + Version: revision.Version, + PolicyHash: revision.PolicyHash, + Status: sdkPolicyLoadStatusString(revision.Status), + LoadError: revision.LoadError, + CreatedAtMs: timeToMs(revision.CreatedAt), + LoadedAtMs: timeToMs(revision.LoadedAt), + Provenance: revision.Provenance, + } + if revision.Policy != nil { + out.Policy = marshalSDKPolicy(revision.Policy) + } + return out +} + +// FromSDKPolicyStatus maps GetStatus into the dashboard view. Revisions is left +// empty — the handler fills history via GetStatus(WithVersion). +func FromSDKPolicyStatus(status *openshell.PolicyStatusResult) SandboxPolicyView { + if status == nil { + return SandboxPolicyView{Revisions: []PolicyRevision{}} + } + latest := FromSDKPolicyRevision(&status.Revision) + return SandboxPolicyView{ + ActiveVersion: status.ActiveVersion, + Latest: &latest, + Revisions: []PolicyRevision{}, + } +} + +// MarshalSDKNetworkPolicyRule converts an SDK NetworkPolicyRule to camelCase +// JSON, round-tripping through the proto for full fidelity. +func MarshalSDKNetworkPolicyRule(rule *openshell.NetworkPolicyRule) json.RawMessage { + if rule == nil { + return nil + } + raw, err := policyProtoMarshaler.Marshal(networkPolicyRuleToProto(rule)) + if err != nil { + return nil + } + return raw +} + +// ParseSDKNetworkPolicyRule parses camelCase JSON into an SDK NetworkPolicyRule, +// preserving every field via the proto round-trip. +func ParseSDKNetworkPolicyRule(raw json.RawMessage) (*openshell.NetworkPolicyRule, error) { + var pb sbv1.NetworkPolicyRule + if err := protojson.Unmarshal(raw, &pb); err != nil { + return nil, err + } + return networkPolicyRuleFromProto(&pb), nil +} + +// FromSDKDraftPolicy converts an SDK DraftPolicy to the JSON DTO. +func FromSDKDraftPolicy(draft *openshell.DraftPolicy) DraftPolicy { + if draft == nil { + return DraftPolicy{Chunks: []PolicyChunk{}} + } + out := DraftPolicy{ + Chunks: []PolicyChunk{}, + RollingSummary: draft.RollingSummary, + DraftVersion: draft.DraftVersion, + LastAnalyzedAtMs: timeToMs(draft.LastAnalyzedAt), + } + for i := range draft.Chunks { + chunk := &draft.Chunks[i] + item := PolicyChunk{ + ID: chunk.ID, + Status: chunk.Status, + RuleName: chunk.RuleName, + Rationale: chunk.Rationale, + SecurityNotes: chunk.SecurityNotes, + Confidence: chunk.Confidence, + CreatedAtMs: timeToMs(chunk.CreatedAt), + DecidedAtMs: timeToMs(chunk.DecidedAt), + HitCount: chunk.HitCount, + Binary: chunk.Binary, + ValidationResult: chunk.ValidationResult, + RejectionReason: chunk.RejectionReason, + } + if chunk.ProposedRule != nil { + item.ProposedRule = MarshalSDKNetworkPolicyRule(chunk.ProposedRule) + } + out.Chunks = append(out.Chunks, item) + } + return out +} + +// FromSDKDraftHistory converts SDK draft history entries to JSON DTOs. +func FromSDKDraftHistory(entries []openshell.DraftHistoryEntry) []DraftHistoryEntry { + out := make([]DraftHistoryEntry, 0, len(entries)) + for _, e := range entries { + out = append(out, DraftHistoryEntry{ + TimestampMs: timeToMs(e.Timestamp), + EventType: e.EventType, + Description: e.Description, + ChunkID: e.ChunkID, + }) + } + return out +} + +// FromSDKServiceEndpoint converts an SDK ServiceEndpoint to the JSON DTO. +func FromSDKServiceEndpoint(svc *openshell.ServiceEndpoint) ServiceEndpoint { + if svc == nil { + return ServiceEndpoint{} + } + return ServiceEndpoint{ + SandboxName: svc.SandboxName, + ServiceName: svc.ServiceName, + TargetPort: svc.TargetPort, + Domain: svc.Domain, + URL: svc.URL, + } +} + +func sdkSettingValueString(sv openshell.SettingValue) string { + switch sv.Type { + case openshell.SettingValueString: + return sv.StringVal + case openshell.SettingValueBool: + return fmt.Sprintf("%t", sv.BoolVal) + case openshell.SettingValueInt: + return fmt.Sprintf("%d", sv.IntVal) + case openshell.SettingValueBytes: + return fmt.Sprintf("%x", sv.BytesVal) + } + return "" +} + +// FromSDKGatewaySettings converts an SDK GatewayConfig to the JSON DTO. +func FromSDKGatewaySettings(config *openshell.GatewayConfig) GatewaySettings { + if config == nil { + return GatewaySettings{Settings: []SettingEntry{}} + } + out := GatewaySettings{ + Settings: []SettingEntry{}, + SettingsRevision: config.SettingsRevision, + } + for key, val := range config.Settings { + out.Settings = append(out.Settings, SettingEntry{ + Key: key, + Value: sdkSettingValueString(val), + }) + } + sort.Slice(out.Settings, func(i, j int) bool { + return out.Settings[i].Key < out.Settings[j].Key + }) + return out +} + +// FromSDKInferenceRoute converts an SDK InferenceRoute to the JSON DTO. +func FromSDKInferenceRoute(route *openshell.InferenceRoute) InferenceRoute { + if route == nil { + return InferenceRoute{} + } + return InferenceRoute{ + RouteName: route.RouteName, + ProviderName: route.ProviderName, + ModelID: route.ModelID, + Version: route.Version, + TimeoutSecs: route.TimeoutSecs, + } +} + +// FromSDKCurrentUser converts an SDK CurrentUser to the JSON DTO. +func FromSDKCurrentUser(user *openshell.CurrentUser) CurrentUser { + if user == nil { + return CurrentUser{} + } + return CurrentUser{ + Subject: user.Subject, + DisplayName: user.DisplayName, + Roles: user.Roles, + Scopes: user.Scopes, + IdentityProvider: user.IdentityProvider, + } +} + +func sdkServiceStatusString(status openshell.ServiceStatus) string { + switch status { + case openshell.ServiceStatusHealthy: + return "HEALTHY" + case openshell.ServiceStatusDegraded: + return "DEGRADED" + case openshell.ServiceStatusUnhealthy: + return "UNHEALTHY" + } + return "UNSPECIFIED" +} + +// FromSDKGatewayInfo converts an SDK GatewayInfo to the JSON DTO. +func FromSDKGatewayInfo(info *openshell.GatewayInfo) GatewayInfo { + if info == nil { + return GatewayInfo{Status: "UNSPECIFIED", ComputeDrivers: []ComputeDriver{}} + } + out := GatewayInfo{ + Status: sdkServiceStatusString(info.Status), + GatewayVersion: info.Version, + ComputeDrivers: []ComputeDriver{}, + } + for _, driver := range info.ComputeDrivers { + out.ComputeDrivers = append(out.ComputeDrivers, ComputeDriver{ + Name: driver.Name, + DriverName: driver.DriverName, + DriverVersion: driver.DriverVersion, + }) + } + return out +} + +// FromSDKSandboxLogs converts an SDK LogResult to the JSON DTO. +func FromSDKSandboxLogs(result *openshell.LogResult) SandboxLogs { + if result == nil { + return SandboxLogs{Logs: []LogLine{}} + } + out := SandboxLogs{Logs: []LogLine{}, BufferTotal: result.BufferTotal} + for _, line := range result.Lines { + out.Logs = append(out.Logs, LogLine{ + TimestampMs: timeToMs(line.Timestamp), + Level: line.Level, + Target: line.Target, + Message: line.Message, + Source: line.Source, + Fields: line.Fields, + }) + } + return out +} diff --git a/backend/internal/models/sdk_converters_test.go b/backend/internal/models/sdk_converters_test.go new file mode 100644 index 00000000..28a13acb --- /dev/null +++ b/backend/internal/models/sdk_converters_test.go @@ -0,0 +1,326 @@ +package models + +import ( + "encoding/json" + "strings" + "testing" + + openshell "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1" + "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types" +) + +func TestBuildSDKSandboxSpecBasic(t *testing.T) { + req := CreateSandboxRequest{ + Name: "test-sandbox", + Image: "ubuntu:latest", + Policy: json.RawMessage(`{"version":1,"filesystem":{"includeWorkdir":true}}`), + } + spec, err := BuildSDKSandboxSpec(req) + if err != nil { + t.Fatalf("BuildSDKSandboxSpec: %v", err) + } + if spec.Template == nil || spec.Template.Image != "ubuntu:latest" { + t.Errorf("image = %v, want ubuntu:latest", spec.Template) + } + if spec.Policy == nil || spec.Policy.Version != 1 { + t.Errorf("policy version = %v, want 1", spec.Policy) + } + if spec.Policy.Filesystem == nil || !spec.Policy.Filesystem.IncludeWorkdir { + t.Error("expected filesystem.includeWorkdir = true") + } +} + +func TestBuildSDKSandboxSpecWithGPU(t *testing.T) { + req := CreateSandboxRequest{ + Name: "gpu-sandbox", + Image: "nvidia/cuda", + GpuCount: 2, + Policy: json.RawMessage(`{"version":1}`), + } + spec, err := BuildSDKSandboxSpec(req) + if err != nil { + t.Fatalf("BuildSDKSandboxSpec: %v", err) + } + if spec.GPUCount == nil || *spec.GPUCount != 2 { + t.Errorf("GPUCount = %v, want 2", spec.GPUCount) + } +} + +func TestBuildSDKSandboxSpecWithCPUMemory(t *testing.T) { + req := CreateSandboxRequest{ + Name: "resource-sandbox", + Image: "ubuntu:latest", + CPU: "4", + Memory: "8Gi", + Policy: json.RawMessage(`{"version":1}`), + } + spec, err := BuildSDKSandboxSpec(req) + if err != nil { + t.Fatalf("BuildSDKSandboxSpec: %v", err) + } + if spec.Template.Resources == nil { + t.Fatal("expected Template.Resources to be set") + } + limits, ok := spec.Template.Resources["limits"] + if !ok { + t.Fatal("expected resources.limits to be set") + } + limitsMap, ok := limits.(map[string]any) + if !ok { + t.Fatalf("limits is %T, want map[string]any", limits) + } + if limitsMap["cpu"] != "4" { + t.Errorf("cpu = %v, want 4", limitsMap["cpu"]) + } + if limitsMap["memory"] != "8Gi" { + t.Errorf("memory = %v, want 8Gi", limitsMap["memory"]) + } +} + +func TestBuildSDKSandboxSpecInvalidPolicy(t *testing.T) { + req := CreateSandboxRequest{ + Name: "bad-policy", + Image: "ubuntu:latest", + Policy: json.RawMessage(`{invalid json`), + } + _, err := BuildSDKSandboxSpec(req) + if err == nil { + t.Fatal("expected error for invalid policy JSON") + } +} + +func TestFromSDKSandboxNil(t *testing.T) { + got := FromSDKSandbox(nil) + if got.Metadata.Name != "" || got.Status.Phase != "" { + t.Errorf("expected empty sandbox, got %+v", got) + } +} + +func TestFromSDKSandboxPhaseMapping(t *testing.T) { + cases := []struct { + phase openshell.SandboxPhase + want string + }{ + {openshell.SandboxProvisioning, "PROVISIONING"}, + {openshell.SandboxReady, "READY"}, + {openshell.SandboxError, "ERROR"}, + {openshell.SandboxDeleting, "DELETING"}, + {openshell.SandboxUnknown, "UNKNOWN"}, + } + for _, tc := range cases { + t.Run(string(tc.phase), func(t *testing.T) { + sb := &openshell.Sandbox{ + Status: openshell.SandboxStatus{Phase: tc.phase}, + } + result := FromSDKSandbox(sb) + if result.Status.Phase != tc.want { + t.Errorf("phase %q: got %q, want %q", tc.phase, result.Status.Phase, tc.want) + } + }) + } +} + +func TestFromSDKProviderStripsCredentials(t *testing.T) { + got := FromSDKProvider(&openshell.Provider{ + Name: "claude-prov", + Type: "claude", + Spec: openshell.ProviderSpec{ + Credentials: map[string]string{"api_key": "sk-secret"}, + Config: map[string]string{"region": "us"}, + }, + }) + if got.Type != "claude" { + t.Errorf("type = %q", got.Type) + } + if got.Config["region"] != "us" { + t.Errorf("config = %v", got.Config) + } + if len(got.CredentialNames) != 1 || got.CredentialNames[0] != "api_key" { + t.Errorf("credentialNames = %v, want [api_key]", got.CredentialNames) + } + raw, _ := json.Marshal(got) + if strings.Contains(string(raw), "sk-secret") { + t.Errorf("leaked credential value: %s", raw) + } +} + +func TestFromSDKProviderCredentialNamesFromHandles(t *testing.T) { + got := FromSDKProvider(&openshell.Provider{ + Name: "claude-prov", + Type: "claude", + Spec: openshell.ProviderSpec{ + CredentialHandles: map[string]types.CredentialHandle{ + "api_key": {Driver: "vault", Handle: "vault://must-not-leak"}, + }, + }, + }) + if len(got.CredentialNames) != 1 || got.CredentialNames[0] != "api_key" { + t.Errorf("credentialNames = %v, want [api_key]", got.CredentialNames) + } + raw, _ := json.Marshal(got) + if strings.Contains(string(raw), "vault://must-not-leak") || strings.Contains(string(raw), "vault") { + t.Errorf("leaked credential handle: %s", raw) + } +} + +func TestFromSDKProviderNil(t *testing.T) { + got := FromSDKProvider(nil) + if got.Type != "" || got.Metadata.Name != "" { + t.Errorf("expected empty provider, got %+v", got) + } +} + +func TestFromSDKRefreshStatusStrategies(t *testing.T) { + tests := []struct { + want string + strategy openshell.RefreshStrategy + }{ + {want: "STATIC", strategy: openshell.RefreshStrategyStatic}, + {want: "EXTERNAL", strategy: openshell.RefreshStrategyExternal}, + {want: "OAUTH2_REFRESH_TOKEN", strategy: openshell.RefreshStrategyOAuth2RefreshToken}, + {want: "OAUTH2_CLIENT_CREDENTIALS", strategy: openshell.RefreshStrategyOAuth2ClientCredentials}, + {want: "GOOGLE_SERVICE_ACCOUNT_JWT", strategy: openshell.RefreshStrategyGoogleServiceAccountJWT}, + {want: "AWS_STS_ASSUME_ROLE", strategy: RefreshStrategyAWSStsAssumeRole}, + {want: "UNSPECIFIED", strategy: "nope"}, + } + for _, tc := range tests { + t.Run(tc.want, func(t *testing.T) { + got := FromSDKRefreshStatus(&openshell.RefreshStatus{ + CredentialKey: "api_key", + Strategy: tc.strategy, + Status: "active", + }) + if got.Strategy != tc.want { + t.Errorf("strategy = %q, want %q", got.Strategy, tc.want) + } + }) + } +} + +func TestFromSDKProviderProfileCategories(t *testing.T) { + tests := []struct { + want string + category openshell.ProfileCategory + }{ + {want: "OTHER", category: openshell.ProfileCategoryOther}, + {want: "INFERENCE", category: openshell.ProfileCategoryInference}, + {want: "AGENT", category: openshell.ProfileCategoryAgent}, + {want: "SOURCE_CONTROL", category: openshell.ProfileCategorySourceControl}, + {want: "MESSAGING", category: openshell.ProfileCategoryMessaging}, + {want: "DATA", category: openshell.ProfileCategoryData}, + {want: "KNOWLEDGE", category: openshell.ProfileCategoryKnowledge}, + {want: "UNSPECIFIED", category: "nope"}, + } + for _, tc := range tests { + t.Run(tc.want, func(t *testing.T) { + got := FromSDKProviderProfile(&openshell.ProviderProfile{ + ID: "p", + Category: tc.category, + Endpoints: []openshell.NetworkEndpoint{ + {Host: "api.example.com", Port: 443}, + }, + }) + if got.Category != tc.want { + t.Errorf("category = %q, want %q", got.Category, tc.want) + } + if len(got.Endpoints) != 1 || got.Endpoints[0] != "api.example.com:443" { + t.Errorf("endpoints = %v, want [api.example.com:443]", got.Endpoints) + } + }) + } +} + +func TestParseSDKProfileCategory(t *testing.T) { + if ParseSDKProfileCategory("INFERENCE") != openshell.ProfileCategoryInference { + t.Error("INFERENCE should map to ProfileCategoryInference") + } + if ParseSDKProfileCategory("unknown") != openshell.ProfileCategoryOther { + t.Error("unknown should default to Other") + } +} + +func TestFromSDKDiagnostics(t *testing.T) { + got := FromSDKDiagnostics([]openshell.ProfileDiagnostic{ + {Source: "import", ProfileID: "custom-llm", Field: "credentials[0].name", Message: "name is required", Severity: "error"}, + }) + if len(got) != 1 { + t.Fatalf("got %d, want 1", len(got)) + } + if got[0].ProfileID != "custom-llm" || got[0].Severity != "error" { + t.Errorf("diagnostic = %+v", got[0]) + } + if len(FromSDKDiagnostics(nil)) != 0 { + t.Error("nil diagnostics should yield empty slice") + } +} + +func TestSDKWorkspaceRoleFromString(t *testing.T) { + role, ok := SDKWorkspaceRoleFromString("USER") + if !ok || role != openshell.WorkspaceRoleUser { + t.Errorf("USER = %q ok=%v", role, ok) + } + role, ok = SDKWorkspaceRoleFromString("ADMIN") + if !ok || role != openshell.WorkspaceRoleAdmin { + t.Errorf("ADMIN = %q ok=%v", role, ok) + } + if _, ok := SDKWorkspaceRoleFromString("nope"); ok { + t.Error("expected invalid role to fail") + } +} + +func TestFromSDKWorkspacePhaseMapping(t *testing.T) { + got := FromSDKWorkspace(&openshell.Workspace{Name: "ws", Phase: openshell.WorkspaceActive}) + if got.Phase != "ACTIVE" || got.Metadata.Name != "ws" { + t.Errorf("got %+v", got) + } + got = FromSDKWorkspace(&openshell.Workspace{Name: "ws", Phase: openshell.WorkspaceUnknown}) + if got.Phase != "UNSPECIFIED" { + t.Errorf("unknown phase = %q, want UNSPECIFIED", got.Phase) + } +} + +func TestFromSDKPolicyStatusLatestOnly(t *testing.T) { + view := FromSDKPolicyStatus(&openshell.PolicyStatusResult{ + ActiveVersion: 3, + Revision: openshell.SandboxPolicyRevision{Version: 3, Status: openshell.PolicyLoadStatusLoaded}, + }) + if view.ActiveVersion != 3 || view.Latest == nil || view.Latest.Status != "LOADED" { + t.Errorf("view = %+v", view) + } + if len(view.Revisions) != 0 { + t.Errorf("revisions = %d, want 0 (handler fills history)", len(view.Revisions)) + } +} + +func TestFromSDKSandboxLogs(t *testing.T) { + got := FromSDKSandboxLogs(&openshell.LogResult{ + BufferTotal: 4, + Lines: []openshell.LogLine{ + {Message: "hi", Level: "INFO", Source: "gateway"}, + }, + }) + if got.BufferTotal != 4 || len(got.Logs) != 1 || got.Logs[0].Message != "hi" { + t.Errorf("got %+v", got) + } +} + +func TestFromSDKGatewayInfo(t *testing.T) { + got := FromSDKGatewayInfo(&openshell.GatewayInfo{ + Status: openshell.ServiceStatusHealthy, + Version: "1.2.3", + ComputeDrivers: []openshell.ComputeDriverInfo{{Name: "podman"}}, + }) + if got.Status != "HEALTHY" || got.GatewayVersion != "1.2.3" || len(got.ComputeDrivers) != 1 { + t.Errorf("got %+v", got) + } +} + +func TestParseSDKNetworkPolicyRule(t *testing.T) { + rule, err := ParseSDKNetworkPolicyRule(json.RawMessage(`{"name":"allow-api","endpoints":[{"host":"api.example.com","port":443}]}`)) + if err != nil { + t.Fatalf("ParseSDKNetworkPolicyRule: %v", err) + } + if rule.Name != "allow-api" || len(rule.Endpoints) != 1 || rule.Endpoints[0].Host != "api.example.com" { + t.Errorf("rule = %+v", rule) + } +} diff --git a/backend/internal/sdkclient/auth.go b/backend/internal/sdkclient/auth.go new file mode 100644 index 00000000..10d800db --- /dev/null +++ b/backend/internal/sdkclient/auth.go @@ -0,0 +1,26 @@ +package sdkclient + +import ( + "context" + + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" +) + +// ContextAuthProvider implements grpc.PerRPCCredentials by reading the JWT +// from the request context on every gRPC call. This allows a single shared +// SDK client to forward per-request user tokens to the gateway. +type ContextAuthProvider struct { + RequireTLS bool +} + +func (c ContextAuthProvider) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) { + token := auth.TokenFromContext(ctx) + if token == "" { + return nil, nil + } + return map[string]string{"authorization": "Bearer " + token}, nil +} + +func (c ContextAuthProvider) RequireTransportSecurity() bool { + return c.RequireTLS +} diff --git a/backend/internal/sdkclient/rawexec.go b/backend/internal/sdkclient/rawexec.go new file mode 100644 index 00000000..baa713fd --- /dev/null +++ b/backend/internal/sdkclient/rawexec.go @@ -0,0 +1,106 @@ +package sdkclient + +import ( + "context" + "crypto/tls" + "crypto/x509" + "fmt" + "io" + "os" + "strings" + + pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1" + "google.golang.org/grpc" + "google.golang.org/grpc/credentials" + "google.golang.org/grpc/credentials/insecure" +) + +// RawExecClient performs the gateway's non-TTY, stdin-carrying ExecSandbox RPC, +// which the OpenShell Go SDK does not expose (its Run has no stdin and its +// Interactive forces a PTY). It exists solely so binary file uploads run +// through a clean pipe — `dd` with Stdin bytes and Tty=false — instead of a +// PTY, whose line discipline (EOF/flow-control bytes, CR/LF translation, echo) +// silently corrupts binary content. It shares the same address, TLS, and +// per-request bearer forwarding as the main SDK client. +type RawExecClient struct { + conn *grpc.ClientConn + client pb.OpenShellClient +} + +// NewRawExecClient dials the gateway. address is host:port (no URL scheme). +// When useTLS is set, caFile (optional) verifies the server and clientCert + +// clientKey (optional, both required together) enable mTLS client auth — the +// same knobs the SDK client uses, so upload honors gateway mTLS too. +func NewRawExecClient(address, caFile, clientCert, clientKey string, useTLS bool) (*RawExecClient, error) { + var creds credentials.TransportCredentials + if useTLS { + tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12} + if caFile != "" { + pem, err := os.ReadFile(caFile) + if err != nil { + return nil, fmt.Errorf("read gateway CA cert: %w", err) + } + pool := x509.NewCertPool() + if !pool.AppendCertsFromPEM(pem) { + return nil, fmt.Errorf("no valid certificates in %s", caFile) + } + tlsCfg.RootCAs = pool + } + if clientCert != "" && clientKey != "" { + cert, err := tls.LoadX509KeyPair(clientCert, clientKey) + if err != nil { + return nil, fmt.Errorf("load gateway client cert/key: %w", err) + } + tlsCfg.Certificates = []tls.Certificate{cert} + } + creds = credentials.NewTLS(tlsCfg) + } else { + creds = insecure.NewCredentials() + } + conn, err := grpc.NewClient(address, + grpc.WithTransportCredentials(creds), + grpc.WithPerRPCCredentials(ContextAuthProvider{RequireTLS: useTLS}), + ) + if err != nil { + return nil, err + } + return &RawExecClient{conn: conn, client: pb.NewOpenShellClient(conn)}, nil +} + +// Close closes the underlying gRPC connection. +func (r *RawExecClient) Close() error { return r.conn.Close() } + +// ExecWithStdin runs command in the sandbox (identified by UUID) with stdin +// piped in and no TTY, returning merged stdout+stderr and the process exit +// code. exitCode is -1 if the gateway sent no exit event. +func (r *RawExecClient) ExecWithStdin(ctx context.Context, sandboxID string, command []string, stdin []byte) (string, int, error) { + stream, err := r.client.ExecSandbox(ctx, &pb.ExecSandboxRequest{ + SandboxId: sandboxID, + Command: command, + Stdin: stdin, + Tty: false, + }) + if err != nil { + return "", 0, err + } + var out strings.Builder + exitCode := -1 + for { + ev, recvErr := stream.Recv() + if recvErr == io.EOF { + break + } + if recvErr != nil { + return out.String(), exitCode, recvErr + } + switch p := ev.Payload.(type) { + case *pb.ExecSandboxEvent_Stdout: + out.Write(p.Stdout.GetData()) + case *pb.ExecSandboxEvent_Stderr: + out.Write(p.Stderr.GetData()) + case *pb.ExecSandboxEvent_Exit: + exitCode = int(p.Exit.GetExitCode()) + } + } + return out.String(), exitCode, nil +} diff --git a/backend/internal/sdkclient/rawexec_test.go b/backend/internal/sdkclient/rawexec_test.go new file mode 100644 index 00000000..e89e7f57 --- /dev/null +++ b/backend/internal/sdkclient/rawexec_test.go @@ -0,0 +1,93 @@ +package sdkclient + +import ( + "context" + "net" + "testing" + + pb "github.com/NVIDIA/OpenShell/sdk/go/proto/openshellv1" + "google.golang.org/grpc" + "google.golang.org/grpc/credentials/insecure" + "google.golang.org/grpc/test/bufconn" +) + +// fakeExecServer captures the ExecSandbox request and replays a fixed event +// sequence (stdout, stderr, exit). +type fakeExecServer struct { + pb.UnimplementedOpenShellServer + gotReq *pb.ExecSandboxRequest + exitCode int32 +} + +func (f *fakeExecServer) ExecSandbox(req *pb.ExecSandboxRequest, stream grpc.ServerStreamingServer[pb.ExecSandboxEvent]) error { + f.gotReq = req + if err := stream.Send(&pb.ExecSandboxEvent{Payload: &pb.ExecSandboxEvent_Stdout{Stdout: &pb.ExecSandboxStdout{Data: []byte("out")}}}); err != nil { + return err + } + if err := stream.Send(&pb.ExecSandboxEvent{Payload: &pb.ExecSandboxEvent_Stderr{Stderr: &pb.ExecSandboxStderr{Data: []byte("err")}}}); err != nil { + return err + } + return stream.Send(&pb.ExecSandboxEvent{Payload: &pb.ExecSandboxEvent_Exit{Exit: &pb.ExecSandboxExit{ExitCode: f.exitCode}}}) +} + +func newTestRawExec(t *testing.T, fake *fakeExecServer) *RawExecClient { + t.Helper() + lis := bufconn.Listen(1 << 20) + srv := grpc.NewServer() + pb.RegisterOpenShellServer(srv, fake) + go func() { _ = srv.Serve(lis) }() + + conn, err := grpc.NewClient("passthrough:///bufnet", + grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return lis.DialContext(ctx) }), + grpc.WithTransportCredentials(insecure.NewCredentials()), + ) + if err != nil { + t.Fatalf("dial: %v", err) + } + t.Cleanup(func() { + _ = conn.Close() + srv.Stop() + }) + return &RawExecClient{conn: conn, client: pb.NewOpenShellClient(conn)} +} + +func TestExecWithStdinForwardsRawBytesNoTTY(t *testing.T) { + fake := &fakeExecServer{exitCode: 0} + rc := newTestRawExec(t, fake) + + // Binary payload with control bytes a PTY would corrupt. + payload := []byte("bin\x00\x04\x03\x11\x13data") + stdout, code, err := rc.ExecWithStdin(context.Background(), "sb-uuid", []string{"dd", "of=/x"}, payload) + if err != nil { + t.Fatalf("ExecWithStdin: %v", err) + } + if code != 0 { + t.Errorf("exit code = %d, want 0", code) + } + if stdout != "outerr" { + t.Errorf("stdout = %q, want %q (stdout+stderr merged)", stdout, "outerr") + } + if fake.gotReq.GetTty() { + t.Error("Tty = true, want false (non-TTY exec required for binary fidelity)") + } + if string(fake.gotReq.GetStdin()) != string(payload) { + t.Errorf("stdin = %q, want %q (exact bytes, unmangled)", fake.gotReq.GetStdin(), payload) + } + if fake.gotReq.GetSandboxId() != "sb-uuid" { + t.Errorf("sandboxId = %q, want sb-uuid", fake.gotReq.GetSandboxId()) + } + if got := fake.gotReq.GetCommand(); len(got) != 2 || got[0] != "dd" || got[1] != "of=/x" { + t.Errorf("command = %v", got) + } +} + +func TestExecWithStdinNonZeroExit(t *testing.T) { + rc := newTestRawExec(t, &fakeExecServer{exitCode: 1}) + _, code, err := rc.ExecWithStdin(context.Background(), "sb", []string{"dd"}, []byte("x")) + if err != nil { + t.Fatalf("ExecWithStdin: %v", err) + } + if code != 1 { + t.Errorf("exit code = %d, want 1", code) + } +} diff --git a/scripts/dev-env.sh b/scripts/dev-env.sh index 90b02ac1..ad7568ca 100755 --- a/scripts/dev-env.sh +++ b/scripts/dev-env.sh @@ -604,7 +604,7 @@ write_env_file() { cat > "$ENV_FILE" <