From b72f8c2ee929d92f391fd760be9fc468f0939168 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 14:13:11 +0000 Subject: [PATCH] chore(deps): update vendored OpenAPI specs --- .../policy/attributes/attributes.openapi.yaml | 73 ++++++++++++++++ .../keymanagement/key_management.openapi.yaml | 28 ++++++- specs/policy/unsafe/unsafe.openapi.yaml | 83 ++++++++++++++++++- 3 files changed, 181 insertions(+), 3 deletions(-) diff --git a/specs/policy/attributes/attributes.openapi.yaml b/specs/policy/attributes/attributes.openapi.yaml index 19415e3c..3588e95d 100644 --- a/specs/policy/attributes/attributes.openapi.yaml +++ b/specs/policy/attributes/attributes.openapi.yaml @@ -1880,6 +1880,52 @@ components: - obligationValue - action additionalProperties: false + policy.attributes.AttributeValueSubjectMappingRequest: + type: object + properties: + actions: + type: array + items: + $ref: '#/components/schemas/policy.Action' + title: actions + minItems: 1 + description: |+ + Required. The actions permitted by subjects in this mapping. + Action name or ID must not be empty if provided: + ``` + this.all(item, item.name != '' || item.id != '') + ``` + + existingSubjectConditionSetId: + type: string + title: existing_subject_condition_set_id + format: uuid + description: Reuse an existing SubjectConditionSet. + newSubjectConditionSet: + title: new_subject_condition_set + description: Create a new SubjectConditionSet. + $ref: '#/components/schemas/policy.subjectmapping.SubjectConditionSetCreate' + namespaceId: + type: string + title: namespace_id + format: uuid + namespaceFqn: + type: string + title: namespace_fqn + minLength: 1 + format: uri + metadata: + title: metadata + description: Optional. Common metadata for the subject mapping. + $ref: '#/components/schemas/common.MetadataMutable' + title: AttributeValueSubjectMappingRequest + additionalProperties: false + description: |+ + Exactly one of existing_subject_condition_set_id or new_subject_condition_set must be provided: + ``` + (this.existing_subject_condition_set_id != '') != has(this.new_subject_condition_set) + ``` + policy.attributes.AttributesSort: type: object properties: @@ -1981,6 +2027,15 @@ components: description: |- Optional Existing obligation values to trigger for the newly created attribute value. + subjectMappings: + type: array + items: + $ref: '#/components/schemas/policy.attributes.AttributeValueSubjectMappingRequest' + title: subject_mappings + maxItems: 250 + description: |- + Optional + Subject mappings to associate with the newly created attribute value. metadata: title: metadata description: |- @@ -2632,6 +2687,24 @@ components: description: Required title: ValueKeyAccessServer additionalProperties: false + policy.subjectmapping.SubjectConditionSetCreate: + type: object + properties: + subjectSets: + type: array + items: + $ref: '#/components/schemas/policy.SubjectSet' + title: subject_sets + minItems: 1 + description: Required + metadata: + title: metadata + description: |- + Optional + Common metadata + $ref: '#/components/schemas/common.MetadataMutable' + title: SubjectConditionSetCreate + additionalProperties: false connect-protocol-version: type: number title: Connect-Protocol-Version diff --git a/specs/policy/keymanagement/key_management.openapi.yaml b/specs/policy/keymanagement/key_management.openapi.yaml index 61a3e433..b76124e8 100644 --- a/specs/policy/keymanagement/key_management.openapi.yaml +++ b/specs/policy/keymanagement/key_management.openapi.yaml @@ -480,16 +480,42 @@ components: type: string title: name minLength: 1 + description: DEPRECATED, please use the NameManager and specify manager + name together. + deprecated: true title: name required: - name + - properties: + nameManager: + title: name_manager + description: Search by name and manager. + $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigRequest.NameManager' + title: name_manager + required: + - nameManager properties: manager: type: string title: manager - description: Optional - filter by manager type when searching by name + description: DEPRECATED, please use the NameManager and specify manager + name together. + deprecated: true title: GetProviderConfigRequest additionalProperties: false + policy.keymanagement.GetProviderConfigRequest.NameManager: + type: object + properties: + name: + type: string + title: name + minLength: 1 + description: The name of the key provider + manager: + type: string + title: manager + minLength: 1 + description: The type of key manager. + title: NameManager + additionalProperties: false policy.keymanagement.GetProviderConfigResponse: type: object properties: diff --git a/specs/policy/unsafe/unsafe.openapi.yaml b/specs/policy/unsafe/unsafe.openapi.yaml index 0fd9822b..383144f9 100644 --- a/specs/policy/unsafe/unsafe.openapi.yaml +++ b/specs/policy/unsafe/unsafe.openapi.yaml @@ -329,15 +329,50 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueResponse' - /policy.unsafe.UnsafeService/UnsafeDeleteKasKey: + /policy.unsafe.UnsafeService/UnsafeUpdateKey: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeDeleteKasKey + summary: UnsafeUpdateKey description: |- --------------------------------------* Kas Key RPCs --------------------------------------- + operationId: policy.unsafe.UnsafeService.UnsafeUpdateKey + parameters: + - name: Connect-Protocol-Version + in: header + required: true + schema: + $ref: '#/components/schemas/connect-protocol-version' + - name: Connect-Timeout-Ms + in: header + schema: + $ref: '#/components/schemas/connect-timeout-header' + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateKeyRequest' + required: true + responses: + default: + description: Error + content: + application/json: + schema: + $ref: '#/components/schemas/connect.error' + "200": + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateKeyResponse' + /policy.unsafe.UnsafeService/UnsafeDeleteKasKey: + post: + tags: + - policy.unsafe.UnsafeService + summary: UnsafeDeleteKasKey operationId: policy.unsafe.UnsafeService.UnsafeDeleteKasKey parameters: - name: Connect-Protocol-Version @@ -1617,6 +1652,50 @@ components: $ref: '#/components/schemas/policy.Value' title: UnsafeUpdateAttributeValueResponse additionalProperties: false + policy.unsafe.UnsafeUpdateKeyRequest: + type: object + properties: + id: + type: string + title: id + format: uuid + description: |- + Required + UUID of the Key + targetKeyMode: + title: target_key_mode + enum: + - 0 + - 3 + - 4 + description: |- + Optional + Target key mode. Only KEY_MODE_REMOTE and KEY_MODE_PUBLIC_KEY_ONLY mode changes are supported. + KEY_MODE_UNSPECIFIED with provider_config_id updates only the provider configuration for an existing REMOTE key. + $ref: '#/components/schemas/policy.KeyMode' + providerConfigId: + type: string + title: provider_config_id + format: uuid + description: |- + Conditionally Required + Configuration ID for the key provider. Required for KEY_MODE_REMOTE and KEY_MODE_UNSPECIFIED; empty for KEY_MODE_PUBLIC_KEY_ONLY. + title: UnsafeUpdateKeyRequest + additionalProperties: false + description: |- + WARNING!! + Updating a key in place can retroactively alter decryptability for existing TDFs. + This support-only operation is limited to switching between REMOTE and PUBLIC_KEY_ONLY + key modes, or updating the provider configuration for an existing REMOTE key, while + preserving the existing KID, KAS URI, and public key. + policy.unsafe.UnsafeUpdateKeyResponse: + type: object + properties: + key: + title: key + $ref: '#/components/schemas/policy.KasKey' + title: UnsafeUpdateKeyResponse + additionalProperties: false policy.unsafe.UnsafeUpdateNamespaceRequest: type: object properties: