Kyle Isom
59d51a1d38
- proto/mcias/v1/: AdminService, AuthService, TokenService, AccountService, CredentialService; generated Go stubs in gen/ - internal/grpcserver: full handler implementations sharing all business logic (auth, token, db, crypto) with REST server; interceptor chain: logging -> auth (JWT alg-first + revocation) -> rate-limit (token bucket, 10 req/s, burst 10, per-IP) - internal/config: optional grpc_addr field in [server] section - cmd/mciassrv: dual-stack startup; gRPC/TLS listener on grpc_addr when configured; graceful shutdown of both servers in 15s window - cmd/mciasgrpcctl: companion gRPC CLI mirroring mciasctl commands (health, pubkey, account, role, token, pgcreds) using TLS with optional custom CA cert - internal/grpcserver/grpcserver_test.go: 20 tests via bufconn covering public RPCs, auth interceptor (no token, invalid, revoked -> 401), non-admin -> 403, Login/Logout/RenewToken/ValidateToken flows, AccountService CRUD, SetPGCreds/GetPGCreds AES-GCM round-trip, credential fields absent from all responses Security: JWT validation path identical to REST: alg header checked before signature, alg:none rejected, revocation table checked after sig. Authorization metadata value never logged by any interceptor. Credential fields (PasswordHash, TOTPSecret*, PGPassword) absent from all proto response messages — enforced by proto design and confirmed by test TestCredentialFieldsAbsentFromAccountResponse. Login dummy-Argon2 timing guard preserves timing uniformity for unknown users (same as REST handleLogin). TLS required at listener level; cmd/mciassrv uses credentials.NewServerTLSFromFile; no h2c offered. 137 tests pass, zero race conditions (go test -race ./...)
297 lines
9.0 KiB
Go
297 lines
9.0 KiB
Go
// AdminService: health check and public-key retrieval.
|
|
// These RPCs are public — no authentication is required.
|
|
|
|
// Code generated by protoc-gen-go. DO NOT EDIT.
|
|
// versions:
|
|
// protoc-gen-go v1.36.11
|
|
// protoc v6.33.4
|
|
// source: mcias/v1/admin.proto
|
|
|
|
package mciasv1
|
|
|
|
import (
|
|
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
|
|
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
|
|
reflect "reflect"
|
|
sync "sync"
|
|
unsafe "unsafe"
|
|
)
|
|
|
|
const (
|
|
// Verify that this generated code is sufficiently up-to-date.
|
|
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
|
|
// Verify that runtime/protoimpl is sufficiently up-to-date.
|
|
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
|
|
)
|
|
|
|
// HealthRequest carries no parameters.
|
|
type HealthRequest struct {
|
|
state protoimpl.MessageState `protogen:"open.v1"`
|
|
unknownFields protoimpl.UnknownFields
|
|
sizeCache protoimpl.SizeCache
|
|
}
|
|
|
|
func (x *HealthRequest) Reset() {
|
|
*x = HealthRequest{}
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[0]
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
|
|
func (x *HealthRequest) String() string {
|
|
return protoimpl.X.MessageStringOf(x)
|
|
}
|
|
|
|
func (*HealthRequest) ProtoMessage() {}
|
|
|
|
func (x *HealthRequest) ProtoReflect() protoreflect.Message {
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[0]
|
|
if x != nil {
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
if ms.LoadMessageInfo() == nil {
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
return ms
|
|
}
|
|
return mi.MessageOf(x)
|
|
}
|
|
|
|
// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead.
|
|
func (*HealthRequest) Descriptor() ([]byte, []int) {
|
|
return file_mcias_v1_admin_proto_rawDescGZIP(), []int{0}
|
|
}
|
|
|
|
// HealthResponse confirms the server is operational.
|
|
type HealthResponse struct {
|
|
state protoimpl.MessageState `protogen:"open.v1"`
|
|
Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"` // "ok"
|
|
unknownFields protoimpl.UnknownFields
|
|
sizeCache protoimpl.SizeCache
|
|
}
|
|
|
|
func (x *HealthResponse) Reset() {
|
|
*x = HealthResponse{}
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[1]
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
|
|
func (x *HealthResponse) String() string {
|
|
return protoimpl.X.MessageStringOf(x)
|
|
}
|
|
|
|
func (*HealthResponse) ProtoMessage() {}
|
|
|
|
func (x *HealthResponse) ProtoReflect() protoreflect.Message {
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[1]
|
|
if x != nil {
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
if ms.LoadMessageInfo() == nil {
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
return ms
|
|
}
|
|
return mi.MessageOf(x)
|
|
}
|
|
|
|
// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead.
|
|
func (*HealthResponse) Descriptor() ([]byte, []int) {
|
|
return file_mcias_v1_admin_proto_rawDescGZIP(), []int{1}
|
|
}
|
|
|
|
func (x *HealthResponse) GetStatus() string {
|
|
if x != nil {
|
|
return x.Status
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// GetPublicKeyRequest carries no parameters.
|
|
type GetPublicKeyRequest struct {
|
|
state protoimpl.MessageState `protogen:"open.v1"`
|
|
unknownFields protoimpl.UnknownFields
|
|
sizeCache protoimpl.SizeCache
|
|
}
|
|
|
|
func (x *GetPublicKeyRequest) Reset() {
|
|
*x = GetPublicKeyRequest{}
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[2]
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
|
|
func (x *GetPublicKeyRequest) String() string {
|
|
return protoimpl.X.MessageStringOf(x)
|
|
}
|
|
|
|
func (*GetPublicKeyRequest) ProtoMessage() {}
|
|
|
|
func (x *GetPublicKeyRequest) ProtoReflect() protoreflect.Message {
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[2]
|
|
if x != nil {
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
if ms.LoadMessageInfo() == nil {
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
return ms
|
|
}
|
|
return mi.MessageOf(x)
|
|
}
|
|
|
|
// Deprecated: Use GetPublicKeyRequest.ProtoReflect.Descriptor instead.
|
|
func (*GetPublicKeyRequest) Descriptor() ([]byte, []int) {
|
|
return file_mcias_v1_admin_proto_rawDescGZIP(), []int{2}
|
|
}
|
|
|
|
// GetPublicKeyResponse returns the Ed25519 public key in JWK format fields.
|
|
// The "x" field is the base64url-encoded 32-byte public key.
|
|
type GetPublicKeyResponse struct {
|
|
state protoimpl.MessageState `protogen:"open.v1"`
|
|
Kty string `protobuf:"bytes,1,opt,name=kty,proto3" json:"kty,omitempty"` // "OKP"
|
|
Crv string `protobuf:"bytes,2,opt,name=crv,proto3" json:"crv,omitempty"` // "Ed25519"
|
|
Use string `protobuf:"bytes,3,opt,name=use,proto3" json:"use,omitempty"` // "sig"
|
|
Alg string `protobuf:"bytes,4,opt,name=alg,proto3" json:"alg,omitempty"` // "EdDSA"
|
|
X string `protobuf:"bytes,5,opt,name=x,proto3" json:"x,omitempty"` // base64url-encoded public key bytes
|
|
unknownFields protoimpl.UnknownFields
|
|
sizeCache protoimpl.SizeCache
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) Reset() {
|
|
*x = GetPublicKeyResponse{}
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[3]
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) String() string {
|
|
return protoimpl.X.MessageStringOf(x)
|
|
}
|
|
|
|
func (*GetPublicKeyResponse) ProtoMessage() {}
|
|
|
|
func (x *GetPublicKeyResponse) ProtoReflect() protoreflect.Message {
|
|
mi := &file_mcias_v1_admin_proto_msgTypes[3]
|
|
if x != nil {
|
|
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
|
|
if ms.LoadMessageInfo() == nil {
|
|
ms.StoreMessageInfo(mi)
|
|
}
|
|
return ms
|
|
}
|
|
return mi.MessageOf(x)
|
|
}
|
|
|
|
// Deprecated: Use GetPublicKeyResponse.ProtoReflect.Descriptor instead.
|
|
func (*GetPublicKeyResponse) Descriptor() ([]byte, []int) {
|
|
return file_mcias_v1_admin_proto_rawDescGZIP(), []int{3}
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) GetKty() string {
|
|
if x != nil {
|
|
return x.Kty
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) GetCrv() string {
|
|
if x != nil {
|
|
return x.Crv
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) GetUse() string {
|
|
if x != nil {
|
|
return x.Use
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) GetAlg() string {
|
|
if x != nil {
|
|
return x.Alg
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func (x *GetPublicKeyResponse) GetX() string {
|
|
if x != nil {
|
|
return x.X
|
|
}
|
|
return ""
|
|
}
|
|
|
|
var File_mcias_v1_admin_proto protoreflect.FileDescriptor
|
|
|
|
const file_mcias_v1_admin_proto_rawDesc = "" +
|
|
"\n" +
|
|
"\x14mcias/v1/admin.proto\x12\bmcias.v1\"\x0f\n" +
|
|
"\rHealthRequest\"(\n" +
|
|
"\x0eHealthResponse\x12\x16\n" +
|
|
"\x06status\x18\x01 \x01(\tR\x06status\"\x15\n" +
|
|
"\x13GetPublicKeyRequest\"l\n" +
|
|
"\x14GetPublicKeyResponse\x12\x10\n" +
|
|
"\x03kty\x18\x01 \x01(\tR\x03kty\x12\x10\n" +
|
|
"\x03crv\x18\x02 \x01(\tR\x03crv\x12\x10\n" +
|
|
"\x03use\x18\x03 \x01(\tR\x03use\x12\x10\n" +
|
|
"\x03alg\x18\x04 \x01(\tR\x03alg\x12\f\n" +
|
|
"\x01x\x18\x05 \x01(\tR\x01x2\x9a\x01\n" +
|
|
"\fAdminService\x12;\n" +
|
|
"\x06Health\x12\x17.mcias.v1.HealthRequest\x1a\x18.mcias.v1.HealthResponse\x12M\n" +
|
|
"\fGetPublicKey\x12\x1d.mcias.v1.GetPublicKeyRequest\x1a\x1e.mcias.v1.GetPublicKeyResponseB2Z0git.wntrmute.dev/kyle/mcias/gen/mcias/v1;mciasv1b\x06proto3"
|
|
|
|
var (
|
|
file_mcias_v1_admin_proto_rawDescOnce sync.Once
|
|
file_mcias_v1_admin_proto_rawDescData []byte
|
|
)
|
|
|
|
func file_mcias_v1_admin_proto_rawDescGZIP() []byte {
|
|
file_mcias_v1_admin_proto_rawDescOnce.Do(func() {
|
|
file_mcias_v1_admin_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcias_v1_admin_proto_rawDesc), len(file_mcias_v1_admin_proto_rawDesc)))
|
|
})
|
|
return file_mcias_v1_admin_proto_rawDescData
|
|
}
|
|
|
|
var file_mcias_v1_admin_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
|
|
var file_mcias_v1_admin_proto_goTypes = []any{
|
|
(*HealthRequest)(nil), // 0: mcias.v1.HealthRequest
|
|
(*HealthResponse)(nil), // 1: mcias.v1.HealthResponse
|
|
(*GetPublicKeyRequest)(nil), // 2: mcias.v1.GetPublicKeyRequest
|
|
(*GetPublicKeyResponse)(nil), // 3: mcias.v1.GetPublicKeyResponse
|
|
}
|
|
var file_mcias_v1_admin_proto_depIdxs = []int32{
|
|
0, // 0: mcias.v1.AdminService.Health:input_type -> mcias.v1.HealthRequest
|
|
2, // 1: mcias.v1.AdminService.GetPublicKey:input_type -> mcias.v1.GetPublicKeyRequest
|
|
1, // 2: mcias.v1.AdminService.Health:output_type -> mcias.v1.HealthResponse
|
|
3, // 3: mcias.v1.AdminService.GetPublicKey:output_type -> mcias.v1.GetPublicKeyResponse
|
|
2, // [2:4] is the sub-list for method output_type
|
|
0, // [0:2] is the sub-list for method input_type
|
|
0, // [0:0] is the sub-list for extension type_name
|
|
0, // [0:0] is the sub-list for extension extendee
|
|
0, // [0:0] is the sub-list for field type_name
|
|
}
|
|
|
|
func init() { file_mcias_v1_admin_proto_init() }
|
|
func file_mcias_v1_admin_proto_init() {
|
|
if File_mcias_v1_admin_proto != nil {
|
|
return
|
|
}
|
|
type x struct{}
|
|
out := protoimpl.TypeBuilder{
|
|
File: protoimpl.DescBuilder{
|
|
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
|
|
RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcias_v1_admin_proto_rawDesc), len(file_mcias_v1_admin_proto_rawDesc)),
|
|
NumEnums: 0,
|
|
NumMessages: 4,
|
|
NumExtensions: 0,
|
|
NumServices: 1,
|
|
},
|
|
GoTypes: file_mcias_v1_admin_proto_goTypes,
|
|
DependencyIndexes: file_mcias_v1_admin_proto_depIdxs,
|
|
MessageInfos: file_mcias_v1_admin_proto_msgTypes,
|
|
}.Build()
|
|
File_mcias_v1_admin_proto = out.File
|
|
file_mcias_v1_admin_proto_goTypes = nil
|
|
file_mcias_v1_admin_proto_depIdxs = nil
|
|
}
|