signet-client 0.4.0

// @generated
// This file is @generated by prost-build.
// --- AdminService messages ---

#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnsealKeyRequest {
    #[prost(bytes="vec", tag="1")]
    pub key: ::prost::alloc::vec::Vec<u8>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnsealKeyResponse {
    #[prost(bool, tag="1")]
    pub unsealed: bool,
    #[prost(int32, tag="2")]
    pub shares_received: i32,
    #[prost(int32, tag="3")]
    pub shares_required: i32,
    #[prost(string, tag="4")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnsealShareRequest {
    #[prost(bytes="vec", tag="1")]
    pub share: ::prost::alloc::vec::Vec<u8>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct UnsealShareResponse {
    #[prost(bool, tag="1")]
    pub unsealed: bool,
    #[prost(int32, tag="2")]
    pub shares_received: i32,
    #[prost(int32, tag="3")]
    pub shares_required: i32,
    #[prost(string, tag="4")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SealRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SealResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct StatusRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct StatusResponse {
    #[prost(enumeration="status_response::State", tag="1")]
    pub state: i32,
    #[prost(int32, tag="2")]
    pub shares_received: i32,
    #[prost(int32, tag="3")]
    pub shares_required: i32,
    #[prost(string, tag="4")]
    pub version: ::prost::alloc::string::String,
}
/// Nested message and enum types in `StatusResponse`.
pub mod status_response {
    #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
    #[repr(i32)]
    pub enum State {
        Unspecified = 0,
        Sealed = 1,
        Unsealing = 2,
        Unsealed = 3,
    }
    impl State {
        /// String value of the enum field names used in the ProtoBuf definition.
        ///
        /// The values are not transformed in any way and thus are considered stable
        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
        pub fn as_str_name(&self) -> &'static str {
            match self {
                Self::Unspecified => "STATE_UNSPECIFIED",
                Self::Sealed => "STATE_SEALED",
                Self::Unsealing => "STATE_UNSEALING",
                Self::Unsealed => "STATE_UNSEALED",
            }
        }
        /// Creates an enum from field names used in the ProtoBuf definition.
        pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
            match value {
                "STATE_UNSPECIFIED" => Some(Self::Unspecified),
                "STATE_SEALED" => Some(Self::Sealed),
                "STATE_UNSEALING" => Some(Self::Unsealing),
                "STATE_UNSEALED" => Some(Self::Unsealed),
                _ => None,
            }
        }
    }
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateKekRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateKekResponse {
    #[prost(string, tag="1")]
    pub new_kek_id: ::prost::alloc::string::String,
    /// old_kek_id is retained (deactivated, not deleted) so DEKs wrapped before
    /// rotation completes remain decryptable until PruneKEK is called.
    #[prost(string, tag="2")]
    pub old_kek_id: ::prost::alloc::string::String,
    /// secrets_rewrapped is the number of DEKs successfully re-wrapped under
    /// the new KEK during this call.
    #[prost(int32, tag="3")]
    pub secrets_rewrapped: i32,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListKeKsRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KekInfo {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    #[prost(bool, tag="2")]
    pub is_active: bool,
    #[prost(string, tag="3")]
    pub created_at: ::prost::alloc::string::String,
    /// empty if still active
    #[prost(string, tag="4")]
    pub deactivated_at: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListKeKsResponse {
    #[prost(message, repeated, tag="1")]
    pub keks: ::prost::alloc::vec::Vec<KekInfo>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PruneKekRequest {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PruneKekResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateMasterKeyRequest {
    /// new_key must be exactly 32 bytes.
    #[prost(bytes="vec", tag="1")]
    pub new_key: ::prost::alloc::vec::Vec<u8>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateMasterKeyResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
    #[prost(int32, tag="2")]
    pub keks_rewrapped: i32,
}
// --- Policy messages ---

#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreatePolicyRequest {
    /// spiffe_id is a glob matched against the caller's SPIFFE ID. '*' matches
    /// any single path segment (does not cross '/'); e.g.
    /// "spiffe://cluster.local/ns/*/sa/echo" matches the "echo" service account
    /// in any namespace. To grant access to every workload in the trust domain,
    /// use "spiffe://cluster.local/ns/*/sa/*" — a bare "**" is NOT supported
    /// (this is Go's path.Match, not a shell/gitignore-style glob engine).
    #[prost(string, tag="1")]
    pub spiffe_id: ::prost::alloc::string::String,
    /// namespace is the target secret's namespace, or "*" for any namespace.
    #[prost(string, tag="2")]
    pub namespace: ::prost::alloc::string::String,
    /// service is the target secret's service. Combined with secret_name into
    /// a "namespace/service/secret_name" pattern evaluated the same way.
    #[prost(string, tag="3")]
    pub service: ::prost::alloc::string::String,
    /// secret_name is a glob for the secret name within namespace/service.
    /// Defaults to "*" (every secret in that namespace/service) if empty.
    #[prost(string, tag="4")]
    pub secret_name: ::prost::alloc::string::String,
    /// permissions granted, e.g. \["read"\]. "*" grants every permission.
    /// Defaults to \["read"\] if empty.
    #[prost(string, repeated, tag="5")]
    pub permissions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct CreatePolicyResponse {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListPoliciesRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PolicyInfo {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub spiffe_id: ::prost::alloc::string::String,
    #[prost(string, tag="3")]
    pub namespace: ::prost::alloc::string::String,
    /// pattern is the full "namespace/service/secret_name"-shaped glob as
    /// stored — service and secret_name are not tracked as separate fields.
    #[prost(string, tag="4")]
    pub pattern: ::prost::alloc::string::String,
    #[prost(string, repeated, tag="5")]
    pub permissions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    #[prost(string, tag="6")]
    pub created_at: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListPoliciesResponse {
    #[prost(message, repeated, tag="1")]
    pub policies: ::prost::alloc::vec::Vec<PolicyInfo>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeletePolicyRequest {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeletePolicyResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
}
// --- GitOpsService messages ---

#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSopsPublicKeyRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetSopsPublicKeyResponse {
    /// age public key in bech32 format (age1...). Add to .sops.yaml as an age recipient.
    #[prost(string, tag="1")]
    pub public_key: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub fingerprint: ::prost::alloc::string::String,
    #[prost(string, tag="3")]
    pub created_at: ::prost::alloc::string::String,
    /// environment this key is scoped to; empty = global (usable by any environment).
    #[prost(string, tag="4")]
    pub environment: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateSopsKeyRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RotateSopsKeyResponse {
    #[prost(string, tag="1")]
    pub new_public_key: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub new_fingerprint: ::prost::alloc::string::String,
    /// old_public_key is retained for decryption until pruned.
    #[prost(string, tag="3")]
    pub old_public_key: ::prost::alloc::string::String,
    /// environment the new key is scoped to; empty = global.
    #[prost(string, tag="4")]
    pub new_environment: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListSopsKeysRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SopsKeyInfo {
    #[prost(string, tag="1")]
    pub public_key: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub fingerprint: ::prost::alloc::string::String,
    #[prost(bool, tag="3")]
    pub is_active: bool,
    #[prost(string, tag="4")]
    pub created_at: ::prost::alloc::string::String,
    /// empty if still active
    #[prost(string, tag="5")]
    pub deactivated_at: ::prost::alloc::string::String,
    /// environment this key is scoped to; empty = global.
    #[prost(string, tag="6")]
    pub environment: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListSopsKeysResponse {
    #[prost(message, repeated, tag="1")]
    pub keys: ::prost::alloc::vec::Vec<SopsKeyInfo>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PruneSopsKeyRequest {
    #[prost(string, tag="1")]
    pub public_key: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct PruneSopsKeyResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RegisterRepositoryRequest {
    /// human alias, e.g. "infra-secrets"
    #[prost(string, tag="1")]
    pub name: ::prost::alloc::string::String,
    /// <https://github.com/org/repo>
    #[prost(string, tag="2")]
    pub repo_url: ::prost::alloc::string::String,
    /// e.g. "main"
    #[prost(string, tag="3")]
    pub branch: ::prost::alloc::string::String,
    /// path within repo, e.g. "secrets/"
    #[prost(string, tag="4")]
    pub secrets_path: ::prost::alloc::string::String,
    /// PEM-encoded SSH private key for read-only deploy access.
    #[prost(bytes="vec", tag="5")]
    pub deploy_key: ::prost::alloc::vec::Vec<u8>,
    /// config_path is the directory prefix within the repo that holds plain YAML
    /// config files, e.g. "config/". Leave empty to disable config sync.
    #[prost(string, tag="6")]
    pub config_path: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RegisterRepositoryResponse {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    /// webhook_url is the endpoint to configure in GitHub (Settings → Webhooks).
    #[prost(string, tag="2")]
    pub webhook_url: ::prost::alloc::string::String,
    /// webhook_secret is the shared HMAC secret to configure in GitHub.
    /// Shown only on registration; not retrievable afterwards.
    #[prost(string, tag="3")]
    pub webhook_secret: ::prost::alloc::string::String,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListRepositoriesRequest {
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RepositoryInfo {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
    #[prost(string, tag="2")]
    pub name: ::prost::alloc::string::String,
    #[prost(string, tag="3")]
    pub repo_url: ::prost::alloc::string::String,
    #[prost(string, tag="4")]
    pub branch: ::prost::alloc::string::String,
    #[prost(string, tag="5")]
    pub secrets_path: ::prost::alloc::string::String,
    #[prost(string, tag="6")]
    pub last_sync_sha: ::prost::alloc::string::String,
    #[prost(string, tag="7")]
    pub last_sync_at: ::prost::alloc::string::String,
    #[prost(string, tag="8")]
    pub config_path: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListRepositoriesResponse {
    #[prost(message, repeated, tag="1")]
    pub repositories: ::prost::alloc::vec::Vec<RepositoryInfo>,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveRepositoryRequest {
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RemoveRepositoryResponse {
    #[prost(string, tag="1")]
    pub message: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerSyncRequest {
    /// repository id
    #[prost(string, tag="1")]
    pub id: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct TriggerSyncResponse {
    #[prost(int32, tag="1")]
    pub secrets_added: i32,
    #[prost(int32, tag="2")]
    pub secrets_updated: i32,
    #[prost(int32, tag="3")]
    pub secrets_deleted: i32,
    #[prost(string, tag="4")]
    pub sync_sha: ::prost::alloc::string::String,
    #[prost(string, repeated, tag="5")]
    pub errors: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    #[prost(int32, tag="6")]
    pub configs_synced: i32,
}
// --- SyncBundle messages ---

/// SyncBundleChunk is a single streaming message for the SyncBundle RPC.
/// The first message must contain a SyncBundleHeader; all subsequent messages
/// must contain raw tar.gz archive bytes.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SyncBundleChunk {
    #[prost(oneof="sync_bundle_chunk::Payload", tags="1, 2")]
    pub payload: ::core::option::Option<sync_bundle_chunk::Payload>,
}
/// Nested message and enum types in `SyncBundleChunk`.
pub mod sync_bundle_chunk {
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum Payload {
        #[prost(message, tag="1")]
        Header(super::SyncBundleHeader),
        #[prost(bytes, tag="2")]
        Data(::prost::alloc::vec::Vec<u8>),
    }
}
/// SyncBundleHeader carries metadata sent as the first SyncBundleChunk.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SyncBundleHeader {
    /// secrets_path is the directory prefix within the repo that holds secrets,
    /// e.g. "secrets/". Defaults to "secrets/" if empty.
    #[prost(string, tag="1")]
    pub secrets_path: ::prost::alloc::string::String,
    /// head_sha is the HEAD commit SHA of the local repo, used for audit logging.
    /// May be empty for non-git sources.
    #[prost(string, tag="2")]
    pub head_sha: ::prost::alloc::string::String,
    /// config_path is the directory prefix for plain YAML config files, e.g. "config/".
    /// Leave empty to skip config sync.
    #[prost(string, tag="3")]
    pub config_path: ::prost::alloc::string::String,
}
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SyncBundleResponse {
    #[prost(int32, tag="1")]
    pub secrets_added: i32,
    #[prost(int32, tag="2")]
    pub secrets_updated: i32,
    #[prost(int32, tag="3")]
    pub secrets_deleted: i32,
    #[prost(string, tag="4")]
    pub sync_sha: ::prost::alloc::string::String,
    #[prost(string, repeated, tag="5")]
    pub errors: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    #[prost(int32, tag="6")]
    pub configs_synced: i32,
}
include!("admin.v1.tonic.rs");
// @@protoc_insertion_point(module)