spire-api 0.6.0

// This file is @generated by prost-build.
/// X.509 SPIFFE Verifiable Identity Document with the private key.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct X509svidWithKey {
    /// The workload X509-SVID.
    #[prost(message, optional, tag = "1")]
    pub x509_svid: ::core::option::Option<super::super::super::types::X509svid>,
    /// Private key (encoding DER PKCS#8).
    #[prost(bytes = "bytes", tag = "2")]
    pub x509_svid_key: ::prost::bytes::Bytes,
}
/// SubscribeToX509SVIDsRequest is used by clients to subscribe the set of SVIDs that
/// any given workload is entitled to. Clients subscribe to a workload's SVIDs by providing
/// one-of
///
/// * a set of selectors describing the workload.
/// * a PID of a workload process.
///   Specifying both at the same time is not allowed.
///
/// Subscribers are expected to ensure that the PID they use is not recycled
/// for the lifetime of the stream, and in the event that it is, are expected
/// to immediately close the stream.
///
/// TODO we should use `oneof` here but you currently cannot use `repeated`
/// in a `oneof` without creating and nesting an intermediate `message` type, which would break
/// back compat - so we accept both and check for mutual exclusion in the handler
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToX509sviDsRequest {
    /// Selectors describing the workload to subscribe to. Mutually exclusive with `pid`.
    #[prost(message, repeated, tag = "1")]
    pub selectors: ::prost::alloc::vec::Vec<super::super::super::types::Selector>,
    /// PID for the workload to subscribe to. Mutually exclusive with `selectors`
    #[prost(int32, tag = "2")]
    pub pid: i32,
}
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToX509sviDsResponse {
    #[prost(message, repeated, tag = "1")]
    pub x509_svids: ::prost::alloc::vec::Vec<X509svidWithKey>,
    /// Names of the trust domains that this workload should federates with.
    #[prost(string, repeated, tag = "2")]
    pub federates_with: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubscribeToX509BundlesRequest {}
/// SubscribeToX509BundlesResponse contains all bundles that the agent is tracking,
/// including the local bundle. When an update occurs, or bundles are added or removed,
/// a new response with the full set of bundles is sent.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToX509BundlesResponse {
    /// A map keyed by trust domain name, with ASN.1 DER-encoded
    /// X.509 CA certificates as the values
    #[prost(map = "string, bytes", tag = "1")]
    pub ca_certificates:
        ::std::collections::HashMap<::prost::alloc::string::String, ::prost::bytes::Bytes>,
}
/// FetchJWTSVIDsRequest is used by clients to fetch a JWT-SVID for a workload.
/// Clients may provide one-of
///
/// * a set of selectors describing the workload.
/// * a PID of a workload process.
///   Specifying both at the same time is not allowed.
///
/// Callers are expected to ensure that the PID they use is not recycled
/// until obtaining a response, and in the event that it is, are expected
/// to discard the response of this call.
///
/// TODO we should use `oneof` here but you currently cannot use `repeated`
/// in a `oneof` without creating and nesting an intermediate `message` type, which would break
/// back compat - so we accept both and check for mutual exclusion in the handler
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct FetchJwtsviDsRequest {
    /// Required. The audience(s) the workload intends to authenticate against.
    #[prost(string, repeated, tag = "1")]
    pub audience: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Selectors describing the workload to subscribe to. Mutually exclusive with `pid`
    #[prost(message, repeated, tag = "2")]
    pub selectors: ::prost::alloc::vec::Vec<super::super::super::types::Selector>,
    /// PID for the workload to subscribe to. Mutually exclusive with `selectors`.
    #[prost(int32, tag = "3")]
    pub pid: i32,
}
/// The FetchJWTSVIDsResponse message conveys JWT-SVIDs.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct FetchJwtsviDsResponse {
    /// Required. The list of returned JWT-SVIDs.
    #[prost(message, repeated, tag = "1")]
    pub svids: ::prost::alloc::vec::Vec<super::super::super::types::Jwtsvid>,
}
/// The SubscribeToJWTBundlesRequest message conveys parameters for requesting JWKS bundles.
/// There are currently no such parameters.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubscribeToJwtBundlesRequest {}
/// The SubscribeToJWTBundlesReponse conveys JWKS bundles.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToJwtBundlesResponse {
    /// Required. JWK encoded JWT bundles, keyed by the SPIFFE ID of the trust
    /// domain.
    #[prost(map = "string, bytes", tag = "1")]
    pub bundles: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::bytes::Bytes>,
}
/// Generated client implementations.
pub mod delegated_identity_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value
    )]
    use tonic::codegen::http::Uri;
    use tonic::codegen::*;
    /// The delegatedIdentity service provides an interface to get the SVIDs of other
    /// workloads on the host. This service is intended for use cases where a process
    /// (different than the workload one) should access the workload's SVID to
    /// perform actions on behalf of the workload. One example of is using a single
    /// node instance of Envoy that upgrades TCP connections for different processes
    /// running in such a node.
    ///
    /// The caller must be local and its identity must be listed in the allowed
    /// clients on the spire-agent configuration.
    #[derive(Debug, Clone)]
    pub struct DelegatedIdentityClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl DelegatedIdentityClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> DelegatedIdentityClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> DelegatedIdentityClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                    http::Request<tonic::body::Body>,
                    Response = http::Response<
                        <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                    >,
                >,
            <T as tonic::codegen::Service<http::Request<tonic::body::Body>>>::Error:
                Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            DelegatedIdentityClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Subscribe to get X.509-SVIDs for workloads that match the given selectors.
        /// The lifetime of the subscription aligns to the lifetime of the stream.
        pub async fn subscribe_to_x509svi_ds(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToX509sviDsRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToX509sviDsResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/spire.api.agent.delegatedidentity.v1.DelegatedIdentity/SubscribeToX509SVIDs",
            );
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spire.api.agent.delegatedidentity.v1.DelegatedIdentity",
                "SubscribeToX509SVIDs",
            ));
            self.inner.server_streaming(req, path, codec).await
        }
        /// Subscribe to get X.509-SVIDs for workloads that match the given selectors.
        /// The lifetime of the subscription aligns to the lifetime of the stream.
        ///
        /// Subscribe to get local and all federated bundles.
        /// The lifetime of the subscription aligns to the lifetime of the stream.
        pub async fn subscribe_to_x509_bundles(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToX509BundlesRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToX509BundlesResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/spire.api.agent.delegatedidentity.v1.DelegatedIdentity/SubscribeToX509Bundles",
            );
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spire.api.agent.delegatedidentity.v1.DelegatedIdentity",
                "SubscribeToX509Bundles",
            ));
            self.inner.server_streaming(req, path, codec).await
        }
        /// Fetch JWT-SVIDs for workloads that match the given selectors, and
        /// for the requested audience.
        pub async fn fetch_jwtsvi_ds(
            &mut self,
            request: impl tonic::IntoRequest<super::FetchJwtsviDsRequest>,
        ) -> std::result::Result<tonic::Response<super::FetchJwtsviDsResponse>, tonic::Status>
        {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/spire.api.agent.delegatedidentity.v1.DelegatedIdentity/FetchJWTSVIDs",
            );
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spire.api.agent.delegatedidentity.v1.DelegatedIdentity",
                "FetchJWTSVIDs",
            ));
            self.inner.unary(req, path, codec).await
        }
        /// Subscribe to get local and all federated JWKS bundles.
        /// The lifetime of the subscription aligns to the lifetime of the stream.
        pub async fn subscribe_to_jwt_bundles(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToJwtBundlesRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToJwtBundlesResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/spire.api.agent.delegatedidentity.v1.DelegatedIdentity/SubscribeToJWTBundles",
            );
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spire.api.agent.delegatedidentity.v1.DelegatedIdentity",
                "SubscribeToJWTBundles",
            ));
            self.inner.server_streaming(req, path, codec).await
        }
    }
}