diff --git a/proto/agentic_mesh_protocol/module/v1/information.proto b/proto/agentic_mesh_protocol/module/v1/information.proto index 3ad802d..b20f0b2 100644 --- a/proto/agentic_mesh_protocol/module/v1/information.proto +++ b/proto/agentic_mesh_protocol/module/v1/information.proto @@ -97,6 +97,23 @@ message GetModuleSecretRequest { bool llm_format = 2; } +// GetModuleUserInfoRequest +// +// Fields: +// +// - module_id: Database ID of the Module to get secret schema +// - llm_format: Define if the secret schema should be in LLM format or raw pydantic format +message GetModuleUserInfoRequest { + // module_id: Database ID of the Module to get secret schema + string module_id = 1 [ + (buf.validate.field).string.min_len = 1, + (buf.validate.field).string.prefix = "modules:", + (buf.validate.field).required = true + ]; + // llm_format: Define if the secret schema should be in LLM format or raw pydantic format + bool llm_format = 2; +} + // GetModuleInputResponse // // Returns: @@ -157,6 +174,19 @@ message GetModuleSecretResponse { google.protobuf.Struct secret_schema = 2 [(buf.validate.field).required = true]; } +// GetModuleUserInfoResponse +// +// Returns: +// +// - success: Flag to indicate if the user info schema request was successful +// - user_info_schema: User info schema of the Module +message GetModuleUserInfoResponse { + // success: Flag to indicate if the user info schema request was successful + bool success = 1; + // user_info_schema: User info schema of the Module + google.protobuf.Struct user_info_schema = 2 [(buf.validate.field).required = true]; +} + // GetConfigSetupModuleRequest // // Fields: diff --git a/proto/agentic_mesh_protocol/module/v1/module_service.proto b/proto/agentic_mesh_protocol/module/v1/module_service.proto index 72e6b9d..7ab7a7c 100644 --- a/proto/agentic_mesh_protocol/module/v1/module_service.proto +++ b/proto/agentic_mesh_protocol/module/v1/module_service.proto @@ -42,6 +42,8 @@ service ModuleService { rpc GetModuleSetup(GetModuleSetupRequest) returns (GetModuleSetupResponse); // GetModuleSecret rpc GetModuleSecret(GetModuleSecretRequest) returns (GetModuleSecretResponse); + // GetModuleUserInfo + rpc GetModuleUserInfo(GetModuleUserInfoRequest) returns (GetModuleUserInfoResponse); // GetConfigSetupModule rpc GetConfigSetupModule(GetConfigSetupModuleRequest) returns (GetConfigSetupModuleResponse); // ConfigSetupModule diff --git a/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto b/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto index ba30c71..7ff392a 100644 --- a/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto +++ b/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto @@ -72,13 +72,9 @@ message UserProfile { // last_name: User last name string last_name = 5 [(buf.validate.field).required = true]; // creation_date: Profile creation date - google.protobuf.Timestamp creation_date = 6 [ - (buf.validate.field).required = true - ]; + google.protobuf.Timestamp creation_date = 6 [(buf.validate.field).required = true]; // update_date: Profile last update date - google.protobuf.Timestamp update_date = 7 [ - (buf.validate.field).required = true - ]; + google.protobuf.Timestamp update_date = 7 [(buf.validate.field).required = true]; // locale: User locale preference string locale = 8 [(buf.validate.field).required = true]; // subscription: User subscription information @@ -105,3 +101,113 @@ message GetUserProfileResponse { // user_profile: Retrieved user profile UserProfile user_profile = 2 [(buf.validate.field).required = true]; } + +// GetSetupSecretRequest +// This request is used to resolve the secret object attached to a setup, +// for the user resolved from the mission. +// +// Fields: +// - setup_id: The unique identifier of the setup whose secrets are resolved. +// - mission_id: The mission scope used to resolve the user the secrets belong to. +message GetSetupSecretRequest { + // setup_id: The unique identifier of the setup. + string setup_id = 1 [(buf.validate.field).required = true]; + // mission_id: The mission scope used to resolve the user the secrets belong to. + string mission_id = 2 [ + (buf.validate.field).required = true, + (buf.validate.field).string.prefix = "missions:" + ]; +} + +// GetSetupSecretResponse +// Returns the resolved secret object, conforming to the secret_schema of the +// setup's module (see module.v1 ModuleService.GetModuleSecret). +// +// Fields: +// - success: description flag of the operation. +// - secret: The secret values as a structured object matching the secret_schema. +message GetSetupSecretResponse { + // success: description flag of the operation. + bool success = 1; + // secret: The secret values as a structured object matching the secret_schema. + google.protobuf.Struct secret = 2 [(buf.validate.field).required = true]; +} + +// GetSetupUserInfoRequest +// This request is used to retrieve the user information attached to a setup, +// for the user resolved from the mission, needed for a kin to run. +// +// Fields: +// - setup_id: The unique identifier of the setup whose user info is resolved. +// - mission_id: The mission scope used to resolve the user. +message GetSetupUserInfoRequest { + // setup_id: The unique identifier of the setup. + string setup_id = 1 [(buf.validate.field).required = true]; + // mission_id: The mission scope used to resolve the user. + string mission_id = 2 [ + (buf.validate.field).required = true, + (buf.validate.field).string.prefix = "missions:" + ]; +} + +// GetSetupUserInfoResponse +// Returns the user information associated with the setup owner. +// +// Fields: +// - success: description flag of the operation. +// - user_info: The user profile information needed for the kin to run. +message GetSetupUserInfoResponse { + // success: description flag of the operation. + bool success = 1; + // secret: The secret values as a structured object matching the secret_schema. + google.protobuf.Struct secret = 2 [(buf.validate.field).required = true]; +} + +// ResourceType: Enumerates the kinds of resources whose access can be checked. +// Enum values can be added over time without breaking existing clients. +enum ResourceType { + // RESOURCE_TYPE_UNSPECIFIED: Default value, must not be used in requests. + RESOURCE_TYPE_UNSPECIFIED = 0; + // RESOURCE_TYPE_SETUP: A setup resource (setups:). + RESOURCE_TYPE_SETUP = 1; + // RESOURCE_TYPE_MODULE: A module resource (modules:). + RESOURCE_TYPE_MODULE = 2; + // RESOURCE_TYPE_MISSION: A mission resource (missions:). + RESOURCE_TYPE_MISSION = 3; + // RESOURCE_TYPE_STORAGE_RECORD: A storage record resource. + RESOURCE_TYPE_STORAGE_RECORD = 4; + // RESOURCE_TYPE_FILE: A filesystem file resource. + RESOURCE_TYPE_FILE = 5; +} + +// CheckResourceAccessRequest +// This request is used to check whether the calling task is authorized to +// access a given resource. +// +// The task identifier is NOT carried in this message: it is provided through +// the gRPC request metadata (e.g. the "task-id" header) and resolved +// server-side, so authorization context is decoupled from the payload. +// +// Fields: +// - resource_type: The type of the resource whose access is being checked. +// - resource_id: The unique identifier of the resource whose access is being checked. +message CheckResourceAccessRequest { + // resource_type: The type of the resource whose access is being checked. + ResourceType resource_type = 1 [(buf.validate.field).required = true]; + // resource_id: The unique identifier of the resource whose access is being checked. + string resource_id = 2 [(buf.validate.field).required = true]; +} + +// CheckResourceAccessResponse +// Returns whether the calling task is allowed to access the requested resource. +// +// A denied access is a normal, expected answer and is reported through the +// allowed flag with an OK gRPC status. Non-OK statuses are reserved for actual +// failures (missing task metadata, unknown resource, internal errors). +// +// Fields: +// - allowed: True if the task is authorized to access the resource, false otherwise. +message CheckResourceAccessResponse { + // allowed: True if the task is authorized to access the resource, false otherwise. + bool allowed = 1; +} diff --git a/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto b/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto index a08ade9..ad0850f 100644 --- a/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto +++ b/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto @@ -22,4 +22,15 @@ import "agentic_mesh_protocol/user_profile/v1/user_profile.proto"; service UserProfileService { // GetUserProfile: Get a user profile by user ID rpc GetUserProfile(GetUserProfileRequest) returns (GetUserProfileResponse); + + // GetSetupSecret resolves the secret object attached to a setup, conforming to the module's secret_schema. + rpc GetSetupSecret(GetSetupSecretRequest) returns (GetSetupSecretResponse); + + // GetSetupUserInfo retrieves the user information attached to a setup, needed for a kin to run. + rpc GetSetupUserInfo(GetSetupUserInfoRequest) returns (GetSetupUserInfoResponse); + + // CheckResourceAccess checks whether the calling task (resolved from the request + // metadata) is authorized to access the given resource. Access is returned as a + // boolean flag with an OK status; non-OK statuses signal failures, not denials. + rpc CheckResourceAccess(CheckResourceAccessRequest) returns (CheckResourceAccessResponse); }