wocao

gitrpc/gitrpc.proto

@@ -1,5 +1,3 @@
-// Connect (crpc) contract for the gitrpc JSON-RPC server.
-//
 // This is a faithful translation of the hand-written JSON-RPC method set in
 // handlers.go (registerRepoMethods + registerWriteMethods) plus the gitcmd
 // result types those handlers return verbatim. Every rpc below maps 1:1 to a
@@ -86,9 +84,15 @@ service GitService {
 // (the Updater / console is the caller). Unlike GitService these mutate the
 // state DB, not just git.
 service ManageService {
-  // Create a repo (git init --bare). Reuses the namespace's NamespaceID if it
-  // exists, else mints a new one.
-  rpc CreateRepo(CreateRepoRequest) returns (google.protobuf.Empty);
+  // Execute a whitelisted state/ctrl database operation. Arguments are
+  // positional strings interpreted by the selected operation.
+  rpc Ctrl(CtrlRequest) returns (CtrlResponse);
+  // Create an empty namespace. Password login is configured separately.
+  rpc CreateNS(CreateNSRequest) returns (google.protobuf.Empty);
+  // Delete an empty namespace and its namespace-level auth data.
+  rpc DeleteNS(DeleteNSRequest) returns (google.protobuf.Empty);
+  // Create a repo when absent, or update its mutable properties when present.
+  rpc UpsertRepo(UpsertRepoRequest) returns (google.protobuf.Empty);
   // OK if the repo is registered; NotFound otherwise.
   rpc ExistRepo(ExistRepoRequest) returns (google.protobuf.Empty);
   // Remove a repo (DB row + repo-targeted ACL grants + on-disk dir).
@@ -97,6 +101,10 @@ service ManageService {
   rpc MoveRepo(MoveRepoRequest) returns (google.protobuf.Empty);
   // Rename a namespace (all its repos); NamespaceID is stable.
   rpc MoveNS(MoveNSRequest) returns (google.protobuf.Empty);
+  // Create or rotate the password-login projection for a namespace.
+  rpc UserPasswordUpsert(UserPasswordUpsertRequest) returns (google.protobuf.Empty);
+  // Remove a namespace's password-login projection. Repos and namespace remain.
+  rpc UserDelete(UserDeleteRequest) returns (google.protobuf.Empty);
 
   // Grant an SSH key perm on a namespace; registers the key if new. Returns the ACL id.
   rpc ACLUpsertSSHKeyOnNS(ACLUpsertSSHKeyOnNSRequest) returns (ACLIDResponse);
@@ -108,11 +116,11 @@ service ManageService {
   rpc ACLUpsertPATOnRepo(ACLUpsertPATOnRepoRequest) returns (ACLIDResponse);
   // Remove a single ACL grant by id.
   rpc ACLDelete(ACLDeleteRequest) returns (google.protobuf.Empty);
+  // Change a grant's permission without resubmitting its credential.
+  rpc ACLSetPerm(ACLSetPermRequest) returns (google.protobuf.Empty);
 
-  // Daemon status + config: startup params, listen locations, start time /
-  // uptime, and the state DB URI (gitctl uses db_uri to connect directly for
-  // inspection reads -- there is no list RPC on this service). Diagnostics only;
-  // does not touch the DB.
+  // Daemon status + config. Database connection details are intentionally not
+  // exposed; management reads use Ctrl.
   rpc Status(google.protobuf.Empty) returns (StatusResponse);
 }
 
@@ -217,9 +225,23 @@ message MergeRequest {
 
 // ---- ManageService requests ----
 
-message CreateRepoRequest {
+message CreateNSRequest {
+  string ns = 1;
+}
+
+message DeleteNSRequest {
+  string ns = 1;
+}
+
+message UpsertRepoRequest {
   string ns = 1;
   string name = 2;
+  // is_private seeds the repo's privacy flag in simplegit's state DB. simplegit
+  // enforces it at the git-transport layer: a private repo denies read (clone)
+  // to anyone without an ACL grant, so the console's isPrivate must be
+  // propagated here (it can't be enforced console-side - simplegit is the git
+  // kernel that owns the bare repo + its access checks).
+  bool is_private = 3;
 }
 
 message ExistRepoRequest {
@@ -242,6 +264,15 @@ message MoveNSRequest {
   string dst = 2;  // new namespace
 }
 
+message UserPasswordUpsertRequest {
+  string ns = 1;
+  string password = 2;
+}
+
+message UserDeleteRequest {
+  string ns = 1;
+}
+
 message ACLUpsertSSHKeyOnNSRequest {
   string ns = 1;
   string key = 2;   // authorized-keys text
@@ -270,19 +301,21 @@ message ACLDeleteRequest {
   int64 acl_id = 1;
 }
 
+message ACLSetPermRequest {
+  int64 acl_id = 1;
+  string perm = 2;
+}
+
 // ---- ManageService Status (diagnostics) ----
 
-// StatusResponse is the daemon's config + runtime snapshot. db_uri is the state
-// DB connection string (sqlite://<path> or postgres://<dsn>) gitctl connects to
-// directly for inspection reads; it carries credentials when postgres, so the
-// manage port must stay localhost-only/trusted.
+// StatusResponse is the daemon's config + runtime snapshot.
 message StatusResponse {
   string root = 1;                              // -root (git root)
   string rpc_addr = 2;                          // -rpc listen
   string ssh_addr = 3;                          // -ssh listen
   string manage_addr = 4;                       // -manage listen
   string auth_url = 5;                          // -auth RBAC center ("" if skip-auth)
-  string db_uri = 6;                            // -db state DB URI
+  reserved 6;                                   // formerly db_uri
   bool skip_auth = 7;                           // -skip-auth
   google.protobuf.Timestamp started_at = 8;     // daemon start time
   int64 uptime_seconds = 9;                     // seconds since started_at
@@ -295,6 +328,15 @@ message ACLIDResponse {
   int64 acl_id = 1;
 }
 
+message CtrlRequest {
+  string op = 1;
+  repeated string args = 2;
+}
+
+message CtrlResponse {
+  bytes result = 1; // JSON encoded operation result
+}
+
 message ListBranchesResponse {
   repeated Branch branches = 1;
 }