@kusinta/iot-schema 0.2.0-beta.34 → 0.2.0-beta.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kusinta/iot-schema",
-  "version": "0.2.0-beta.34",
+  "version": "0.2.0-beta.35",
   "type": "module",
   "license": "MIT",
   "files": ["src"],

package/src/kusinta/iot/access/v1/roles_pb.d.ts

@@ -22,9 +22,10 @@ export declare const file_kusinta_iot_access_v1_roles: GenFile;
  * role narrows what may appear there; it does not put anything there on its own.
  *
  * The building-server gateway holds each user's roles itself and authorises from what it
- * holds. The one role it cannot know is the administration of whoever registered it, which
- * the api-server records: that one it takes from the app's token
- * (webrtc.v1.AppTokenClaims.roles). The api-server learns the rest from the gateway
+ * holds. The one role it cannot know is the administration of the organisation that owns it,
+ * which the api-server keeps: that one it takes from the app's token
+ * (webrtc.v1.AppTokenClaims.roles), and the api-server tells it who those administrators are
+ * (signaling.v1.VouchedAdministrators), which can end that administration but never grant it. The api-server learns the rest from the gateway
  * (reporting.v1.GatewayMember). A user may hold several at once and the effective ceiling is
  * their union.
  *
@@ -41,7 +42,7 @@ export declare const file_kusinta_iot_access_v1_roles: GenFile;
  * STAFF. A user who holds ROLE_TECHNICIAN, ROLE_PROPERTY_OWNER or ROLE_GATEWAY_ADMIN on a
  * gateway is staff there: they serve the building rather than live in it. Wherever this
  * schema says "staff" or "a staff member" it means exactly that, as the gateway holds roles,
- * the registering administrator included; holding ROLE_RESIDENT besides changes nothing. The
+ * every vouched administrator included; holding ROLE_RESIDENT besides changes nothing. The
  * term carries one rule about people: staff are named to whoever may list every member; a
  * resident is named only to the people they live with; and where anyone lives is told by
  * user id only to their own household, and to anyone else only under a residency id

package/src/kusinta/iot/access/v1/roles_pb.js

@@ -29,9 +29,10 @@ export const RoleSchema = /*@__PURE__*/
  * role narrows what may appear there; it does not put anything there on its own.
  *
  * The building-server gateway holds each user's roles itself and authorises from what it
- * holds. The one role it cannot know is the administration of whoever registered it, which
- * the api-server records: that one it takes from the app's token
- * (webrtc.v1.AppTokenClaims.roles). The api-server learns the rest from the gateway
+ * holds. The one role it cannot know is the administration of the organisation that owns it,
+ * which the api-server keeps: that one it takes from the app's token
+ * (webrtc.v1.AppTokenClaims.roles), and the api-server tells it who those administrators are
+ * (signaling.v1.VouchedAdministrators), which can end that administration but never grant it. The api-server learns the rest from the gateway
  * (reporting.v1.GatewayMember). A user may hold several at once and the effective ceiling is
  * their union.
  *
@@ -48,7 +49,7 @@ export const RoleSchema = /*@__PURE__*/
  * STAFF. A user who holds ROLE_TECHNICIAN, ROLE_PROPERTY_OWNER or ROLE_GATEWAY_ADMIN on a
  * gateway is staff there: they serve the building rather than live in it. Wherever this
  * schema says "staff" or "a staff member" it means exactly that, as the gateway holds roles,
- * the registering administrator included; holding ROLE_RESIDENT besides changes nothing. The
+ * every vouched administrator included; holding ROLE_RESIDENT besides changes nothing. The
  * term carries one rule about people: staff are named to whoever may list every member; a
  * resident is named only to the people they live with; and where anyone lives is told by
  * user id only to their own household, and to anyone else only under a residency id

package/src/kusinta/iot/registration/v1/registration_pb.d.ts

@@ -15,6 +15,11 @@ export declare const file_kusinta_iot_registration_v1_registration: GenFile;
  */
 export declare type RegistrationRequest = Message<"kusinta.iot.registration.v1.RegistrationRequest"> & {
   /**
+   * The one-time token an administrator of the owning organisation obtained from the
+   * api-server and handed to the gateway. Opaque to the gateway: it is signed with a key only
+   * the api-server holds, and the gateway passes it on unread. Nothing the gateway acts on is
+   * taken from it; what the registration settles comes back in RegistrationComplete.
+   *
    * @generated from field: string registration_token = 1;
    */
   registrationToken: string;
@@ -65,6 +70,19 @@ export declare type RegistrationComplete = Message<"kusinta.iot.registration.v1.
    * @generated from field: string ca_bundle_pem = 2;
    */
   caBundlePem: string;
+
+  /**
+   * The ownership epoch of the gateway's owner record (signaling.v1.GatewayStreamOpened,
+   * OWNERSHIP EPOCH), from the api-server's answer to the registration the gateway made over
+   * its own connection to it, which is what makes it trusted. Never empty. An epoch other than
+   * the one the gateway holds makes it wipe (signaling.v1.GatewayDeleted, WIPE) before it
+   * installs the certificate or admits any session. A registration again by the owning
+   * organisation, after a revoke included, answers the epoch the gateway holds and wipes
+   * nothing.
+   *
+   * @generated from field: string ownership_epoch = 3;
+   */
+  ownershipEpoch: string;
 };
 
 /**

package/src/kusinta/iot/registration/v1/registration_pb.js

@@ -8,7 +8,7 @@ import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
  * Describes the file kusinta/iot/registration/v1/registration.proto.
  */
 export const file_kusinta_iot_registration_v1_registration = /*@__PURE__*/
-  fileDesc("Ci5rdXNpbnRhL2lvdC9yZWdpc3RyYXRpb24vdjEvcmVnaXN0cmF0aW9uLnByb3RvEhtrdXNpbnRhLmlvdC5yZWdpc3RyYXRpb24udjEiVwoTUmVnaXN0cmF0aW9uUmVxdWVzdBIaChJyZWdpc3RyYXRpb25fdG9rZW4YASABKAkSEwoLZXh0ZXJuYWxfaXAYAiABKAkSDwoHY3NyX3BlbRgDIAEoCSIkChRSZWdpc3RyYXRpb25Qcm9ncmVzcxIMCgRzdGVwGAEgASgJIkYKFFJlZ2lzdHJhdGlvbkNvbXBsZXRlEhcKD2NlcnRpZmljYXRlX3BlbRgBIAEoCRIVCg1jYV9idW5kbGVfcGVtGAIgASgJIjIKEVJlZ2lzdHJhdGlvbkVycm9yEgwKBGNvZGUYASABKAkSDwoHbWVzc2FnZRgCIAEoCSLuAQoUUmVnaXN0cmF0aW9uUmVzcG9uc2USRQoIcHJvZ3Jlc3MYASABKAsyMS5rdXNpbnRhLmlvdC5yZWdpc3RyYXRpb24udjEuUmVnaXN0cmF0aW9uUHJvZ3Jlc3NIABJFCghjb21wbGV0ZRgCIAEoCzIxLmt1c2ludGEuaW90LnJlZ2lzdHJhdGlvbi52MS5SZWdpc3RyYXRpb25Db21wbGV0ZUgAEj8KBWVycm9yGAMgASgLMi4ua3VzaW50YS5pb3QucmVnaXN0cmF0aW9uLnYxLlJlZ2lzdHJhdGlvbkVycm9ySABCBwoFZXZlbnQiJQoSQ2VydFJlbmV3YWxSZXF1ZXN0Eg8KB2Nzcl9wZW0YASABKAkiRQoTQ2VydFJlbmV3YWxSZXNwb25zZRIXCg9jZXJ0aWZpY2F0ZV9wZW0YASABKAkSFQoNY2FfYnVuZGxlX3BlbRgCIAEoCUICSAFiBnByb3RvMw");
+  fileDesc("Ci5rdXNpbnRhL2lvdC9yZWdpc3RyYXRpb24vdjEvcmVnaXN0cmF0aW9uLnByb3RvEhtrdXNpbnRhLmlvdC5yZWdpc3RyYXRpb24udjEiVwoTUmVnaXN0cmF0aW9uUmVxdWVzdBIaChJyZWdpc3RyYXRpb25fdG9rZW4YASABKAkSEwoLZXh0ZXJuYWxfaXAYAiABKAkSDwoHY3NyX3BlbRgDIAEoCSIkChRSZWdpc3RyYXRpb25Qcm9ncmVzcxIMCgRzdGVwGAEgASgJIl8KFFJlZ2lzdHJhdGlvbkNvbXBsZXRlEhcKD2NlcnRpZmljYXRlX3BlbRgBIAEoCRIVCg1jYV9idW5kbGVfcGVtGAIgASgJEhcKD293bmVyc2hpcF9lcG9jaBgDIAEoCSIyChFSZWdpc3RyYXRpb25FcnJvchIMCgRjb2RlGAEgASgJEg8KB21lc3NhZ2UYAiABKAki7gEKFFJlZ2lzdHJhdGlvblJlc3BvbnNlEkUKCHByb2dyZXNzGAEgASgLMjEua3VzaW50YS5pb3QucmVnaXN0cmF0aW9uLnYxLlJlZ2lzdHJhdGlvblByb2dyZXNzSAASRQoIY29tcGxldGUYAiABKAsyMS5rdXNpbnRhLmlvdC5yZWdpc3RyYXRpb24udjEuUmVnaXN0cmF0aW9uQ29tcGxldGVIABI/CgVlcnJvchgDIAEoCzIuLmt1c2ludGEuaW90LnJlZ2lzdHJhdGlvbi52MS5SZWdpc3RyYXRpb25FcnJvckgAQgcKBWV2ZW50IiUKEkNlcnRSZW5ld2FsUmVxdWVzdBIPCgdjc3JfcGVtGAEgASgJIkUKE0NlcnRSZW5ld2FsUmVzcG9uc2USFwoPY2VydGlmaWNhdGVfcGVtGAEgASgJEhUKDWNhX2J1bmRsZV9wZW0YAiABKAlCAkgBYgZwcm90bzM");
 
 /**
  * Describes the message kusinta.iot.registration.v1.RegistrationRequest.

package/src/kusinta/iot/reporting/v1/reporting_pb.d.ts

@@ -421,8 +421,9 @@ export declare const ReportProblemsResponseSchema: GenMessage<ReportProblemsResp
  *
  * The administration of the gateway is not reported here; the administrator's own service
  * memberships, if any, are, like anyone's. The api-server records who administers a gateway
- * itself, and from when, and gives the administrator every space the gateway serves
- * from that moment, applying a change of administrator at once. A problem with no space the
+ * itself — the administrators of the organisation that owns it — and from when, and gives each
+ * administrator every space the gateway serves from that moment, applying a change of
+ * administrator, or of owning organisation, at once. A problem with no space the
  * api-server holds — a device filed nowhere, a space not yet held or since removed — is shown
  * only to the administrator. A problem about a connector or the gateway itself concerns no
  * one's home, and is shown to the administrator and every member with any reach.
@@ -717,20 +718,25 @@ export declare const ReportServedSpacesResponseSchema: GenMessage<ReportServedSp
  * person connect and leaving is what revokes them. Roles do not follow relations
  * (access.v1.MembershipRelation): a relation changing alone changes nothing reported here.
  *
- * Who registered the gateway is the api-server's own record, not the gateway's. The
- * administration that came with registering it is never taken away by this report — not by
- * its absence from a snapshot, not by removed_user_ids — and ends only with a change of who
- * is registered as the gateway's administrator at the api-server. Any other administrator is
- * a member reported with ROLE_GATEWAY_ADMIN, whom the api-server gives what it gives the
- * registering one, from administrator_since (see ServiceReach). Where the registering
- * administrator is also reported so, the api-server's record governs: their administration
- * counts from the earlier of its own start and administrator_since.
+ * Which organisation owns the gateway, and who its administrators are, is the api-server's own
+ * record, not the gateway's. The administration that comes with them is never taken away by this
+ * report — not by absence from a snapshot, not by removed_user_ids — and ends only when the
+ * person stops being an administrator of the owning organisation, or the gateway moves to
+ * another (signaling.v1.TransferOutcome). Any other administrator is a member reported with
+ * ROLE_GATEWAY_ADMIN, whom the api-server gives what it gives the organisation's, from
+ * administrator_since (see ServiceReach). Where an administrator of the organisation is also
+ * reported so, the api-server's record governs: their administration counts from the earlier of
+ * its own start and administrator_since. The api-server's own start for an organisation's
+ * administrator is never before the gateway came to that organisation, so a new owner learns
+ * nothing from before a transfer.
  *
- * A member here is a user the gateway holds a membership or a role for, and no one else. The
- * registering administrator is reported only when the gateway holds one of those for them —
- * a membership, or ROLE_PROPERTY_OWNER they were given — and never with the
- * ROLE_GATEWAY_ADMIN their token carries. That the gateway recognises them otherwise
- * (webrtc.v1.MemberDetail.registering_admin) does not make them a member of this report.
+ * A member here is a user the gateway holds a membership or a role for, and no one else. A
+ * vouched administrator (signaling.v1.VouchedAdministrators) is reported only when the gateway
+ * holds one of those for them — a membership, or ROLE_PROPERTY_OWNER they were given — and
+ * never with the ROLE_GATEWAY_ADMIN the vouched set and their token give. That the gateway
+ * lists them otherwise (webrtc.v1.MemberDetail.vouched_admin) does not make them a member of
+ * this report. After a wipe (signaling.v1.GatewayDeleted, WIPE) the gateway reports a snapshot
+ * with no members.
  *
  * @generated from message kusinta.iot.reporting.v1.GatewayMember
  */