From 6830777d65404e579b9e834413f498e3aa507887 Mon Sep 17 00:00:00 2001 From: Dmitri Dolguikh Date: Fri, 10 Jul 2026 20:26:54 +0200 Subject: [PATCH] updated comments in management.proto Signed-off-by: Dmitri Dolguikh --- shared/management/proto/management.pb.go | 45 ++++++++++-------------- shared/management/proto/management.proto | 44 ++++++++++------------- 2 files changed, 36 insertions(+), 53 deletions(-) diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go index 749c46f4f..2f1b6f7ef 100644 --- a/shared/management/proto/management.pb.go +++ b/shared/management/proto/management.pb.go @@ -4828,7 +4828,7 @@ type NetworkMapComponentsFull struct { RouterPeerIndexes []uint32 `protobuf:"varint,10,rep,packed,name=router_peer_indexes,json=routerPeerIndexes,proto3" json:"router_peer_indexes,omitempty"` // Policies that affect the receiving peer. Policies []*PolicyCompact `protobuf:"bytes,11,rep,name=policies,proto3" json:"policies,omitempty"` - // Groups in unspecified order — clients key off id (account_seq_id). + // Groups in unspecified order — clients key off id (public_id). Groups []*GroupCompact `protobuf:"bytes,12,rep,name=groups,proto3" json:"groups,omitempty"` // Routes relevant to this peer, raw shape (mirrors []*route.Route). Routes []*RouteRaw `protobuf:"bytes,13,rep,name=routes,proto3" json:"routes,omitempty"` @@ -4842,18 +4842,18 @@ type NetworkMapComponentsFull struct { AccountZones []*CustomZone `protobuf:"bytes,16,rep,name=account_zones,json=accountZones,proto3" json:"account_zones,omitempty"` // Network resources (mirrors []*resourceTypes.NetworkResource). NetworkResources []*NetworkResourceRaw `protobuf:"bytes,17,rep,name=network_resources,json=networkResources,proto3" json:"network_resources,omitempty"` - // Routers per network. Outer key: network account_seq_id. Each entry is + // Routers per network. Outer key: network public_id. Each entry is // the set of routers backing that network for this peer's view. RoutersMap map[string]*NetworkRouterList `protobuf:"bytes,18,rep,name=routers_map,json=routersMap,proto3" json:"routers_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` - // For each NetworkResource account_seq_id, the indexes into policies[] + // For each NetworkResource public_id, the indexes into policies[] // that apply to it. ResourcePoliciesMap map[string]*PolicyIds `protobuf:"bytes,19,rep,name=resource_policies_map,json=resourcePoliciesMap,proto3" json:"resource_policies_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` - // Group-id (account_seq_id) → user ids authorized for SSH on members. + // Group-id (public_id) → user ids authorized for SSH on members. GroupIdToUserIds map[string]*UserIDList `protobuf:"bytes,20,rep,name=group_id_to_user_ids,json=groupIdToUserIds,proto3" json:"group_id_to_user_ids,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` // Account-level allowed user ids (used by Calculate() when assembling SSH // authorized users for the receiving peer). AllowedUserIds []string `protobuf:"bytes,21,rep,name=allowed_user_ids,json=allowedUserIds,proto3" json:"allowed_user_ids,omitempty"` - // Per posture-check account_seq_id, the set of peer indexes that failed + // Per posture-check public_id, the set of peer indexes that failed // the check. Server-side evaluation result; clients do not re-evaluate. PostureFailedPeers map[string]*PeerIndexSet `protobuf:"bytes,22,rep,name=posture_failed_peers,json=postureFailedPeers,proto3" json:"posture_failed_peers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"` // Account-level DNS forwarder port (mirrors the legacy @@ -5542,7 +5542,7 @@ func (x *PeerCompact) GetServerSshAllowed() bool { } // PolicyCompact is the compact form of a policy rule. Group references use -// the per-account integer ids from account_seq_counters; the client resolves +// the public_ids; the client resolves // them against NetworkMapComponentsFull.groups. Direction is derived per-peer // on the client (ingress when the peer is in destination_group_ids, egress // when in source_group_ids; both when bidirectional). @@ -5551,9 +5551,8 @@ type PolicyCompact struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - // Per-account integer id (matches policies.account_seq_id). Used as a - // stable reference for ResourcePoliciesMap.indexes and future delta - // updates. + // public_id. Used as a stable reference for + // ResourcePoliciesMap.indexes and future delta updates. Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` Action RuleAction `protobuf:"varint,2,opt,name=action,proto3,enum=management.RuleAction" json:"action,omitempty"` Protocol RuleProtocol `protobuf:"varint,3,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"` @@ -5562,11 +5561,11 @@ type PolicyCompact struct { Ports []uint32 `protobuf:"varint,5,rep,packed,name=ports,proto3" json:"ports,omitempty"` // Port ranges (start..end) referenced by the rule. PortRanges []*PortInfo_Range `protobuf:"bytes,6,rep,name=port_ranges,json=portRanges,proto3" json:"port_ranges,omitempty"` - // Group ids (account_seq_id) of source / destination groups. + // Group ids (public_ids) of source / destination groups. SourceGroupIds []string `protobuf:"bytes,7,rep,name=source_group_ids,json=sourceGroupIds,proto3" json:"source_group_ids,omitempty"` DestinationGroupIds []string `protobuf:"bytes,8,rep,name=destination_group_ids,json=destinationGroupIds,proto3" json:"destination_group_ids,omitempty"` // SSH authorization fields. PolicyRule.AuthorizedGroups maps the rule's - // applicable group ids (account_seq_id) to a list of local-user names — + // applicable group ids (public_ids) to a list of local-user names — // when a peer in one of those groups is the SSH destination, the named // local users gain access. AuthorizedUser is the single-user form // (legacy: rule scopes SSH to one specific user id). @@ -5584,7 +5583,7 @@ type PolicyCompact struct { // Calculate's resource-typed rule path today. SourceResource *ResourceCompact `protobuf:"bytes,11,opt,name=source_resource,json=sourceResource,proto3" json:"source_resource,omitempty"` DestinationResource *ResourceCompact `protobuf:"bytes,12,opt,name=destination_resource,json=destinationResource,proto3" json:"destination_resource,omitempty"` - // Posture-check seq ids gating this policy's source peers. Calculate() + // Posture-check ids gating this policy's source peers. Calculate() // reads them when filtering rule peers (peers that fail any listed check // are dropped from sourcePeers). Match keys in // NetworkMapComponentsFull.posture_failed_peers. @@ -5831,15 +5830,14 @@ func (x *UserNameList) GetNames() []string { return nil } -// GroupCompact is the wire-shape of a group: per-account integer id, optional +// GroupCompact is the wire-shape of a group: public id, optional // name, and indexes into NetworkMapComponentsFull.peers identifying members. type GroupCompact struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - // Per-account integer id (matches groups.account_seq_id). Used by - // PolicyCompact.source_group_ids / destination_group_ids. + // id comes from PublicID. Used by PolicyCompact.source_group_ids / destination_group_ids. Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` // Group name; only sent when non-empty (clients use it for diagnostics). Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` @@ -5906,7 +5904,7 @@ type DNSSettingsCompact struct { sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - // Group ids (account_seq_id) whose DNS management is disabled. + // Group ids (public_id) whose DNS management is disabled. DisabledManagementGroupIds []string `protobuf:"bytes,1,rep,name=disabled_management_group_ids,json=disabledManagementGroupIds,proto3" json:"disabled_management_group_ids,omitempty"` } @@ -5951,15 +5949,14 @@ func (x *DNSSettingsCompact) GetDisabledManagementGroupIds() []string { // RouteRaw mirrors *route.Route (the domain type), trimmed to fields that // types.NetworkMapComponents.Calculate() reads. Group references are -// account_seq_ids; the routing peer (when set) is referenced by index into +// public_ids; the routing peer (when set) is referenced by index into // NetworkMapComponentsFull.peers. type RouteRaw struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - // Per-account integer id (matches routes.account_seq_id). - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` // public_id NetId string `protobuf:"bytes,2,opt,name=net_id,json=netId,proto3" json:"net_id,omitempty"` Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` // Either network_cidr (e.g. "10.0.0.0/16") or domains is set, not both. @@ -6249,19 +6246,13 @@ func (x *NameServerGroupRaw) GetSearchDomainsEnabled() bool { } // NetworkResourceRaw mirrors *resourceTypes.NetworkResource. -// -// INCOMPATIBLE WIRE CHANGE: field 2 changed from `string network_id` (xid) -// to `uint32 network_seq` without a `reserved` entry. Safe only because -// capability=3 has never been released — every cap=3 producer and consumer -// carries the same regenerated descriptor. Do NOT reuse this pattern once -// cap=3 ships. type NetworkResourceRaw struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache unknownFields protoimpl.UnknownFields - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` // network_resources.account_seq_id - NetworkSeq string `protobuf:"bytes,2,opt,name=network_seq,json=networkSeq,proto3" json:"network_seq,omitempty"` // networks.account_seq_id (replaces xid) + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + NetworkSeq string `protobuf:"bytes,2,opt,name=network_seq,json=networkSeq,proto3" json:"network_seq,omitempty"` Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"` Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"` // Resource type: "host" / "subnet" / "domain". diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto index 2f84a1e49..f89bdffb9 100644 --- a/shared/management/proto/management.proto +++ b/shared/management/proto/management.proto @@ -836,7 +836,7 @@ message NetworkMapComponentsFull { // Policies that affect the receiving peer. repeated PolicyCompact policies = 11; - // Groups in unspecified order — clients key off id (account_seq_id). + // Groups in unspecified order — clients key off id (public_id). repeated GroupCompact groups = 12; // Routes relevant to this peer, raw shape (mirrors []*route.Route). @@ -856,22 +856,22 @@ message NetworkMapComponentsFull { // Network resources (mirrors []*resourceTypes.NetworkResource). repeated NetworkResourceRaw network_resources = 17; - // Routers per network. Outer key: network account_seq_id. Each entry is + // Routers per network. Outer key: network public_id. Each entry is // the set of routers backing that network for this peer's view. map routers_map = 18; - // For each NetworkResource account_seq_id, the indexes into policies[] + // For each NetworkResource public_id, the indexes into policies[] // that apply to it. map resource_policies_map = 19; - // Group-id (account_seq_id) → user ids authorized for SSH on members. + // Group-id (public_id) → user ids authorized for SSH on members. map group_id_to_user_ids = 20; // Account-level allowed user ids (used by Calculate() when assembling SSH // authorized users for the receiving peer). repeated string allowed_user_ids = 21; - // Per posture-check account_seq_id, the set of peer indexes that failed + // Per posture-check public_id, the set of peer indexes that failed // the check. Server-side evaluation result; clients do not re-evaluate. map posture_failed_peers = 22; @@ -1012,14 +1012,13 @@ message PeerCompact { } // PolicyCompact is the compact form of a policy rule. Group references use -// the per-account integer ids from account_seq_counters; the client resolves +// the public_ids; the client resolves // them against NetworkMapComponentsFull.groups. Direction is derived per-peer // on the client (ingress when the peer is in destination_group_ids, egress // when in source_group_ids; both when bidirectional). message PolicyCompact { - // Per-account integer id (matches policies.account_seq_id). Used as a - // stable reference for ResourcePoliciesMap.indexes and future delta - // updates. + // public_id. Used as a stable reference for + // ResourcePoliciesMap.indexes and future delta updates. string id = 1; RuleAction action = 2; @@ -1032,12 +1031,12 @@ message PolicyCompact { // Port ranges (start..end) referenced by the rule. repeated PortInfo.Range port_ranges = 6; - // Group ids (account_seq_id) of source / destination groups. + // Group ids (public_ids) of source / destination groups. repeated string source_group_ids = 7; repeated string destination_group_ids = 8; // SSH authorization fields. PolicyRule.AuthorizedGroups maps the rule's - // applicable group ids (account_seq_id) to a list of local-user names — + // applicable group ids (public_ids) to a list of local-user names — // when a peer in one of those groups is the SSH destination, the named // local users gain access. AuthorizedUser is the single-user form // (legacy: rule scopes SSH to one specific user id). @@ -1057,7 +1056,7 @@ message PolicyCompact { ResourceCompact source_resource = 11; ResourceCompact destination_resource = 12; - // Posture-check seq ids gating this policy's source peers. Calculate() + // Posture-check ids gating this policy's source peers. Calculate() // reads them when filtering rule peers (peers that fail any listed check // are dropped from sourcePeers). Match keys in // NetworkMapComponentsFull.posture_failed_peers. @@ -1082,11 +1081,10 @@ message UserNameList { repeated string names = 1; } -// GroupCompact is the wire-shape of a group: per-account integer id, optional +// GroupCompact is the wire-shape of a group: public id, optional // name, and indexes into NetworkMapComponentsFull.peers identifying members. message GroupCompact { - // Per-account integer id (matches groups.account_seq_id). Used by - // PolicyCompact.source_group_ids / destination_group_ids. + // id comes from PublicID. Used by PolicyCompact.source_group_ids / destination_group_ids. string id = 1; // Group name; only sent when non-empty (clients use it for diagnostics). @@ -1098,17 +1096,16 @@ message GroupCompact { // DNSSettingsCompact mirrors types.DNSSettings. message DNSSettingsCompact { - // Group ids (account_seq_id) whose DNS management is disabled. + // Group ids (public_id) whose DNS management is disabled. repeated string disabled_management_group_ids = 1; } // RouteRaw mirrors *route.Route (the domain type), trimmed to fields that // types.NetworkMapComponents.Calculate() reads. Group references are -// account_seq_ids; the routing peer (when set) is referenced by index into +// public_ids; the routing peer (when set) is referenced by index into // NetworkMapComponentsFull.peers. message RouteRaw { - // Per-account integer id (matches routes.account_seq_id). - string id = 1; + string id = 1; // public_id string net_id = 2; string description = 3; @@ -1159,14 +1156,9 @@ message NameServerGroupRaw { // NetworkResourceRaw mirrors *resourceTypes.NetworkResource. // -// INCOMPATIBLE WIRE CHANGE: field 2 changed from `string network_id` (xid) -// to `uint32 network_seq` without a `reserved` entry. Safe only because -// capability=3 has never been released — every cap=3 producer and consumer -// carries the same regenerated descriptor. Do NOT reuse this pattern once -// cap=3 ships. message NetworkResourceRaw { - string id = 1; // network_resources.account_seq_id - string network_seq = 2; // networks.account_seq_id (replaces xid) + string id = 1; + string network_seq = 2; string name = 3; string description = 4; // Resource type: "host" / "subnet" / "domain".