mc/metacrypt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
64d921827e1b29ffe6c041cec70ee4b25be0a5ab
metacrypt/gen/metacrypt/v1/barrier.pb.go
Kyle Isom 64d921827e Add MEK rotation, per-engine DEKs, and v2 ciphertext format (audit #6, #22) 
Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs
stored in a new barrier_keys table, rather than encrypting all barrier
entries directly. A v2 ciphertext format (0x02) embeds the key ID so the
barrier can resolve which DEK to use on decryption. v1 ciphertext remains
supported for backward compatibility.

Key changes:
- crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs
- barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys)
- seal: RotateMEK re-wraps DEKs without re-encrypting data
- engine: Mount auto-creates per-engine DEK
- REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate
- proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate
- db: migration v2 adds barrier_keys table

Also includes: security audit report, CSRF protection, engine design specs
(sshca, transit, user), path-bound AAD migration tool, policy engine
enhancements, and ARCHITECTURE.md updates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-16 18:27:44 -07:00

524 lines
16 KiB
Go
Raw Blame History

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// protoc-gen-go v1.36.11
// protoc v3.20.3
// source: proto/metacrypt/v1/barrier.proto
package metacryptv1
import (
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
reflect "reflect"
sync "sync"
unsafe "unsafe"
)
const (
// Verify that this generated code is sufficiently up-to-date.
_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
// Verify that runtime/protoimpl is sufficiently up-to-date.
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)
type ListKeysRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *ListKeysRequest) Reset() {
*x = ListKeysRequest{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[0]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *ListKeysRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*ListKeysRequest) ProtoMessage() {}
func (x *ListKeysRequest) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[0]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use ListKeysRequest.ProtoReflect.Descriptor instead.
func (*ListKeysRequest) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{0}
}
type ListKeysResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Keys []*BarrierKeyInfo `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *ListKeysResponse) Reset() {
*x = ListKeysResponse{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[1]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *ListKeysResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*ListKeysResponse) ProtoMessage() {}
func (x *ListKeysResponse) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[1]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use ListKeysResponse.ProtoReflect.Descriptor instead.
func (*ListKeysResponse) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{1}
}
func (x *ListKeysResponse) GetKeys() []*BarrierKeyInfo {
if x != nil {
return x.Keys
}
return nil
}
type BarrierKeyInfo struct {
state protoimpl.MessageState `protogen:"open.v1"`
KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
Version int32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
CreatedAt string `protobuf:"bytes,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
RotatedAt string `protobuf:"bytes,4,opt,name=rotated_at,json=rotatedAt,proto3" json:"rotated_at,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *BarrierKeyInfo) Reset() {
*x = BarrierKeyInfo{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[2]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *BarrierKeyInfo) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*BarrierKeyInfo) ProtoMessage() {}
func (x *BarrierKeyInfo) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[2]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use BarrierKeyInfo.ProtoReflect.Descriptor instead.
func (*BarrierKeyInfo) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{2}
}
func (x *BarrierKeyInfo) GetKeyId() string {
if x != nil {
return x.KeyId
}
return ""
}
func (x *BarrierKeyInfo) GetVersion() int32 {
if x != nil {
return x.Version
}
return 0
}
func (x *BarrierKeyInfo) GetCreatedAt() string {
if x != nil {
return x.CreatedAt
}
return ""
}
func (x *BarrierKeyInfo) GetRotatedAt() string {
if x != nil {
return x.RotatedAt
}
return ""
}
type RotateMEKRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
Password string `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *RotateMEKRequest) Reset() {
*x = RotateMEKRequest{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[3]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *RotateMEKRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*RotateMEKRequest) ProtoMessage() {}
func (x *RotateMEKRequest) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[3]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use RotateMEKRequest.ProtoReflect.Descriptor instead.
func (*RotateMEKRequest) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{3}
}
func (x *RotateMEKRequest) GetPassword() string {
if x != nil {
return x.Password
}
return ""
}
type RotateMEKResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Ok bool `protobuf:"varint,1,opt,name=ok,proto3" json:"ok,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *RotateMEKResponse) Reset() {
*x = RotateMEKResponse{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[4]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *RotateMEKResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*RotateMEKResponse) ProtoMessage() {}
func (x *RotateMEKResponse) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[4]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use RotateMEKResponse.ProtoReflect.Descriptor instead.
func (*RotateMEKResponse) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{4}
}
func (x *RotateMEKResponse) GetOk() bool {
if x != nil {
return x.Ok
}
return false
}
type RotateKeyRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *RotateKeyRequest) Reset() {
*x = RotateKeyRequest{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[5]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *RotateKeyRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*RotateKeyRequest) ProtoMessage() {}
func (x *RotateKeyRequest) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[5]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use RotateKeyRequest.ProtoReflect.Descriptor instead.
func (*RotateKeyRequest) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{5}
}
func (x *RotateKeyRequest) GetKeyId() string {
if x != nil {
return x.KeyId
}
return ""
}
type RotateKeyResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Ok bool `protobuf:"varint,1,opt,name=ok,proto3" json:"ok,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *RotateKeyResponse) Reset() {
*x = RotateKeyResponse{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[6]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *RotateKeyResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*RotateKeyResponse) ProtoMessage() {}
func (x *RotateKeyResponse) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[6]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use RotateKeyResponse.ProtoReflect.Descriptor instead.
func (*RotateKeyResponse) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{6}
}
func (x *RotateKeyResponse) GetOk() bool {
if x != nil {
return x.Ok
}
return false
}
type MigrateBarrierRequest struct {
state protoimpl.MessageState `protogen:"open.v1"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *MigrateBarrierRequest) Reset() {
*x = MigrateBarrierRequest{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[7]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *MigrateBarrierRequest) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*MigrateBarrierRequest) ProtoMessage() {}
func (x *MigrateBarrierRequest) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[7]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use MigrateBarrierRequest.ProtoReflect.Descriptor instead.
func (*MigrateBarrierRequest) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{7}
}
type MigrateBarrierResponse struct {
state protoimpl.MessageState `protogen:"open.v1"`
Migrated int32 `protobuf:"varint,1,opt,name=migrated,proto3" json:"migrated,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *MigrateBarrierResponse) Reset() {
*x = MigrateBarrierResponse{}
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[8]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *MigrateBarrierResponse) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*MigrateBarrierResponse) ProtoMessage() {}
func (x *MigrateBarrierResponse) ProtoReflect() protoreflect.Message {
mi := &file_proto_metacrypt_v1_barrier_proto_msgTypes[8]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use MigrateBarrierResponse.ProtoReflect.Descriptor instead.
func (*MigrateBarrierResponse) Descriptor() ([]byte, []int) {
return file_proto_metacrypt_v1_barrier_proto_rawDescGZIP(), []int{8}
}
func (x *MigrateBarrierResponse) GetMigrated() int32 {
if x != nil {
return x.Migrated
}
return 0
}
var File_proto_metacrypt_v1_barrier_proto protoreflect.FileDescriptor
const file_proto_metacrypt_v1_barrier_proto_rawDesc = "" +
"\n" +
" proto/metacrypt/v1/barrier.proto\x12\fmetacrypt.v1\"\x11\n" +
"\x0fListKeysRequest\"D\n" +
"\x10ListKeysResponse\x120\n" +
"\x04keys\x18\x01 \x03(\v2\x1c.metacrypt.v1.BarrierKeyInfoR\x04keys\"\x7f\n" +
"\x0eBarrierKeyInfo\x12\x15\n" +
"\x06key_id\x18\x01 \x01(\tR\x05keyId\x12\x18\n" +
"\aversion\x18\x02 \x01(\x05R\aversion\x12\x1d\n" +
"\n" +
"created_at\x18\x03 \x01(\tR\tcreatedAt\x12\x1d\n" +
"\n" +
"rotated_at\x18\x04 \x01(\tR\trotatedAt\".\n" +
"\x10RotateMEKRequest\x12\x1a\n" +
"\bpassword\x18\x01 \x01(\tR\bpassword\"#\n" +
"\x11RotateMEKResponse\x12\x0e\n" +
"\x02ok\x18\x01 \x01(\bR\x02ok\")\n" +
"\x10RotateKeyRequest\x12\x15\n" +
"\x06key_id\x18\x01 \x01(\tR\x05keyId\"#\n" +
"\x11RotateKeyResponse\x12\x0e\n" +
"\x02ok\x18\x01 \x01(\bR\x02ok\"\x17\n" +
"\x15MigrateBarrierRequest\"4\n" +
"\x16MigrateBarrierResponse\x12\x1a\n" +
"\bmigrated\x18\x01 \x01(\x05R\bmigrated2\xcd\x02\n" +
"\x0eBarrierService\x12I\n" +
"\bListKeys\x12\x1d.metacrypt.v1.ListKeysRequest\x1a\x1e.metacrypt.v1.ListKeysResponse\x12L\n" +
"\tRotateMEK\x12\x1e.metacrypt.v1.RotateMEKRequest\x1a\x1f.metacrypt.v1.RotateMEKResponse\x12L\n" +
"\tRotateKey\x12\x1e.metacrypt.v1.RotateKeyRequest\x1a\x1f.metacrypt.v1.RotateKeyResponse\x12T\n" +
"\aMigrate\x12#.metacrypt.v1.MigrateBarrierRequest\x1a$.metacrypt.v1.MigrateBarrierResponseB>Z<git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1;metacryptv1b\x06proto3"
var (
file_proto_metacrypt_v1_barrier_proto_rawDescOnce sync.Once
file_proto_metacrypt_v1_barrier_proto_rawDescData []byte
)
func file_proto_metacrypt_v1_barrier_proto_rawDescGZIP() []byte {
file_proto_metacrypt_v1_barrier_proto_rawDescOnce.Do(func() {
file_proto_metacrypt_v1_barrier_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_barrier_proto_rawDesc), len(file_proto_metacrypt_v1_barrier_proto_rawDesc)))
})
return file_proto_metacrypt_v1_barrier_proto_rawDescData
}
var file_proto_metacrypt_v1_barrier_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
var file_proto_metacrypt_v1_barrier_proto_goTypes = []any{
(*ListKeysRequest)(nil), // 0: metacrypt.v1.ListKeysRequest
(*ListKeysResponse)(nil), // 1: metacrypt.v1.ListKeysResponse
(*BarrierKeyInfo)(nil), // 2: metacrypt.v1.BarrierKeyInfo
(*RotateMEKRequest)(nil), // 3: metacrypt.v1.RotateMEKRequest
(*RotateMEKResponse)(nil), // 4: metacrypt.v1.RotateMEKResponse
(*RotateKeyRequest)(nil), // 5: metacrypt.v1.RotateKeyRequest
(*RotateKeyResponse)(nil), // 6: metacrypt.v1.RotateKeyResponse
(*MigrateBarrierRequest)(nil), // 7: metacrypt.v1.MigrateBarrierRequest
(*MigrateBarrierResponse)(nil), // 8: metacrypt.v1.MigrateBarrierResponse
}
var file_proto_metacrypt_v1_barrier_proto_depIdxs = []int32{
2, // 0: metacrypt.v1.ListKeysResponse.keys:type_name -> metacrypt.v1.BarrierKeyInfo
0, // 1: metacrypt.v1.BarrierService.ListKeys:input_type -> metacrypt.v1.ListKeysRequest
3, // 2: metacrypt.v1.BarrierService.RotateMEK:input_type -> metacrypt.v1.RotateMEKRequest
5, // 3: metacrypt.v1.BarrierService.RotateKey:input_type -> metacrypt.v1.RotateKeyRequest
7, // 4: metacrypt.v1.BarrierService.Migrate:input_type -> metacrypt.v1.MigrateBarrierRequest
1, // 5: metacrypt.v1.BarrierService.ListKeys:output_type -> metacrypt.v1.ListKeysResponse
4, // 6: metacrypt.v1.BarrierService.RotateMEK:output_type -> metacrypt.v1.RotateMEKResponse
6, // 7: metacrypt.v1.BarrierService.RotateKey:output_type -> metacrypt.v1.RotateKeyResponse
8, // 8: metacrypt.v1.BarrierService.Migrate:output_type -> metacrypt.v1.MigrateBarrierResponse
5, // [5:9] is the sub-list for method output_type
1, // [1:5] is the sub-list for method input_type
1, // [1:1] is the sub-list for extension type_name
1, // [1:1] is the sub-list for extension extendee
0, // [0:1] is the sub-list for field type_name
}
func init() { file_proto_metacrypt_v1_barrier_proto_init() }
func file_proto_metacrypt_v1_barrier_proto_init() {
if File_proto_metacrypt_v1_barrier_proto != nil {
return
}
type x struct{}
out := protoimpl.TypeBuilder{
File: protoimpl.DescBuilder{
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
RawDescriptor: unsafe.Slice(unsafe.StringData(file_proto_metacrypt_v1_barrier_proto_rawDesc), len(file_proto_metacrypt_v1_barrier_proto_rawDesc)),
NumEnums: 0,
NumMessages: 9,
NumExtensions: 0,
NumServices: 1,
},
GoTypes: file_proto_metacrypt_v1_barrier_proto_goTypes,
DependencyIndexes: file_proto_metacrypt_v1_barrier_proto_depIdxs,
MessageInfos: file_proto_metacrypt_v1_barrier_proto_msgTypes,
}.Build()
File_proto_metacrypt_v1_barrier_proto = out.File
file_proto_metacrypt_v1_barrier_proto_goTypes = nil
file_proto_metacrypt_v1_barrier_proto_depIdxs = nil
}
Reference in New Issue View Git Blame Copy Permalink