mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Seth Jennings
4c1b16a4a1
* feat(server): add operator-only provider credential retrieval Authenticate operators exclusively through verified direct gateway mTLS. Export selected runtime credentials with freshness validation and all-or-nothing delivery. Coordinate refresh across callers and replicas, preserve rotated grants across RPC cancellation, and fence credential delivery against reconfiguration. Add generated bindings, security and regression tests, and operator documentation. Signed-off-by: Seth Jennings <sjenning@redhat.com> * feat(sdk): add curated operator credential retrieval Expose provider credential clients in Python and TypeScript with explicit workspace and key selection, freshness options, optional expiration, and preserved gateway errors. Reuse existing mTLS transports without introducing retries or secret caching. Add generated-wire and error-mapping tests, SDK package validation, and operator usage documentation. Signed-off-by: Seth Jennings <sjenning@redhat.com> * fix(server): honor recovery state for queued automatic refreshes Signed-off-by: Seth Jennings <sjenning@redhat.com> --------- Signed-off-by: Seth Jennings <sjenning@redhat.com>
37 lines
1.3 KiB
Protocol Buffer
37 lines
1.3 KiB
Protocol Buffer
// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
syntax = "proto3";
|
|
|
|
package openshell.options.v1;
|
|
|
|
import "google/protobuf/descriptor.proto";
|
|
|
|
// Per-method authorization rule. Consumed at runtime by the gateway's
|
|
// descriptor-pool-based auth table to enforce auth mode, role, and scope.
|
|
message AuthorizationRule {
|
|
// Authentication mode: "bearer", "sandbox", "dual", "peer", "operator",
|
|
// or "unauthenticated". Operator requires a verified mTLS operator certificate.
|
|
string auth_mode = 1;
|
|
// Minimum workspace-level role required (checked by handler via
|
|
// authorize_workspace): "user" or "admin". Mutually exclusive with
|
|
// global_role.
|
|
string workspace_role = 2;
|
|
// Global role required (checked by middleware via OIDC claims):
|
|
// "platform_admin". Mutually exclusive with workspace_role.
|
|
string global_role = 3;
|
|
// Required OIDC scope on the bearer path (e.g. "sandbox:read").
|
|
string scope = 4;
|
|
}
|
|
|
|
extend google.protobuf.MethodOptions {
|
|
// Authorization metadata for a gRPC method.
|
|
AuthorizationRule authorization = 50000;
|
|
}
|
|
|
|
// Marks a protobuf field whose value must not cross generic observation or
|
|
// extension boundaries such as gateway interceptors.
|
|
extend google.protobuf.FieldOptions {
|
|
bool secret = 50001;
|
|
}
|