Feat/setup secret userinfo

proto/agentic_mesh_protocol/module/v1/information.proto

@@ -97,6 +97,23 @@ message GetModuleSecretRequest {
   bool llm_format = 2;
 }
 
+// GetModuleUserInfoRequest
+//
+// Fields:
+//
+// - module_id: Database ID of the Module to get secret schema
+// - llm_format: Define if the secret schema should be in LLM format or raw pydantic format
+message GetModuleUserInfoRequest {
+  // module_id: Database ID of the Module to get secret schema
+  string module_id = 1 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.prefix = "modules:",
+    (buf.validate.field).required = true
+  ];
+  // llm_format: Define if the secret schema should be in LLM format or raw pydantic format
+  bool llm_format = 2;
+}
+
 // GetModuleInputResponse
 //
 // Returns:
@@ -157,6 +174,19 @@ message GetModuleSecretResponse {
   google.protobuf.Struct secret_schema = 2 [(buf.validate.field).required = true];
 }
 
+// GetModuleUserInfoResponse
+//
+// Returns:
+//
+// - success: Flag to indicate if the user info schema request was successful
+// - user_info_schema: User info schema of the Module
+message GetModuleUserInfoResponse {
+  // success: Flag to indicate if the user info schema request was successful
+  bool success = 1;
+  // user_info_schema: User info schema of the Module
+  google.protobuf.Struct user_info_schema = 2 [(buf.validate.field).required = true];
+}
+
 // GetConfigSetupModuleRequest
 //
 // Fields:

proto/agentic_mesh_protocol/module/v1/module_service.proto

@@ -42,6 +42,8 @@ service ModuleService {
   rpc GetModuleSetup(GetModuleSetupRequest) returns (GetModuleSetupResponse);
   // GetModuleSecret
   rpc GetModuleSecret(GetModuleSecretRequest) returns (GetModuleSecretResponse);
+  // GetModuleUserInfo
+  rpc GetModuleUserInfo(GetModuleUserInfoRequest) returns (GetModuleUserInfoResponse);
   // GetConfigSetupModule
   rpc GetConfigSetupModule(GetConfigSetupModuleRequest) returns (GetConfigSetupModuleResponse);
   // ConfigSetupModule

proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto

@@ -72,13 +72,9 @@ message UserProfile {
   // last_name: User last name
   string last_name = 5 [(buf.validate.field).required = true];
   // creation_date: Profile creation date
-  google.protobuf.Timestamp creation_date = 6 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp creation_date = 6 [(buf.validate.field).required = true];
   // update_date: Profile last update date
-  google.protobuf.Timestamp update_date = 7 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp update_date = 7 [(buf.validate.field).required = true];
   // locale: User locale preference
   string locale = 8 [(buf.validate.field).required = true];
   // subscription: User subscription information
@@ -105,3 +101,113 @@ message GetUserProfileResponse {
   // user_profile: Retrieved user profile
   UserProfile user_profile = 2 [(buf.validate.field).required = true];
 }
+
+// GetSetupSecretRequest
+// This request is used to resolve the secret object attached to a setup,
+// for the user resolved from the mission.
+//
+// Fields:
+// - setup_id: The unique identifier of the setup whose secrets are resolved.
+// - mission_id: The mission scope used to resolve the user the secrets belong to.
+message GetSetupSecretRequest {
+  // setup_id: The unique identifier of the setup.
+  string setup_id = 1 [(buf.validate.field).required = true];
+  // mission_id: The mission scope used to resolve the user the secrets belong to.
+  string mission_id = 2 [
+    (buf.validate.field).required = true,
+    (buf.validate.field).string.prefix = "missions:"
+  ];
+}
+
+// GetSetupSecretResponse
+// Returns the resolved secret object, conforming to the secret_schema of the
+// setup's module (see module.v1 ModuleService.GetModuleSecret).
+//
+// Fields:
+// - success: description flag of the operation.
+// - secret: The secret values as a structured object matching the secret_schema.
+message GetSetupSecretResponse {
+  // success: description flag of the operation.
+  bool success = 1;
+  // secret: The secret values as a structured object matching the secret_schema.
+  google.protobuf.Struct secret = 2 [(buf.validate.field).required = true];
+}
+
+// GetSetupUserInfoRequest
+// This request is used to retrieve the user information attached to a setup,
+// for the user resolved from the mission, needed for a kin to run.
+//
+// Fields:
+// - setup_id: The unique identifier of the setup whose user info is resolved.
+// - mission_id: The mission scope used to resolve the user.
+message GetSetupUserInfoRequest {
+  // setup_id: The unique identifier of the setup.
+  string setup_id = 1 [(buf.validate.field).required = true];
+  // mission_id: The mission scope used to resolve the user.
+  string mission_id = 2 [
+    (buf.validate.field).required = true,
+    (buf.validate.field).string.prefix = "missions:"
+  ];
+}
+
+// GetSetupUserInfoResponse
+// Returns the user information associated with the setup owner.
+//
+// Fields:
+// - success: description flag of the operation.
+// - user_info: The user profile information needed for the kin to run.
+message GetSetupUserInfoResponse {
+  // success: description flag of the operation.
+  bool success = 1;
+  // secret: The secret values as a structured object matching the secret_schema.
+  google.protobuf.Struct secret = 2 [(buf.validate.field).required = true];
+}
+
+// ResourceType: Enumerates the kinds of resources whose access can be checked.
+// Enum values can be added over time without breaking existing clients.
+enum ResourceType {
+  // RESOURCE_TYPE_UNSPECIFIED: Default value, must not be used in requests.
+  RESOURCE_TYPE_UNSPECIFIED = 0;
+  // RESOURCE_TYPE_SETUP: A setup resource (setups:).
+  RESOURCE_TYPE_SETUP = 1;
+  // RESOURCE_TYPE_MODULE: A module resource (modules:).
+  RESOURCE_TYPE_MODULE = 2;
+  // RESOURCE_TYPE_MISSION: A mission resource (missions:).
+  RESOURCE_TYPE_MISSION = 3;
+  // RESOURCE_TYPE_STORAGE_RECORD: A storage record resource.
+  RESOURCE_TYPE_STORAGE_RECORD = 4;
+  // RESOURCE_TYPE_FILE: A filesystem file resource.
+  RESOURCE_TYPE_FILE = 5;
+}
+
+// CheckResourceAccessRequest
+// This request is used to check whether the calling task is authorized to
+// access a given resource.
+//
+// The task identifier is NOT carried in this message: it is provided through
+// the gRPC request metadata (e.g. the "task-id" header) and resolved
+// server-side, so authorization context is decoupled from the payload.
+//
+// Fields:
+// - resource_type: The type of the resource whose access is being checked.
+// - resource_id: The unique identifier of the resource whose access is being checked.
+message CheckResourceAccessRequest {
+  // resource_type: The type of the resource whose access is being checked.
+  ResourceType resource_type = 1 [(buf.validate.field).required = true];
+  // resource_id: The unique identifier of the resource whose access is being checked.
+  string resource_id = 2 [(buf.validate.field).required = true];
+}
+
+// CheckResourceAccessResponse
+// Returns whether the calling task is allowed to access the requested resource.
+//
+// A denied access is a normal, expected answer and is reported through the
+// allowed flag with an OK gRPC status. Non-OK statuses are reserved for actual
+// failures (missing task metadata, unknown resource, internal errors).
+//
+// Fields:
+// - allowed: True if the task is authorized to access the resource, false otherwise.
+message CheckResourceAccessResponse {
+  // allowed: True if the task is authorized to access the resource, false otherwise.
+  bool allowed = 1;
+}

proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto

@@ -22,4 +22,15 @@ import "agentic_mesh_protocol/user_profile/v1/user_profile.proto";
 service UserProfileService {
   // GetUserProfile: Get a user profile by user ID
   rpc GetUserProfile(GetUserProfileRequest) returns (GetUserProfileResponse);
+
+  // GetSetupSecret resolves the secret object attached to a setup, conforming to the module's secret_schema.
+  rpc GetSetupSecret(GetSetupSecretRequest) returns (GetSetupSecretResponse);
+
+  // GetSetupUserInfo retrieves the user information attached to a setup, needed for a kin to run.
+  rpc GetSetupUserInfo(GetSetupUserInfoRequest) returns (GetSetupUserInfoResponse);
+
+  // CheckResourceAccess checks whether the calling task (resolved from the request
+  // metadata) is authorized to access the given resource. Access is returned as a
+  // boolean flag with an OK status; non-OK statuses signal failures, not denials.
+  rpc CheckResourceAccess(CheckResourceAccessRequest) returns (CheckResourceAccessResponse);
 }