mesh-contracts/go/seats/meshvault/contract.go

// Code generated by seatgen from the seat definitions; DO NOT EDIT.

// Package meshvault is the contract of the seat "mesh-vault", defined whole (seats/mesh-vault/seat.json): The mesh's secrets. accept and move-asks, which no holder served and nothing called, are left out (ADR 0620 §3). The vault's own events stay under its own subjects (ADR 0620 §2).
package meshvault

// Seat is the seat's name.
const Seat = "mesh-vault"

const (
	VerbGet                = "get"
	VerbSecretAsk          = "secret-ask"
	VerbIssued             = "issued"
	VerbRotate             = "rotate"
	VerbMoveIn             = "move-in"
	VerbNodeKey            = "node-key"
	VerbOwn                = "own"
	VerbIssueAccount       = "issue-account"
	VerbSign               = "sign"
	VerbEnrolmentToken     = "enrolment-token"
	VerbNodeAccount        = "node-account"
	VerbRotateNode         = "rotate-node"
	VerbNodeAccountConfirm = "node-account-confirm"
	VerbAbandon            = "abandon"
	VerbRetire             = "retire"
)

// Verbs is every verb the seat serves, in its definition's order: a new copy each call.
func Verbs() []string {
	return []string{VerbGet, VerbSecretAsk, VerbIssued, VerbRotate, VerbMoveIn, VerbNodeKey, VerbOwn, VerbIssueAccount, VerbSign, VerbEnrolmentToken, VerbNodeAccount, VerbRotateNode, VerbNodeAccountConfirm, VerbAbandon, VerbRetire}
}

// The holder's own events, listed beside the seat and published under the holder's subjects (ADR 0620 §2).
const (
	HolderEventProvisioned      = "provisioned"
	HolderEventRotated          = "rotated"
	HolderEventSecretChanged    = "secret-changed"
	HolderEventAccountHashed    = "account-hashed"
	HolderEventOwnReplaced      = "own-replaced"
	HolderEventAccountIssued    = "account-issued"
	HolderEventSigned           = "signed"
	HolderEventRotationBegun    = "rotation-begun"
	HolderEventNodeAccountReady = "node-account-ready"
	HolderEventRotationDone     = "rotation-done"
	HolderEventOwnRetired       = "own-retired"
)

// HolderSubjectProvisioned is where the holder publishes provisioned.
func HolderSubjectProvisioned(holder string) string {
	return "mesh.mod." + holder + ".event.provisioned"
}

// HolderSubjectRotated is where the holder publishes rotated.
func HolderSubjectRotated(holder string) string { return "mesh.mod." + holder + ".event.rotated" }

// HolderSubjectSecretChanged is where the holder publishes secret-changed.
func HolderSubjectSecretChanged(holder string) string {
	return "mesh.mod." + holder + ".event.secret-changed"
}

// HolderSubjectAccountHashed is where the holder publishes account-hashed.
func HolderSubjectAccountHashed(holder string) string {
	return "mesh.mod." + holder + ".event.account-hashed"
}

// HolderSubjectOwnReplaced is where the holder publishes own-replaced.
func HolderSubjectOwnReplaced(holder string) string {
	return "mesh.mod." + holder + ".event.own-replaced"
}

// HolderSubjectAccountIssued is where the holder publishes account-issued.
func HolderSubjectAccountIssued(holder string) string {
	return "mesh.mod." + holder + ".event.account-issued"
}

// HolderSubjectSigned is where the holder publishes signed.
func HolderSubjectSigned(holder string) string { return "mesh.mod." + holder + ".event.signed" }

// HolderSubjectRotationBegun is where the holder publishes rotation-begun.
func HolderSubjectRotationBegun(holder string) string {
	return "mesh.mod." + holder + ".event.rotation-begun"
}

// HolderSubjectNodeAccountReady is where the holder publishes node-account-ready.
func HolderSubjectNodeAccountReady(holder string) string {
	return "mesh.mod." + holder + ".event.node-account-ready"
}

// HolderSubjectRotationDone is where the holder publishes rotation-done.
func HolderSubjectRotationDone(holder string) string {
	return "mesh.mod." + holder + ".event.rotation-done"
}

// HolderSubjectOwnRetired is where the holder publishes own-retired.
func HolderSubjectOwnRetired(holder string) string {
	return "mesh.mod." + holder + ".event.own-retired"
}

// GetInput is what get takes.
type GetInput struct {
	// the secret's name
	Name string `json:"name"`
	// the asker's X25519 public key as SPKI PEM — never a private key
	PublicKey string `json:"public_key"`
}

// GetAnswer is what get answers.
type GetAnswer = map[string]any

// SecretAskInput is what secret-ask takes.
type SecretAskInput struct {
	// who asked, as the bus named its caller
	AskedBy string `json:"asked_by,omitempty"`
	// the second step: the call the first step answered
	Call string `json:"call,omitempty"`
	// the machine whose prompt asks
	Desk string `json:"desk,omitempty"`
	// the module
	Module string `json:"module,omitempty"`
	// the secret's name in the module
	Name string `json:"name,omitempty"`
	// the machine the secret is for
	Node string `json:"node,omitempty"`
	// instead of sealed: how the prompt ended
	Outcome string `json:"outcome,omitempty"`
	// the second step: the value sealed to the call's key — never the value
	Sealed string `json:"sealed,omitempty"`
}

// SecretAskAnswer is what secret-ask answers.
type SecretAskAnswer = map[string]any

// IssuedInputHoldersItem is a type of the contract.
type IssuedInputHoldersItem struct {
	// the consuming module
	Module string `json:"module,omitempty"`
	// the holder's machine
	Node string `json:"node,omitempty"`
}

// IssuedInput is what issued takes.
type IssuedInput struct {
	// the second step: the call the first step answered
	Call string `json:"call,omitempty"`
	// the provision's holders from that provider, each {node, module}: its tool may answer a value for each, kept as that holder's own and handed to it alone
	Holders []IssuedInputHoldersItem `json:"holders,omitempty"`
	// the provider's module
	Module string `json:"module,omitempty"`
	// the provider's machine
	Provider string `json:"provider,omitempty"`
	// the provision
	Provision string `json:"provision,omitempty"`
	// the second step: the value sealed to the call's key — never the value
	Sealed string `json:"sealed,omitempty"`
}

// IssuedAnswer is what issued answers.
type IssuedAnswer = map[string]any

// RotateInput is what rotate takes.
type RotateInput struct {
	// who asked, when the controller carries the act
	By string `json:"by,omitempty"`
	// the module
	Module string `json:"module,omitempty"`
	// the secret's name in the module
	Name string `json:"name,omitempty"`
	// the machine, for a module's own secret
	Node string `json:"node,omitempty"`
	// the provider's machine
	Provider string `json:"provider,omitempty"`
	// the provision
	Provision string `json:"provision,omitempty"`
}

// RotateAnswer is what rotate answers.
type RotateAnswer = map[string]any

// MoveInInput is what move-in takes.
type MoveInInput struct {
	// the second step: the call the first step answered
	Call string `json:"call,omitempty"`
	// the consumer's machine
	Consumer string `json:"consumer,omitempty"`
	// the consuming module
	ConsumerModule string `json:"consumer_module,omitempty"`
	// the controller's generation for the value
	Generation string `json:"generation,omitempty"`
	// the credential's local name, when it has one
	Local string `json:"local,omitempty"`
	// when it was made (RFC 3339)
	MadeAt string `json:"made_at,omitempty"`
	// its module
	Module string `json:"module,omitempty"`
	// its name in the module
	Name string `json:"name,omitempty"`
	// a module's own secret: its machine
	Node string `json:"node,omitempty"`
	// made, accepted or issued, as the controller's store says
	Origin string `json:"origin,omitempty"`
	// a pair credential: the provider's machine
	Provider string `json:"provider,omitempty"`
	// the provision
	Provision string `json:"provision,omitempty"`
	// the second step: a raw X25519 public key the read-back is sealed to
	ReadBackTo string `json:"read_back_to,omitempty"`
	// the second step: the value sealed to the call's key — never the value
	Sealed string `json:"sealed,omitempty"`
}

// MoveInAnswer is what move-in answers.
type MoveInAnswer = map[string]any

// NodeKeyInput is what node-key takes.
type NodeKeyInput struct {
	// the machine's sealing key, a raw X25519 public key in base64
	Key string `json:"key,omitempty"`
}

// NodeKeyAnswer is what node-key answers.
type NodeKeyAnswer = map[string]any

// OwnInput is what own takes.
type OwnInput struct {
	// the pair credentials the machine's composition reads, each {role: consumer|provider, provision, consumer, consumer_module, provider, local}
	Credentials []map[string]any `json:"credentials,omitempty"`
}

// OwnAnswer is what own answers.
type OwnAnswer = map[string]any

// IssueAccountInput is what issue-account takes.
type IssueAccountInput struct {
	// the bus user, e.g. ace.mesh-build-go
	User string `json:"user"`
}

// IssueAccountAnswer is what issue-account answers.
type IssueAccountAnswer = map[string]any

// SignInput is what sign takes.
type SignInput struct {
	// node-certificate or enrolment
	Kind string `json:"kind"`
	// the machine, for a node certificate: the caller's own, or the node mesh-enrolment enrols
	Node string `json:"node,omitempty"`
	// the redeem answer's bytes in base64, for an enrolment
	Reply string `json:"reply,omitempty"`
	// from mesh-enrolment: the serving key's public half the enrolling node presented
	ServingKey string `json:"serving_key,omitempty"`
}

// SignAnswer is what sign answers.
type SignAnswer = map[string]any

// EnrolmentTokenInputTunnel is the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range.
type EnrolmentTokenInputTunnel struct {
	// the joining node's tunnel address
	Address string `json:"address"`
	// the hub's endpoint, host:port
	HubEndpoint string `json:"hub_endpoint"`
	// the hub's tunnel public key
	HubKey string `json:"hub_key"`
	// the joining machine's own tunnel public key, as given at issue
	Key string `json:"key"`
	// the private network's range, a prefix
	Range string `json:"range"`
}

// EnrolmentTokenInput is what enrolment-token takes.
type EnrolmentTokenInput struct {
	// "true": drop the node's token and its hash
	Drop string `json:"drop,omitempty"`
	// when the token expires (RFC 3339), as the enrolment's key says
	Expires string `json:"expires,omitempty"`
	// the node the token is for
	Node string `json:"node"`
	// "true": answer the token sealed to the operator key
	Sealed string `json:"sealed,omitempty"`
	// the node's first tunnel, built by mesh-enrolment at issue and carried in the token: the hub's public key, the hub's endpoint, the node's tunnel address, its own tunnel key and the network's range
	Tunnel *EnrolmentTokenInputTunnel `json:"tunnel,omitempty"`
}

// EnrolmentTokenAnswer is what enrolment-token answers.
type EnrolmentTokenAnswer = map[string]any

// NodeAccountInput is what node-account takes.
type NodeAccountInput struct {
	// the digest of every public key the node presented (delivery.KeysDigest)
	KeysDigest string `json:"keys_digest,omitempty"`
	// the joining node
	Node string `json:"node"`
	// "true": retire the account minted for this node
	Retire string `json:"retire,omitempty"`
	// the sealing key's public half the node presented, which the account is sealed to
	SealingKey string `json:"sealing_key,omitempty"`
}

// NodeAccountAnswer is what node-account answers.
type NodeAccountAnswer = map[string]any

// RotateNodeInput is what rotate-node takes.
type RotateNodeInput struct {
	// the id of the hand act recorded for it in mesh-hand-acts
	Act string `json:"act"`
	// the node whose account rotates
	Node string `json:"node"`
	// why, in a sentence
	Why string `json:"why"`
}

// RotateNodeAnswer is what rotate-node answers.
type RotateNodeAnswer = map[string]any

// NodeAccountConfirmInput is what node-account-confirm takes.
type NodeAccountConfirmInput struct {
}

// NodeAccountConfirmAnswer is what node-account-confirm answers.
type NodeAccountConfirmAnswer = map[string]any

// AbandonInput is what abandon takes.
type AbandonInput struct {
	// the node whose rotation is abandoned
	Node string `json:"node"`
}

// AbandonAnswer is what abandon answers.
type AbandonAnswer = map[string]any

// RetireInput is what retire takes.
type RetireInput struct {
	// the id of the operator's ask the warrant answers
	Ask string `json:"ask"`
	// the module
	Module string `json:"module"`
	// the own secret's name
	Name string `json:"name"`
	// the node
	Node string `json:"node"`
	// the operator's warrant for this node, module and name: the hand act's id
	Warrant string `json:"warrant"`
}

// RetireAnswer is what retire answers.
type RetireAnswer struct {
	// the secret is gone
	Retired bool `json:"retired"`
}

// OwnRetiredHolderEvent is the body of the holder's event own-retired.
type OwnRetiredHolderEvent struct {
	// the ask's id
	Ask string `json:"ask,omitempty"`
	// the caller the vault proved
	Caller string `json:"caller"`
	// the module
	Module string `json:"module"`
	// the secret's name
	Name string `json:"name"`
	// the node
	Node string `json:"node"`
}