@tdxvolt/volt-client-grpc 0.20.27 → 0.20.29

package/lib/index.cjs

@@ -763,6 +763,7 @@ service SqliteServerAPI {
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
 
   // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
   rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
@@ -1541,6 +1542,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -4108,41 +4113,41 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
 
-  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
-  // on its own (path forwarding on the Volt's own host) or together with
-  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
-  // \`domain\` or \`path\` must be set.
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
   string path = 9;
 
-  // When a \`path\` prefix is configured, controls whether that prefix is removed
-  // from the request path before forwarding (standard reverse-proxy behaviour).
-  // Defaults to true when unset: the target then receives the request at its
-  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
-  // static file servers and root-mounted backends. Set to false for targets
-  // that are themselves configured under the same sub-path and expect to
-  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
-  optional bool strip_path = 10;
-
-  // When true, incoming requests to this forwarder must carry a valid
-  // authenticated session (established via the OIDC sign-in flow) and pass the
-  // policy check before being proxied to the target. Unauthenticated requests
-  // are redirected to the configured OpenID Provider. The session is never
-  // exposed to the target (the session cookie is stripped before forwarding).
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
   bool auth_enabled = 11;
 
-  // OpenID Provider issuer URL used for discovery
-  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
-  // OpenID Provider, or any external OIDC provider. Required when
-  // \`auth_enabled\` is set.
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
   string oidc_issuer = 12;
 
   // OAuth 2.0 client identifier registered with the OpenID Provider.
@@ -4154,36 +4159,45 @@ message SaveHttpForwarderRequest {
   // Space separated OAuth scopes. Defaults to "openid email" when empty.
   string oidc_scopes = 15;
 
-  // Optional override for the reserved callback path on the app host. Defaults
-  // to "/__volt-auth/oidc/callback".
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
   string oidc_redirect_path = 16;
 
-  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
-  // a Volt: "link" (default) or "code".
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
   string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveOidcClientRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
 
-  // Human-friendly name for the client (also used as resource name when the
-  // resource name is empty).
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
   string client_name = 5;
 
   // OAuth 2.0 client_id. Required.
   string client_id = 6;
 
-  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
-  // (re)written when non-empty so updates can omit it to keep the existing
-  // secret.
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
   string client_secret = 7;
 
   // Comma- or space-separated list of allowed redirect URIs.
@@ -4191,69 +4205,150 @@ message SaveOidcClientRequest {
 }
 
 message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
   bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
   bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
   string literal_json = 10;
+
+  // The database ID to serve the API from.
   string database_id = 11;
+
+  // The SQL to execute for this node.
   string sql = 12;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -4261,6 +4356,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }
 

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.20.27",
+  "version": "0.20.29",
   "description": "tdx Volt library for nodejs clients",
   "type": "module",
   "exports": {
@@ -33,8 +33,8 @@
   "author": "toby.ealden@gmail.com",
   "license": "ISC",
   "dependencies": {
-    "@tdxvolt/volt-client-web": "^0.20.27",
-    "@tdxvolt/volt-utility": "^0.20.27",
+    "@tdxvolt/volt-client-web": "^0.20.29",
+    "@tdxvolt/volt-utility": "^0.20.29",
     "debug": "^4.1.1",
     "ip": "^1.1.5",
     "jsonwebtoken": "^8.5.1",

package/src/volt-proto-literals.js

@@ -215,6 +215,7 @@ service SqliteServerAPI {
   rpc CreateDatabase(CreateDatabaseRequest) returns (CreateDatabaseResponse);
 
   // Create or update a data view resource.
+  //Note that when creating a data view, the authenticated account must have access to the source database resource. For 'read-only' views that are \`SELECT\` only, this requires \`volt:database-read\` access to the source database. Any non-\`SELECT\` views require \`volt:database-write\` access to the source database.
   rpc SaveDataView(SaveDataViewRequest) returns (SaveDataViewResponse);
 }
 
@@ -993,6 +994,10 @@ message DeleteDIDRequest {
 
   // Optional passphrase of the DID controller key. Required if the key is encrypted.
   string key_passphrase = 3;
+
+  // When true and \`did\` is set, hard-delete the DID from the local registry without requiring controller keys or signatures, and without synchronising with other registries. Ignored when \`origin_volt\`.
+  // Requires \`volt:delete-did\` API privilege.
+  bool force = 4;
 }
 
 message DeleteDIDResponse {
@@ -3560,41 +3565,41 @@ message SaveDatabaseResponse {
 }
 
 message SaveHttpForwarderRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The domain to forward requests to.
   string domain = 5;
+
+  // The host to forward requests to.
   string host = 6;
+
+  // The port to forward requests to.
   int32 port = 7;
+
+  // Set to indicate that the host header should reflect the proxy domain rather than the target host.
   bool forward_host = 8;
 
-  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used
-  // on its own (path forwarding on the Volt's own host) or together with
-  // \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of
-  // \`domain\` or \`path\` must be set.
+  // Optional path prefix (e.g. "/myapp") for path-based forwarding. May be used on its own (path forwarding on the Volt's own host) or together with \`domain\` (sub-domain + path, e.g. sub.acme.com/myapp). At least one of \`domain\` or \`path\` must be set.
   string path = 9;
 
-  // When a \`path\` prefix is configured, controls whether that prefix is removed
-  // from the request path before forwarding (standard reverse-proxy behaviour).
-  // Defaults to true when unset: the target then receives the request at its
-  // own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain
-  // static file servers and root-mounted backends. Set to false for targets
-  // that are themselves configured under the same sub-path and expect to
-  // receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
-  optional bool strip_path = 10;
-
-  // When true, incoming requests to this forwarder must carry a valid
-  // authenticated session (established via the OIDC sign-in flow) and pass the
-  // policy check before being proxied to the target. Unauthenticated requests
-  // are redirected to the configured OpenID Provider. The session is never
-  // exposed to the target (the session cookie is stripped before forwarding).
+  // When a \`path\` prefix is configured, keep that prefix on the request path when forwarding. The default (false) is standard reverse-proxy behaviour: the prefix is stripped so the target receives the request at its own root (e.g. "/drive/assets/x.js" -> "/assets/x.js"), which suits plain static file servers and root-mounted backends. Set to true for targets that are themselves configured under the same sub-path and expect to receive the prefix. The \`X-Forwarded-Prefix\` header is always sent.
+  bool keep_path = 10;
+
+  // When true, incoming HTTP requests to this forwarder must carry a valid authenticated session (established via the OIDC sign-in flow) and pass the policy check before being proxied, except for the public-path and manifest exceptions on \`auth_public_paths\`. Unauthenticated top-level document navigations are redirected to the configured OpenID Provider; other unauthenticated requests receive 401. An authenticated session that fails the policy check receives 403. The Volt session cookie is stripped from the HTTP hop to the target. WebSocket and SSE upgrades are not gated.
   bool auth_enabled = 11;
 
-  // OpenID Provider issuer URL used for discovery
-  // (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an
-  // OpenID Provider, or any external OIDC provider. Required when
-  // \`auth_enabled\` is set.
+  // OpenID Provider issuer URL used for discovery (\`<issuer>/.well-known/openid-configuration\`). May be a Volt acting as an OpenID Provider, or any external OIDC provider. Required when \`auth_enabled\` is set.
   string oidc_issuer = 12;
 
   // OAuth 2.0 client identifier registered with the OpenID Provider.
@@ -3606,36 +3611,45 @@ message SaveHttpForwarderRequest {
   // Space separated OAuth scopes. Defaults to "openid email" when empty.
   string oidc_scopes = 15;
 
-  // Optional override for the reserved callback path on the app host. Defaults
-  // to "/__volt-auth/oidc/callback".
+  // Optional override for the reserved callback path on the app host. Defaults to "/__volt-auth/oidc/callback".
   string oidc_redirect_path = 16;
 
-  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is
-  // a Volt: "link" (default) or "code".
+  // Email verification mode for OIDC-gated sign-in when the OpenID Provider is a Volt: "code" (default) or "link".
   string email_verification_mode = 17;
+
+  // Effective-path patterns that may be fetched without a session (GET/HEAD). A trailing \`/*\` matches descendants on segment boundaries (e.g. \`/icon/*\`). Used for PWA icons and similar public chrome; the manifest itself is allowed via \`Sec-Fetch-Dest: manifest\` and does not need to be listed.
+  repeated string auth_public_paths = 18;
 }
 
 message SaveHttpForwarderResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveOidcClientRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
 
-  // Human-friendly name for the client (also used as resource name when the
-  // resource name is empty).
+  // Human-friendly name for the client (also used as resource name when the resource name is empty).
   string client_name = 5;
 
   // OAuth 2.0 client_id. Required.
   string client_id = 6;
 
-  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only
-  // (re)written when non-empty so updates can omit it to keep the existing
-  // secret.
+  // OAuth 2.0 client_secret. Stored encrypted and redacted on read. Only (re)written when non-empty so updates can omit it to keep the existing secret.
   string client_secret = 7;
 
   // Comma- or space-separated list of allowed redirect URIs.
@@ -3643,69 +3657,150 @@ message SaveOidcClientRequest {
 }
 
 message SaveOidcClientResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpFileServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The path to serve files from.
   string path = 5;
+
+  // The host to serve files from.
   string host = 6;
+
+  // The port to serve files from.
   int32 port = 7;
+
+  // Set to indicate the server is enabled.
   bool enabled = 8;
+
+  // The cache timeout in seconds.
   int32 cache_timeout = 9;
+
+  // Set to indicate the catch all is enabled.
   bool catch_all_enabled = 10;
+
+  // The catch all path, e.g. '/'.
   string catch_all = 11;
+
+  // Set to indicate the dynamic index is enabled, which will return a dynamic index page for the path if it exists.
   bool dynamic_index_enabled = 12;
 }
 
 message SaveHttpFileServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiServerRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // The host to serve the API from.
   string host = 5;
+
+  // The port to serve the API from.
   int32 port = 6;
+
+  // Set to indicate the server is enabled.
   bool enabled = 7;
+
+  // Set to indicate the CORS is enabled.
   bool cors_enabled = 8;
+
+  // Set to indicate the API is a literal.
   bool is_literal = 9;
+
+  // The literal JSON to serve the API from.
   string literal_json = 10;
+
+  // The database ID to serve the API from.
   string database_id = 11;
+
+  // The SQL to execute for this node.
   string sql = 12;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 13;
 }
 
 message SaveHttpRestApiServerResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveHttpRestApiNodeRequest {
+  // Details of the resource to save.
   Resource resource = 1;
+
+  // Set to indicate this is a new resource.
   bool create = 2;
+
+  // The id of the folder resource in which a new resource should be created.
+  // If omitted, the home folder of the currently authenticated identity will be used.
   string create_in_parent_id = 3;
+
+  // Set to indicate the resource attributes should be purged before saving the resource.
   bool purge_attributes = 4;
+
+  // Set to indicate the node is a literal.
   bool is_literal = 5;
+
+  // The literal JSON to serve the node from.
   string literal_json = 6;
+
+  // The database ID to serve the node from.
   string database_id = 7;
+
+  // The SQL to execute for this node.
   string sql = 8;
+
+  // The parameters to inject into the SQL.
   repeated string parameter = 9;
 }
 
 message SaveHttpRestApiNodeResponse {
+  // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
+
+  // The updated resource.
   Resource resource = 2;
 }
 
 message SaveSessionRequest {
+  // Details of the session to save.
   Session session = 1;
 }
 
@@ -3713,6 +3808,7 @@ message SaveSessionResponse {
   // Details of any error that occurred on the call.
   tdx.volt_api.volt.v1.Status status = 1;
 
+  // The updated session.
   Session session = 2;
 }