@tdxvolt/volt-client-grpc 0.16.0-beta.9 → 0.18.0

package/protobuf/tdx/volt_api/volt/v1/volt.proto

@@ -92,17 +92,27 @@ message ProxyConnection {
   // Set to indicate the Volt API itself is not automatically exposed to the connection.
   bool disable_volt_api = 9;
 
-  // Optional challenge that can be presented in the bind phase when initialising the connection.
+  // Optional challenge that can be presented in the authentication request.
   string challenge = 10;
 
+  // The id of the target Volt that this connection is bound to.
+  string target_id = 11;
+
   // Indicates that this connection hosts a DID registry that we should synchronise with.
-  bool sync_did_registry = 11;
+  bool sync_did_registry = 12;
 
   // The id of the last DID registry operation that was synchronised.
-  uint64 did_registry_sync_id = 12;
+  uint64 did_registry_sync_id = 13;
 
-  // The id of the target Volt that this connection is bound to.
-  string target_id = 13;
+  // Indicates that this connection hosts a DID registry that we should synchronise with.
+  bool sync_vc_registry = 14;
+
+  // The timestamp of the last VC registry operation that was synchronised.
+  uint64 vc_registry_sync_timestamp = 15;
+
+  string session_id = 16;
+
+  string certificate = 17;
 }
 
 enum SecureMode {
@@ -160,15 +170,11 @@ message VoltParameters {
   // Indicates the Volt will be discoverable by clients using the discovery api.
   bool discoverable = 16;
 
-  // Optional base-64 encoded verifiable credential issued by the owner of this Volt.
-  // @Toby - why is this base64 encoded?
-  string owner_credential = 17;
+  // Optional challenge code that can be used aid in the process of authenticating clients.
+  string authenticate_challenge = 18;
 
-  // Optional challenge code that can be used aid in the process of verifying clients attempting to bind to the Volt.
-  string bind_challenge = 18;
-
-  // Indicates that clients must present the correct challenge code in order to be able to bind to the Volt.
-  bool require_bind_challenge = 19;
+  // Indicates that clients must present the correct challenge code in order to be able to authenticate.
+  bool require_authenticate_challenge = 19;
 
   // Internal use only.
   bool confirm_stop = 20;
@@ -183,7 +189,7 @@ message VoltParameters {
   // This means this Volt can act as a proxy for other Volts (or in fact any client) that connect to it.
   bool has_relay = 23;
 
-  // Set to run the Relay open to any client, i.e. clients can utilise the Relay without first binding to this Volt.
+  // Set to run the Relay open to any client, i.e. clients can utilise the Relay without first authenticating.
   bool relay_open = 24;
 
   // Determines if the Volt HTTP server is enabled.
@@ -228,51 +234,92 @@ message VoltParameters {
   // The runtime version this Volt is running.
   Version version = 36;
 
-  // If set, indicates that any client that provides the correct challenge in the bind phase will automatically be approved to access the Volt.
+  // If set, indicates that any client that provides the correct challenge during authentication will automatically be approved to access the Volt.
   bool approve_on_challenge = 37;
 
-  // Maintain and expose a database of DIDs.
-  bool enable_did_registry = 38;
+  // If set, indicates that any client that proves ownership of a DID known to the Volt will automatically be approved to access the Volt.
+  bool approve_on_did = 38;
+
+  // If set, indicates that clients can register DIDs with this Volt.
+  bool enable_did_registry = 39;
 
   // Zero or more URLs of trusted peer DID registries.
   repeated string did_registry = 40;
+
+  // If set, enables outbound SMTP.
+  bool enable_outbound_smtp = 41;
+
+  // The SMTP host to use for sending emails.
+  string outbound_smtp_host = 42;
+
+  // The SMTP port to use for sending emails.
+  uint32 outbound_smtp_port = 43;
+
+  // The SMTP username to use for sending emails.
+  string outbound_smtp_user = 44;
+
+  // The SMTP password to use for sending emails.
+  string outbound_smtp_password = 45;
+
+  // If set, enables sessions that authenticate using credentials rather than a DID to create resources in the 'anonymous' system folder.
+  bool enable_anonymous_create = 46;
+
+  // The decision to apply to all authentication requests that do not match any other policy.
+  // The default is PROMPT.
+  PolicyDecision catch_all_auth_decision = 47;
+
+  // If set, enables caching of policy decisions.
+  bool enable_policy_cache = 48;
+
+  // If set, enables the terminal API.
+  bool enable_terminal = 49;
+
+  // The time at which the Volt was started.
+  uint64 start_time = 50;
 }
 
 message VoltEndpoint {
   // The globally unique Volt id.
   string id = 1;
 
-  // Optional owner credential, base 64 encoded.
-  string owner_credential = 2;
-
   // Human-readable name of the Volt.
   string display_name = 3;
 
   // The actual host/ip the volt is physically running on (might be a local ip if behind firewall).
   string local_address = 4;
 
+  // The address of the endpoint HTTP server.
+  string http_address = 5;
+
   // The global (Relay) address of the volt. Any given volt may be advertising on more than one Relay instance. The value given here will depend on the Relay instance that handled the endpoint query response.
-  string relay_address = 5;
+  string relay_address = 6;
 
   // The root certificate of the Relay instance referred to in `relay_address`.
-  string relay_ca_pem = 6;
+  string relay_ca_pem = 7;
 
   // The self-signed certificate used by the volt to sign client certificates.
-  string ca_pem = 7;
+  string ca_pem = 8;
 
   // The Volt public key in PEM format.
-  string public_key = 8;
+  string public_key = 9;
 
   // The base58 fingerprint of the Volt public key.
-  string fingerprint = 9;
+  string fingerprint = 10;
 
   // The online status of the Volt.
-  OnlineStatus online_status = 10;
+  OnlineStatus online_status = 11;
 
-  // Set to indicate that this Volt acts as a Relay.
-  bool has_relay = 11;
+  // Indicates that this Volt acts as a Relay.
+  bool has_relay = 12;
 
-  Version api_version = 12;
+  // The API version supported by the endpoint.
+  Version api_version = 13;
+
+  // Optional description of the endpoint.
+  string description = 14;
+
+  // The list of DID registries that this Volt trusts.
+  repeated string did_registry = 15;
 }
 
 // Internal use only.
@@ -306,10 +353,11 @@ enum ServiceHostType {
 
 // Describes a Volt service.
 message ServiceDescription {
+  // The configuration used by the host of this service.
   ServiceHostType host_type = 1;
 
   // The identity of the client that is exposing the service.
-  // For example, if a third party is exposing a database service via a Volt, it will first bind to the Volt and obtain a client DID and credentials in order to be able to create service resource(s).
+  // For example, if a third party is exposing a database service via a Volt, it will first authenticate and obtain a client DID and credentials in order to be able to create service resource(s).
   // Any resources that are owned by this client will be marked as online if the client itself is online, i.e. has a live connection to the Volt.
   // This will be empty if the service is a built-in Volt service.
   string host_client_id = 2;
@@ -334,6 +382,9 @@ message ServiceDescription {
   // The connection id currently used to host this service.
   string host_connection_id = 8;
 
+  // Internal use only.
+  string host_session_id = 9;
+
   // The discovery mode.
   DiscoveryMode discoverable = 10;
 
@@ -414,10 +465,10 @@ message Resource {
   string owner = 101;
 
   // Creation timestamp, milliseconds since epoch.
-  int64 created = 105;
+  uint64 created = 105;
 
   // Last modification timestamp, milliseconds since epoch.
-  int64 modified = 106;
+  uint64 modified = 106;
 
   // Not in use.
   ResourceStatus status = 108;
@@ -442,23 +493,19 @@ message Resource {
   // No format restrictions are currently applied to alias, but this may change in future, for the time being it makes sense to stick to alphanumeric characters and '_' or '-'.
   repeated string alias = 115;
 
+  // The hash of the resource content contained in the store.
+  string content_hash = 116;
+
   // Not yet supported.
   repeated Resource child = 200;
 }
 
-enum IdentityType {
-  IDENTITY_TYPE_UNKNOWN = 0;
-  IDENTITY_TYPE_USER = 1;
-  IDENTITY_TYPE_AUTHORITY = 2;
-  IDENTITY_TYPE_GROUP = 3;
-}
-
 message IdentityAlias {
   // The alias id.
   uint32 id = 1;
 
   // The corresponding identity id.
-  string identity_id = 2;
+  string identity_did = 2;
 
   // The actual alias, e.g. a common name or key fingerprint.
   string alias = 3;
@@ -475,8 +522,8 @@ message IdentityAlias {
   // The identity that issued this alias.
   string issuer_id = 7;
 
-  // Indicates if this alias has an 'bind' policy decision assigned.
-  PolicyDecision bind = 8;
+  // Indicates if this alias has an authenticate policy decision assigned.
+  PolicyDecision authenticate = 8;
 
   // Optional description of this alias.
   string description = 9;
@@ -489,68 +536,6 @@ message Identity {
   repeated IdentityAlias alias = 2;
 }
 
-enum BindCredentialType {
-  BIND_CREDENTIAL_TYPE_UNKNOWN = 0;
-  BIND_CREDENTIAL_TYPE_OWNER = 1;
-  BIND_CREDENTIAL_TYPE_X509 = 2;
-}
-
-message BindCredential {
-  BindCredentialType credential_type = 1;
-  string issuer_id = 2;
-  string issuer_name = 3;
-  string issuer_fingerprint = 4;
-  string issuer_public_key = 5;
-  PolicyDecision decision = 6;
-}
-
-message Binding {
-  // The bind request public key fingerprint.
-  string fingerprint = 1;
-
-  // The bind request public key.
-  string public_key = 2;
-
-  // A human-readable short identifier of the binding.
-  string friendly_name = 3;
-
-  // The host name to add as a SAN to the issued certificate. See also `ip`.
-  string host = 4;
-
-  // The IP address to add as a SAN to the issued certificate as an alternative
-  // to `host`.
-  string ip = 5;
-
-  // Counter of number times a binding was requested.
-  uint32 request_count = 6;
-
-  int64 request_time = 7;
-
-  int64 decision_time = 8;
-
-  // The policy decision assigned to this binding.
-  PolicyDecision decision = 9;
-
-  // The identity id associated with this binding.
-  // Only valid if the bind request has been permitted.
-  string identity_id = 10;
-
-  string status = 11;
-
-  // All credentials supplied as part of bind request.
-  repeated BindCredential credential = 12;
-
-  // The chosen 'owner' credential.
-  BindCredential owner_credential = 14;
-
-  // Set if the bind request presented a valid challenge code.
-  bool volt_challenge = 15;
-
-  string did_document = 16;
-
-  string did_document_signature = 17;
-}
-
 message Access {
   string id = 1;
 
@@ -566,44 +551,48 @@ message Access {
   // The kind of resource.
   repeated string resource_kind = 5;
 
-  // The identity attempting access.
-  string identity_id = 6;
+  oneof subject {
+    // The identity attempting access.
+    string identity_did = 6;
+
+    // The JSON path array for looking up verifiable credentials.
+    string credential_lookup = 7;
+  }
 
   // A human-readable short identifier of the subject.
-  string identity_name = 7;
+  string identity_name = 8;
 
   // The kind of identity.
-  repeated string identity_kind = 8;
-
-  string issuer_id = 9;
-
-  string issuer_name = 10;
-
-  repeated string issuer_kind = 11;
+  repeated string identity_kind = 9;
 
   // Requested access.
-  string access = 12;
+  string access = 10;
+
+  // Optional extra data.
+  string extra = 11;
 
   // Assigned decision.
-  PolicyDecision decision = 13;
+  PolicyDecision decision = 12;
 
-  bool recursive = 14;
+  bool recursive = 13;
 
   // Time at which the request was made.
-  int64 request_time = 15;
+  int64 request_time = 14;
 
   // Time at which the decision was taken.
-  int64 decision_time = 16;
+  int64 decision_time = 15;
 
   // Counter of number times this access was requested.
-  uint32 request_count = 17;
+  uint32 request_count = 16;
 }
 
 enum SessionStatus {
   SESSION_STATUS_UNKNOWN = 0;
   SESSION_STATUS_PENDING = 1;
-  SESSION_STATUS_ESTABLISHED = 2;
-  SESSION_STATUS_REJECTED = 3;
+  SESSION_STATUS_LIVE = 2;
+  SESSION_STATUS_EXPIRED = 3;
+  SESSION_STATUS_REVOKED = 4;
+  SESSION_STATUS_REJECTED = 5;
 }
 
 message SessionCredential {
@@ -613,42 +602,65 @@ message SessionCredential {
   // The corresponding session id.
   string session_id = 2;
 
-  // The actual credential, e.g. a key fingerprint or VC.
-  string credential = 3;
-
-  // The credential type, for example public key, email, phone number etc.
+  // The credential type, for example public key, verifiable credential, challenge etc.
   string credential_type = 4;
 
-  // The identity that issued this alias.
-  string issuer_id = 5;
+  // Optional description of this credential.
+  string description = 5;
 
-  // Optional description of this alias.
-  string description = 6;
+  // The id of the verifiable credential, if the credential type is volt:vc-claim.
+  string vc_id = 6;
+
+  // The verifiable credential in JSON format, if the credential type is volt:vc-claim.
+  string vc_json = 7;
+
+  // The subject id extracted from the `vc_json` field.
+  string vc_subject_id = 8;
+
+  // The issuer id extracted from the `vc_json` field.
+  string vc_issuer_id = 9;
+
+  // The comma-separated type(s) extracted from the `vc_json` field.
+  string vc_type = 10;
+
+  // The challenge string, if the credential type is volt:challenge.
+  string challenge = 11;
+
+  // The key fingerprint, if the credential type is volt:public-key.
+  string key_fingerprint = 12;
+
+  // The PEM-encoded public key, if the credential type is volt:public-key.
+  string public_key = 13;
+
+  // Optional PEM-encoded private key, if the credential type is volt:public-key. Only used for ephemeral REST-base sessions created dynamically after OTP authentication.
+  string private_key = 14;
 
   // Type-specific extra data stored with the credential.
-  string extra = 7;
+  string extra = 15;
 
   // More type-specific data stored with the credential.
-  string extra_2 = 8;
+  string extra_2 = 16;
 }
 
 message Session {
   string id = 1;
 
-  //  string public_key = 2;
+  string identity_did = 2;
+
+  string identity_name = 3;
 
-  string identity_id = 3;
+  string ip = 4;
 
-  string identity_name = 4;
+  uint64 created = 5;
 
-  string ip = 5;
+  uint64 modified = 6;
 
-  repeated SessionCredential credential = 6;
+  uint64 expires = 7;
 
-  uint64 created = 7;
+  repeated SessionCredential credential = 8;
 
-  uint64 modified = 8;
+  string origin = 9;
 
-  SessionStatus status = 9;
+  SessionStatus status = 10;
 }