server

package
v0.0.1-nightly.2026101... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2026 License: MPL-2.0 Imports: 49 Imported by: 0

Documentation

Overview

Package server is the HTTP layer: chi router, health surfaces, and the generated API. It never imports internal/store — enforced by the import-boundary test — so a handler cannot reach data except through the service layer, which authorizes inside a transaction.

Index

Constants

View Source 
const (
	MaxInFlightRequests  = 512
	ResponseWriteTimeout = 60 * time.Second
	SSEWriteTimeout      = 30 * time.Second
	SSEHeartbeat         = 30 * time.Second
)

Transport bounds belong to the HTTP layer. Streaming handlers replace the ordinary response deadline with a fresh deadline for each complete frame.

View Source 
const (
	MetricLastPruneSuccess       = "hikyo_last_prune_success_timestamp_seconds"
	MetricPruneStale             = "hikyo_prune_stale"
	MetricProjectStoragePeak     = "hikyo_project_storage_peak_bytes"
	MetricProjectStorageWarn     = "hikyo_project_storage_warn"
	MetricDataVolumeKnown        = "hikyo_data_volume_capacity_known"
	MetricDataVolumeUsedPercent  = "hikyo_data_volume_used_percent"
	MetricDataVolumeWarn         = "hikyo_data_volume_warn"
	MetricDataVolumeCritical     = "hikyo_data_volume_critical"
	MetricRootEscrowVerified     = "hikyo_root_escrow_verified"
	MetricRootEscrowVerifiedAt   = "hikyo_root_escrow_verified_timestamp_seconds"
	MetricRootRotationPending    = "hikyo_root_rotation_pending"
	MetricReencryptPendingScopes = "hikyo_reencrypt_pending_scopes"
	MetricLastReencryptSuccess   = "hikyo_last_reencrypt_success_timestamp_seconds"
	MetricPinsExpired            = "hikyo_pins_expired"
	MetricPinsExpiringDay        = "hikyo_pins_expiring_day"
	MetricPinsExpiringWeek       = "hikyo_pins_expiring_week"
	MetricPinsExpiringMonth      = "hikyo_pins_expiring_month"
	MetricTLSCertNotAfter        = "hikyo_tls_cert_not_after_timestamp_seconds"
	MetricTLSReloadFailures      = "hikyo_tls_reload_failures_total"

	// Deployment-adapter health (#157). Label-free by construction: they
	// count targets and jobs instance-wide and never name a tenant.
	MetricAdapterTargetsFailed    = "hikyo_adapter_targets_failed"
	MetricAdapterTargetsPaused    = "hikyo_adapter_targets_paused"
	MetricAdapterTargetsAttention = "hikyo_adapter_targets_attention"
	MetricAdapterJobsQueued       = "hikyo_adapter_jobs_queued"

	MetricRequestsTotal       = "hikyo_http_requests_total"
	MetricRequestErrors       = "hikyo_http_request_errors_total"
	MetricSignupMailFailures  = "hikyo_signup_mail_failures_total"
	MetricRequestsInFlight    = "hikyo_http_requests_in_flight"
	MetricRequestDuration     = "hikyo_http_request_duration_seconds"
	MetricMCPRequestsTotal    = "hikyo_mcp_requests_total"
	MetricMCPRequestsInFlight = "hikyo_mcp_requests_in_flight"
	MetricMCPRequestDuration  = "hikyo_mcp_request_duration_seconds"

	MetricAdmissionConcurrencyLimit = "hikyo_admission_concurrency_limit"
	MetricAdmissionInFlight         = "hikyo_admission_in_flight"
	MetricAdmissionQueueDepthLimit  = "hikyo_admission_queue_depth_limit"
	MetricAdmissionQueueWaiting     = "hikyo_admission_queue_waiting"
	MetricAdmissionActiveBackoffs   = "hikyo_admission_active_backoffs"

	// Multi-node HA gauges (#146). Label-free, so their cardinality is one each
	// regardless of cluster size (the ops-spec bounded-cardinality posture: no
	// per-node labels). On a single node they report the trivial values: this
	// node is the leader, one node is seen, and the lease age is zero.
	MetricHAIsLeader       = "hikyo_ha_is_leader"
	MetricHANodesSeen      = "hikyo_ha_nodes_seen"
	MetricHALeaseAgeSecond = "hikyo_ha_lease_age_seconds"

	// Secret-change approvals (#151). Label-free, bounded-cardinality gauges:
	// how many requests are awaiting review right now, and how many have expired
	// unmerged (a monotonic-ish operational signal that a policy's reviewers are
	// not keeping up). No per-tenant labels, so cardinality is one each.
	MetricApprovalRequestsOpen    = "hikyo_approval_requests_open"
	MetricApprovalRequestsExpired = "hikyo_approval_requests_expired"
	// MetricApprovalGaugesKnown is 1 when the two approval gauges above were
	// measured on this scrape and 0 when the source failed, in which case both
	// are omitted rather than rendered as zeros (a failed count is unknown,
	// not empty). Check it before alerting on either, like capacity_known.
	MetricApprovalGaugesKnown = "hikyo_approval_gauges_known"
	// Approval-mediated temporary access (#152). Label-free like the approval
	// gauges: open access requests awaiting a decision, and temporary grants
	// currently in force (granted requests whose absolute expiry is ahead).
	MetricAccessRequestsOpen = "hikyo_access_requests_open"
	MetricAccessGrantsActive = "hikyo_access_grants_active"
	// MetricAccessGaugesKnown is 1 when the two access gauges were measured on
	// this scrape; they are omitted when it is 0.
	MetricAccessGaugesKnown = "hikyo_access_gauges_known"
	// Disaster-recovery gauges (#145, ops-spec section 11). Label-free like
	// every other operator gauge: one series each, no archive name, no path.
	MetricLastBackupExportSuccess = "hikyo_last_backup_export_success_timestamp_seconds"
	MetricBackupRPOExceeded       = "hikyo_backup_rpo_exceeded"
	MetricLastBackupPruneSuccess  = "hikyo_last_backup_prune_success_timestamp_seconds"
	MetricLastRestoreDrill        = "hikyo_last_restore_drill_timestamp_seconds"
	MetricRestoreDrillOK          = "hikyo_restore_drill_ok"

	// Dynamic-secret gauges (#147). Label-free, cardinality one each. active is
	// the count of currently usable leases; effectsUnknown is the count of lease
	// transitions stuck in an uncertain state awaiting reconcile.
	MetricDynamicLeasesActive   = "hikyo_dynamic_leases_active"
	MetricDynamicEffectsUnknown = "hikyo_dynamic_effects_unknown"
	// MetricDynamicGaugesKnown is 1 when the two dynamic gauges above were
	// measured on this scrape and 0 when the source failed, in which case both
	// are omitted: a datastore outage must not read as "no unknown effects".
	MetricDynamicGaugesKnown = "hikyo_dynamic_gauges_known"
	// SSH certificate gauges (#155). Label-free, cardinality one each. active
	// counts issued, unexpired certificates; krl_entries counts the serials
	// every KRL currently publishes (bounded per CA by sshca.MaxKRLSerials).
	MetricSSHCertificatesActive = "hikyo_ssh_certificates_active"
	MetricSSHKRLEntries         = "hikyo_ssh_krl_entries"
	// MetricSSHGaugesKnown is 1 when the two SSH gauges were measured on this
	// scrape; 0 means they are omitted rather than rendered as zeros.
	MetricSSHGaugesKnown = "hikyo_ssh_gauges_known"
	// Transit (#156): live managed keys, keys whose rotation period has
	// elapsed, and keys waiting out their deletion delay. Label-free; the
	// known flag is 0 when the scrape could not measure them, and the three
	// value gauges are then omitted rather than rendered as zeros.
	MetricTransitKeysLive            = "hikyo_transit_keys_live"
	MetricTransitKeysRotationDue     = "hikyo_transit_keys_rotation_due"
	MetricTransitKeysPendingDeletion = "hikyo_transit_keys_pending_deletion"
	MetricTransitGaugesKnown         = "hikyo_transit_gauges_known"

	// Private-PKI gauges (#154). Label-free, cardinality one each: live leaf
	// certificates, certificates in the uncertain `unknown` state (published on
	// the CRL as revoked), and issuers held after a restore. The known flag has
	// the dynamic-gauge semantics: 0 means unmeasured, and the values are omitted.
	MetricPKICertificatesLive    = "hikyo_pki_certificates_live"
	MetricPKICertificatesUnknown = "hikyo_pki_certificates_unknown"
	MetricPKIIssuersOnHold       = "hikyo_pki_issuers_on_hold"
	MetricPKIGaugesKnown         = "hikyo_pki_gauges_known"

	// MetricSeriesBudget is the ops-spec ceiling for every registered series.
	MetricSeriesBudget = 1000
)

Metric family names. Exported so the conformance drift-guard can pin them: a rename here fails that test rather than silently breaking a dashboard.

View Source 
const ContractPrefix = api.PathPrefix

ContractPrefix re-exports the version prefix so callers building URLs read it from the contract rather than restating it.

View Source 
const MaxRequestBytes = 2 << 20

validateAgainstContract is the runtime request-validation duty: a request that does not satisfy api/openapi.yaml never reaches a handler, so the document is enforced rather than merely published. MaxRequestBytes bounds a request body before anything decodes it. Contract validation runs before the handler and before any pre-auth admission decision, so without this an unauthenticated client could make the server allocate an arbitrary amount of memory parsing JSON it was always going to reject. The bound is far above any legitimate request this contract describes.

Variables

This section is empty.

Functions

func New 

func New(a *API, ui fs.FS) http.Handler

func NewMaintenance 

func NewMaintenance(source RuntimeStatusSource, ui fs.FS, options PublicOptions) http.Handler

NewMaintenance exposes only public availability and static UI. It constructs no tenant API, auth service, workspace directory, or MCP handler.

func NewOperational 

func NewOperational(ready ReadyChecker, healthService OperationalRetentionHealthService, metrics *Metrics) http.Handler

NewOperational builds the separate plaintext operational router. It carries no CORS or admission middleware and registers only local process surfaces.

metrics is the shared RED collector (#513). It is the SAME instance handed to the API middleware, so the scrape here reads the counters that middleware writes. A nil collector leaves /metrics as the retention/TLS gauges alone — the pre-#513 shape.

func NewPublic 

func NewPublic(a *API, ui fs.FS, publicOptions PublicOptions) http.Handler

NewPublic builds the public router with explicit transport policy.

func RequestLatencyBucketsSeconds 

func RequestLatencyBucketsSeconds() []float64

RequestLatencyBucketsSeconds returns a copy of the fixed histogram grid.

func WriteRuntimeUnavailable 

func WriteRuntimeUnavailable(w http.ResponseWriter, r *http.Request)

WriteRuntimeUnavailable answers during the supervisor's brief global drain, before admission to any retiring graph. This instance-wide refusal does not inspect credentials or reveal whether a tenant/binding exists. Once routing resumes, SCIM refusals again rank behind normal binding authentication.

Types

type API 

type API struct {
	Runtime      RuntimeStatusSource
	SelfConfig   *service.SelfConfig
	Mail         MailService
	Discovery    *service.Discovery
	Auth         AuthService
	SAMLAuth     SAMLAuthService
	Orgs         OrgService
	Projects     ProjectService
	Environments EnvironmentService
	Folders      FolderService
	Keys         KeyService
	Definitions  DefinitionsService
	Values       ValueService
	Revisions    RevisionService
	Rotation     RotationService
	Reencrypt    ReencryptService
	Pins         PinService
	Reveal       RevealService
	KeyGroups    KeyGroupService
	Grants       GrantService
	// Rules is the member access rule surface (member-access-rules ADR).
	Rules RuleService
	// Registration is the registration policy surface (#606) and the public
	// sign-up door `/auth/methods` renders.
	Registration         RegistrationService
	Identities           IdentityService
	DeveloperCredentials DeveloperCredentialService
	Federation           FederationService
	Delivery             DeliveryService
	Settings             SettingsService
	Retention            RetentionSettingsService
	RetentionHealth      OperationalRetentionHealthService
	Updates              UpdateService
	Providers            ProviderService
	OAuth2Providers      OAuth2ProviderService
	SAMLProviders        SAMLProviderService
	Adapters             *service.Adapters
	// FileTargets is the generic file-destination administration (#164).
	FileTargets *service.FileTargets
	// Dynamic is the dynamic-secret provider + lease surface (#147). Concrete
	// like Adapters: it resolves the session and mints/settles leases itself.
	Dynamic *service.Dynamic
	// SSH is the SSH user-certificate surface (#155).
	SSH *service.SSH
	// Transit is the managed-key surface (#156). Concrete like Dynamic: it
	// resolves the caller and applies key policy itself.
	Transit *service.Transit
	// PKI is the private-PKI surface (#154).
	PKI *service.PKI
	// Audits is the trail read/export surface. Concrete like Adapters: it is
	// principal-keyed and the handler resolves the session before calling it.
	Audits *service.Audits
	// Approvals is the change-approval administration and review surface (#151).
	// The merge/bypass DECISION rides Revisions.PublishPlanned, not this.
	Approvals ApprovalService
	// Access is the approval-mediated temporary-access surface (#152).
	Access AccessService
	// SCIM is the provisioning ADMINISTRATION surface (human sessions,
	// `manage-members` at org scope); SCIMWire is the identity provider's own
	// protocol path (a provisioning credential, `scim-provision`). They are two
	// fields rather than one because they are two authorization languages, and
	// a single interface would let a handler reach the wrong one by autocomplete.
	SCIM     SCIMAdminService
	SCIMWire SCIMWireService
	// Multi-instance (#71): the viewing side's directory and the serving
	// side's connections, allowlist, handoff and session surface.
	Remotes   RemoteService
	Workspace WorkspaceService
	// Admission bounds the unauthenticated discovery endpoint. The expensive
	// pre-auth paths take their own slot inside the service, where the cost
	// they bound actually lives; /meta is cheap and only needs a per-IP
	// ceiling, so it is charged here. Nil means unlimited, which is only for
	// tests.
	Admission *admission.Limiter
	// RequestBudget charges authenticated human requests at the service's
	// transaction-local admission hook, never from a guessed wire subject.
	RequestBudget *service.Budget
	// Metrics is the shared RED collector (#513). The same instance is handed to
	// NewOperational so the /metrics reader and this middleware's writer see one
	// set of counters. Nil disables collection (tests), leaving the access log
	// and handler behaviour unchanged.
	Metrics *Metrics
	Version string
	Log     *slog.Logger
	// TrustedProxies are the CIDRs whose forwarded headers are believed.
	// Empty means none: proxy trust is explicit configuration, never
	// inferred, because an unauthenticated header is not evidence.
	TrustedProxies []*net.IPNet
}

API implements the generated strict server.

func (*API) AddAdapterTarget 

func (a *API) AddAdapterTarget(ctx context.Context, req apigen.AddAdapterTargetRequestObject) (apigen.AddAdapterTargetResponseObject, error)

func (*API) AddRemote 

func (a *API) AddRemote(ctx context.Context, req apigen.AddRemoteRequestObject) (apigen.AddRemoteResponseObject, error)

func (*API) AddWorkspaceOrigin 

func (a *API) AddWorkspaceOrigin(ctx context.Context, req apigen.AddWorkspaceOriginRequestObject) (apigen.AddWorkspaceOriginResponseObject, error)

func (*API) AdoptAdapterTargetNames 

func (a *API) AdoptAdapterTargetNames(ctx context.Context, req apigen.AdoptAdapterTargetNamesRequestObject) (apigen.AdoptAdapterTargetNamesResponseObject, error)

func (*API) AdoptInstanceConfig 

func (a *API) AdoptInstanceConfig(ctx context.Context, req apigen.AdoptInstanceConfigRequestObject) (apigen.AdoptInstanceConfigResponseObject, error)

func (*API) ApplyDefinitionsPlan 

func (a *API) ApplyDefinitionsPlan(ctx context.Context, req apigen.ApplyDefinitionsPlanRequestObject) (apigen.ApplyDefinitionsPlanResponseObject, error)

func (*API) ApplyEnvTemplate 

func (a *API) ApplyEnvTemplate(ctx context.Context, req apigen.ApplyEnvTemplateRequestObject) (apigen.ApplyEnvTemplateResponseObject, error)

func (*API) ApplyInstanceConfig 

func (a *API) ApplyInstanceConfig(ctx context.Context, req apigen.ApplyInstanceConfigRequestObject) (apigen.ApplyInstanceConfigResponseObject, error)

func (*API) ApplyInstanceTemplate 

func (a *API) ApplyInstanceTemplate(ctx context.Context, req apigen.ApplyInstanceTemplateRequestObject) (apigen.ApplyInstanceTemplateResponseObject, error)

func (*API) ApplyOrgTemplate 

func (a *API) ApplyOrgTemplate(ctx context.Context, req apigen.ApplyOrgTemplateRequestObject) (apigen.ApplyOrgTemplateResponseObject, error)

func (*API) ApplyProjectTemplate 

func (a *API) ApplyProjectTemplate(ctx context.Context, req apigen.ApplyProjectTemplateRequestObject) (apigen.ApplyProjectTemplateResponseObject, error)

func (*API) ApproveCLILogin 

func (a *API) ApproveCLILogin(ctx context.Context, req apigen.ApproveCLILoginRequestObject) (apigen.ApproveCLILoginResponseObject, error)

func (*API) ApproveCLIReauth 

func (a *API) ApproveCLIReauth(ctx context.Context, req apigen.ApproveCLIReauthRequestObject) (apigen.ApproveCLIReauthResponseObject, error)

func (*API) ApproveWorkspaceHandoff 

func (a *API) ApproveWorkspaceHandoff(ctx context.Context, req apigen.ApproveWorkspaceHandoffRequestObject) (apigen.ApproveWorkspaceHandoffResponseObject, error)

func (*API) AuthMethods 

func (a *API) AuthMethods(ctx context.Context, req apigen.AuthMethodsRequestObject) (apigen.AuthMethodsResponseObject, error)

AuthMethods returns public login methods and the sign-up door for the requested org, or the instance when no org is supplied. An unknown or empty org selects a closed door. Discovery throttling returns 429; service and conversion failures become 500 responses.

func (*API) BeginRecovery 

func (a *API) BeginRecovery(ctx context.Context, req apigen.BeginRecoveryRequestObject) (apigen.BeginRecoveryResponseObject, error)

func (*API) BindPkiProfile 

func (a *API) BindPkiProfile(ctx context.Context, req apigen.BindPkiProfileRequestObject) (apigen.BindPkiProfileResponseObject, error)

func (*API) CancelAccessRequest 

func (a *API) CancelAccessRequest(ctx context.Context, req apigen.CancelAccessRequestRequestObject) (apigen.CancelAccessRequestResponseObject, error)

CancelAccessRequest withdraws the addressed request and returns it as JSON, propagating service errors.

func (*API) CancelAdapterMove 

func (a *API) CancelAdapterMove(ctx context.Context, req apigen.CancelAdapterMoveRequestObject) (apigen.CancelAdapterMoveResponseObject, error)

func (*API) ChangeEnvironmentParameter 

func (a *API) ChangeEnvironmentParameter(ctx context.Context, req apigen.ChangeEnvironmentParameterRequestObject) (apigen.ChangeEnvironmentParameterResponseObject, error)

func (*API) ChangeTransitKeyState 

func (a *API) ChangeTransitKeyState(ctx context.Context, req apigen.ChangeTransitKeyStateRequestObject) (apigen.ChangeTransitKeyStateResponseObject, error)

ChangeTransitKeyState applies a lifecycle action with an optional deletion delay in seconds. Delay validation, service, and response conversion errors propagate to the HTTP error handler.

func (*API) CheckDefinitions 

func (a *API) CheckDefinitions(ctx context.Context, req apigen.CheckDefinitionsRequestObject) (apigen.CheckDefinitionsResponseObject, error)

func (*API) ClearValue 

func (a *API) ClearValue(ctx context.Context, req apigen.ClearValueRequestObject) (apigen.ClearValueResponseObject, error)

func (*API) CloneEnvironment 

func (a *API) CloneEnvironment(ctx context.Context, req apigen.CloneEnvironmentRequestObject) (apigen.CloneEnvironmentResponseObject, error)

func (*API) CompromiseRetireSamlSpKey 

func (a *API) CompromiseRetireSamlSpKey(ctx context.Context, req apigen.CompromiseRetireSamlSpKeyRequestObject) (apigen.CompromiseRetireSamlSpKeyResponseObject, error)

func (*API) ConfigureTransitKey 

func (a *API) ConfigureTransitKey(ctx context.Context, req apigen.ConfigureTransitKeyRequestObject) (apigen.ConfigureTransitKeyResponseObject, error)

ConfigureTransitKey applies supplied policy fields and returns updated metadata. Version validation, service, and response conversion errors propagate.

func (*API) CopyValues 

func (a *API) CopyValues(ctx context.Context, req apigen.CopyValuesRequestObject) (apigen.CopyValuesResponseObject, error)

func (*API) CreateAccessPolicy 

func (a *API) CreateAccessPolicy(ctx context.Context, req apigen.CreateAccessPolicyRequestObject) (apigen.CreateAccessPolicyResponseObject, error)

CreateAccessPolicy creates a policy in the addressed project and returns it as JSON, propagating service errors.

func (*API) CreateAccessRequest 

func (a *API) CreateAccessRequest(ctx context.Context, req apigen.CreateAccessRequestRequestObject) (apigen.CreateAccessRequestResponseObject, error)

CreateAccessRequest files an environment request and returns it as JSON, propagating service errors.

func (*API) CreateAdapter 

func (a *API) CreateAdapter(ctx context.Context, req apigen.CreateAdapterRequestObject) (apigen.CreateAdapterResponseObject, error)

func (*API) CreateApprovalPolicy 

func (a *API) CreateApprovalPolicy(ctx context.Context, req apigen.CreateApprovalPolicyRequestObject) (apigen.CreateApprovalPolicyResponseObject, error)

func (*API) CreateDefinitionsPlan 

func (a *API) CreateDefinitionsPlan(ctx context.Context, req apigen.CreateDefinitionsPlanRequestObject) (apigen.CreateDefinitionsPlanResponseObject, error)

func (*API) CreateDynamicProvider 

func (a *API) CreateDynamicProvider(ctx context.Context, req apigen.CreateDynamicProviderRequestObject) (apigen.CreateDynamicProviderResponseObject, error)

func (*API) CreateEnvGrant 

func (a *API) CreateEnvGrant(ctx context.Context, req apigen.CreateEnvGrantRequestObject) (apigen.CreateEnvGrantResponseObject, error)

func (*API) CreateEnvironment 

func (a *API) CreateEnvironment(ctx context.Context, req apigen.CreateEnvironmentRequestObject) (apigen.CreateEnvironmentResponseObject, error)

func (*API) CreateFederatedBinding 

func (a *API) CreateFederatedBinding(ctx context.Context, req apigen.CreateFederatedBindingRequestObject) (apigen.CreateFederatedBindingResponseObject, error)

func (*API) CreateFederationIssuer 

func (a *API) CreateFederationIssuer(ctx context.Context, req apigen.CreateFederationIssuerRequestObject) (apigen.CreateFederationIssuerResponseObject, error)

func (*API) CreateFileTarget 

func (a *API) CreateFileTarget(ctx context.Context, req apigen.CreateFileTargetRequestObject) (apigen.CreateFileTargetResponseObject, error)

func (*API) CreateFolder 

func (a *API) CreateFolder(ctx context.Context, req apigen.CreateFolderRequestObject) (apigen.CreateFolderResponseObject, error)

func (*API) CreateInstanceGrant 

func (a *API) CreateInstanceGrant(ctx context.Context, req apigen.CreateInstanceGrantRequestObject) (apigen.CreateInstanceGrantResponseObject, error)

func (*API) CreateKey 

func (a *API) CreateKey(ctx context.Context, req apigen.CreateKeyRequestObject) (apigen.CreateKeyResponseObject, error)

func (*API) CreateKeyGroup 

func (a *API) CreateKeyGroup(ctx context.Context, req apigen.CreateKeyGroupRequestObject) (apigen.CreateKeyGroupResponseObject, error)

func (*API) CreateOrg 

func (a *API) CreateOrg(ctx context.Context, req apigen.CreateOrgRequestObject) (apigen.CreateOrgResponseObject, error)

func (*API) CreateOrgGrant 

func (a *API) CreateOrgGrant(ctx context.Context, req apigen.CreateOrgGrantRequestObject) (apigen.CreateOrgGrantResponseObject, error)

func (*API) CreatePkiIssuer 

func (a *API) CreatePkiIssuer(ctx context.Context, req apigen.CreatePkiIssuerRequestObject) (apigen.CreatePkiIssuerResponseObject, error)

func (*API) CreatePkiProfile 

func (a *API) CreatePkiProfile(ctx context.Context, req apigen.CreatePkiProfileRequestObject) (apigen.CreatePkiProfileResponseObject, error)

func (*API) CreateProject 

func (a *API) CreateProject(ctx context.Context, req apigen.CreateProjectRequestObject) (apigen.CreateProjectResponseObject, error)

func (*API) CreateProjectGrant 

func (a *API) CreateProjectGrant(ctx context.Context, req apigen.CreateProjectGrantRequestObject) (apigen.CreateProjectGrantResponseObject, error)

func (*API) CreateRevisionPin 

func (a *API) CreateRevisionPin(ctx context.Context, req apigen.CreateRevisionPinRequestObject) (apigen.CreateRevisionPinResponseObject, error)

func (*API) CreateRule 

func (a *API) CreateRule(ctx context.Context, req apigen.CreateRuleRequestObject) (apigen.CreateRuleResponseObject, error)

func (*API) CreateScimBinding 

func (a *API) CreateScimBinding(ctx context.Context, req apigen.CreateScimBindingRequestObject) (apigen.CreateScimBindingResponseObject, error)

func (*API) CreateScimMapping 

func (a *API) CreateScimMapping(ctx context.Context, req apigen.CreateScimMappingRequestObject) (apigen.CreateScimMappingResponseObject, error)

func (*API) CreateServiceAccount 

func (a *API) CreateServiceAccount(ctx context.Context, req apigen.CreateServiceAccountRequestObject) (apigen.CreateServiceAccountResponseObject, error)

func (*API) CreateSshCa 

func (a *API) CreateSshCa(ctx context.Context, req apigen.CreateSshCaRequestObject) (apigen.CreateSshCaResponseObject, error)

func (*API) CreateSshProfile 

func (a *API) CreateSshProfile(ctx context.Context, req apigen.CreateSshProfileRequestObject) (apigen.CreateSshProfileResponseObject, error)

func (*API) CreateTransitKey 

func (a *API) CreateTransitKey(ctx context.Context, req apigen.CreateTransitKeyRequestObject) (apigen.CreateTransitKeyResponseObject, error)

CreateTransitKey creates a key and returns its metadata with status 201. Service and response conversion errors propagate to the HTTP error handler.

func (*API) DeclareValues 

func (a *API) DeclareValues(ctx context.Context, req apigen.DeclareValuesRequestObject) (apigen.DeclareValuesResponseObject, error)

func (*API) DeleteAccessPolicy 

func (a *API) DeleteAccessPolicy(ctx context.Context, req apigen.DeleteAccessPolicyRequestObject) (apigen.DeleteAccessPolicyResponseObject, error)

DeleteAccessPolicy deletes the addressed policy and returns a no-content response, propagating service errors.

func (*API) DeleteAdapter 

func (a *API) DeleteAdapter(ctx context.Context, req apigen.DeleteAdapterRequestObject) (apigen.DeleteAdapterResponseObject, error)

func (*API) DeleteApprovalPolicy 

func (a *API) DeleteApprovalPolicy(ctx context.Context, req apigen.DeleteApprovalPolicyRequestObject) (apigen.DeleteApprovalPolicyResponseObject, error)

func (*API) DeleteDynamicProvider 

func (a *API) DeleteDynamicProvider(ctx context.Context, req apigen.DeleteDynamicProviderRequestObject) (apigen.DeleteDynamicProviderResponseObject, error)

func (*API) DeleteEnvironment 

func (a *API) DeleteEnvironment(ctx context.Context, req apigen.DeleteEnvironmentRequestObject) (apigen.DeleteEnvironmentResponseObject, error)

func (*API) DeleteFederationIssuer 

func (a *API) DeleteFederationIssuer(ctx context.Context, req apigen.DeleteFederationIssuerRequestObject) (apigen.DeleteFederationIssuerResponseObject, error)

func (*API) DeleteFileTarget 

func (a *API) DeleteFileTarget(ctx context.Context, req apigen.DeleteFileTargetRequestObject) (apigen.DeleteFileTargetResponseObject, error)

func (*API) DeleteFolder 

func (a *API) DeleteFolder(ctx context.Context, req apigen.DeleteFolderRequestObject) (apigen.DeleteFolderResponseObject, error)

func (*API) DeleteInstanceRegistrationPolicy 

func (a *API) DeleteInstanceRegistrationPolicy(ctx context.Context, req apigen.DeleteInstanceRegistrationPolicyRequestObject) (apigen.DeleteInstanceRegistrationPolicyResponseObject, error)

func (*API) DeleteKey 

func (a *API) DeleteKey(ctx context.Context, req apigen.DeleteKeyRequestObject) (apigen.DeleteKeyResponseObject, error)

func (*API) DeleteKeyGroup 

func (a *API) DeleteKeyGroup(ctx context.Context, req apigen.DeleteKeyGroupRequestObject) (apigen.DeleteKeyGroupResponseObject, error)

func (*API) DeleteOauth2Provider 

func (a *API) DeleteOauth2Provider(ctx context.Context, req apigen.DeleteOauth2ProviderRequestObject) (apigen.DeleteOauth2ProviderResponseObject, error)

func (*API) DeleteOidcProvider 

func (a *API) DeleteOidcProvider(ctx context.Context, req apigen.DeleteOidcProviderRequestObject) (apigen.DeleteOidcProviderResponseObject, error)

func (*API) DeleteOrg 

func (a *API) DeleteOrg(ctx context.Context, req apigen.DeleteOrgRequestObject) (apigen.DeleteOrgResponseObject, error)

func (*API) DeleteOrgRegistrationPolicy 

func (a *API) DeleteOrgRegistrationPolicy(ctx context.Context, req apigen.DeleteOrgRegistrationPolicyRequestObject) (apigen.DeleteOrgRegistrationPolicyResponseObject, error)

func (*API) DeletePkiProfile 

func (a *API) DeletePkiProfile(ctx context.Context, req apigen.DeletePkiProfileRequestObject) (apigen.DeletePkiProfileResponseObject, error)

func (*API) DeleteProject 

func (a *API) DeleteProject(ctx context.Context, req apigen.DeleteProjectRequestObject) (apigen.DeleteProjectResponseObject, error)

func (*API) DeleteSamlProvider 

func (a *API) DeleteSamlProvider(ctx context.Context, req apigen.DeleteSamlProviderRequestObject) (apigen.DeleteSamlProviderResponseObject, error)

func (*API) DeleteScimBinding 

func (a *API) DeleteScimBinding(ctx context.Context, req apigen.DeleteScimBindingRequestObject) (apigen.DeleteScimBindingResponseObject, error)

func (*API) DeleteScimMapping 

func (a *API) DeleteScimMapping(ctx context.Context, req apigen.DeleteScimMappingRequestObject) (apigen.DeleteScimMappingResponseObject, error)

func (*API) DeleteServiceAccount 

func (a *API) DeleteServiceAccount(ctx context.Context, req apigen.DeleteServiceAccountRequestObject) (apigen.DeleteServiceAccountResponseObject, error)

func (*API) DeleteSshCa 

func (a *API) DeleteSshCa(ctx context.Context, req apigen.DeleteSshCaRequestObject) (apigen.DeleteSshCaResponseObject, error)

func (*API) DeleteSshProfile 

func (a *API) DeleteSshProfile(ctx context.Context, req apigen.DeleteSshProfileRequestObject) (apigen.DeleteSshProfileResponseObject, error)

func (*API) DiffRevisions 

func (a *API) DiffRevisions(ctx context.Context, req apigen.DiffRevisionsRequestObject) (apigen.DiffRevisionsResponseObject, error)

func (*API) DiffValues 

func (a *API) DiffValues(ctx context.Context, req apigen.DiffValuesRequestObject) (apigen.DiffValuesResponseObject, error)

func (*API) EmergencyAccess 

func (a *API) EmergencyAccess(ctx context.Context, req apigen.EmergencyAccessRequestObject) (apigen.EmergencyAccessResponseObject, error)

EmergencyAccess asks the service for emergency access in the addressed environment and returns the request as JSON, propagating service errors.

func (*API) EnrolPasskeyFinish 

func (a *API) EnrolPasskeyFinish(ctx context.Context, req apigen.EnrolPasskeyFinishRequestObject) (apigen.EnrolPasskeyFinishResponseObject, error)

func (*API) EnrolPasskeyStart 

func (a *API) EnrolPasskeyStart(ctx context.Context, req apigen.EnrolPasskeyStartRequestObject) (apigen.EnrolPasskeyStartResponseObject, error)

func (*API) EnrolTotpConfirm 

func (a *API) EnrolTotpConfirm(ctx context.Context, req apigen.EnrolTotpConfirmRequestObject) (apigen.EnrolTotpConfirmResponseObject, error)

func (*API) EnrolTotpStart 

func (a *API) EnrolTotpStart(ctx context.Context, req apigen.EnrolTotpStartRequestObject) (apigen.EnrolTotpStartResponseObject, error)

func (*API) EstablishCredential 

func (a *API) EstablishCredential(ctx context.Context, req apigen.EstablishCredentialRequestObject) (apigen.EstablishCredentialResponseObject, error)

func (*API) ExportDefinitions 

func (a *API) ExportDefinitions(ctx context.Context, req apigen.ExportDefinitionsRequestObject) (apigen.ExportDefinitionsResponseObject, error)

func (*API) ExportEnvAudit 

func (a *API) ExportEnvAudit(ctx context.Context, req apigen.ExportEnvAuditRequestObject) (apigen.ExportEnvAuditResponseObject, error)

func (*API) ExportOrgAudit 

func (a *API) ExportOrgAudit(ctx context.Context, req apigen.ExportOrgAuditRequestObject) (apigen.ExportOrgAuditResponseObject, error)

func (*API) ExportProjectAudit 

func (a *API) ExportProjectAudit(ctx context.Context, req apigen.ExportProjectAuditRequestObject) (apigen.ExportProjectAuditResponseObject, error)

func (*API) ExportValues 

func (a *API) ExportValues(ctx context.Context, req apigen.ExportValuesRequestObject) (apigen.ExportValuesResponseObject, error)

func (*API) FetchDelivery 

func (a *API) FetchDelivery(ctx context.Context, req apigen.FetchDeliveryRequestObject) (apigen.FetchDeliveryResponseObject, error)

func (*API) GetApprovalCeremony 

func (a *API) GetApprovalCeremony(ctx context.Context, req apigen.GetApprovalCeremonyRequestObject) (apigen.GetApprovalCeremonyResponseObject, error)

func (*API) GetCertificateCrl 

func (a *API) GetCertificateCrl(ctx context.Context, req apigen.GetCertificateCrlRequestObject) (apigen.GetCertificateCrlResponseObject, error)

func (*API) GetCredentialPolicy 

func (a *API) GetCredentialPolicy(ctx context.Context, _ apigen.GetCredentialPolicyRequestObject) (apigen.GetCredentialPolicyResponseObject, error)

func (*API) GetDefinitionsPlan 

func (a *API) GetDefinitionsPlan(ctx context.Context, req apigen.GetDefinitionsPlanRequestObject) (apigen.GetDefinitionsPlanResponseObject, error)

func (*API) GetDefinitionsSettings 

func (a *API) GetDefinitionsSettings(ctx context.Context, req apigen.GetDefinitionsSettingsRequestObject) (apigen.GetDefinitionsSettingsResponseObject, error)

func (*API) GetDeveloperCredentialPolicy 

func (a *API) GetDeveloperCredentialPolicy(ctx context.Context, _ apigen.GetDeveloperCredentialPolicyRequestObject) (apigen.GetDeveloperCredentialPolicyResponseObject, error)

func (*API) GetEnvironment 

func (a *API) GetEnvironment(ctx context.Context, req apigen.GetEnvironmentRequestObject) (apigen.GetEnvironmentResponseObject, error)

func (*API) GetEnvironmentSettings 

func (a *API) GetEnvironmentSettings(ctx context.Context, req apigen.GetEnvironmentSettingsRequestObject) (apigen.GetEnvironmentSettingsResponseObject, error)

func (*API) GetEnvironmentSignals 

func (a *API) GetEnvironmentSignals(ctx context.Context, req apigen.GetEnvironmentSignalsRequestObject) (apigen.GetEnvironmentSignalsResponseObject, error)

func (*API) GetFileTarget 

func (a *API) GetFileTarget(ctx context.Context, req apigen.GetFileTargetRequestObject) (apigen.GetFileTargetResponseObject, error)

func (*API) GetFolder 

func (a *API) GetFolder(ctx context.Context, req apigen.GetFolderRequestObject) (apigen.GetFolderResponseObject, error)

func (*API) GetInstanceConfig 

func (a *API) GetInstanceConfig(ctx context.Context, _ apigen.GetInstanceConfigRequestObject) (apigen.GetInstanceConfigResponseObject, error)

func (*API) GetInstanceMail 

func (a *API) GetInstanceMail(ctx context.Context, _ apigen.GetInstanceMailRequestObject) (apigen.GetInstanceMailResponseObject, error)

func (*API) GetInstanceRegistrationPolicy 

func (a *API) GetInstanceRegistrationPolicy(ctx context.Context, _ apigen.GetInstanceRegistrationPolicyRequestObject) (apigen.GetInstanceRegistrationPolicyResponseObject, error)

func (*API) GetInstanceUpdateJob 

func (a *API) GetInstanceUpdateJob(ctx context.Context, req apigen.GetInstanceUpdateJobRequestObject) (apigen.GetInstanceUpdateJobResponseObject, error)

func (*API) GetKey 

func (a *API) GetKey(ctx context.Context, req apigen.GetKeyRequestObject) (apigen.GetKeyResponseObject, error)

func (*API) GetKeyGroup 

func (a *API) GetKeyGroup(ctx context.Context, req apigen.GetKeyGroupRequestObject) (apigen.GetKeyGroupResponseObject, error)

func (*API) GetMachineReveal 

func (a *API) GetMachineReveal(ctx context.Context, req apigen.GetMachineRevealRequestObject) (apigen.GetMachineRevealResponseObject, error)

func (*API) GetMeta 

func (a *API) GetMeta(ctx context.Context, _ apigen.GetMetaRequestObject) (apigen.GetMetaResponseObject, error)

func (*API) GetMyProfile 

func (a *API) GetMyProfile(ctx context.Context, _ apigen.GetMyProfileRequestObject) (apigen.GetMyProfileResponseObject, error)

GetMyProfile returns the authenticated account profile over the API.

func (*API) GetOauth2Provider 

func (a *API) GetOauth2Provider(ctx context.Context, req apigen.GetOauth2ProviderRequestObject) (apigen.GetOauth2ProviderResponseObject, error)

func (*API) GetOidcProvider 

func (a *API) GetOidcProvider(ctx context.Context, req apigen.GetOidcProviderRequestObject) (apigen.GetOidcProviderResponseObject, error)

func (*API) GetOrg 

func (a *API) GetOrg(ctx context.Context, req apigen.GetOrgRequestObject) (apigen.GetOrgResponseObject, error)

GetOrg reads one organisation. It is tenant-scoped at org depth (#48), so there is no 403 leg: a caller who may not reach the org gets the same 404 as one asking after an org that never existed. The refusal is rendered by the uniform writer through the strict server's error leg, like the rest of the hierarchy surface — see internal/server/hierarchy.go.

func (*API) GetOrgRegistrationPolicy 

func (a *API) GetOrgRegistrationPolicy(ctx context.Context, req apigen.GetOrgRegistrationPolicyRequestObject) (apigen.GetOrgRegistrationPolicyResponseObject, error)

func (*API) GetOrgRetention 

func (a *API) GetOrgRetention(ctx context.Context, req apigen.GetOrgRetentionRequestObject) (apigen.GetOrgRetentionResponseObject, error)

func (*API) GetPkiIssuerCrl 

func (a *API) GetPkiIssuerCrl(ctx context.Context, req apigen.GetPkiIssuerCrlRequestObject) (apigen.GetPkiIssuerCrlResponseObject, error)

func (*API) GetProject 

func (a *API) GetProject(ctx context.Context, req apigen.GetProjectRequestObject) (apigen.GetProjectResponseObject, error)

func (*API) GetProjectRetention 

func (a *API) GetProjectRetention(ctx context.Context, req apigen.GetProjectRetentionRequestObject) (apigen.GetProjectRetentionResponseObject, error)

func (*API) GetRetentionHealth 

func (a *API) GetRetentionHealth(ctx context.Context, _ apigen.GetRetentionHealthRequestObject) (apigen.GetRetentionHealthResponseObject, error)

func (*API) GetRevealWindow 

func (a *API) GetRevealWindow(ctx context.Context, req apigen.GetRevealWindowRequestObject) (apigen.GetRevealWindowResponseObject, error)

func (*API) GetRevision 

func (a *API) GetRevision(ctx context.Context, req apigen.GetRevisionRequestObject) (apigen.GetRevisionResponseObject, error)

func (*API) GetRuntimeStatus 

func (a *API) GetRuntimeStatus(ctx context.Context, _ apigen.GetRuntimeStatusRequestObject) (apigen.GetRuntimeStatusResponseObject, error)

func (*API) GetSamlProvider 

func (a *API) GetSamlProvider(ctx context.Context, req apigen.GetSamlProviderRequestObject) (apigen.GetSamlProviderResponseObject, error)

func (*API) GetScimBinding 

func (a *API) GetScimBinding(ctx context.Context, req apigen.GetScimBindingRequestObject) (apigen.GetScimBindingResponseObject, error)

func (*API) GetScimCredential 

func (a *API) GetScimCredential(ctx context.Context, req apigen.GetScimCredentialRequestObject) (apigen.GetScimCredentialResponseObject, error)

func (*API) GetSshKrl 

func (a *API) GetSshKrl(ctx context.Context, req apigen.GetSshKrlRequestObject) (apigen.GetSshKrlResponseObject, error)

func (*API) GetSshTrustedKeys 

func (a *API) GetSshTrustedKeys(ctx context.Context, req apigen.GetSshTrustedKeysRequestObject) (apigen.GetSshTrustedKeysResponseObject, error)

func (*API) GetTotpStatus 

func (a *API) GetTotpStatus(ctx context.Context, _ apigen.GetTotpStatusRequestObject) (apigen.GetTotpStatusResponseObject, error)

GetTotpStatus reports the caller's own authenticator state. A pure read on the caller's account, classified like ListPasskeys: no MFA gate, no mutation.

func (*API) GetUpdateStatus 

func (a *API) GetUpdateStatus(ctx context.Context, _ apigen.GetUpdateStatusRequestObject) (apigen.GetUpdateStatusResponseObject, error)

func (*API) GetValue 

func (a *API) GetValue(ctx context.Context, req apigen.GetValueRequestObject) (apigen.GetValueResponseObject, error)

func (*API) ImportValues 

func (a *API) ImportValues(ctx context.Context, req apigen.ImportValuesRequestObject) (apigen.ImportValuesResponseObject, error)

func (*API) InitializeValue 

func (a *API) InitializeValue(ctx context.Context, req apigen.InitializeValueRequestObject) (apigen.InitializeValueResponseObject, error)

func (*API) InstallPkiIssuerCertificate 

func (a *API) InstallPkiIssuerCertificate(ctx context.Context, req apigen.InstallPkiIssuerCertificateRequestObject) (apigen.InstallPkiIssuerCertificateResponseObject, error)

func (*API) InviteInstanceMember 

func (a *API) InviteInstanceMember(ctx context.Context, req apigen.InviteInstanceMemberRequestObject) (apigen.InviteInstanceMemberResponseObject, error)

InviteInstanceMember is the instance-scope form: the same transaction under `manage-members` held at instance scope.

func (*API) InviteOrgMember 

func (a *API) InviteOrgMember(ctx context.Context, req apigen.InviteOrgMemberRequestObject) (apigen.InviteOrgMemberResponseObject, error)

InviteOrgMember is the human-auth ADR's account-creation path at organisation scope. The authority is delivered in the HTTP response to the inviter, who hands it to the invitee out of band — the same delivery credential-reset uses. Every refusal goes through the one uniform writer: a taken username is the store's conflict, an unauthorized caller the tenant class's uniform 403/404.

func (*API) IssueCertificate 

func (a *API) IssueCertificate(ctx context.Context, req apigen.IssueCertificateRequestObject) (apigen.IssueCertificateResponseObject, error)

IssueCertificate returns the public certificate and, for generated-key issuance, its display-once private key. It zeroes the service's key buffer after copying it into the response. Conversion and service errors propagate.

func (*API) IssueSshCertificate 

func (a *API) IssueSshCertificate(ctx context.Context, req apigen.IssueSshCertificateRequestObject) (apigen.IssueSshCertificateResponseObject, error)

func (*API) LinkIdentity 

func (a *API) LinkIdentity(ctx context.Context, req apigen.LinkIdentityRequestObject) (apigen.LinkIdentityResponseObject, error)

LinkIdentity starts a session-bound OIDC linking ceremony using the caller's proof. A browser start sets a return marker cookie; service errors propagate.

func (*API) ListAccessPolicies 

func (a *API) ListAccessPolicies(ctx context.Context, req apigen.ListAccessPoliciesRequestObject) (apigen.ListAccessPoliciesResponseObject, error)

ListAccessPolicies returns the addressed project's policies as a JSON list, propagating service errors.

func (*API) ListAccessRequests 

func (a *API) ListAccessRequests(ctx context.Context, req apigen.ListAccessRequestsRequestObject) (apigen.ListAccessRequestsResponseObject, error)

ListAccessRequests returns the environment's request queue and covering offer as JSON, omitting the offer when absent and propagating service errors.

func (*API) ListAdapterTargets 

func (a *API) ListAdapterTargets(ctx context.Context, req apigen.ListAdapterTargetsRequestObject) (apigen.ListAdapterTargetsResponseObject, error)

func (*API) ListAdapters 

func (a *API) ListAdapters(ctx context.Context, req apigen.ListAdaptersRequestObject) (apigen.ListAdaptersResponseObject, error)

func (*API) ListApprovalPolicies 

func (a *API) ListApprovalPolicies(ctx context.Context, req apigen.ListApprovalPoliciesRequestObject) (apigen.ListApprovalPoliciesResponseObject, error)

func (*API) ListApprovalRequests 

func (a *API) ListApprovalRequests(ctx context.Context, req apigen.ListApprovalRequestsRequestObject) (apigen.ListApprovalRequestsResponseObject, error)

func (*API) ListCertificateProfiles 

func (a *API) ListCertificateProfiles(ctx context.Context, req apigen.ListCertificateProfilesRequestObject) (apigen.ListCertificateProfilesResponseObject, error)

func (*API) ListCertificates 

func (a *API) ListCertificates(ctx context.Context, req apigen.ListCertificatesRequestObject) (apigen.ListCertificatesResponseObject, error)

func (*API) ListDeliveryTargets 

func (a *API) ListDeliveryTargets(ctx context.Context, req apigen.ListDeliveryTargetsRequestObject) (apigen.ListDeliveryTargetsResponseObject, error)

func (*API) ListDynamicProviders 

func (a *API) ListDynamicProviders(ctx context.Context, req apigen.ListDynamicProvidersRequestObject) (apigen.ListDynamicProvidersResponseObject, error)

func (*API) ListEnvironmentParameters 

func (a *API) ListEnvironmentParameters(ctx context.Context, req apigen.ListEnvironmentParametersRequestObject) (apigen.ListEnvironmentParametersResponseObject, error)

func (*API) ListEnvironments 

func (a *API) ListEnvironments(ctx context.Context, req apigen.ListEnvironmentsRequestObject) (apigen.ListEnvironmentsResponseObject, error)

func (*API) ListFederationIssuers 

func (a *API) ListFederationIssuers(ctx context.Context, _ apigen.ListFederationIssuersRequestObject) (apigen.ListFederationIssuersResponseObject, error)

func (*API) ListFileTargets 

func (a *API) ListFileTargets(ctx context.Context, req apigen.ListFileTargetsRequestObject) (apigen.ListFileTargetsResponseObject, error)

func (*API) ListFolders 

func (a *API) ListFolders(ctx context.Context, req apigen.ListFoldersRequestObject) (apigen.ListFoldersResponseObject, error)

func (*API) ListIdentities 

func (a *API) ListIdentities(ctx context.Context, _ apigen.ListIdentitiesRequestObject) (apigen.ListIdentitiesResponseObject, error)

func (*API) ListInstanceConnections 

func (a *API) ListInstanceConnections(ctx context.Context, _ apigen.ListInstanceConnectionsRequestObject) (apigen.ListInstanceConnectionsResponseObject, error)

func (*API) ListInstanceGrants 

func (a *API) ListInstanceGrants(ctx context.Context, _ apigen.ListInstanceGrantsRequestObject) (apigen.ListInstanceGrantsResponseObject, error)

func (*API) ListKeyGroups 

func (a *API) ListKeyGroups(ctx context.Context, req apigen.ListKeyGroupsRequestObject) (apigen.ListKeyGroupsResponseObject, error)

func (*API) ListKeys 

func (a *API) ListKeys(ctx context.Context, req apigen.ListKeysRequestObject) (apigen.ListKeysResponseObject, error)

func (*API) ListLeases 

func (a *API) ListLeases(ctx context.Context, req apigen.ListLeasesRequestObject) (apigen.ListLeasesResponseObject, error)

func (*API) ListMachineCredentials 

func (a *API) ListMachineCredentials(ctx context.Context, req apigen.ListMachineCredentialsRequestObject) (apigen.ListMachineCredentialsResponseObject, error)

func (*API) ListMyDeveloperCredentials 

func (a *API) ListMyDeveloperCredentials(ctx context.Context, _ apigen.ListMyDeveloperCredentialsRequestObject) (apigen.ListMyDeveloperCredentialsResponseObject, error)

func (*API) ListMyOrgs 

func (a *API) ListMyOrgs(ctx context.Context, _ apigen.ListMyOrgsRequestObject) (apigen.ListMyOrgsResponseObject, error)

ListMyOrgs is the navigation surface: the organisations the caller's own grants name. Distinct from ListOrgs, which is the operator's enumeration of every org and is MFA-mandatory — see the contract and service for why the sidebar must not go through it.

func (*API) ListMySessions 

func (a *API) ListMySessions(ctx context.Context, _ apigen.ListMySessionsRequestObject) (apigen.ListMySessionsResponseObject, error)

func (*API) ListOauth2Providers 

func (a *API) ListOauth2Providers(ctx context.Context, _ apigen.ListOauth2ProvidersRequestObject) (apigen.ListOauth2ProvidersResponseObject, error)

func (*API) ListOidcProviders 

func (a *API) ListOidcProviders(ctx context.Context, _ apigen.ListOidcProvidersRequestObject) (apigen.ListOidcProvidersResponseObject, error)

func (*API) ListOrgGrants 

func (a *API) ListOrgGrants(ctx context.Context, req apigen.ListOrgGrantsRequestObject) (apigen.ListOrgGrantsResponseObject, error)

func (*API) ListOrgRules 

func (a *API) ListOrgRules(ctx context.Context, req apigen.ListOrgRulesRequestObject) (apigen.ListOrgRulesResponseObject, error)

func (*API) ListOrgs 

func (a *API) ListOrgs(ctx context.Context, req apigen.ListOrgsRequestObject) (apigen.ListOrgsResponseObject, error)

ListOrgs enumerates organizations for an authorized operator. An origin query narrows the returned items and count after the service read; list authorization and read errors propagate.

func (*API) ListPasskeys 

func (a *API) ListPasskeys(ctx context.Context, _ apigen.ListPasskeysRequestObject) (apigen.ListPasskeysResponseObject, error)

func (*API) ListPendingDrafts 

func (a *API) ListPendingDrafts(ctx context.Context, req apigen.ListPendingDraftsRequestObject) (apigen.ListPendingDraftsResponseObject, error)

func (*API) ListPkiIssuers 

func (a *API) ListPkiIssuers(ctx context.Context, _ apigen.ListPkiIssuersRequestObject) (apigen.ListPkiIssuersResponseObject, error)

func (*API) ListPkiProfiles 

func (a *API) ListPkiProfiles(ctx context.Context, _ apigen.ListPkiProfilesRequestObject) (apigen.ListPkiProfilesResponseObject, error)

func (*API) ListProjectDeveloperCredentials 

func (a *API) ListProjectDeveloperCredentials(ctx context.Context, req apigen.ListProjectDeveloperCredentialsRequestObject) (apigen.ListProjectDeveloperCredentialsResponseObject, error)

func (*API) ListProjectGrants 

func (a *API) ListProjectGrants(ctx context.Context, req apigen.ListProjectGrantsRequestObject) (apigen.ListProjectGrantsResponseObject, error)

func (*API) ListProjectRules 

func (a *API) ListProjectRules(ctx context.Context, req apigen.ListProjectRulesRequestObject) (apigen.ListProjectRulesResponseObject, error)

func (*API) ListProjects 

func (a *API) ListProjects(ctx context.Context, req apigen.ListProjectsRequestObject) (apigen.ListProjectsResponseObject, error)

func (*API) ListRemotes 

func (a *API) ListRemotes(ctx context.Context, _ apigen.ListRemotesRequestObject) (apigen.ListRemotesResponseObject, error)

func (*API) ListRevisionPins 

func (a *API) ListRevisionPins(ctx context.Context, req apigen.ListRevisionPinsRequestObject) (apigen.ListRevisionPinsResponseObject, error)

func (*API) ListRevisions 

func (a *API) ListRevisions(ctx context.Context, req apigen.ListRevisionsRequestObject) (apigen.ListRevisionsResponseObject, error)

ListRevisions is one page of lineage. The contract validator has already bounded `limit` to the spec's range, so the defaults here are the only interpretation left: no cursor means "from the newest", no limit means the documented default page. `next_before` appears exactly when the page was full, so a client that pages until it is absent reads the whole history.

func (*API) ListSamlProviders 

func (a *API) ListSamlProviders(ctx context.Context, _ apigen.ListSamlProvidersRequestObject) (apigen.ListSamlProvidersResponseObject, error)

func (*API) ListSamlSpKeys 

func (a *API) ListSamlSpKeys(ctx context.Context, _ apigen.ListSamlSpKeysRequestObject) (apigen.ListSamlSpKeysResponseObject, error)

func (*API) ListScimBindings 

func (a *API) ListScimBindings(ctx context.Context, req apigen.ListScimBindingsRequestObject) (apigen.ListScimBindingsResponseObject, error)

func (*API) ListScimCredentials 

func (a *API) ListScimCredentials(ctx context.Context, req apigen.ListScimCredentialsRequestObject) (apigen.ListScimCredentialsResponseObject, error)

func (*API) ListScimDirectoryGroups 

func (a *API) ListScimDirectoryGroups(ctx context.Context, req apigen.ListScimDirectoryGroupsRequestObject) (apigen.ListScimDirectoryGroupsResponseObject, error)

func (*API) ListScimDirectoryUsers 

func (a *API) ListScimDirectoryUsers(ctx context.Context, req apigen.ListScimDirectoryUsersRequestObject) (apigen.ListScimDirectoryUsersResponseObject, error)

func (*API) ListScimMappings 

func (a *API) ListScimMappings(ctx context.Context, req apigen.ListScimMappingsRequestObject) (apigen.ListScimMappingsResponseObject, error)

func (*API) ListServiceAccounts 

func (a *API) ListServiceAccounts(ctx context.Context, req apigen.ListServiceAccountsRequestObject) (apigen.ListServiceAccountsResponseObject, error)

func (*API) ListSshCas 

func (a *API) ListSshCas(ctx context.Context, req apigen.ListSshCasRequestObject) (apigen.ListSshCasResponseObject, error)

func (*API) ListSshCertificates 

func (a *API) ListSshCertificates(ctx context.Context, req apigen.ListSshCertificatesRequestObject) (apigen.ListSshCertificatesResponseObject, error)

func (*API) ListSshProfiles 

func (a *API) ListSshProfiles(ctx context.Context, req apigen.ListSshProfilesRequestObject) (apigen.ListSshProfilesResponseObject, error)

func (*API) ListTransitKeys 

func (a *API) ListTransitKeys(ctx context.Context, req apigen.ListTransitKeysRequestObject) (apigen.ListTransitKeysResponseObject, error)

ListTransitKeys returns the environment's key metadata. Service and response conversion errors propagate to the HTTP error handler.

func (*API) ListValueOccurrences 

func (a *API) ListValueOccurrences(ctx context.Context, req apigen.ListValueOccurrencesRequestObject) (apigen.ListValueOccurrencesResponseObject, error)

func (*API) ListValues 

func (a *API) ListValues(ctx context.Context, req apigen.ListValuesRequestObject) (apigen.ListValuesResponseObject, error)

func (*API) ListWorkspaceOrigins 

func (a *API) ListWorkspaceOrigins(ctx context.Context, _ apigen.ListWorkspaceOriginsRequestObject) (apigen.ListWorkspaceOriginsResponseObject, error)

func (*API) LocalLogin 

func (a *API) LocalLogin(ctx context.Context, req apigen.LocalLoginRequestObject) (apigen.LocalLoginResponseObject, error)

func (*API) LoginChallengeTotp 

func (a *API) LoginChallengeTotp(ctx context.Context, req apigen.LoginChallengeTotpRequestObject) (apigen.LoginChallengeTotpResponseObject, error)

LoginChallengeTotp satisfies a login challenge with a TOTP code and mints the browser session (#760). Refusals map through the shared wire policy exactly as stepUpTotp does: a missing/expired/consumed challenge is 404, a wrong code 401, a replayed time step 409, the factor budget 429.

func (*API) LoginChallengeWebauthnFinish 

func (a *API) LoginChallengeWebauthnFinish(ctx context.Context, req apigen.LoginChallengeWebauthnFinishRequestObject) (apigen.LoginChallengeWebauthnFinishResponseObject, error)

func (*API) LoginChallengeWebauthnStart 

func (a *API) LoginChallengeWebauthnStart(ctx context.Context, req apigen.LoginChallengeWebauthnStartRequestObject) (apigen.LoginChallengeWebauthnStartResponseObject, error)

func (*API) Logout 

func (a *API) Logout(ctx context.Context, _ apigen.LogoutRequestObject) (apigen.LogoutResponseObject, error)

func (*API) Middleware 

func (a *API) Middleware() []func(http.Handler) http.Handler

Middleware returns the matched-route API stack, outermost first. recoverPanics leads the error-contract legs so an invariant panic below becomes the uniform refusal. RED observation lives at public-router scope so it also sees unmatched API paths, unsupported methods, and CORS preflights — see internal/server/server.go and metrics.go.

func (*API) MintDeveloperCredential 

func (a *API) MintDeveloperCredential(ctx context.Context, req apigen.MintDeveloperCredentialRequestObject) (apigen.MintDeveloperCredentialResponseObject, error)

func (*API) MintInstanceConnection 

func (a *API) MintInstanceConnection(ctx context.Context, req apigen.MintInstanceConnectionRequestObject) (apigen.MintInstanceConnectionResponseObject, error)

func (*API) MintLease 

func (a *API) MintLease(ctx context.Context, req apigen.MintLeaseRequestObject) (apigen.MintLeaseResponseObject, error)

func (*API) MintMachineCredential 

func (a *API) MintMachineCredential(ctx context.Context, req apigen.MintMachineCredentialRequestObject) (apigen.MintMachineCredentialResponseObject, error)

func (*API) MintScimCredential 

func (a *API) MintScimCredential(ctx context.Context, req apigen.MintScimCredentialRequestObject) (apigen.MintScimCredentialResponseObject, error)

func (*API) Oauth2Callback 

func (a *API) Oauth2Callback(ctx context.Context, req apigen.Oauth2CallbackRequestObject) (apigen.Oauth2CallbackResponseObject, error)

func (*API) Oauth2Start 

func (a *API) Oauth2Start(ctx context.Context, req apigen.Oauth2StartRequestObject) (apigen.Oauth2StartResponseObject, error)

Oauth2Start forwards the purpose, login intent and optional sign-up org to the service. A successful anonymous start sets the browser-binding cookie; its expected refusals are rendered by oauth2StartError.

func (*API) OidcCallback 

func (a *API) OidcCallback(ctx context.Context, req apigen.OidcCallbackRequestObject) (apigen.OidcCallbackResponseObject, error)

func (*API) OidcStart 

func (a *API) OidcStart(ctx context.Context, req apigen.OidcStartRequestObject) (apigen.OidcStartResponseObject, error)

OidcStart forwards the purpose, login intent and optional sign-up org to the service. A successful anonymous start sets the browser-binding cookie; its expected refusals are rendered by oidcStartError.

func (*API) PasskeyLoginFinish 

func (a *API) PasskeyLoginFinish(ctx context.Context, req apigen.PasskeyLoginFinishRequestObject) (apigen.PasskeyLoginFinishResponseObject, error)

func (*API) PasskeyLoginStart 

func (a *API) PasskeyLoginStart(ctx context.Context, _ apigen.PasskeyLoginStartRequestObject) (apigen.PasskeyLoginStartResponseObject, error)

func (*API) PatchSamlProvider 

func (a *API) PatchSamlProvider(ctx context.Context, req apigen.PatchSamlProviderRequestObject) (apigen.PatchSamlProviderResponseObject, error)

func (*API) PauseAdapterTarget 

func (a *API) PauseAdapterTarget(ctx context.Context, req apigen.PauseAdapterTargetRequestObject) (apigen.PauseAdapterTargetResponseObject, error)

func (*API) PlanAdapterTarget 

func (a *API) PlanAdapterTarget(ctx context.Context, req apigen.PlanAdapterTargetRequestObject) (apigen.PlanAdapterTargetResponseObject, error)

func (*API) PollCLIDevice 

func (a *API) PollCLIDevice(ctx context.Context, req apigen.PollCLIDeviceRequestObject) (apigen.PollCLIDeviceResponseObject, error)

func (*API) PreviewInstanceConfigAdoption 

func (a *API) PreviewInstanceConfigAdoption(ctx context.Context, _ apigen.PreviewInstanceConfigAdoptionRequestObject) (apigen.PreviewInstanceConfigAdoptionResponseObject, error)

func (*API) PublishPendingChanges 

func (a *API) PublishPendingChanges(ctx context.Context, req apigen.PublishPendingChangesRequestObject) (apigen.PublishPendingChangesResponseObject, error)

func (*API) PublishPkiIssuerCrl 

func (a *API) PublishPkiIssuerCrl(ctx context.Context, req apigen.PublishPkiIssuerCrlRequestObject) (apigen.PublishPkiIssuerCrlResponseObject, error)

func (*API) PutInstanceRegistrationPolicy 

func (a *API) PutInstanceRegistrationPolicy(ctx context.Context, req apigen.PutInstanceRegistrationPolicyRequestObject) (apigen.PutInstanceRegistrationPolicyResponseObject, error)

func (*API) PutOauth2Provider 

func (a *API) PutOauth2Provider(ctx context.Context, req apigen.PutOauth2ProviderRequestObject) (apigen.PutOauth2ProviderResponseObject, error)

func (*API) PutOidcProvider 

func (a *API) PutOidcProvider(ctx context.Context, req apigen.PutOidcProviderRequestObject) (apigen.PutOidcProviderResponseObject, error)

func (*API) PutOrgRegistrationPolicy 

func (a *API) PutOrgRegistrationPolicy(ctx context.Context, req apigen.PutOrgRegistrationPolicyRequestObject) (apigen.PutOrgRegistrationPolicyResponseObject, error)

func (*API) PutSamlProvider 

func (a *API) PutSamlProvider(ctx context.Context, req apigen.PutSamlProviderRequestObject) (apigen.PutSamlProviderResponseObject, error)

func (*API) QueryEnvAudit 

func (a *API) QueryEnvAudit(ctx context.Context, req apigen.QueryEnvAuditRequestObject) (apigen.QueryEnvAuditResponseObject, error)

func (*API) QueryOrgAudit 

func (a *API) QueryOrgAudit(ctx context.Context, req apigen.QueryOrgAuditRequestObject) (apigen.QueryOrgAuditResponseObject, error)

func (*API) QueryProjectAudit 

func (a *API) QueryProjectAudit(ctx context.Context, req apigen.QueryProjectAuditRequestObject) (apigen.QueryProjectAuditResponseObject, error)

func (*API) ReauthPasskeyFinish 

func (a *API) ReauthPasskeyFinish(ctx context.Context, req apigen.ReauthPasskeyFinishRequestObject) (apigen.ReauthPasskeyFinishResponseObject, error)

func (*API) ReauthPasskeyStart 

func (a *API) ReauthPasskeyStart(ctx context.Context, req apigen.ReauthPasskeyStartRequestObject) (apigen.ReauthPasskeyStartResponseObject, error)

func (*API) ReauthTotp 

func (a *API) ReauthTotp(ctx context.Context, req apigen.ReauthTotpRequestObject) (apigen.ReauthTotpResponseObject, error)

ReauthTotp opens a disclosure window with a TOTP code.

The one refusal worth reading twice is the 409. A `0` effective window — what every protected environment is capped at — has no TOTP path at all, because TOTP cannot bind its challenge to the enumerated unit and therefore cannot authorize one decision over exactly those keys. That is not an authorization answer about this caller, it is the ENVIRONMENT's state refusing the factor, which is what conflict means. Answering 401 instead would tell the human their code was wrong and send them to re-enrol an authenticator that was never the problem.

func (*API) ReclassifyKey 

func (a *API) ReclassifyKey(ctx context.Context, req apigen.ReclassifyKeyRequestObject) (apigen.ReclassifyKeyResponseObject, error)

func (*API) ReconcileOfflineRecords 

func (a *API) ReconcileOfflineRecords(ctx context.Context, req apigen.ReconcileOfflineRecordsRequestObject) (apigen.ReconcileOfflineRecordsResponseObject, error)

func (*API) RedeemCLILogin 

func (a *API) RedeemCLILogin(ctx context.Context, req apigen.RedeemCLILoginRequestObject) (apigen.RedeemCLILoginResponseObject, error)

func (*API) RedeemCLIReauth 

func (a *API) RedeemCLIReauth(ctx context.Context, req apigen.RedeemCLIReauthRequestObject) (apigen.RedeemCLIReauthResponseObject, error)

func (*API) RedeemWorkspaceHandoff 

func (a *API) RedeemWorkspaceHandoff(ctx context.Context, req apigen.RedeemWorkspaceHandoffRequestObject) (apigen.RedeemWorkspaceHandoffResponseObject, error)

func (*API) ReencryptInstance 

func (a *API) ReencryptInstance(ctx context.Context, _ apigen.ReencryptInstanceRequestObject) (apigen.ReencryptInstanceResponseObject, error)

func (*API) ReencryptProject 

func (a *API) ReencryptProject(ctx context.Context, req apigen.ReencryptProjectRequestObject) (apigen.ReencryptProjectResponseObject, error)

func (*API) RefreshSamlProviderMetadata 

func (a *API) RefreshSamlProviderMetadata(ctx context.Context, req apigen.RefreshSamlProviderMetadataRequestObject) (apigen.RefreshSamlProviderMetadataResponseObject, error)

func (*API) RegenerateRecoveryCodes 

func (a *API) RegenerateRecoveryCodes(ctx context.Context, req apigen.RegenerateRecoveryCodesRequestObject) (apigen.RegenerateRecoveryCodesResponseObject, error)

func (*API) ReleasePkiIssuerHold 

func (a *API) ReleasePkiIssuerHold(ctx context.Context, req apigen.ReleasePkiIssuerHoldRequestObject) (apigen.ReleasePkiIssuerHoldResponseObject, error)

func (*API) ReleaseRevisionPin 

func (a *API) ReleaseRevisionPin(ctx context.Context, req apigen.ReleaseRevisionPinRequestObject) (apigen.ReleaseRevisionPinResponseObject, error)

func (*API) RemoveAdapterTarget 

func (a *API) RemoveAdapterTarget(ctx context.Context, req apigen.RemoveAdapterTargetRequestObject) (apigen.RemoveAdapterTargetResponseObject, error)

func (*API) RemovePasskey 

func (a *API) RemovePasskey(ctx context.Context, req apigen.RemovePasskeyRequestObject) (apigen.RemovePasskeyResponseObject, error)

func (*API) RemoveRemote 

func (a *API) RemoveRemote(ctx context.Context, req apigen.RemoveRemoteRequestObject) (apigen.RemoveRemoteResponseObject, error)

func (*API) RemoveTotp 

func (a *API) RemoveTotp(ctx context.Context, req apigen.RemoveTotpRequestObject) (apigen.RemoveTotpResponseObject, error)

func (*API) RemoveWorkspaceOrigin 

func (a *API) RemoveWorkspaceOrigin(ctx context.Context, req apigen.RemoveWorkspaceOriginRequestObject) (apigen.RemoveWorkspaceOriginResponseObject, error)

RemoveWorkspaceOrigin takes the origin in the BODY, never in the path. A path parameter naming an origin is one review lapse away from a path parameter naming a target, and api/noproxy_test.go refuses that shape by name.

func (*API) RenameEnvironment 

func (a *API) RenameEnvironment(ctx context.Context, req apigen.RenameEnvironmentRequestObject) (apigen.RenameEnvironmentResponseObject, error)

func (*API) RenameFolder 

func (a *API) RenameFolder(ctx context.Context, req apigen.RenameFolderRequestObject) (apigen.RenameFolderResponseObject, error)

func (*API) RenameKey 

func (a *API) RenameKey(ctx context.Context, req apigen.RenameKeyRequestObject) (apigen.RenameKeyResponseObject, error)

func (*API) RenameKeyGroup 

func (a *API) RenameKeyGroup(ctx context.Context, req apigen.RenameKeyGroupRequestObject) (apigen.RenameKeyGroupResponseObject, error)

func (*API) RenameOrg 

func (a *API) RenameOrg(ctx context.Context, req apigen.RenameOrgRequestObject) (apigen.RenameOrgResponseObject, error)

func (*API) RenameProject 

func (a *API) RenameProject(ctx context.Context, req apigen.RenameProjectRequestObject) (apigen.RenameProjectResponseObject, error)

func (*API) RenameRemote 

func (a *API) RenameRemote(ctx context.Context, req apigen.RenameRemoteRequestObject) (apigen.RenameRemoteResponseObject, error)

func (*API) RenewCertificate 

func (a *API) RenewCertificate(ctx context.Context, req apigen.RenewCertificateRequestObject) (apigen.RenewCertificateResponseObject, error)

func (*API) RenewLease 

func (a *API) RenewLease(ctx context.Context, req apigen.RenewLeaseRequestObject) (apigen.RenewLeaseResponseObject, error)

func (*API) ReorderEnvironments 

func (a *API) ReorderEnvironments(ctx context.Context, req apigen.ReorderEnvironmentsRequestObject) (apigen.ReorderEnvironmentsResponseObject, error)

func (*API) ReplaceRules 

func (a *API) ReplaceRules(ctx context.Context, req apigen.ReplaceRulesRequestObject) (apigen.ReplaceRulesResponseObject, error)

func (*API) ReportDeliveryTarget 

func (a *API) ReportDeliveryTarget(ctx context.Context, req apigen.ReportDeliveryTargetRequestObject) (apigen.ReportDeliveryTargetResponseObject, error)

func (*API) ReportFileTarget 

func (a *API) ReportFileTarget(ctx context.Context, req apigen.ReportFileTargetRequestObject) (apigen.ReportFileTargetResponseObject, error)

func (*API) RequestInstanceUpdate 

func (a *API) RequestInstanceUpdate(ctx context.Context, req apigen.RequestInstanceUpdateRequestObject) (apigen.RequestInstanceUpdateResponseObject, error)

func (*API) ResetCredential 

func (a *API) ResetCredential(ctx context.Context, req apigen.ResetCredentialRequestObject) (apigen.ResetCredentialResponseObject, error)

Administrator-issued credential reset (#54, human-auth ADR - Recovery).

The route is enumeration-uniform (classified unauthenticated): every failure that could reveal the target's grant shape — an unknown target, a caller lacking credential-reset, an org-P holder reaching for an org-O target, and a target holding an instance capability (break-glass only) — answers the same uniform 401 (B2). There is no differential status a reset holder could probe grant shapes with; the operator learns to use break-glass from the docs, and the true cause of every refusal is durable in the audit trail.

func (*API) ResumeAdapterMove 

func (a *API) ResumeAdapterMove(ctx context.Context, req apigen.ResumeAdapterMoveRequestObject) (apigen.ResumeAdapterMoveResponseObject, error)

func (*API) ResumeAdapterTarget 

func (a *API) ResumeAdapterTarget(ctx context.Context, req apigen.ResumeAdapterTargetRequestObject) (apigen.ResumeAdapterTargetResponseObject, error)

func (*API) RetirePkiIssuer 

func (a *API) RetirePkiIssuer(ctx context.Context, req apigen.RetirePkiIssuerRequestObject) (apigen.RetirePkiIssuerResponseObject, error)

func (*API) RetireSamlSpKey 

func (a *API) RetireSamlSpKey(ctx context.Context, req apigen.RetireSamlSpKeyRequestObject) (apigen.RetireSamlSpKeyResponseObject, error)

func (*API) RetireSshCaKey 

func (a *API) RetireSshCaKey(ctx context.Context, req apigen.RetireSshCaKeyRequestObject) (apigen.RetireSshCaKeyResponseObject, error)

func (*API) RevealRevisionDiff 

func (a *API) RevealRevisionDiff(ctx context.Context, req apigen.RevealRevisionDiffRequestObject) (apigen.RevealRevisionDiffResponseObject, error)

func (*API) RevealValue 

func (a *API) RevealValue(ctx context.Context, req apigen.RevealValueRequestObject) (apigen.RevealValueResponseObject, error)

func (*API) RevealValueDiff 

func (a *API) RevealValueDiff(ctx context.Context, req apigen.RevealValueDiffRequestObject) (apigen.RevealValueDiffResponseObject, error)

func (*API) RevealValues 

func (a *API) RevealValues(ctx context.Context, req apigen.RevealValuesRequestObject) (apigen.RevealValuesResponseObject, error)

func (*API) RevokeAccessRequest 

func (a *API) RevokeAccessRequest(ctx context.Context, req apigen.RevokeAccessRequestRequestObject) (apigen.RevokeAccessRequestResponseObject, error)

RevokeAccessRequest ends the addressed granted access and returns the request as JSON, propagating service errors.

func (*API) RevokeAdapterCredential 

func (a *API) RevokeAdapterCredential(ctx context.Context, req apigen.RevokeAdapterCredentialRequestObject) (apigen.RevokeAdapterCredentialResponseObject, error)

func (*API) RevokeAllMyDeveloperCredentials 

func (a *API) RevokeAllMyDeveloperCredentials(ctx context.Context, _ apigen.RevokeAllMyDeveloperCredentialsRequestObject) (apigen.RevokeAllMyDeveloperCredentialsResponseObject, error)

func (*API) RevokeCertificate 

func (a *API) RevokeCertificate(ctx context.Context, req apigen.RevokeCertificateRequestObject) (apigen.RevokeCertificateResponseObject, error)

func (*API) RevokeDynamicProviderCredential 

func (a *API) RevokeDynamicProviderCredential(ctx context.Context, req apigen.RevokeDynamicProviderCredentialRequestObject) (apigen.RevokeDynamicProviderCredentialResponseObject, error)

func (*API) RevokeEnvGrant 

func (a *API) RevokeEnvGrant(ctx context.Context, req apigen.RevokeEnvGrantRequestObject) (apigen.RevokeEnvGrantResponseObject, error)

func (*API) RevokeInstanceConnection 

func (a *API) RevokeInstanceConnection(ctx context.Context, req apigen.RevokeInstanceConnectionRequestObject) (apigen.RevokeInstanceConnectionResponseObject, error)

func (*API) RevokeInstanceGrant 

func (a *API) RevokeInstanceGrant(ctx context.Context, req apigen.RevokeInstanceGrantRequestObject) (apigen.RevokeInstanceGrantResponseObject, error)

func (*API) RevokeLease 

func (a *API) RevokeLease(ctx context.Context, req apigen.RevokeLeaseRequestObject) (apigen.RevokeLeaseResponseObject, error)

func (*API) RevokeMachineCredential 

func (a *API) RevokeMachineCredential(ctx context.Context, req apigen.RevokeMachineCredentialRequestObject) (apigen.RevokeMachineCredentialResponseObject, error)

func (*API) RevokeMyDeveloperCredential 

func (a *API) RevokeMyDeveloperCredential(ctx context.Context, req apigen.RevokeMyDeveloperCredentialRequestObject) (apigen.RevokeMyDeveloperCredentialResponseObject, error)

func (*API) RevokeMySession 

func (a *API) RevokeMySession(ctx context.Context, req apigen.RevokeMySessionRequestObject) (apigen.RevokeMySessionResponseObject, error)

func (*API) RevokeOrgGrant 

func (a *API) RevokeOrgGrant(ctx context.Context, req apigen.RevokeOrgGrantRequestObject) (apigen.RevokeOrgGrantResponseObject, error)

func (*API) RevokePkiIssuer 

func (a *API) RevokePkiIssuer(ctx context.Context, req apigen.RevokePkiIssuerRequestObject) (apigen.RevokePkiIssuerResponseObject, error)

func (*API) RevokeProjectDeveloperCredential 

func (a *API) RevokeProjectDeveloperCredential(ctx context.Context, req apigen.RevokeProjectDeveloperCredentialRequestObject) (apigen.RevokeProjectDeveloperCredentialResponseObject, error)

func (*API) RevokeProjectGrant 

func (a *API) RevokeProjectGrant(ctx context.Context, req apigen.RevokeProjectGrantRequestObject) (apigen.RevokeProjectGrantResponseObject, error)

func (*API) RevokeRule 

func (a *API) RevokeRule(ctx context.Context, req apigen.RevokeRuleRequestObject) (apigen.RevokeRuleResponseObject, error)

func (*API) RevokeScimCredential 

func (a *API) RevokeScimCredential(ctx context.Context, req apigen.RevokeScimCredentialRequestObject) (apigen.RevokeScimCredentialResponseObject, error)

func (*API) RevokeSshCertificate 

func (a *API) RevokeSshCertificate(ctx context.Context, req apigen.RevokeSshCertificateRequestObject) (apigen.RevokeSshCertificateResponseObject, error)

func (*API) RollbackRevision 

func (a *API) RollbackRevision(ctx context.Context, req apigen.RollbackRevisionRequestObject) (apigen.RollbackRevisionResponseObject, error)

func (*API) RotateDEK 

func (a *API) RotateDEK(ctx context.Context, req apigen.RotateDEKRequestObject) (apigen.RotateDEKResponseObject, error)

func (*API) RotateMasterKey 

func (a *API) RotateMasterKey(ctx context.Context, _ apigen.RotateMasterKeyRequestObject) (apigen.RotateMasterKeyResponseObject, error)

func (*API) RotatePkiIssuer 

func (a *API) RotatePkiIssuer(ctx context.Context, req apigen.RotatePkiIssuerRequestObject) (apigen.RotatePkiIssuerResponseObject, error)

func (*API) RotateRootKey 

func (a *API) RotateRootKey(ctx context.Context, req apigen.RotateRootKeyRequestObject) (apigen.RotateRootKeyResponseObject, error)

func (*API) RotateSamlSpKey 

func (a *API) RotateSamlSpKey(ctx context.Context, _ apigen.RotateSamlSpKeyRequestObject) (apigen.RotateSamlSpKeyResponseObject, error)

func (*API) RotateScanningKey 

func (a *API) RotateScanningKey(ctx context.Context, _ apigen.RotateScanningKeyRequestObject) (apigen.RotateScanningKeyResponseObject, error)

func (*API) RotateSshCa 

func (a *API) RotateSshCa(ctx context.Context, req apigen.RotateSshCaRequestObject) (apigen.RotateSshCaResponseObject, error)

func (*API) RotateTokenKey 

func (a *API) RotateTokenKey(ctx context.Context, _ apigen.RotateTokenKeyRequestObject) (apigen.RotateTokenKeyResponseObject, error)

func (*API) RotateTransitKey 

func (a *API) RotateTransitKey(ctx context.Context, req apigen.RotateTransitKeyRequestObject) (apigen.RotateTransitKeyResponseObject, error)

RotateTransitKey appends a key version and returns updated metadata. Service and response conversion errors propagate to the HTTP error handler.

func (*API) SamlACS 

func (a *API) SamlACS(ctx context.Context, req apigen.SamlACSRequestObject) (apigen.SamlACSResponseObject, error)

func (*API) SamlMetadata 

func (a *API) SamlMetadata(ctx context.Context, req apigen.SamlMetadataRequestObject) (apigen.SamlMetadataResponseObject, error)

func (*API) SamlStart 

func (a *API) SamlStart(ctx context.Context, req apigen.SamlStartRequestObject) (apigen.SamlStartResponseObject, error)

func (*API) ScimBulk 

func (a *API) ScimBulk(ctx context.Context, req apigen.ScimBulkRequestObject) (apigen.ScimBulkResponseObject, error)

func (*API) ScimCreateGroup 

func (a *API) ScimCreateGroup(ctx context.Context, req apigen.ScimCreateGroupRequestObject) (apigen.ScimCreateGroupResponseObject, error)

func (*API) ScimCreateUser 

func (a *API) ScimCreateUser(ctx context.Context, req apigen.ScimCreateUserRequestObject) (apigen.ScimCreateUserResponseObject, error)

func (*API) ScimDeleteGroup 

func (a *API) ScimDeleteGroup(ctx context.Context, req apigen.ScimDeleteGroupRequestObject) (apigen.ScimDeleteGroupResponseObject, error)

func (*API) ScimDeleteUser 

func (a *API) ScimDeleteUser(ctx context.Context, req apigen.ScimDeleteUserRequestObject) (apigen.ScimDeleteUserResponseObject, error)

func (*API) ScimGetGroup 

func (a *API) ScimGetGroup(ctx context.Context, req apigen.ScimGetGroupRequestObject) (apigen.ScimGetGroupResponseObject, error)

func (*API) ScimGetUser 

func (a *API) ScimGetUser(ctx context.Context, req apigen.ScimGetUserRequestObject) (apigen.ScimGetUserResponseObject, error)

func (*API) ScimListGroups 

func (a *API) ScimListGroups(ctx context.Context, req apigen.ScimListGroupsRequestObject) (apigen.ScimListGroupsResponseObject, error)

func (*API) ScimListUsers 

func (a *API) ScimListUsers(ctx context.Context, req apigen.ScimListUsersRequestObject) (apigen.ScimListUsersResponseObject, error)

func (*API) ScimMe 

func (a *API) ScimMe(ctx context.Context, req apigen.ScimMeRequestObject) (apigen.ScimMeResponseObject, error)

func (*API) ScimPatchGroup 

func (a *API) ScimPatchGroup(ctx context.Context, req apigen.ScimPatchGroupRequestObject) (apigen.ScimPatchGroupResponseObject, error)

func (*API) ScimPatchUser 

func (a *API) ScimPatchUser(ctx context.Context, req apigen.ScimPatchUserRequestObject) (apigen.ScimPatchUserResponseObject, error)

func (*API) ScimReplaceGroup 

func (a *API) ScimReplaceGroup(ctx context.Context, req apigen.ScimReplaceGroupRequestObject) (apigen.ScimReplaceGroupResponseObject, error)

func (*API) ScimReplaceUser 

func (a *API) ScimReplaceUser(ctx context.Context, req apigen.ScimReplaceUserRequestObject) (apigen.ScimReplaceUserResponseObject, error)

func (*API) ScimResourceTypes 

func (a *API) ScimResourceTypes(ctx context.Context, req apigen.ScimResourceTypesRequestObject) (apigen.ScimResourceTypesResponseObject, error)

The two documents that describe SCHEMAS are per-binding: they render the extensions THIS binding declared, which is the same closed set ingest enforces and a rendered resource may name.

func (*API) ScimSchemas 

func (a *API) ScimSchemas(ctx context.Context, req apigen.ScimSchemasRequestObject) (apigen.ScimSchemasResponseObject, error)

func (*API) ScimSearchGroups 

func (a *API) ScimSearchGroups(ctx context.Context, req apigen.ScimSearchGroupsRequestObject) (apigen.ScimSearchGroupsResponseObject, error)

func (*API) ScimSearchUsers 

func (a *API) ScimSearchUsers(ctx context.Context, req apigen.ScimSearchUsersRequestObject) (apigen.ScimSearchUsersResponseObject, error)

func (*API) ScimServiceProviderConfig 

func (a *API) ScimServiceProviderConfig(ctx context.Context, req apigen.ScimServiceProviderConfigRequestObject) (apigen.ScimServiceProviderConfigResponseObject, error)

func (*API) ServeDirectory 

func (a *API) ServeDirectory(ctx context.Context, _ apigen.ServeDirectoryRequestObject) (apigen.ServeDirectoryResponseObject, error)

func (*API) SetAdapterCredential 

func (a *API) SetAdapterCredential(ctx context.Context, req apigen.SetAdapterCredentialRequestObject) (apigen.SetAdapterCredentialResponseObject, error)

func (*API) SetCredentialPolicy 

func (a *API) SetCredentialPolicy(ctx context.Context, req apigen.SetCredentialPolicyRequestObject) (apigen.SetCredentialPolicyResponseObject, error)

func (*API) SetDefinitionsSettings 

func (a *API) SetDefinitionsSettings(ctx context.Context, req apigen.SetDefinitionsSettingsRequestObject) (apigen.SetDefinitionsSettingsResponseObject, error)

func (*API) SetDeveloperCredentialPolicy 

func (a *API) SetDeveloperCredentialPolicy(ctx context.Context, req apigen.SetDeveloperCredentialPolicyRequestObject) (apigen.SetDeveloperCredentialPolicyResponseObject, error)

func (*API) SetDynamicProviderCredential 

func (a *API) SetDynamicProviderCredential(ctx context.Context, req apigen.SetDynamicProviderCredentialRequestObject) (apigen.SetDynamicProviderCredentialResponseObject, error)

func (*API) SetEnvironmentSettings 

func (a *API) SetEnvironmentSettings(ctx context.Context, req apigen.SetEnvironmentSettingsRequestObject) (apigen.SetEnvironmentSettingsResponseObject, error)

func (*API) SetKeyGroup 

func (a *API) SetKeyGroup(ctx context.Context, req apigen.SetKeyGroupRequestObject) (apigen.SetKeyGroupResponseObject, error)

func (*API) SetMachineReveal 

func (a *API) SetMachineReveal(ctx context.Context, req apigen.SetMachineRevealRequestObject) (apigen.SetMachineRevealResponseObject, error)

func (*API) SetOrgRetention 

func (a *API) SetOrgRetention(ctx context.Context, req apigen.SetOrgRetentionRequestObject) (apigen.SetOrgRetentionResponseObject, error)

func (*API) SetPassword 

func (a *API) SetPassword(ctx context.Context, req apigen.SetPasswordRequestObject) (apigen.SetPasswordResponseObject, error)

func (*API) SetProjectRetention 

func (a *API) SetProjectRetention(ctx context.Context, req apigen.SetProjectRetentionRequestObject) (apigen.SetProjectRetentionResponseObject, error)

func (*API) SetValue 

func (a *API) SetValue(ctx context.Context, req apigen.SetValueRequestObject) (apigen.SetValueResponseObject, error)

SetValue and ClearValue STAGE. Neither publishes, so neither answers with a value cell: what they return is the immutable version id a later selective publish names, which is the only thing the caller can act on.

func (*API) SettleLease 

func (a *API) SettleLease(ctx context.Context, req apigen.SettleLeaseRequestObject) (apigen.SettleLeaseResponseObject, error)

func (*API) ShowAdapter 

func (a *API) ShowAdapter(ctx context.Context, req apigen.ShowAdapterRequestObject) (apigen.ShowAdapterResponseObject, error)

func (*API) ShowAdapterMove 

func (a *API) ShowAdapterMove(ctx context.Context, req apigen.ShowAdapterMoveRequestObject) (apigen.ShowAdapterMoveResponseObject, error)

func (*API) ShowAdapterTarget 

func (a *API) ShowAdapterTarget(ctx context.Context, req apigen.ShowAdapterTargetRequestObject) (apigen.ShowAdapterTargetResponseObject, error)

func (*API) ShowCLILoginTransaction 

func (a *API) ShowCLILoginTransaction(ctx context.Context, req apigen.ShowCLILoginTransactionRequestObject) (apigen.ShowCLILoginTransactionResponseObject, error)

func (*API) ShowCLIReauthTransaction 

func (a *API) ShowCLIReauthTransaction(ctx context.Context, req apigen.ShowCLIReauthTransactionRequestObject) (apigen.ShowCLIReauthTransactionResponseObject, error)

func (*API) ShowCertificate 

func (a *API) ShowCertificate(ctx context.Context, req apigen.ShowCertificateRequestObject) (apigen.ShowCertificateResponseObject, error)

func (*API) ShowDynamicProvider 

func (a *API) ShowDynamicProvider(ctx context.Context, req apigen.ShowDynamicProviderRequestObject) (apigen.ShowDynamicProviderResponseObject, error)

func (*API) ShowInstanceConnection 

func (a *API) ShowInstanceConnection(ctx context.Context, req apigen.ShowInstanceConnectionRequestObject) (apigen.ShowInstanceConnectionResponseObject, error)

func (*API) ShowLease 

func (a *API) ShowLease(ctx context.Context, req apigen.ShowLeaseRequestObject) (apigen.ShowLeaseResponseObject, error)

func (*API) ShowPkiIssuer 

func (a *API) ShowPkiIssuer(ctx context.Context, req apigen.ShowPkiIssuerRequestObject) (apigen.ShowPkiIssuerResponseObject, error)

func (*API) ShowPkiProfile 

func (a *API) ShowPkiProfile(ctx context.Context, req apigen.ShowPkiProfileRequestObject) (apigen.ShowPkiProfileResponseObject, error)

func (*API) ShowRemote 

func (a *API) ShowRemote(ctx context.Context, req apigen.ShowRemoteRequestObject) (apigen.ShowRemoteResponseObject, error)

func (*API) ShowSshCa 

func (a *API) ShowSshCa(ctx context.Context, req apigen.ShowSshCaRequestObject) (apigen.ShowSshCaResponseObject, error)

func (*API) ShowSshCertificate 

func (a *API) ShowSshCertificate(ctx context.Context, req apigen.ShowSshCertificateRequestObject) (apigen.ShowSshCertificateResponseObject, error)

func (*API) ShowSshProfile 

func (a *API) ShowSshProfile(ctx context.Context, req apigen.ShowSshProfileRequestObject) (apigen.ShowSshProfileResponseObject, error)

func (*API) ShowTransitKey 

func (a *API) ShowTransitKey(ctx context.Context, req apigen.ShowTransitKeyRequestObject) (apigen.ShowTransitKeyResponseObject, error)

ShowTransitKey returns metadata for the named key. Service and response conversion errors propagate to the HTTP error handler.

func (*API) ShowWorkspaceHandoff 

func (a *API) ShowWorkspaceHandoff(ctx context.Context, req apigen.ShowWorkspaceHandoffRequestObject) (apigen.ShowWorkspaceHandoffResponseObject, error)

func (*API) SignupRequest 

func (a *API) SignupRequest(ctx context.Context, req apigen.SignupRequestRequestObject) (apigen.SignupRequestResponseObject, error)

func (*API) SignupVerify 

func (a *API) SignupVerify(ctx context.Context, req apigen.SignupVerifyRequestObject) (apigen.SignupVerifyResponseObject, error)

func (*API) SlideSessionClocks 

func (a *API) SlideSessionClocks(next http.Handler) http.Handler

SlideSessionClocks is the post-response idle-clock touch. It runs after the handler so a write never sits between authorization and the answer, and it is rate-limited by granularity inside the service so an authenticated GET storm does not become a write storm.

func (*API) StartCLIDevice 

func (a *API) StartCLIDevice(ctx context.Context, req apigen.StartCLIDeviceRequestObject) (apigen.StartCLIDeviceResponseObject, error)

func (*API) StartCLILogin 

func (a *API) StartCLILogin(ctx context.Context, req apigen.StartCLILoginRequestObject) (apigen.StartCLILoginResponseObject, error)

func (*API) StartCLIReauth 

func (a *API) StartCLIReauth(ctx context.Context, req apigen.StartCLIReauthRequestObject) (apigen.StartCLIReauthResponseObject, error)

func (*API) StartWorkspaceHandoff 

func (a *API) StartWorkspaceHandoff(ctx context.Context, req apigen.StartWorkspaceHandoffRequestObject) (apigen.StartWorkspaceHandoffResponseObject, error)

func (*API) StepUpPasskeyFinish 

func (a *API) StepUpPasskeyFinish(ctx context.Context, req apigen.StepUpPasskeyFinishRequestObject) (apigen.StepUpPasskeyFinishResponseObject, error)

func (*API) StepUpPasskeyStart 

func (a *API) StepUpPasskeyStart(ctx context.Context, _ apigen.StepUpPasskeyStartRequestObject) (apigen.StepUpPasskeyStartResponseObject, error)

func (*API) StepUpTotp 

func (a *API) StepUpTotp(ctx context.Context, req apigen.StepUpTotpRequestObject) (apigen.StepUpTotpResponseObject, error)

func (*API) SyncAdapterTarget 

func (a *API) SyncAdapterTarget(ctx context.Context, req apigen.SyncAdapterTargetRequestObject) (apigen.SyncAdapterTargetResponseObject, error)

func (*API) TestAdapterTarget 

func (a *API) TestAdapterTarget(ctx context.Context, req apigen.TestAdapterTargetRequestObject) (apigen.TestAdapterTargetResponseObject, error)

func (*API) TestInstanceConfigMail 

func (a *API) TestInstanceConfigMail(ctx context.Context, req apigen.TestInstanceConfigMailRequestObject) (apigen.TestInstanceConfigMailResponseObject, error)

func (*API) TestInstanceMail 

func (a *API) TestInstanceMail(ctx context.Context, req apigen.TestInstanceMailRequestObject) (apigen.TestInstanceMailResponseObject, error)

func (*API) TombstoneDeliveryTarget 

func (a *API) TombstoneDeliveryTarget(ctx context.Context, req apigen.TombstoneDeliveryTargetRequestObject) (apigen.TombstoneDeliveryTargetResponseObject, error)

func (*API) TransitDataKey 

func (a *API) TransitDataKey(ctx context.Context, req apigen.TransitDataKeyRequestObject) (apigen.TransitDataKeyResponseObject, error)

TransitDataKey returns a wrapped data key and, when requested, standard-base64 plaintext. The plaintext buffer is zeroed after encoding. Context decoding and service errors propagate.

func (*API) TransitDecrypt 

func (a *API) TransitDecrypt(ctx context.Context, req apigen.TransitDecryptRequestObject) (apigen.TransitDecryptResponseObject, error)

TransitDecrypt returns standard-base64 plaintext and its key version, zeroing the decoded plaintext buffer after encoding. Context decoding and service errors propagate.

func (*API) TransitEncrypt 

func (a *API) TransitEncrypt(ctx context.Context, req apigen.TransitEncryptRequestObject) (apigen.TransitEncryptResponseObject, error)

TransitEncrypt decodes standard-base64 plaintext and context and returns versioned ciphertext. The decoded plaintext is zeroed on return; decoding, version validation, and service errors propagate.

func (*API) TransitHMAC 

func (a *API) TransitHMAC(ctx context.Context, req apigen.TransitHMACRequestObject) (apigen.TransitHMACResponseObject, error)

TransitHMAC decodes a standard-base64 message and returns a versioned MAC. Decoding, version validation, and service errors propagate.

func (*API) TransitRewrap 

func (a *API) TransitRewrap(ctx context.Context, req apigen.TransitRewrapRequestObject) (apigen.TransitRewrapResponseObject, error)

TransitRewrap returns ciphertext under the latest permitted key version without returning plaintext. Context decoding and service errors propagate.

func (*API) TransitSign 

func (a *API) TransitSign(ctx context.Context, req apigen.TransitSignRequestObject) (apigen.TransitSignResponseObject, error)

TransitSign decodes a standard-base64 message and returns a versioned signature. Decoding, version validation, and service errors propagate.

func (*API) TransitVerify 

func (a *API) TransitVerify(ctx context.Context, req apigen.TransitVerifyRequestObject) (apigen.TransitVerifyResponseObject, error)

TransitVerify returns the signature verification result and key version. A mismatch returns Valid=false with status 200; decoding and service errors propagate to the HTTP error handler.

func (*API) TransitVerifyHMAC 

func (a *API) TransitVerifyHMAC(ctx context.Context, req apigen.TransitVerifyHMACRequestObject) (apigen.TransitVerifyHMACResponseObject, error)

TransitVerifyHMAC returns the MAC verification result and key version. A mismatch returns Valid=false with status 200; decoding and service errors propagate to the HTTP error handler.

func (*API) TrimTransitKey 

func (a *API) TrimTransitKey(ctx context.Context, req apigen.TrimTransitKeyRequestObject) (apigen.TrimTransitKeyResponseObject, error)

TrimTransitKey removes eligible old versions and returns the key metadata and deletion count. Service and response conversion errors propagate.

func (*API) UnbindPkiProfile 

func (a *API) UnbindPkiProfile(ctx context.Context, req apigen.UnbindPkiProfileRequestObject) (apigen.UnbindPkiProfileResponseObject, error)

func (*API) UnlinkIdentity 

func (a *API) UnlinkIdentity(ctx context.Context, req apigen.UnlinkIdentityRequestObject) (apigen.UnlinkIdentityResponseObject, error)

func (*API) UpdateAccessPolicy 

func (a *API) UpdateAccessPolicy(ctx context.Context, req apigen.UpdateAccessPolicyRequestObject) (apigen.UpdateAccessPolicyResponseObject, error)

UpdateAccessPolicy replaces the addressed policy and returns it as JSON, propagating service errors.

func (*API) UpdateAdapterOrigin 

func (a *API) UpdateAdapterOrigin(ctx context.Context, req apigen.UpdateAdapterOriginRequestObject) (apigen.UpdateAdapterOriginResponseObject, error)

func (*API) UpdateAdapterTarget 

func (a *API) UpdateAdapterTarget(ctx context.Context, req apigen.UpdateAdapterTargetRequestObject) (apigen.UpdateAdapterTargetResponseObject, error)

func (*API) UpdateApprovalPolicy 

func (a *API) UpdateApprovalPolicy(ctx context.Context, req apigen.UpdateApprovalPolicyRequestObject) (apigen.UpdateApprovalPolicyResponseObject, error)

func (*API) UpdateFederationIssuer 

func (a *API) UpdateFederationIssuer(ctx context.Context, req apigen.UpdateFederationIssuerRequestObject) (apigen.UpdateFederationIssuerResponseObject, error)

func (*API) UpdateFileTarget 

func (a *API) UpdateFileTarget(ctx context.Context, req apigen.UpdateFileTargetRequestObject) (apigen.UpdateFileTargetResponseObject, error)

func (*API) UpdateKeyDeclaration 

func (a *API) UpdateKeyDeclaration(ctx context.Context, req apigen.UpdateKeyDeclarationRequestObject) (apigen.UpdateKeyDeclarationResponseObject, error)

func (*API) UpdateKeyMetadata 

func (a *API) UpdateKeyMetadata(ctx context.Context, req apigen.UpdateKeyMetadataRequestObject) (apigen.UpdateKeyMetadataResponseObject, error)

UpdateKeyMetadata writes the four non-semantic fields — and refuses a body that carries `classification` at all, equal to the current value or not. Refusing the FIELD rather than the CHANGE is deliberate: it needs no read, and it keeps a caller from discovering the current classification by observing which values are accepted.

func (*API) UpdateMyProfile 

func (a *API) UpdateMyProfile(ctx context.Context, req apigen.UpdateMyProfileRequestObject) (apigen.UpdateMyProfileResponseObject, error)

UpdateMyProfile applies editable names without accepting email changes.

func (*API) UpdatePkiProfile 

func (a *API) UpdatePkiProfile(ctx context.Context, req apigen.UpdatePkiProfileRequestObject) (apigen.UpdatePkiProfileResponseObject, error)

func (*API) UpdateScimMapping 

func (a *API) UpdateScimMapping(ctx context.Context, req apigen.UpdateScimMappingRequestObject) (apigen.UpdateScimMappingResponseObject, error)

func (*API) UpdateSshProfile 

func (a *API) UpdateSshProfile(ctx context.Context, req apigen.UpdateSshProfileRequestObject) (apigen.UpdateSshProfileResponseObject, error)

func (*API) VoteAccessRequest 

func (a *API) VoteAccessRequest(ctx context.Context, req apigen.VoteAccessRequestRequestObject) (apigen.VoteAccessRequestResponseObject, error)

VoteAccessRequest submits an approve or reject decision and returns the request as JSON, propagating service errors.

func (*API) VoteApprovalRequest 

func (a *API) VoteApprovalRequest(ctx context.Context, req apigen.VoteApprovalRequestRequestObject) (apigen.VoteApprovalRequestResponseObject, error)

func (*API) WatchProjectEvents 

func (a *API) WatchProjectEvents(ctx context.Context, req apigen.WatchProjectEventsRequestObject) (apigen.WatchProjectEventsResponseObject, error)

WatchProjectEvents streams the advisory channel.

The events arrive already authorized and already projected -- the service evaluates the per-event, per-object check before anything reaches this channel -- so this function does transport and nothing else: headers, framing, flushing, heartbeats, and giving up when the peer goes away.

func (*API) Whoami 

func (a *API) Whoami(ctx context.Context, _ apigen.WhoamiRequestObject) (apigen.WhoamiResponseObject, error)

type AccessService 

type AccessService interface {
	ListPolicies(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.AccessPolicyView, error)
	CreatePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, input service.AccessPolicyInput) (service.AccessPolicyView, error)
	UpdatePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, id string, input service.AccessPolicyInput) (service.AccessPolicyView, error)
	DeletePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
	Queue(ctx context.Context, actor service.Actor, scope domain.Scope) (service.AccessQueue, error)
	Request(ctx context.Context, actor service.Actor, scope domain.Scope, input service.AccessRequestInput) (service.AccessRequestView, error)
	Vote(ctx context.Context, actor service.Actor, scope domain.Scope, requestID, decision string) (service.AccessRequestView, error)
	Cancel(ctx context.Context, actor service.Actor, scope domain.Scope, requestID string) (service.AccessRequestView, error)
	Revoke(ctx context.Context, actor service.Actor, scope domain.Scope, requestID string) (service.AccessRequestView, error)
	EmergencyAccess(ctx context.Context, actor service.Actor, scope domain.Scope, input service.AccessRequestInput) (service.AccessRequestView, error)
}

AccessService is the domain surface this transport exposes.

type AccessSnapshotter 

type AccessSnapshotter interface {
	AccessSnapshot() (open, active int64, err error)
}

AccessSnapshotter supplies the temporary-access gauges at scrape time (#152). Same contract as ApprovalSnapshotter: quick, non-blocking, and an error marks the gauges unknown for this scrape.

type AdmissionSnapshotter 

type AdmissionSnapshotter interface {
	Snapshot() admission.Snapshot
}

AdmissionSnapshotter is the admission-pressure source the gauges read at scrape time. Nil renders zeros, so the exposition shape stays deterministic whether or not a limiter is wired.

type ApprovalService 

type ApprovalService interface {
	ListPolicies(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.ApprovalPolicyView, error)
	CreatePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, input service.ApprovalPolicyInput) (service.ApprovalPolicyView, error)
	UpdatePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, id string, input service.ApprovalPolicyInput) (service.ApprovalPolicyView, error)
	DeletePolicy(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
	ListRequests(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.ApprovalRequestView, error)
	CeremonyBinding(ctx context.Context, actor service.Actor, scope domain.Scope, requestID string) (service.ApprovalCeremonyBinding, error)
	Vote(ctx context.Context, actor service.Actor, scope domain.Scope, requestID string, decision string) (service.ApprovalRequestView, error)
}

ApprovalService is the domain surface this transport exposes.

type ApprovalSnapshotter 

type ApprovalSnapshotter interface {
	ApprovalSnapshot() (ApprovalStats, error)
}

ApprovalSnapshotter supplies the approval gauges at scrape time. It is read synchronously in Collect, so an implementation must be quick and must not block. An error marks the gauges unknown for this scrape: the collector omits them and renders MetricApprovalGaugesKnown as 0 instead of failing the scrape or inventing zeros.

type ApprovalStats 

type ApprovalStats struct {
	Open    float64
	Expired float64
}

ApprovalStats is the label-free approval snapshot (#151): active requests awaiting review, and requests that have expired unmerged.

type AuthService 

type AuthService interface {
	StartCLILogin(ctx context.Context, transport, state, challenge, redirect string) (service.CLILoginStart, error)
	CLILoginTransaction(ctx context.Context, actor service.Actor, reference string) (service.CLILoginTransaction, error)
	ApproveCLILogin(ctx context.Context, actor service.Actor, reference string) (service.CLIReauthApproval, error)
	RedeemCLILogin(ctx context.Context, code, verifier, redirect string) (service.LoginResult, error)
	PollCLIDevice(ctx context.Context, code string) (service.CLIDeviceAttempt, error)

	OAuth2Start(ctx context.Context, slug, purpose, intent, signupOrg, environmentID, presented, proof string, browser bool) (service.OIDCStartResult, error)
	OAuth2Callback(ctx context.Context, slug, code, state, iss, idpError, bindingCookie, presented string) (service.OIDCCallbackResult, error)
	Signup(ctx context.Context, email string, org domain.OrgID) error
	VerifySignup(ctx context.Context, in service.SignupVerification) error
	MyProfile(ctx context.Context, presented string) (service.AccountProfile, error)
	UpdateMyProfile(ctx context.Context, presented string, profile service.ProfileUpdate, proof string) (service.AccountProfile, error)
	LocalLogin(ctx context.Context, username, password string, artifact service.Artifact) (service.LoginResult, error)
	LoginChallengeTOTP(ctx context.Context, challengeID, code string) (service.LoginResult, error)
	LoginChallengeWebauthnStart(ctx context.Context, challengeID string) ([]byte, error)
	LoginChallengeWebauthnFinish(ctx context.Context, challengeID string, responseJSON []byte) (service.LoginResult, error)
	EstablishCredential(ctx context.Context, authority, password string) error
	SetPassword(ctx context.Context, presented, password, proof string) (service.LoginResult, error)
	Identity(ctx context.Context, presented string) (service.Identity, error)
	Logout(ctx context.Context, presented string) error
	VerifyBrowserCSRF(ctx context.Context, presented, csrfToken string) error
	SlideIdleClock(ctx context.Context, presented string, activity service.CallerActivity) error
	EnrolTOTPStart(ctx context.Context, presented, password string) (string, error)
	EnrolTOTPConfirm(ctx context.Context, presented, code string) (service.LoginResult, error)
	StepUpTOTP(ctx context.Context, presented, code string) (service.LoginResult, error)
	RemoveTOTP(ctx context.Context, presented, password string) (service.LoginResult, error)
	TOTPStatus(ctx context.Context, presented string) (service.TOTPStatusResult, error)
	GenerateRecoveryCodes(ctx context.Context, presented, proof string) ([]string, service.LoginResult, error)
	ConsumeRecoveryCode(ctx context.Context, username, code string) (service.RecoveryResult, error)
	AuthMethods(ctx context.Context) ([]service.AuthMethodProvider, bool, error)
	OIDCStart(ctx context.Context, slug, purpose, intent, signupOrg, environmentID, presented, proof string, browser bool) (service.OIDCStartResult, error)
	OIDCCallback(ctx context.Context, slug, code, state, iss, idpError, bindingCookie, presented string) (service.OIDCCallbackResult, error)
	ListIdentities(ctx context.Context, presented string) ([]authnIdentity, error)
	UnlinkIdentity(ctx context.Context, presented, identityID, proof string) (service.LoginResult, error)
	EnrolPasskeyStart(ctx context.Context, presented, password, code string) ([]byte, error)
	EnrolPasskeyFinish(ctx context.Context, presented string, responseJSON []byte) (service.LoginResult, error)
	PasskeyLoginStart(ctx context.Context) ([]byte, error)
	PasskeyLoginFinish(ctx context.Context, responseJSON []byte) (service.LoginResult, error)
	StepUpPasskeyStart(ctx context.Context, presented string) ([]byte, error)
	StepUpPasskeyFinish(ctx context.Context, presented string, responseJSON []byte) (service.LoginResult, error)
	ReauthPasskeyStart(ctx context.Context, presented string, intent service.ReauthIntent) ([]byte, error)
	ReauthPasskeyFinish(ctx context.Context, presented string, responseJSON []byte) (service.ReauthResult, error)
	ReauthTOTP(ctx context.Context, presented string, intent service.ReauthIntent, code string) (service.ReauthResult, error)
	ReauthAdapterTOTP(ctx context.Context, presented string, intent service.ReauthIntent, code string) ([]service.ReauthResult, error)
	StartCLIReauth(ctx context.Context, presented string, intent service.ReauthIntent, pkceChallenge, redirectURI string) (service.CLIReauthStart, error)
	CLIReauthTransaction(ctx context.Context, actor service.Actor, state string) (service.CLIReauthTransaction, error)
	ApproveCLIReauth(ctx context.Context, actor service.Actor, state string) (service.CLIReauthApproval, error)
	RedeemCLIReauth(ctx context.Context, code, pkceVerifier string) (service.CLIReauthRedeemed, error)
	RemovePasskey(ctx context.Context, presented, credentialID, password, code string) (service.LoginResult, error)
	ListPasskeys(ctx context.Context, presented string) ([]service.PasskeyView, error)
	ResetCredential(ctx context.Context, actor service.Actor, targetPrincipal, delivery string) (service.ResetResult, error)
}

AuthService is the human-authentication surface this transport needs.

type DefinitionsService 

type DefinitionsService interface {
	Export(ctx context.Context, actor service.Actor, scope domain.Scope, portable bool) ([]byte, error)
	Check(ctx context.Context, actor service.Actor, scope domain.Scope, raw []byte) (service.CheckResult, error)
	Plan(ctx context.Context, actor service.Actor, scope domain.Scope, raw []byte, acks []string) (service.PlanView, error)
	GetPlan(ctx context.Context, actor service.Actor, scope domain.Scope, planID string) (service.PlanView, error)
	Apply(ctx context.Context, actor service.Actor, scope domain.Scope, planID string, opts service.ApplyOptions) (service.ApplyResult, error)
	GetSettings(ctx context.Context, actor service.Actor, scope domain.Scope) (service.DefinitionsSettings, error)
	SetSettings(ctx context.Context, actor service.Actor, scope domain.Scope, source string) (service.DefinitionsSettings, error)
}

DefinitionsService is the project definitions Git-flow surface. Bundle inputs remain raw bytes through transport so the strict parser can detect duplicate members and enforce its own byte bound without a lossy re-encode.

type DeliveryService 

type DeliveryService interface {
	Fetch(ctx context.Context, presented string, scope domain.Scope, cursor string, opts service.FetchOptions) (service.FetchResult, error)
	ReconcileOfflineRecords(ctx context.Context, presented string, scope domain.Scope, records []service.OfflineRecord) (service.ReconcileResult, error)
	ReportTarget(ctx context.Context, presented string, scope domain.Scope, report deliverytarget.Report) error
	TombstoneTarget(ctx context.Context, presented string, scope domain.Scope, key service.DeliveryTargetKey) error
	RefuseOversizeReport(ctx context.Context, presented string, scope domain.Scope) error
	ListTargets(ctx context.Context, actor service.Actor, scope domain.Scope) (service.DeliveryTargetList, error)
	ReportFileTarget(ctx context.Context, presented string, scope domain.Scope, targetID string, report service.FileTargetReport) error
}

DeliveryService is the domain surface this transport exposes.

type DeveloperCredentialService 

type DeveloperCredentialService interface {
	Mint(context.Context, service.Actor, domain.Scope, service.MintDeveloperCredentialRequest) (service.MintedDeveloperCredential, error)
	List(context.Context, service.Actor, domain.Scope) ([]service.DeveloperCredential, error)
	Revoke(context.Context, service.Actor, domain.Scope, string, bool) error
	Policy(context.Context, service.Actor) (time.Duration, error)
	SetPolicy(context.Context, service.Actor, time.Duration) (time.Duration, error)
}

DeveloperCredentialService preserves the raw presented human artifact. The service owns self-delegation, live authorization, reauthentication and policy.

type DynamicSnapshotter 

type DynamicSnapshotter interface {
	DynamicSnapshot() (activeLeases, unknownEffects int64, err error)
}

DynamicSnapshotter is the dynamic-secret gauge source, read at scrape time. An error (or a nil source) marks the gauges unknown for this scrape: the collector omits them and renders MetricDynamicGaugesKnown as 0, so a datastore hiccup never reads as a measured zero.

type EnvironmentService 

type EnvironmentService interface {
	Parameters(context.Context, service.Actor, domain.Scope) (map[string]string, error)
	SetParameter(context.Context, service.Actor, domain.Scope, string, string, bool) error
	Create(ctx context.Context, actor service.Actor, scope domain.Scope, name string, acks []string) (service.Environment, error)
	// Clone is create-with-clone-at-creation (#50). It is a separate method
	// because its RESULT is different: a clone reports what it could not take.
	Clone(ctx context.Context, actor service.Actor, scope domain.Scope, name, sourceEnvID string, acks []string) (service.Environment, service.CloneResult, error)
	Get(ctx context.Context, actor service.Actor, scope domain.Scope) (service.Environment, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.Environment, error)
	Rename(ctx context.Context, actor service.Actor, scope domain.Scope, name string, acks []string) (service.Environment, error)
	Reorder(ctx context.Context, actor service.Actor, scope domain.Scope, ordered []string) ([]service.Environment, error)
	Delete(ctx context.Context, actor service.Actor, scope domain.Scope) error
}

type FederationService 

type FederationService interface {
	CreateIssuer(ctx context.Context, actor service.Actor, req service.IssuerRequest) (service.IssuerView, error)
	UpdateIssuer(ctx context.Context, actor service.Actor, id string, source jwkssource.KeySource, refused []string, caBundle *string) (service.IssuerView, error)
	ListIssuers(ctx context.Context, actor service.Actor) ([]service.IssuerView, error)
	DeleteIssuer(ctx context.Context, actor service.Actor, id string) error
	CreateBinding(ctx context.Context, actor service.Actor, scope domain.Scope, saID string, req service.BindingRequest) (service.BindingView, error)
}

FederationService is the domain surface this transport exposes.

type FolderService 

type FolderService interface {
	Create(ctx context.Context, actor service.Actor, scope domain.Scope, path string, acks []string) (service.Folder, error)
	Get(ctx context.Context, actor service.Actor, scope domain.Scope, id string) (service.Folder, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.Folder, error)
	Rename(ctx context.Context, actor service.Actor, scope domain.Scope, id, path string, acks []string) (service.Folder, error)
	Delete(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
}

type GrantService 

type GrantService interface {
	Create(ctx context.Context, actor service.Actor, spec service.GrantSpec) (service.GrantResult, error)
	Revoke(ctx context.Context, actor service.Actor, spec service.GrantSpec) error
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.Membership, error)
	ApplyTemplate(ctx context.Context, actor service.Actor, template domain.Template, principal domain.PrincipalID, scope domain.Scope) ([]service.GrantResult, error)
	InviteMember(ctx context.Context, actor service.Actor, spec service.InviteSpec) (service.InvitationResult, error)
}

GrantService is the domain surface this transport exposes.

type HASnapshotter 

type HASnapshotter interface {
	HASnapshot() HAStats
}

HASnapshotter is the HA-state source the gauges read at scrape time. A nil source renders the single-node defaults, so the exposition shape is deterministic whether or not HA is wired.

type HAStats 

type HAStats struct {
	Enabled         bool
	IsLeader        bool
	NodesSeen       int
	LeaseAgeSeconds float64
}

HAStats is a point-in-time read of multi-node HA state for the label-free gauges. Enabled is false on a single node, where the collector emits the trivial values (leader, one node, zero lease age).

type IdentityService 

type IdentityService interface {
	CreateServiceAccount(ctx context.Context, actor service.Actor, scope domain.Scope, name string, kind domain.PrincipalClass) (service.ServiceAccountView, error)
	ListServiceAccounts(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.ServiceAccountView, error)
	DeleteServiceAccount(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
	MintCredential(ctx context.Context, actor service.Actor, scope domain.Scope, saID string, req service.MintRequest) (service.MintResult, error)
	ListCredentials(ctx context.Context, actor service.Actor, scope domain.Scope, saID string) ([]service.CredentialView, error)
	RevokeCredential(ctx context.Context, actor service.Actor, scope domain.Scope, saID, credentialID string) error
	Policy(ctx context.Context, actor service.Actor) (service.PolicyView, error)
	SetPolicy(ctx context.Context, actor service.Actor, change service.PolicyChange) (service.PolicyResult, error)
}

IdentityService is the domain surface this transport exposes.

type KeyGroupService 

type KeyGroupService interface {
	Create(ctx context.Context, actor service.Actor, scope domain.Scope, name string, acks []string) (service.KeyGroupView, error)
	Get(ctx context.Context, actor service.Actor, scope domain.Scope, id string) (service.KeyGroupView, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.KeyGroupView, error)
	Rename(ctx context.Context, actor service.Actor, scope domain.Scope, id, name string, acks []string) (service.KeyGroupView, error)
	Delete(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
}

type KeyService 

type KeyService interface {
	Create(ctx context.Context, actor service.Actor, scope domain.Scope, spec service.KeySpec, acks []string) (service.Key, error)
	Get(ctx context.Context, actor service.Actor, scope domain.Scope, id string) (service.Key, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.Key, int64, error)
	Rename(ctx context.Context, actor service.Actor, scope domain.Scope, id, name string, acks []string) (service.Key, error)
	UpdateMetadata(ctx context.Context, actor service.Actor, scope domain.Scope, id string, m service.KeyMetadataUpdate, acks []string) (service.Key, error)
	UpdateDeclaration(ctx context.Context, actor service.Actor, scope domain.Scope, id string, u service.KeyDeclarationUpdate, acks []string) (service.Key, error)
	Reclassify(ctx context.Context, actor service.Actor, scope domain.Scope, id, classification string) (service.Key, []service.Finding, error)
	SetGroup(ctx context.Context, actor service.Actor, scope domain.Scope, id, groupID string) (service.Key, error)
	Delete(ctx context.Context, actor service.Actor, scope domain.Scope, id string) error
}

KeyService and KeyGroupService are the domain surfaces this transport exposes. Scopes are addressed as domain.Scope, the same shape authorize() takes, so a wrong-depth address is refused at the chokepoint.

type MailService 

type MailService interface {
	Configured(context.Context, service.Actor) (bool, error)
	Test(context.Context, service.Actor, string, string) error
}

type Metrics 

type Metrics struct {
	// contains filtered or unexported fields
}

Metrics is the instance-wide RED collector. One instance is shared between the API middleware (which writes) and the operational /metrics handler (which reads), so both sides see the same counters.

func NewMetrics 

func NewMetrics(adm AdmissionSnapshotter) *Metrics

NewMetrics builds the fixed collector set in a private pedantic registry. Pre-creating every closed label combination keeps the scrape shape deterministic even before traffic arrives.

func (*Metrics) ObserveMCP 

func (m *Metrics) ObserveMCP(next http.Handler, log *slog.Logger, toolNames []string) http.Handler

ObserveMCP wraps the feature-gated MCP handler with closed-cardinality metrics and debug access logs. toolNames must come from the compiled registry. Request-controlled method and tool strings collapse to "other".

func (*Metrics) RecordSignupMailFailure 

func (m *Metrics) RecordSignupMailFailure()

RecordSignupMailFailure exposes a hidden synchronous delivery failure. The request counter preserves its wire 202; RED errors use the operational 5xx fault category, as recovered faults after committed headers already do. No address, policy, intent, or SMTP response enters the metric label set.

func (*Metrics) SetAccessSource 

func (m *Metrics) SetAccessSource(source AccessSnapshotter)

SetAccessSource attaches the temporary-access gauge source once at boot.

func (*Metrics) SetApprovalSource 

func (m *Metrics) SetApprovalSource(source ApprovalSnapshotter)

SetApprovalSource attaches the approval gauge source after registration, via an atomic pointer, so boot can wire it without racing a concurrent scrape.

func (*Metrics) SetDynamicSource 

func (m *Metrics) SetDynamicSource(source DynamicSnapshotter)

SetDynamicSource attaches the dynamic-secret gauge source once at boot.

func (*Metrics) SetHASource 

func (m *Metrics) SetHASource(source HASnapshotter)

SetHASource attaches the multi-node HA gauge source. It is called once during boot before the operational listener serves, so the collector's source pointer is set before any scrape reads it.

func (*Metrics) SetPKISource 

func (m *Metrics) SetPKISource(source PKISnapshotter)

SetPKISource attaches the private-PKI gauge source once at boot.

func (*Metrics) SetSSHSource 

func (m *Metrics) SetSSHSource(source SSHSnapshotter)

SetSSHSource attaches the SSH certificate gauge source once at boot.

func (*Metrics) SetTransitSource 

func (m *Metrics) SetTransitSource(source TransitSnapshotter)

SetTransitSource attaches the transit gauge source once at boot.

type OAuth2ProviderService 

type OAuth2ProviderService interface {
	Put(ctx context.Context, actor service.Actor, slug string, in service.OAuth2ProviderInput) (service.OAuth2ProviderView, error)
	Get(ctx context.Context, actor service.Actor, slug string) (service.OAuth2ProviderView, error)
	List(ctx context.Context, actor service.Actor) ([]service.OAuth2ProviderView, error)
	Delete(ctx context.Context, actor service.Actor, slug string) error
}

type OperationalRetentionHealthService 

type OperationalRetentionHealthService interface {
	OperationalHealth(ctx context.Context) (service.PruneHealth, error)
}

type OrgService 

type OrgService interface {
	Create(ctx context.Context, actor service.Actor, name string, active bool, metadata json.RawMessage) (org service.Org, err error)
	Get(ctx context.Context, actor service.Actor, org domain.OrgID) (service.Org, error)
	List(ctx context.Context, actor service.Actor) ([]service.Org, error)
	ListMine(ctx context.Context, actor service.Actor) ([]service.MyOrg, error)
	Rename(ctx context.Context, actor service.Actor, org domain.OrgID, name string) (service.Org, error)
	Delete(ctx context.Context, actor service.Actor, org domain.OrgID) error
}

OrgService is the domain surface this slice exposes.

Every method takes a service.Actor, never a principal id: the transport hands over the RAW artifact and the service resolves it inside the transaction that authorizes the operation. Resolving here and passing an id would put the decision about who the caller is on one side of a transaction boundary and the authorization that trusts it on the other — a session revoked in between would still authorize the operation. That is the cross-request cache the permission model forbids, wearing an argument's clothes.

type PKISnapshotter 

type PKISnapshotter interface {
	PKISnapshot() (live, unknown, held int64, err error)
}

PKISnapshotter is the private-PKI gauge source, read at scrape time, with the DynamicSnapshotter failure semantics.

type PinService 

type PinService interface {
	Set(ctx context.Context, actor service.Actor, scope domain.Scope, request service.SetPinRequest) (service.SetPinResult, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.PinView, error)
	Release(ctx context.Context, actor service.Actor, scope domain.Scope, workloadPrincipalID domain.PrincipalID) (service.ReleasePinResult, error)
}

type ProjectService 

type ProjectService interface {
	Create(ctx context.Context, actor service.Actor, org domain.OrgID, name string) (service.Project, error)
	Get(ctx context.Context, actor service.Actor, scope domain.Scope) (service.Project, error)
	List(ctx context.Context, actor service.Actor, org domain.OrgID) ([]service.Project, error)
	Rename(ctx context.Context, actor service.Actor, scope domain.Scope, name string) (service.Project, error)
	Delete(ctx context.Context, actor service.Actor, scope domain.Scope) error
}

ProjectService, EnvironmentService and FolderService are the domain surfaces this transport exposes. Scopes are addressed as domain.Scope — the same shape authorize() takes — so a wrong-depth address is refused at the chokepoint rather than silently widened here.

type ProviderService 

type ProviderService interface {
	Put(ctx context.Context, actor service.Actor, slug string, in service.ProviderInput) (service.ProviderView, error)
	Get(ctx context.Context, actor service.Actor, slug string) (service.ProviderView, error)
	List(ctx context.Context, actor service.Actor) ([]service.ProviderView, error)
	Delete(ctx context.Context, actor service.Actor, slug string) error
}

ProviderService is the OIDC provider administration surface.

type PublicOptions 

type PublicOptions struct {
	HSTS bool
	// ExternalOrigin is the config-validated canonical public origin. CORS uses
	// it to identify same-origin requests without trusting the Host header.
	ExternalOrigin string
	// MCP is nil while the independently gated MCP surface is disabled.
	MCP http.Handler
}

PublicOptions carries transport facts that affect public response policy.

type ReadyChecker 

type ReadyChecker interface {
	Ready(ctx context.Context) error
}

ReadyChecker reports whether a request would actually work.

type ReencryptService 

type ReencryptService interface {
	ReencryptProject(ctx context.Context, actor service.Actor, orgID, projectID string) (service.ReencryptResult, error)
	ReencryptInstance(ctx context.Context, actor service.Actor) (service.ReencryptResult, error)
}

ReencryptService is the crypto reencrypt surface (#75/#187): move a scope's ciphertext onto the active DEK version and retire the old.

type RegistrationService 

type RegistrationService interface {
	Get(ctx context.Context, actor service.Actor, scope service.RegistrationScope) (*service.RegistrationPolicyView, error)
	Put(ctx context.Context, actor service.Actor, scope service.RegistrationScope, in service.RegistrationPolicyInput, proof string) (service.RegistrationPolicyView, error)
	Delete(ctx context.Context, actor service.Actor, scope service.RegistrationScope, proof string) error
	SignupDoor(ctx context.Context, scope service.RegistrationScope) (service.SignupDoor, error)
}

RegistrationService is the registration policy surface.

type RemoteService 

type RemoteService interface {
	AddRemote(ctx context.Context, actor service.Actor, name, url, pin, credential string) (service.RemoteView, error)
	ListRemotes(ctx context.Context, actor service.Actor) ([]service.RemoteView, error)
	ShowRemote(ctx context.Context, actor service.Actor, name string) (service.RemoteView, error)
	RenameRemote(ctx context.Context, actor service.Actor, name, newName string) (service.RemoteView, error)
	RemoveRemote(ctx context.Context, actor service.Actor, name string) error
	RemoteOrigins(ctx context.Context, actor service.Actor) ([]string, error)
}

RemoteService is the viewing side's seam.

type RetentionSettingsService 

type RetentionSettingsService interface {
	GetOrg(ctx context.Context, actor service.Actor, orgID domain.OrgID) (service.RetentionPolicy, error)
	SetOrg(ctx context.Context, actor service.Actor, orgID domain.OrgID, want service.RetentionPolicy) (service.RetentionPolicy, error)
	GetProject(ctx context.Context, actor service.Actor, scope domain.Scope) (service.ProjectRetention, error)
	SetProject(ctx context.Context, actor service.Actor, scope domain.Scope, want *service.RetentionPolicy) (service.ProjectRetention, error)
	GetHealth(ctx context.Context, actor service.Actor) (service.PruneHealth, error)
}

RetentionSettingsService is the org cap and project override surface.

type RevealService 

type RevealService interface {
	Window(ctx context.Context, actor service.Actor, scope domain.Scope) (service.RevealWindow, error)
}

RevealService is the guard's read surface.

type RevisionService 

type RevisionService interface {
	Diff(ctx context.Context, actor service.Actor, scope domain.Scope, leftRevision, rightRevision int64, keyID string) (service.RevisionDiff, error)
	PublishPlanned(ctx context.Context, actor service.Actor, scope domain.Scope, request service.PublishRequest) (service.PublishResult, error)
	Restore(ctx context.Context, actor service.Actor, scope domain.Scope, revision int64, keyName string) (service.RestoreResult, error)
	History(ctx context.Context, actor service.Actor, scope domain.Scope, beforeRevision int64, limit int) ([]service.RevisionView, error)
	Show(ctx context.Context, actor service.Actor, scope domain.Scope, revision int64) (service.RevisionDetail, error)
	Signals(ctx context.Context, actor service.Actor, scope domain.Scope) (service.EnvironmentSignals, error)
	PendingDrafts(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.PendingDraft, error)
	ExportWithParameters(ctx context.Context, actor service.Actor, scope domain.Scope, revision int64, reveal bool, supplied map[string]string) ([]service.ExportedValue, int64, error)
	Watch(ctx context.Context, actor service.Actor, scope domain.Scope) (<-chan service.AdvisoryEvent, error)
	RotateTokenKey(ctx context.Context, actor service.Actor) (service.TokenKeyRotation, error)
	RotateScanningKey(ctx context.Context, actor service.Actor) (service.ScanningKeyRotation, error)
}

RevisionService is the domain surface this transport exposes.

type RotationService 

type RotationService interface {
	RotateDEK(ctx context.Context, actor service.Actor, scope service.DEKScope) (service.DEKRotation, error)
	RotateMasterKey(ctx context.Context, actor service.Actor) (service.MasterKeyRotation, error)
	RotateRootKey(ctx context.Context, actor service.Actor, phase service.RootKeyRotationPhase) (service.RootKeyRotation, error)
}

RotationService is the crypto key-hierarchy rotation surface (#75): the four operations that are not the token key. Like every service interface here the transport translates and decides nothing.

type RuleService 

type RuleService interface {
	Replace(ctx context.Context, actor service.Actor, spec service.ReplaceRulesSpec) ([]service.RuleView, error)
	Create(ctx context.Context, actor service.Actor, spec service.RuleSpec) (service.RuleView, error)
	Revoke(ctx context.Context, actor service.Actor, org domain.OrgID, id string) error
	List(ctx context.Context, actor service.Actor, scope domain.Scope) ([]service.RuleView, error)
}

RuleService is the domain surface this transport exposes.

type RuntimeStatusSource 

type RuntimeStatusSource interface {
	RuntimeStatus(context.Context) (service.RuntimeStatus, error)
}

type SAMLAuthService 

type SAMLAuthService interface {
	SAMLStart(ctx context.Context, slug, purpose, environmentID, presented, proof string) (service.SAMLStartResult, error)
	SAMLACS(ctx context.Context, slug, encodedResponse, relayState, initiatorCookie string) (service.LoginResult, error)
	SAMLMetadata(ctx context.Context, slug string) ([]byte, error)
}

type SAMLProviderService 

type SAMLProviderService interface {
	Put(ctx context.Context, actor service.Actor, slug string, in service.SAMLProviderInput) (service.SAMLProviderMutationResult, error)
	Patch(ctx context.Context, actor service.Actor, slug string, in service.SAMLProviderPatch) (service.SAMLProviderView, error)
	Get(ctx context.Context, actor service.Actor, slug string) (service.SAMLProviderView, error)
	List(ctx context.Context, actor service.Actor) ([]service.SAMLProviderView, error)
	Delete(ctx context.Context, actor service.Actor, slug string) error
	RefreshMetadata(ctx context.Context, actor service.Actor, slug string, in service.SAMLMetadataRefreshInput) (service.SAMLProviderMutationResult, error)
	ListSPKeys(ctx context.Context, actor service.Actor) ([]service.SAMLSPKeyView, error)
	RotateSPKey(ctx context.Context, actor service.Actor) (service.SAMLSPKeyView, error)
	RetireSPKey(ctx context.Context, actor service.Actor, fingerprint string) error
	CompromiseRetireSPKey(ctx context.Context, actor service.Actor, fingerprint string) (service.SAMLSPKeyView, error)
}

SAMLProviderService is the instance-scoped SAML provider administration surface, including the metadata diff-and-confirm ceremony.

type SCIMAdminService 

type SCIMAdminService interface {
	CreateBinding(ctx context.Context, actor service.Actor, org domain.OrgID, in service.SCIMBindingInput) (service.SCIMBindingView, error)
	ListBindings(ctx context.Context, actor service.Actor, org domain.OrgID) ([]service.SCIMBindingView, error)
	GetBinding(ctx context.Context, actor service.Actor, org domain.OrgID, id string) (service.SCIMBindingView, error)
	DeleteBinding(ctx context.Context, actor service.Actor, org domain.OrgID, id string) error

	CreateMapping(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, spec service.SCIMMappingSpec) (service.SCIMMappingResult, error)
	UpdateMapping(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, spec service.SCIMMappingSpec) (service.SCIMMappingResult, error)
	DeleteMapping(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, spec service.SCIMMappingSpec) (service.SCIMMappingResult, error)
	ListMappings(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) ([]service.SCIMMappingView, error)

	MintCredential(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, indefinite bool, proof string) (service.SCIMMintResult, error)
	ListCredentials(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) ([]service.SCIMCredentialView, error)
	GetCredential(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) (service.SCIMCredentialView, error)
	RevokeCredential(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) error

	DirectoryUsers(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) ([]service.SCIMDirectoryUser, error)
	DirectoryGroups(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) ([]service.SCIMDirectoryGroup, error)
}

SCIMAdminService is the administration surface this transport needs.

type SCIMWireService 

type SCIMWireService interface {
	CreateUser(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, in service.DesiredUser) (service.SCIMUserResource, error)
	GetUser(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) (service.SCIMUserResource, error)
	ListUsers(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, filter scimproto.Filter, page scimproto.Page) ([]service.SCIMUserResource, int, error)
	ReplaceUser(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string, in service.DesiredUser) (service.SCIMUserResource, error)
	PatchUser(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string, commands []service.UserPatchCommand) (service.SCIMUserResource, error)
	DeleteUser(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) error

	CreateGroup(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, in service.DesiredGroup) (service.SCIMGroupResource, error)
	GetGroup(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) (service.SCIMGroupResource, error)
	ListGroups(ctx context.Context, actor service.Actor, org domain.OrgID, binding string, filter scimproto.Filter, page scimproto.Page) ([]service.SCIMGroupResource, int, error)
	ReplaceGroup(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string, in service.DesiredGroup) (service.SCIMGroupResource, error)
	PatchGroup(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string, commands []service.GroupPatchCommand) (service.SCIMGroupResource, error)
	DeleteGroup(ctx context.Context, actor service.Actor, org domain.OrgID, binding, id string) error

	// Discovery authenticates a probe and returns the binding's DECLARED schema
	// extensions, so the two schema documents describe exactly what this
	// binding accepts and renders.
	Discovery(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) ([]scimproto.ExtensionDecl, error)
	Authenticate(ctx context.Context, actor service.Actor, org domain.OrgID, binding string) error
	Unsupported(ctx context.Context, actor service.Actor, org domain.OrgID, binding, what string) error

	// PageBound is the server's `count` ceiling — an ops-spec bound the
	// transport must clamp against before it reaches the service.
	PageBound() int
}

SCIMWireService is the provisioning surface this transport needs.

type SSHSnapshotter 

type SSHSnapshotter interface {
	SSHSnapshot() (activeCertificates, krlEntries int64, err error)
}

SSHSnapshotter is the SSH certificate gauge source, read at scrape time. An error (or a nil source) marks the gauges unknown for this scrape.

type SettingsService 

type SettingsService interface {
	GetMachineReveal(ctx context.Context, actor service.Actor, scope domain.Scope) (service.MachineRevealSettings, error)
	SetMachineReveal(ctx context.Context, actor service.Actor, scope domain.Scope, enabled bool) (service.MachineRevealSettings, error)
	GetEnvironment(ctx context.Context, actor service.Actor, scope domain.Scope) (service.EnvironmentSettings, error)
	SetEnvironment(ctx context.Context, actor service.Actor, scope domain.Scope, want service.EnvironmentSettings) (service.EnvironmentSettings, error)
}

SettingsService is the `project-settings` surface.

type TLSMetrics 

type TLSMetrics interface {
	TLSMetrics() (notAfterUnix int64, reloadFailures uint64)
}

TLSMetrics reports the label-free native TLS gauges served operationally.

type TransitSnapshotter 

type TransitSnapshotter interface {
	TransitSnapshot() (live, rotationDue, pendingDeletion int64, err error)
}

TransitSnapshotter is the transit gauge source, read at scrape time. An error (or a nil source) marks the gauges unknown for this scrape.

type UpdateService 

type UpdateService interface {
	GetStatus(ctx context.Context, actor service.Actor) (updatecheck.Status, error)
	Request(ctx context.Context, actor service.Actor, version string) (updater.Job, error)
	GetJob(ctx context.Context, actor service.Actor, id string) (updater.Job, error)
}

type ValueService 

type ValueService interface {
	Get(ctx context.Context, actor service.Actor, scope domain.Scope, keyName string, reveal bool) (service.ValueCell, error)
	List(ctx context.Context, actor service.Actor, scope domain.Scope, reveal bool) ([]service.ValueCell, error)
	Set(ctx context.Context, actor service.Actor, scope domain.Scope, keyName, value string, acks []string) (service.StagedChange, error)
	Initialize(ctx context.Context, actor service.Actor, scope domain.Scope, keyName, value string, acks []string) (service.StagedChange, error)
	Unset(ctx context.Context, actor service.Actor, scope domain.Scope, keyName string) (service.StagedChange, error)
	Declare(ctx context.Context, actor service.Actor, scope domain.Scope, envIDs []string, keyName, value string) ([]service.ValueCell, []service.Finding, error)
	Copy(ctx context.Context, actor service.Actor, scope domain.Scope, req service.CopyRequest) (service.CopyResult, error)
	Diff(ctx context.Context, actor service.Actor, scope domain.Scope, left, right string, reveal bool) ([]service.DiffRow, error)
	Occurrences(ctx context.Context, actor service.Actor, scope domain.Scope, candidates []service.ImportCandidate) (service.ImportPresence, error)
	Import(ctx context.Context, actor service.Actor, scope domain.Scope, req service.ImportRequest) (service.ImportResult, error)
}

ValueService is the domain surface this transport exposes.

type WireError 

type WireError struct {
	// contains filtered or unexported fields
}

WireError is the closed server-layer policy for one public error class. Its fields stay private so handlers cannot assemble status, code, message, and detail handling independently.

type WorkspaceService 

type WorkspaceService interface {
	Serve(ctx context.Context, actor service.Actor) (remotefetch.Listing, error)
	MintConnection(ctx context.Context, actor service.Actor, label string, req service.MintRequest) (service.MintConnectionResult, error)
	ListConnections(ctx context.Context, actor service.Actor) ([]service.ConnectionView, error)
	ShowConnection(ctx context.Context, actor service.Actor, id string) (service.ConnectionView, error)
	RevokeConnection(ctx context.Context, actor service.Actor, id string) error
	ListOrigins(ctx context.Context, actor service.Actor) ([]service.OriginView, error)
	AddOrigin(ctx context.Context, actor service.Actor, origin string) (service.OriginView, error)
	RemoveOrigin(ctx context.Context, actor service.Actor, origin string) (int64, error)
	OriginAllowed(ctx context.Context, origin string) (bool, error)
	StartHandoff(ctx context.Context, req service.HandoffRequest) (service.HandoffStart, error)
	ShowHandoff(ctx context.Context, actor service.Actor, state string) (service.HandoffView, error)
	ApproveHandoff(ctx context.Context, actor service.Actor, state string) (string, string, error)
	RedeemHandoff(ctx context.Context, code, pkceVerifier, origin string) (service.WorkspaceSession, error)
	ListSessions(ctx context.Context, actor service.Actor) ([]service.SessionView, error)
	RevokeSession(ctx context.Context, actor service.Actor, id string) error
}

WorkspaceService is the serving side's seam.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.