protocol

package
v0.36.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 19, 2026 License: AGPL-3.0 Imports: 9 Imported by: 0

Documentation

Overview

Package protocol defines the line-delimited JSON admin protocol message types shared between apsigner (server) and apadmin/TUI (client) over IPC and SSH admin transport. This is the single source of truth for the wire protocol.

Index

Constants

View Source 
const (
	ErrCodeInvalidMessageFormat = "invalid_message_format"
	ErrCodeExpectedAuthMessage  = "expected_auth_message"
	ErrCodeInvalidAuthMessage   = "invalid_auth_message"
	ErrCodeAuthenticationFailed = "authentication_failed"
	ErrCodeInvalidPassphrase    = "invalid_passphrase"
	ErrCodeUnlockFailed         = "unlock_failed"
	ErrCodeInvalidRequest       = "invalid_request"
	ErrCodeUnknownMessageType   = "unknown_message_type"
	ErrCodeNoIdentityBound      = "no_identity_bound"
	ErrCodeAuthorizationDenied  = "authorization_denied"
	ErrCodeSignerLocked         = "signer_locked"
	ErrCodeKeyNotFound          = "key_not_found"
	ErrCodeNodeFailClosed       = "node_fail_closed"
	ErrCodeInternal             = "internal_error"
)

Stable machine-readable IPC/admin error codes.

View Source 
const (
	ResultCodeBackupFailed             = "backup_failed"
	ResultCodeListBackupsFailed        = "list_backups_failed"
	ResultCodeDeleteBackupFailed       = "delete_backup_failed"
	ResultCodeRestorePreviewFailed     = "restore_preview_failed"
	ResultCodeRestoreRateLimited       = "restore_rate_limited"
	ResultCodeRestoreFailed            = "restore_failed"
	ResultCodeRestoreConflict          = "restore_conflict"
	ResultCodeRestoreRollbackFailed    = "restore_rollback_failed"
	ResultCodeRestoreRollbackRefused   = "restore_rollback_refused"
	ResultCodeRestoreRollbackDiverged  = "restore_rollback_diverged"
	ResultCodeRestoreAuditFailed       = "restore_audit_failed"
	ResultCodeInvalidBackupArchive     = "invalid_backup_archive"
	ResultCodeBackupArchiveNotFound    = "backup_archive_not_found"
	ResultCodeBackupArchiveUnavailable = "backup_archive_unavailable"
	// ResultCodeRecoveryBlocked reports an unlock that succeeded into
	// recovery mode: the passphrase was right, but the store failed
	// reconciliation or generation validation, so signing is blocked until
	// the operator resolves the store from recovery.
	ResultCodeRecoveryBlocked = "recovery_blocked"

	ResultCodeIdentityBusy         = "identity_busy"
	ResultCodeListFailed           = "list_failed"
	ResultCodeInvalidTemplateType  = "invalid_template_type"
	ResultCodeInstallFailed        = "install_failed"
	ResultCodeReloadFailed         = "reload_failed"
	ResultCodeActivationFailed     = "activation_failed"
	ResultCodeLibraryReadFailed    = "library_read_failed"
	ResultCodeLibraryEntryNotFound = "library_entry_not_found"
	ResultCodeTemplateStateFailed  = "template_state_failed"
	ResultCodeTemplateNotFound     = "template_not_found"
	ResultCodeDecryptFailed        = "decrypt_failed"
	ResultCodeInvalidTemplate      = "invalid_template"
	ResultCodeImportFailed         = "import_failed"
	ResultCodeRemoveFailed         = "remove_failed"
	ResultCodeKeyTypeInUse         = "key_type_in_use"
	ResultCodeDeactivationFailed   = "deactivation_failed"
)

Stable machine-readable result codes carried by admin result messages.

These codes are result-local: they are not the central IPC error taxonomy above, but producers and CLI consumers still share them through this package so the lists cannot drift independently.

View Source 
const (
	AdminProtocolVersionMajor = 5
	AdminProtocolVersionMinor = 0
)
View Source 
const (
	// Authentication message types (sent before any other messages)
	MsgTypeAuthRequired = "auth_required"
	MsgTypeAuth         = "auth"
	MsgTypeAuthOnly     = "auth_only"
	MsgTypeAuthResult   = "auth_result"

	// Signer state message types
	MsgTypeUnlock                   = "unlock"
	MsgTypeUnlockResult             = "unlock_result"
	MsgTypeLockIdentity             = "lock_identity"
	MsgTypeLockIdentityResult       = "lock_identity_result"
	MsgTypeInitializeStore          = "initialize_store"
	MsgTypeInitializeStoreResult    = "initialize_store_result"
	MsgTypeChangeStorePass          = "change_store_passphrase"
	MsgTypeChangeStorePassResult    = "change_store_passphrase_result"
	MsgTypeBackup                   = "backup"
	MsgTypeBackupResult             = "backup_result"
	MsgTypeListBackups              = "list_backups"
	MsgTypeBackupsList              = "backups_list"
	MsgTypeDeleteBackup             = "delete_backup"
	MsgTypeDeleteBackupResult       = "delete_backup_result"
	MsgTypeBeginBackupImport        = "begin_backup_import"
	MsgTypeBeginBackupImportResult  = "begin_backup_import_result"
	MsgTypeAppendBackupImport       = "append_backup_import"
	MsgTypeAppendBackupImportResult = "append_backup_import_result"
	MsgTypeCommitBackupImport       = "commit_backup_import"
	MsgTypeCommitBackupImportResult = "commit_backup_import_result"
	MsgTypeAbortBackupImport        = "abort_backup_import"
	MsgTypeAbortBackupImportResult  = "abort_backup_import_result"
	MsgTypeReadBackupChunk          = "read_backup_chunk"
	MsgTypeBackupChunk              = "backup_chunk"
	MsgTypePreviewRestore           = "preview_restore"
	MsgTypeRestorePreview           = "restore_preview"
	MsgTypeRestoreBackup            = "restore_backup"
	MsgTypeRestoreBackupResult      = "restore_backup_result"
	MsgTypeRollbackRestore          = "rollback_restore"
	MsgTypeRollbackRestoreResult    = "rollback_restore_result"
	MsgTypeReconcileStore           = "reconcile_store"
	MsgTypeReconcileStoreResult     = "reconcile_store_result"
	MsgTypeSignRequest              = "sign_request"
	MsgTypeSignRequestCanceled      = "sign_request_canceled"
	MsgTypeSignResponse             = "sign_response"
	MsgTypeStatus                   = "status"
	MsgTypeError                    = "error"

	// Token provisioning message types (SSH-based token request approval)
	MsgTypeTokenProvisioningRequest  = "token_provisioning_request"
	MsgTypeTokenProvisioningResponse = "token_provisioning_response"

	// Token revocation message types
	MsgTypeRevokeToken       = "revoke_token"
	MsgTypeRevokeTokenResult = "revoke_token_result"

	// Key management message types
	MsgTypeListKeys       = "list_keys"
	MsgTypeKeysList       = "keys_list"
	MsgTypeGenerateKey    = "generate_key"
	MsgTypeGenerateResult = "generate_result"
	MsgTypeDeleteKey      = "delete_key"
	MsgTypeDeleteResult   = "delete_result"
	MsgTypeExportKey      = "export_key"
	MsgTypeExportResult   = "export_result"
	MsgTypeImportKey      = "import_key"
	MsgTypeImportResult   = "import_result"
	MsgTypeGetKeyDetails  = "get_key_details"
	MsgTypeKeyDetails     = "key_details"

	// Template library and key type metadata message types
	MsgTypeListLibraryTemplates          = "list_library_templates"
	MsgTypeLibraryTemplates              = "library_templates"
	MsgTypeInstallLibraryTemplate        = "install_library_template"
	MsgTypeInstallLibraryTemplateResult  = "install_library_template_result"
	MsgTypeListInstalledTemplates        = "list_installed_templates"
	MsgTypeInstalledTemplates            = "installed_templates"
	MsgTypeShowInstalledTemplate         = "show_installed_template"
	MsgTypeShowInstalledTemplateResult   = "show_installed_template_result"
	MsgTypeShowLibraryTemplate           = "show_library_template"
	MsgTypeShowLibraryTemplateResult     = "show_library_template_result"
	MsgTypeImportInstalledTemplate       = "import_installed_template"
	MsgTypeImportInstalledTemplateResult = "import_installed_template_result"
	MsgTypeRemoveInstalledTemplate       = "remove_installed_template"
	MsgTypeRemoveInstalledTemplateResult = "remove_installed_template_result"
	MsgTypeActivateKeyType               = "activate_key_type"
	MsgTypeActivateKeyTypeResult         = "activate_key_type_result"
	MsgTypeDeactivateKeyType             = "deactivate_key_type"
	MsgTypeDeactivateKeyTypeResult       = "deactivate_key_type_result"
	MsgTypeListKeyTypes                  = "list_key_types"
	MsgTypeKeyTypes                      = "key_types"

	// Server-initiated notification message types
	MsgTypeKeysChanged  = "keys_changed"  // Sent when keys are reloaded
	MsgTypeSignerLocked = "signer_locked" // Sent when signer locks

	// Admin settings message types
	MsgTypeGetAdminSettings         = "get_admin_settings"          // Client → server: request current settings
	MsgTypeAdminSettings            = "admin_settings"              // Server → client: current settings
	MsgTypeUpdateAdminSetting       = "update_admin_setting"        // Client → server: change a setting
	MsgTypeUpdateAdminSettingResult = "update_admin_setting_result" // Server → client: result
	MsgTypeGetPolicySnapshot        = "get_policy_snapshot"         // Client → server: request active read-only policy snapshot
	MsgTypePolicySnapshot           = "policy_snapshot"             // Server → client: active read-only policy snapshot
	MsgTypeReplacePolicy            = "replace_policy"              // Client → server: wholesale replace policy.yaml
	MsgTypeReplacePolicyResult      = "replace_policy_result"       // Server → client: replacement result and active snapshot
	MsgTypeValidatePolicy           = "validate_policy"             // Client → server: validate policy YAML without writing
	MsgTypeValidatePolicyResult     = "validate_policy_result"      // Server → client: validation result

	// Signer-owned sentry reference and generation inventory messages.
	MsgTypeListSentryReferences        = "list_sentry_references"
	MsgTypeSentryReferencesList        = "sentry_references_list"
	MsgTypeGetSentryReference          = "get_sentry_reference"
	MsgTypeSentryReference             = "sentry_reference"
	MsgTypeImportSentryReference       = "import_sentry_reference"
	MsgTypeImportSentryReferenceResult = "import_sentry_reference_result"
	MsgTypeRemoveSentryReference       = "remove_sentry_reference"
	MsgTypeRemoveSentryReferenceResult = "remove_sentry_reference_result"
	MsgTypeExportSentryPublic          = "export_sentry_public"
	MsgTypeExportSentryPublicResult    = "export_sentry_public_result"
	MsgTypeListGenerations             = "list_generations"
	MsgTypeGenerationsList             = "generations_list"

	// Client displacement message types (for single-client IPC enforcement)
	MsgTypeClientExists    = "client_exists"    // Server → new client: another client is connected
	MsgTypeDisplaceConfirm = "displace_confirm" // New client → server: proceed with displacement
	MsgTypeDisplaced       = "displaced"        // Server → old client: you've been displaced
)

Admin protocol message type constants

View Source 
const (
	// SignRequestCancelReasonClientCanceled means the original signing
	// requester disconnected or canceled its request before approval
	// completed.
	SignRequestCancelReasonClientCanceled = "client_canceled"

	// SignRequestCancelReasonTimeout means apsigner's approval wait expired.
	SignRequestCancelReasonTimeout = "timeout"
)

Sign-request cancellation reasons carried on SignRequestCanceled notifications. These are wire values: admin clients display them and the approval coordinator produces them.

View Source 
const MaxAdminMessageBytes = 4 * 1024 * 1024

MaxAdminMessageBytes bounds every IPC/SSH admin frame before JSON decode. Current messages are normally kilobytes; this leaves room for template and policy documents without permitting an authenticated or pre-auth peer to grow memory without bound.

Variables

This section is empty.

Functions

func CodeForError added in v0.24.0 

func CodeForError(err error) string

CodeForError returns the code attached at the error origin when present, falling back to exact legacy message strings for old codeless peers.

func IPCErrorCode 

func IPCErrorCode(errMsg string) string

IPCErrorCode maps the small set of legacy codeless protocol/admin messages whose exact text shipped before the wire carried explicit codes. New code must attach codes at the source with WithCode instead of adding message-text patterns here.

func MarshalAdminMessage 

func MarshalAdminMessage(v interface{}) ([]byte, error)

func ReadJSONLine 

func ReadJSONLine(r *bufio.Reader) ([]byte, error)

ReadJSONLine reads one bounded admin frame. Any error invalidates framing: callers must close the connection and must not reuse r. In particular, the function deliberately does not drain an oversized unterminated frame, which could otherwise let a malicious peer block the reader indefinitely.

func WithCode added in v0.24.0 

func WithCode(code string, err error) error

WithCode attaches a stable IPC error code to err at its origin.

func WriteJSONLine 

func WriteJSONLine(w io.Writer, data []byte) error

Types

type AbortBackupImportMessage added in v0.35.0 

type AbortBackupImportMessage struct {
	BaseMessage
	UploadID string `json:"upload_id"`
}

type AbortBackupImportResultMessage added in v0.35.0 

type AbortBackupImportResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

type ActivateKeyTypeMessage 

type ActivateKeyTypeMessage struct {
	BaseMessage
	KeyType string `json:"key_type"`
}

type ActivateKeyTypeResultMessage 

type ActivateKeyTypeResultMessage struct {
	BaseMessage
	Success       bool   `json:"success"`
	KeyType       string `json:"key_type,omitempty"`
	AlreadyExists bool   `json:"already_exists,omitempty"`
	Code          string `json:"code,omitempty"`
	Error         string `json:"error,omitempty"`
}

type AdminKeyInfo added in v0.31.0 

type AdminKeyInfo struct {
	Address                  string `json:"address"`
	KeyType                  string `json:"key_type"` // Full versioned type: "ed25519", "aplane.falcon1024.v1", etc.
	Name                     string `json:"name,omitempty"`
	TemplateProvenanceStatus string `json:"template_provenance_status,omitempty"`
	TemplateProvenanceNote   string `json:"template_provenance_note,omitempty"`
}

AdminKeyInfo is the thin per-key entry in the admin transport wire protocol. It is intentionally NOT pkg/signerapi.KeyInfo (the richer HTTP inventory shape carrying signing_flow, logic_sig_resources, signing_args, and flags): the admin TUI only needs address, key type, name, and template provenance. Do not add HTTP-only fields here; extend the HTTP KeyInfo instead. See docs/ARCH_ADMIN_PROTOCOL.md.

type AdminSettingsMessage 

type AdminSettingsMessage struct {
	BaseMessage
	UserAutoApprove      bool   `json:"user_auto_approve"`
	LockOnDisconnect     bool   `json:"lock_on_disconnect"`
	PassphraseTimeout    string `json:"passphrase_timeout"`
	PassphraseMethod     string `json:"passphrase_method"`
	NodeRole             string `json:"node_role,omitempty"`
	SSHEnabled           bool   `json:"ssh_enabled"`
	SSHListenAddress     string `json:"ssh_listen_address,omitempty"`
	SSHPort              int    `json:"ssh_port,omitempty"`
	SSHFingerprint       string `json:"ssh_fingerprint,omitempty"`
	SSHClients           int    `json:"ssh_clients"`
	SignerPort           int    `json:"signer_port"`
	TEALCompileNet       string `json:"teal_compile_network"`
	EndpointAdvertiseURL string `json:"endpoint_advertise_url,omitempty"`
	EndpointDisplayURL   string `json:"endpoint_display_url,omitempty"`
	Theme                string `json:"theme"`
}

AdminSettingsMessage contains the current admin settings.

type AppendBackupImportMessage added in v0.35.0 

type AppendBackupImportMessage struct {
	BaseMessage
	UploadID string `json:"upload_id"`
	Offset   int64  `json:"offset"`
	Data     []byte `json:"data"`
}

type AppendBackupImportResultMessage added in v0.35.0 

type AppendBackupImportResultMessage struct {
	BaseMessage
	Success    bool   `json:"success"`
	NextOffset int64  `json:"next_offset,omitempty"`
	Code       string `json:"code,omitempty"`
	Error      string `json:"error,omitempty"`
}

type AuthMessage 

type AuthMessage struct {
	BaseMessage
	Passphrase      SensitiveBytes   `json:"passphrase"`
	ProtocolVersion *ProtocolVersion `json:"protocol_version,omitempty"`
}

AuthMessage is sent by an admin client to authenticate the IPC/SSH session. ProtocolVersion is required by the server.

type AuthRequiredMessage 

type AuthRequiredMessage struct {
	BaseMessage
	ProtocolVersion ProtocolVersion `json:"protocol_version"`
}

AuthRequiredMessage is sent by signer when a client connects Client must respond with AuthMessage before any other operations

type AuthResultMessage 

type AuthResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

AuthResultMessage is sent back after an authentication attempt

type BackupChunkMessage added in v0.35.0 

type BackupChunkMessage struct {
	BaseMessage
	Success  bool   `json:"success"`
	FileName string `json:"file_name,omitempty"`
	Offset   int64  `json:"offset,omitempty"`
	Data     []byte `json:"data,omitempty"`
	EOF      bool   `json:"eof,omitempty"`
	Code     string `json:"code,omitempty"`
	Error    string `json:"error,omitempty"`
}

type BackupInfo 

type BackupInfo struct {
	Path      string `json:"path"`
	FileName  string `json:"file_name"`
	CreatedAt int64  `json:"created_at,omitempty"`
	Size      int64  `json:"size,omitempty"`
	Checksum  string `json:"checksum,omitempty"`
}

type BackupMessage 

type BackupMessage struct {
	BaseMessage
	ExportPassphrase SensitiveBytes `json:"export_passphrase"`
	Addresses        []string       `json:"addresses,omitempty"`
}

BackupMessage requests signer-managed creation of a portable key backup for the currently bound identity. The export passphrase protects the resulting .apb payloads inside the archive.

type BackupResultMessage 

type BackupResultMessage struct {
	BaseMessage
	Success         bool     `json:"success"`
	ArchivePath     string   `json:"archive_path,omitempty"`
	ArchiveChecksum string   `json:"archive_checksum,omitempty"`
	ArchiveSize     int64    `json:"archive_size,omitempty"`
	KeyCount        int      `json:"key_count,omitempty"`
	Addresses       []string `json:"addresses,omitempty"`
	Verified        bool     `json:"verified,omitempty"`
	Code            string   `json:"code,omitempty"`
	Error           string   `json:"error,omitempty"`
}

BackupResultMessage is the result of a signer-managed backup request.

type BackupsListMessage 

type BackupsListMessage struct {
	BaseMessage
	Backups []BackupInfo `json:"backups,omitempty"`
	Code    string       `json:"code,omitempty"`
	Error   string       `json:"error,omitempty"`
}

type BaseMessage 

type BaseMessage struct {
	Kind MessageKind `json:"kind,omitempty"`
	Type string      `json:"type"`
	ID   string      `json:"id"` // Unique request ID for correlation
}

BaseMessage is the base structure for all admin protocol messages.

func ParseAdminBaseMessage 

func ParseAdminBaseMessage(data []byte) (BaseMessage, error)

type BeginBackupImportMessage added in v0.35.0 

type BeginBackupImportMessage struct {
	BaseMessage
	FileName string `json:"file_name"`
}

type BeginBackupImportResultMessage added in v0.35.0 

type BeginBackupImportResultMessage struct {
	BaseMessage
	Success  bool   `json:"success"`
	UploadID string `json:"upload_id,omitempty"`
	Code     string `json:"code,omitempty"`
	Error    string `json:"error,omitempty"`
}

type ChangeStorePassphraseMessage 

type ChangeStorePassphraseMessage struct {
	BaseMessage
	CurrentPassphrase SensitiveBytes `json:"current_passphrase"`
	NewPassphrase     SensitiveBytes `json:"new_passphrase"`
}

type ChangeStorePassphraseResultMessage 

type ChangeStorePassphraseResultMessage struct {
	BaseMessage
	Success                  bool   `json:"success"`
	KeysMigrated             int    `json:"keys_migrated,omitempty"`
	TemplatesMigrated        int    `json:"templates_migrated,omitempty"`
	PolicySidecarsMigrated   int    `json:"policy_sidecars_migrated,omitempty"`
	NodeRoleSidecarsMigrated int    `json:"node_role_sidecars_migrated,omitempty"`
	PriorGenerations         int    `json:"prior_generations,omitempty"`
	HelperWarning            string `json:"helper_warning,omitempty"`
	RootCommitted            bool   `json:"root_committed,omitempty"`
	RotationPending          bool   `json:"rotation_pending,omitempty"`
	Code                     string `json:"code,omitempty"`
	Error                    string `json:"error,omitempty"`
}

type ClientExistsMessage 

type ClientExistsMessage struct {
	BaseMessage
}

ClientExistsMessage is sent by the server to a new client when another apadmin is already connected. The new client should show a confirmation prompt before proceeding.

type CodedError added in v0.24.0 

type CodedError struct {
	Code string
	Err  error
}

CodedError carries a stable IPC error code attached at the error origin. Adapters should classify errors with CodeForError instead of matching message text.

func (*CodedError) Error added in v0.24.0 

func (e *CodedError) Error() string

func (*CodedError) Unwrap added in v0.24.0 

func (e *CodedError) Unwrap() error

type CommitBackupImportMessage added in v0.35.0 

type CommitBackupImportMessage struct {
	BaseMessage
	UploadID         string         `json:"upload_id"`
	FileName         string         `json:"file_name"`
	ExpectedSize     int64          `json:"expected_size"`
	ExpectedSHA256   string         `json:"expected_sha256"`
	ExportPassphrase SensitiveBytes `json:"export_passphrase"`
}

type CommitBackupImportResultMessage added in v0.35.0 

type CommitBackupImportResultMessage struct {
	BaseMessage
	Success bool       `json:"success"`
	Backup  BackupInfo `json:"backup,omitempty"`
	Warning string     `json:"warning,omitempty"`
	Code    string     `json:"code,omitempty"`
	Error   string     `json:"error,omitempty"`
}

type DeactivateKeyTypeMessage 

type DeactivateKeyTypeMessage struct {
	BaseMessage
	KeyType string `json:"key_type"`
}

type DeactivateKeyTypeResultMessage 

type DeactivateKeyTypeResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	KeyType string `json:"key_type,omitempty"`
	Removed bool   `json:"removed,omitempty"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

type DeleteBackupMessage 

type DeleteBackupMessage struct {
	BaseMessage
	ArchivePath string `json:"archive_path"`
}

type DeleteBackupResultMessage 

type DeleteBackupResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

type DeleteKeyMessage 

type DeleteKeyMessage struct {
	BaseMessage
	Address string `json:"address"`
}

DeleteKeyMessage requests deletion of a key

type DeleteResultMessage 

type DeleteResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

DeleteResultMessage contains the result of key deletion

type DisplaceConfirmMessage 

type DisplaceConfirmMessage struct {
	BaseMessage
}

DisplaceConfirmMessage is sent by the new client to confirm displacement of the existing client.

type DisplacedMessage 

type DisplacedMessage struct {
	BaseMessage
	Reason string `json:"reason"`
}

DisplacedMessage is sent by the server to the old client when it is being displaced by a new client.

type ErrorMessage 

type ErrorMessage struct {
	BaseMessage
	Code  string `json:"code,omitempty"`
	Error string `json:"error"`
}

ErrorMessage is sent for error conditions

type ExportKeyMessage 

type ExportKeyMessage struct {
	BaseMessage
	Address    string         `json:"address"`
	Passphrase SensitiveBytes `json:"passphrase"` // Required to verify user identity before export
}

ExportKeyMessage requests export of a key's mnemonic. Current servers deny this request on every admin transport.

type ExportResultMessage 

type ExportResultMessage struct {
	BaseMessage
	Success    bool              `json:"success"`
	Address    string            `json:"address,omitempty"`
	KeyType    string            `json:"key_type,omitempty"` // Full versioned type: "ed25519", "aplane.falcon1024.v1", etc.
	Mnemonic   string            `json:"mnemonic,omitempty"` // Legacy compatibility field; current responses omit it.
	WordCount  int               `json:"word_count,omitempty"`
	Parameters map[string]string `json:"parameters,omitempty"` // Creation parameters needed for address re-derivation
	Code       string            `json:"code,omitempty"`
	Error      string            `json:"error,omitempty"`
}

ExportResultMessage is retained for legacy decode compatibility. Current servers return an error instead of this response.

type ExportSentryPublicMessage added in v0.35.0 

type ExportSentryPublicMessage struct {
	BaseMessage
	WitnessKeyID string `json:"witness_key_id"`
}

type ExportSentryPublicResultMessage added in v0.35.0 

type ExportSentryPublicResultMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	WitnessKeyID string `json:"witness_key_id,omitempty"`
	EnvelopeJSON string `json:"envelope_json,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

type GenerateKeyMessage 

type GenerateKeyMessage struct {
	BaseMessage
	KeyType    string            `json:"key_type"` // Versioned key type: "ed25519", "aplane.falcon1024.v1", "aplane.htlc.v1", etc.
	Name       string            `json:"name,omitempty"`
	Parameters map[string]string `json:"parameters,omitempty"` // Template parameters (for generic lsigs like timed-allowlist)
}

GenerateKeyMessage requests generation of a new key

type GenerateResultMessage 

type GenerateResultMessage struct {
	BaseMessage
	Success    bool              `json:"success"`
	Address    string            `json:"address,omitempty"`
	KeyType    string            `json:"key_type,omitempty"` // Full versioned type: "ed25519", "aplane.falcon1024.v1", etc.
	Mnemonic   string            `json:"mnemonic,omitempty"` // Legacy compatibility field; current responses omit it.
	WordCount  int               `json:"word_count,omitempty"`
	Parameters map[string]string `json:"parameters,omitempty"` // Creation parameters needed for address re-derivation
	Code       string            `json:"code,omitempty"`
	Error      string            `json:"error,omitempty"`
}

GenerateResultMessage contains the result of key generation

type GenerationsListMessage added in v0.35.0 

type GenerationsListMessage struct {
	BaseMessage
	Current                string   `json:"current,omitempty"`
	SealedPriors           []string `json:"sealed_priors"`
	PendingAttempts        []string `json:"pending_attempts"`
	PendingStaging         []string `json:"pending_staging"`
	RetainedUnsealedParent string   `json:"retained_unsealed_parent,omitempty"`
	Code                   string   `json:"code,omitempty"`
	Error                  string   `json:"error,omitempty"`
}

type GetAdminSettingsMessage 

type GetAdminSettingsMessage struct {
	BaseMessage
}

GetAdminSettingsMessage requests the current admin settings from the server.

type GetKeyDetailsMessage 

type GetKeyDetailsMessage struct {
	BaseMessage
	Address string `json:"address"`
}

GetKeyDetailsMessage requests detailed information about a key

type GetPolicySnapshotMessage 

type GetPolicySnapshotMessage struct {
	BaseMessage
	Target string `json:"target,omitempty"`
}

GetPolicySnapshotMessage requests the active read-only policy snapshot from the signer. The response is a signer-owned projection and must not be synthesized from local apadmin files.

type GetSentryReferenceMessage added in v0.35.0 

type GetSentryReferenceMessage struct {
	BaseMessage
	Name string `json:"name"`
}

type ImportInstalledTemplateMessage 

type ImportInstalledTemplateMessage struct {
	BaseMessage
	TemplateYAML SensitiveBytes `json:"template_yaml"`
}

type ImportInstalledTemplateResultMessage 

type ImportInstalledTemplateResultMessage struct {
	BaseMessage
	Success       bool   `json:"success"`
	KeyType       string `json:"key_type,omitempty"`
	TemplateType  string `json:"template_type,omitempty"`
	AlreadyExists bool   `json:"already_exists,omitempty"`
	Code          string `json:"code,omitempty"`
	Error         string `json:"error,omitempty"`
}

type ImportKeyMessage 

type ImportKeyMessage struct {
	BaseMessage
	KeyType    string            `json:"key_type"` // Versioned key type: "ed25519", "aplane.falcon1024.v1", etc.
	Mnemonic   string            `json:"mnemonic"` // The recovery phrase
	Parameters map[string]string `json:"parameters,omitempty"`
}

ImportKeyMessage requests import of a key from mnemonic

type ImportResultMessage 

type ImportResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Address string `json:"address,omitempty"`
	KeyType string `json:"key_type,omitempty"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

ImportResultMessage contains the result of key import

type ImportSentryReferenceMessage added in v0.35.0 

type ImportSentryReferenceMessage struct {
	BaseMessage
	Name         string `json:"name"`
	EnvelopeJSON string `json:"envelope_json"`
}

type ImportSentryReferenceResultMessage added in v0.35.0 

type ImportSentryReferenceResultMessage = SentryReferenceMessage

type InitializeStoreMessage 

type InitializeStoreMessage struct {
	BaseMessage
	Passphrase SensitiveBytes `json:"passphrase"`
}

type InitializeStoreResultMessage 

type InitializeStoreResultMessage struct {
	BaseMessage
	Success       bool   `json:"success"`
	MetadataDir   string `json:"metadata_dir,omitempty"`
	HelperWarning string `json:"helper_warning,omitempty"`
	Code          string `json:"code,omitempty"`
	Error         string `json:"error,omitempty"`
}

type InputModeInfo 

type InputModeInfo struct {
	Name       string `json:"name"`
	Label      string `json:"label,omitempty"`
	Transform  string `json:"transform,omitempty"`
	ByteLength int    `json:"byte_length,omitempty"`
	InputType  string `json:"input_type,omitempty"`
}

type InstallLibraryTemplateMessage 

type InstallLibraryTemplateMessage struct {
	BaseMessage
	KeyType      string `json:"key_type"`
	TemplateType string `json:"template_type"`
}

type InstallLibraryTemplateResultMessage 

type InstallLibraryTemplateResultMessage struct {
	BaseMessage
	Success       bool   `json:"success"`
	KeyType       string `json:"key_type,omitempty"`
	TemplateType  string `json:"template_type,omitempty"`
	AlreadyExists bool   `json:"already_exists,omitempty"`
	Code          string `json:"code,omitempty"`
	Error         string `json:"error,omitempty"`
}

type InstalledTemplateInfo 

type InstalledTemplateInfo struct {
	KeyType      string `json:"key_type"`
	TemplateType string `json:"template_type"`
	Size         int64  `json:"size,omitempty"`
	Enabled      bool   `json:"enabled"`
}

type InstalledTemplatesMessage 

type InstalledTemplatesMessage struct {
	BaseMessage
	Templates []InstalledTemplateInfo `json:"templates"`
	Code      string                  `json:"code,omitempty"`
	Error     string                  `json:"error,omitempty"`
}

type KeyDetailsMessage 

type KeyDetailsMessage struct {
	BaseMessage
	Success                  bool              `json:"success"`
	Address                  string            `json:"address,omitempty"`
	KeyType                  string            `json:"key_type,omitempty"`
	PublicKeyHex             string            `json:"public_key_hex,omitempty"`
	Parameters               map[string]string `json:"parameters,omitempty"`   // For generic LogicSigs: recipients, unlock_round, etc.
	DisplayTEAL              string            `json:"display_teal,omitempty"` // TEAL source for generic LogicSigs (actual compiled source)
	TemplateProvenanceStatus string            `json:"template_provenance_status,omitempty"`
	TemplateProvenanceNote   string            `json:"template_provenance_note,omitempty"`
	Code                     string            `json:"code,omitempty"`
	Error                    string            `json:"error,omitempty"`
}

KeyDetailsMessage contains detailed information about a key

type KeyTypeInfo 

type KeyTypeInfo struct {
	KeyType           string              `json:"key_type"`
	Family            string              `json:"family"`
	DisplayName       string              `json:"display_name"`
	Description       string              `json:"description"`
	AuthorizationKind string              `json:"authorization_kind,omitempty"`
	RequiresLogicSig  bool                `json:"requires_logicsig"`
	MnemonicWordCount int                 `json:"mnemonic_word_count"`
	MnemonicImport    bool                `json:"mnemonic_import"`
	MnemonicScheme    string              `json:"mnemonic_scheme"`
	CreationParams    []TemplateParamInfo `json:"creation_params"`
	RuntimeArgs       []TemplateArgInfo   `json:"runtime_args"`
}

type KeyTypesMessage 

type KeyTypesMessage struct {
	BaseMessage
	KeyTypes []KeyTypeInfo `json:"key_types"`
	Code     string        `json:"code,omitempty"`
	Error    string        `json:"error,omitempty"`
}

type KeysChangedMessage 

type KeysChangedMessage struct {
	BaseMessage
	KeyCount int `json:"key_count"` // Number of keys after reload
}

KeysChangedMessage is sent by the server to notify clients that the key list has changed

type KeysListMessage 

type KeysListMessage struct {
	BaseMessage
	Keys []AdminKeyInfo `json:"keys"`
}

KeysListMessage contains the list of keys from signer

type LibraryTemplateInfo 

type LibraryTemplateInfo struct {
	KeyType      string              `json:"key_type,omitempty"`
	TemplateType string              `json:"template_type,omitempty"`
	DisplayName  string              `json:"display_name,omitempty"`
	Description  string              `json:"description,omitempty"`
	SourcePath   string              `json:"source_path,omitempty"`
	FileName     string              `json:"file_name,omitempty"`
	Parameters   []TemplateParamInfo `json:"parameters,omitempty"`
	RuntimeArgs  []TemplateArgInfo   `json:"runtime_args,omitempty"`
	Installed    bool                `json:"installed"`
	Enabled      bool                `json:"enabled,omitempty"`
	Conflict     string              `json:"conflict,omitempty"`
	Invalid      string              `json:"invalid,omitempty"`
}

TemplateType fields use stable wire values: "generic", "composed", or "compiled_provider". These are projections of internal key type state sources, not on-disk record source literals.

type LibraryTemplatesMessage 

type LibraryTemplatesMessage struct {
	BaseMessage
	Templates []LibraryTemplateInfo `json:"templates"`
	Code      string                `json:"code,omitempty"`
	Error     string                `json:"error,omitempty"`
}

type ListBackupsMessage 

type ListBackupsMessage struct {
	BaseMessage
}

ListBackupsMessage requests managed backup archives for the bound identity.

type ListGenerationsMessage added in v0.35.0 

type ListGenerationsMessage struct{ BaseMessage }

type ListInstalledTemplatesMessage 

type ListInstalledTemplatesMessage struct {
	BaseMessage
}

type ListKeyTypesMessage 

type ListKeyTypesMessage struct {
	BaseMessage
}

type ListKeysMessage 

type ListKeysMessage struct {
	BaseMessage
}

ListKeysMessage requests the list of keys from signer

type ListLibraryTemplatesMessage 

type ListLibraryTemplatesMessage struct {
	BaseMessage
}

type ListSentryReferencesMessage added in v0.35.0 

type ListSentryReferencesMessage struct{ BaseMessage }

type LockIdentityMessage 

type LockIdentityMessage struct {
	BaseMessage
	Reason string `json:"reason,omitempty"`
}

LockIdentityMessage requests an explicit lock of the currently bound identity.

type LockIdentityResultMessage 

type LockIdentityResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

LockIdentityResultMessage is the result of an explicit identity lock request.

type MessageKind 

type MessageKind string
const (
	MessageKindRequest      MessageKind = "request"
	MessageKindResponse     MessageKind = "response"
	MessageKindNotification MessageKind = "notification"
)

func InferMessageKind 

func InferMessageKind(messageType string) (MessageKind, bool)

type PolicySnapshotMessage 

type PolicySnapshotMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	Target       string `json:"target,omitempty"`
	IdentityID   string `json:"identity_id,omitempty"`
	PolicyYAML   string `json:"policy_yaml,omitempty"`
	PolicySHA256 string `json:"policy_sha256,omitempty"`
	Canonical    bool   `json:"canonical,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

PolicySnapshotMessage contains the active signer policy snapshot as canonical YAML suitable for read-only display.

type PolicyViolation 

type PolicyViolation struct {
	Field    string `json:"field"`    // Field name (e.g., "RekeyTo", "CloseRemainderTo")
	Value    string `json:"value"`    // The problematic value
	Severity string `json:"severity"` // "warning" or "critical"
	Message  string `json:"message"`  // Human-readable explanation
}

PolicyViolation represents a dangerous transaction field detected by the policy engine

type PreviewRestoreMessage 

type PreviewRestoreMessage struct {
	BaseMessage
	ArchivePath      string         `json:"archive_path"`
	ExportPassphrase SensitiveBytes `json:"export_passphrase"`
}

type ProtocolVersion added in v0.31.0 

type ProtocolVersion struct {
	Major int `json:"major"`
	Minor int `json:"minor"`
}

ProtocolVersion is the admin IPC/SSH protocol version shape surfaced during the auth hello. Clients must provide a matching major version.

func CurrentAdminProtocolVersion added in v0.31.0 

func CurrentAdminProtocolVersion() ProtocolVersion

type ReadBackupChunkMessage added in v0.35.0 

type ReadBackupChunkMessage struct {
	BaseMessage
	FileName string `json:"file_name"`
	Offset   int64  `json:"offset"`
}

type ReconcileStoreMessage added in v0.35.0 

type ReconcileStoreMessage struct {
	BaseMessage
}

type ReconcileStoreResultMessage added in v0.35.0 

type ReconcileStoreResultMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	GenerationID string `json:"generation_id,omitempty"`
	KeyCount     int    `json:"key_count,omitempty"`
	State        string `json:"state,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

type RemoveInstalledTemplateMessage 

type RemoveInstalledTemplateMessage struct {
	BaseMessage
	KeyType string `json:"key_type"`
}

type RemoveInstalledTemplateResultMessage 

type RemoveInstalledTemplateResultMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	KeyType      string `json:"key_type,omitempty"`
	TemplateType string `json:"template_type,omitempty"`
	Removed      bool   `json:"removed,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

type RemoveSentryReferenceMessage added in v0.35.0 

type RemoveSentryReferenceMessage struct {
	BaseMessage
	Name string `json:"name"`
}

type RemoveSentryReferenceResultMessage added in v0.35.0 

type RemoveSentryReferenceResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Name    string `json:"name,omitempty"`
	Removed bool   `json:"removed,omitempty"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

type ReplacePolicyMessage 

type ReplacePolicyMessage struct {
	BaseMessage
	Target                string `json:"target,omitempty"`
	PolicyYAML            string `json:"policy_yaml"`
	ExpectedCurrentSHA256 string `json:"expected_current_sha256,omitempty"`
}

ReplacePolicyMessage requests wholesale replacement of signer-owned policy YAML. ExpectedCurrentSHA256 is the optional canonical active policy SHA from a prior snapshot and lets clients fail closed when the signer policy changed since the file was previewed.

type ReplacePolicyResultMessage 

type ReplacePolicyResultMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	Target       string `json:"target,omitempty"`
	IdentityID   string `json:"identity_id,omitempty"`
	PolicyYAML   string `json:"policy_yaml,omitempty"`
	PolicySHA256 string `json:"policy_sha256,omitempty"`
	Canonical    bool   `json:"canonical,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

ReplacePolicyResultMessage returns the result of a wholesale policy replacement. On success, PolicyYAML is the resulting canonical active policy YAML, not necessarily the exact uploaded bytes.

type RestoreBackupMessage 

type RestoreBackupMessage struct {
	BaseMessage
	ArchivePath      string         `json:"archive_path"`
	Addresses        []string       `json:"addresses,omitempty"`
	ExportPassphrase SensitiveBytes `json:"export_passphrase"`
	ReplaceExisting  bool           `json:"replace_existing,omitempty"`
}

RestoreBackupMessage validates and commits credentials directly into one generation. Destination policy and configuration are never archive input.

type RestoreBackupResultMessage 

type RestoreBackupResultMessage struct {
	BaseMessage
	Success       bool                `json:"success"`
	OperationID   string              `json:"operation_id,omitempty"`
	ArchiveSHA256 string              `json:"archive_sha256,omitempty"`
	GenerationID  string              `json:"generation_id,omitempty"`
	Restored      []RestoreCredential `json:"restored,omitempty"`
	Identical     []RestoreCredential `json:"identical,omitempty"`
	Conflicts     []RestoreConflict   `json:"conflicts,omitempty"`
	KeyCount      int                 `json:"key_count,omitempty"`
	Code          string              `json:"code,omitempty"`
	Error         string              `json:"error,omitempty"`
}

type RestoreConflict added in v0.35.0 

type RestoreConflict struct {
	Selector       string `json:"selector"`
	Category       string `json:"category"`
	KeyType        string `json:"key_type"`
	ExistingSHA256 string `json:"existing_sha256,omitempty"`
	Reason         string `json:"reason"`
}

type RestoreCredential added in v0.35.0 

type RestoreCredential struct {
	Selector string `json:"selector"`
	Category string `json:"category"`
	KeyType  string `json:"key_type"`
}

type RestoreError 

type RestoreError struct {
	Address string `json:"address,omitempty"`
	Error   string `json:"error"`
}

type RestoreKeyInfo 

type RestoreKeyInfo struct {
	Address       string `json:"address"`
	KeyType       string `json:"key_type,omitempty"`
	AlreadyExists bool   `json:"already_exists,omitempty"`
	Error         string `json:"error,omitempty"`
}

type RestorePreviewMessage 

type RestorePreviewMessage struct {
	BaseMessage
	ArchivePath string           `json:"archive_path,omitempty"`
	Keys        []RestoreKeyInfo `json:"keys,omitempty"`
	Errors      []RestoreError   `json:"errors,omitempty"`
	Code        string           `json:"code,omitempty"`
	Error       string           `json:"error,omitempty"`
}

type RevokeTokenMessage 

type RevokeTokenMessage struct {
	BaseMessage
}

RevokeTokenMessage is sent by apadmin to revoke the current API token

type RevokeTokenResultMessage 

type RevokeTokenResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

RevokeTokenResultMessage is the response to a token revocation request

type RollbackRestoreMessage added in v0.35.0 

type RollbackRestoreMessage struct {
	BaseMessage
}

type RollbackRestoreResultMessage added in v0.35.0 

type RollbackRestoreResultMessage struct {
	BaseMessage
	Success      bool   `json:"success"`
	OperationID  string `json:"operation_id,omitempty"`
	GenerationID string `json:"generation_id,omitempty"`
	KeyCount     int    `json:"key_count,omitempty"`
	Code         string `json:"code,omitempty"`
	Error        string `json:"error,omitempty"`
}

type SensitiveBytes 

type SensitiveBytes []byte

SensitiveBytes carries a JSON string as mutable bytes after unmarshal so handlers can zero passphrase material after use.

Contract: SensitiveBytes carries UTF-8 text only (passphrases, template YAML). MarshalJSON emits the bytes as a JSON string, so non-UTF-8 input would be corrupted to U+FFFD replacement runes on the peer. Binary key material must not use this type; give it a distinct base64-encoded type instead.

func NewSensitiveBytes 

func NewSensitiveBytes(s string) SensitiveBytes

func (SensitiveBytes) Clone 

func (s SensitiveBytes) Clone() []byte

func (SensitiveBytes) GoString 

func (s SensitiveBytes) GoString() string

func (SensitiveBytes) MarshalJSON 

func (s SensitiveBytes) MarshalJSON() ([]byte, error)

func (SensitiveBytes) String 

func (s SensitiveBytes) String() string

func (*SensitiveBytes) UnmarshalJSON 

func (s *SensitiveBytes) UnmarshalJSON(data []byte) error

func (SensitiveBytes) Zero 

func (s SensitiveBytes) Zero()

type SentryReferenceInfo added in v0.35.0 

type SentryReferenceInfo struct {
	Schema            string `json:"schema"`
	Name              string `json:"name"`
	ComponentKey      string `json:"component_key"`
	KeyType           string `json:"key_type"`
	PublicKeyEncoding string `json:"public_key_encoding"`
	PublicKeyHex      string `json:"public_key_hex"`
	PublicKeySize     int    `json:"public_key_size"`
	PublicKeySHA256   string `json:"public_key_sha256"`
	ImportedAt        string `json:"imported_at,omitempty"`
	MigrationOrigin   string `json:"migration_origin,omitempty"`
}

type SentryReferenceMessage added in v0.35.0 

type SentryReferenceMessage struct {
	BaseMessage
	Success   bool                `json:"success"`
	Reference SentryReferenceInfo `json:"reference,omitempty"`
	Code      string              `json:"code,omitempty"`
	Error     string              `json:"error,omitempty"`
}

type SentryReferencesListMessage added in v0.35.0 

type SentryReferencesListMessage struct {
	BaseMessage
	References []SentryReferenceInfo `json:"references"`
	Code       string                `json:"code,omitempty"`
	Error      string                `json:"error,omitempty"`
}

type ShowInstalledTemplateMessage 

type ShowInstalledTemplateMessage struct {
	BaseMessage
	KeyType string `json:"key_type"`
}

type ShowInstalledTemplateResultMessage 

type ShowInstalledTemplateResultMessage struct {
	BaseMessage
	Success      bool           `json:"success"`
	KeyType      string         `json:"key_type,omitempty"`
	TemplateType string         `json:"template_type,omitempty"`
	TemplateYAML SensitiveBytes `json:"template_yaml,omitempty"`
	Code         string         `json:"code,omitempty"`
	Error        string         `json:"error,omitempty"`
}

type ShowLibraryTemplateMessage 

type ShowLibraryTemplateMessage struct {
	BaseMessage
	KeyType      string `json:"key_type"`
	TemplateType string `json:"template_type"`
}

ShowLibraryTemplateMessage requests the plaintext YAML for a library entry. Library YAMLs are unencrypted on disk; no keyring is required.

type ShowLibraryTemplateResultMessage 

type ShowLibraryTemplateResultMessage struct {
	BaseMessage
	Success       bool           `json:"success"`
	KeyType       string         `json:"key_type,omitempty"`
	TemplateType  string         `json:"template_type,omitempty"`
	SourcePath    string         `json:"source_path,omitempty"`
	SourceSHA256  string         `json:"source_sha256,omitempty"`
	SourceModTime int64          `json:"source_mtime,omitempty"`
	TemplateYAML  SensitiveBytes `json:"template_yaml,omitempty"`
	Code          string         `json:"code,omitempty"`
	Error         string         `json:"error,omitempty"`
}

type SignRequestCanceledMessage 

type SignRequestCanceledMessage struct {
	BaseMessage
	Reason string `json:"reason,omitempty"`
}

SignRequestCanceledMessage is sent to apadmin when a pending signing request is no longer actionable, for example because the HTTP requester disconnected or apsigner's approval wait timed out.

type SignRequestMessage 

type SignRequestMessage struct {
	BaseMessage
	Address     string            `json:"address"`              // Auth address (which key to use)
	TxnSender   string            `json:"txn_sender"`           // Actual transaction sender
	Description string            `json:"description"`          // Human-readable transaction description
	Timestamp   int64             `json:"timestamp"`            // Unix timestamp of request
	FirstValid  uint64            `json:"first_valid"`          // First valid round (0 if unknown)
	LastValid   uint64            `json:"last_valid"`           // Last valid round (0 if unknown)
	Violations  []PolicyViolation `json:"violations,omitempty"` // Policy violations detected
}

SignRequestMessage is sent to apadmin for approval

type SignResponseMessage 

type SignResponseMessage struct {
	BaseMessage
	Approved bool   `json:"approved"`
	Reason   string `json:"reason,omitempty"` // Optional rejection reason
}

SignResponseMessage is sent by apadmin with approval/rejection

type SignerLockedMessage 

type SignerLockedMessage struct {
	BaseMessage
	Reason string `json:"reason"` // Why the signer locked.
}

SignerLockedMessage is sent by the server to notify clients that the signer has locked. Client should transition to the unlock screen.

type StatusMessage 

type StatusMessage struct {
	BaseMessage
	State    string `json:"state"`
	KeyCount int    `json:"key_count"`
}

StatusMessage is sent to communicate signer status

type TemplateArgInfo 

type TemplateArgInfo struct {
	Name        string `json:"name"`
	Type        string `json:"type"`
	Label       string `json:"label,omitempty"`
	Description string `json:"description,omitempty"`
	Required    bool   `json:"required,omitempty"`
	ByteLength  int    `json:"byte_length,omitempty"`
	MaxSize     int    `json:"max_size,omitempty"`
}

type TemplateParamInfo 

type TemplateParamInfo struct {
	Name        string          `json:"name"`
	Label       string          `json:"label"`
	Description string          `json:"description,omitempty"`
	Type        string          `json:"type"`
	Required    bool            `json:"required"`
	MaxLength   int             `json:"max_length,omitempty"`
	InputModes  []InputModeInfo `json:"input_modes,omitempty"`
	Options     []string        `json:"options,omitempty"`
	MinItems    int             `json:"min_items,omitempty"`
	MaxItems    int             `json:"max_items,omitempty"`
	Example     string          `json:"example,omitempty"`
	Placeholder string          `json:"placeholder,omitempty"`
	Min         *uint64         `json:"min,omitempty"`
	Max         *uint64         `json:"max,omitempty"`
	Default     string          `json:"default,omitempty"`
}

type TokenProvisioningRequestMessage 

type TokenProvisioningRequestMessage struct {
	BaseMessage
	IdentityID     string `json:"identity_id"`     // Identity requesting token (typically the current product identity)
	SSHFingerprint string `json:"ssh_fingerprint"` // SSH key fingerprint of requester
	RemoteAddr     string `json:"remote_addr"`     // Remote address of requester
	Timestamp      int64  `json:"timestamp"`       // Unix timestamp of request
}

TokenProvisioningRequestMessage is sent to apadmin when a client requests a token via SSH

type TokenProvisioningResponseMessage 

type TokenProvisioningResponseMessage struct {
	BaseMessage
	Approved bool   `json:"approved"`
	Reason   string `json:"reason,omitempty"` // Optional rejection reason
}

TokenProvisioningResponseMessage is sent by apadmin with approval/rejection

type UnlockMessage 

type UnlockMessage struct {
	BaseMessage
	Passphrase SensitiveBytes `json:"passphrase"`
}

UnlockMessage is sent by apadmin to unlock the signer

type UnlockResultMessage 

type UnlockResultMessage struct {
	BaseMessage
	Success  bool   `json:"success"`
	KeyCount int    `json:"key_count,omitempty"`
	Code     string `json:"code,omitempty"`
	Error    string `json:"error,omitempty"`
}

UnlockResultMessage is sent back after an unlock attempt

type UpdateAdminSettingMessage 

type UpdateAdminSettingMessage struct {
	BaseMessage
	Key   string `json:"key"`   // Setting name (e.g. "user_auto_approve")
	Value string `json:"value"` // New value (e.g. "true", "30m")
}

UpdateAdminSettingMessage requests a change to a single admin setting.

type UpdateAdminSettingResultMessage 

type UpdateAdminSettingResultMessage struct {
	BaseMessage
	Success bool   `json:"success"`
	Key     string `json:"key"`
	Value   string `json:"value,omitempty"`
	Code    string `json:"code,omitempty"`
	Error   string `json:"error,omitempty"`
}

UpdateAdminSettingResultMessage is the response to an admin setting change.

type ValidatePolicyMessage added in v0.23.0 

type ValidatePolicyMessage struct {
	BaseMessage
	Target     string `json:"target,omitempty"`
	PolicyYAML string `json:"policy_yaml"`
}

ValidatePolicyMessage requests policy validation without mutating signer-owned files.

type ValidatePolicyResultMessage added in v0.23.0 

type ValidatePolicyResultMessage struct {
	BaseMessage
	Success    bool   `json:"success"`
	Target     string `json:"target,omitempty"`
	IdentityID string `json:"identity_id,omitempty"`
	Code       string `json:"code,omitempty"`
	Error      string `json:"error,omitempty"`
}

ValidatePolicyResultMessage is the response to a validation-only policy request.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.