Add 'access' service to manage user access permissions.

Author: TontonSancho

src/protos/pirogue_admin_api/access.proto

@@ -0,0 +1,96 @@
+syntax = "proto3";
+
+package pirogue.admin.access;
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/wrappers.proto";
+
+/*
+ Manage accesses to this PiRogue.
+ */
+service Access {
+
+  /*
+  Resets and generate a new administration token.
+  Returns the new administration token.
+  */
+  rpc ResetAdministrationToken (google.protobuf.Empty) returns (google.protobuf.StringValue);
+  /*
+  Get the current administration token.
+  Returns the current administration token.
+  */
+  rpc GetAdministrationToken (google.protobuf.Empty) returns (google.protobuf.StringValue);
+  /*
+  Get the current administration certificate.
+  Returns the current administration certificate.
+  */
+  rpc GetAdministrationCertificate (google.protobuf.Empty) returns (google.protobuf.StringValue);
+  /*
+  Get a command line set to execute to configure a new remote client.
+  Returns command line instructions in one string
+  */
+  rpc GetAdministrationCLIs (google.protobuf.Empty) returns (google.protobuf.StringValue);
+
+  /*
+  Create a new user access with a fresh token and a empty access list.
+  Returns the newly created UserAccess.
+  */
+  rpc CreateUserAccess (google.protobuf.Empty) returns (UserAccess);
+  /*
+  Get user access details given its integer ID.
+  Params: the user access integer ID.
+  Returns the request UserAccess if it exists.
+  */
+  rpc GetUserAccess (google.protobuf.Int32Value) returns (UserAccess);
+  /*
+  Get a user access list.
+  Returns the UserAccess list.
+  */
+  rpc ListUserAccesses (google.protobuf.Empty) returns (UserAccessList);
+  /*
+  Delete a user access given its integer ID.
+  Params: the user access integer ID.
+  */
+  rpc DeleteUserAccess (google.protobuf.Int32Value) returns (google.protobuf.Empty);
+  /*
+  Reset the token a specific user access given its integer ID.
+  Returns the UserAccess with its new token.
+  */
+  rpc ResetUserAccessToken (google.protobuf.Int32Value) returns (UserAccess);
+  /*
+  Get a dictionary of all available permissions.
+  Returns the ServiceAccess dictionary.
+  */
+  rpc GetPermissionList (google.protobuf.Empty) returns (ServiceAccess);
+  /*
+  Set a batch of permissions changes for the given user access ID.
+  Changes may be a list of 'set', 'add' or 'remove'.
+  Returns the updated UserAccess.
+  */
+  rpc SetUserAccessPermissions (PermissionChanges) returns (UserAccess);
+}
+
+message MethodAccess {
+  repeated string permission = 1;
+}
+
+message ServiceAccess {
+  map<string, MethodAccess> services = 3;
+}
+
+message UserAccess {
+  int32 idx = 1;
+  string token = 2;
+  ServiceAccess permissions = 3;
+}
+
+message UserAccessList {
+  repeated UserAccess user_accesses = 1;
+}
+
+message PermissionChanges {
+  int32 user_access_idx = 1;
+  optional ServiceAccess sets = 2;
+  optional ServiceAccess adds = 3;
+  optional ServiceAccess removes = 4;
+}

src/protos/pirogue_admin_api/network.proto

@@ -5,24 +5,36 @@ package pirogue.admin.network;
 import "google/protobuf/empty.proto";
 import "google/protobuf/wrappers.proto";
 
+/*
+ Manage network related features on this PiRogue.
+ */
 service Network {
-  /* VPN */
+
+  /*
+  Get a list of active VPN peers.
+  Returns a list of VPNPeer.
+  */
   rpc ListVPNPeers (google.protobuf.Empty) returns (VPNPeerList) {}
+  /*
+  Get details about a given VPN peer ID.
+  Returns the VPNPeer details.
+  */
   rpc GetVPNPeer (google.protobuf.Int32Value) returns (VPNPeer) {}
   rpc GetVPNPeerConfig (google.protobuf.Int32Value) returns (google.protobuf.StringValue) {}
   rpc AddVPNPeer (VPNPeerAddRequest) returns (VPNPeer) {}
   rpc DeleteVPNPeer (google.protobuf.Int32Value) returns (VPNPeer) {}
 
-  /* WiFi */
+  /*
+  Get current WiFi configuration.
+  Returns a WifiConfiguration dictionary.
+  */
   rpc GetWifiConfiguration (google.protobuf.Empty) returns (WifiConfiguration) {}
+  /*
+  Set a new WiFi configuration.
+  Params: the WifiConfiguration dictionary to use as new configuration.
+  */
   rpc SetWifiConfiguration (WifiConfiguration) returns (google.protobuf.Empty) {}
 
-  /* External administration */
-  rpc ResetAdministrationToken (google.protobuf.Empty) returns (google.protobuf.StringValue) {}
-  rpc GetAdministrationToken (google.protobuf.Empty) returns (google.protobuf.StringValue) {}
-  rpc GetAdministrationCertificate (google.protobuf.Empty) returns (google.protobuf.StringValue) {}
-  rpc GetAdministrationCLIs (google.protobuf.Empty) returns (google.protobuf.StringValue) {}
-
   /* External access */
   rpc EnableExternalPublicAccess (PublicAccessRequest) returns (google.protobuf.Empty) {}
   rpc DisableExternalPublicAccess (google.protobuf.Empty) returns (google.protobuf.Empty) {}

src/python/debian/changelog

@@ -1,9 +1,10 @@
-python3-pirogue-admin-api (2.0.2) UNRELEASED; urgency=medium
+python3-pirogue-admin-api (2.0.3) bookworm; urgency=medium
 
   * Improved package info message.
   * More versatile status info message.
+  * Adds access service to manage user tokens
 
- -- Christophe Andral <christophe@andral.fr>  Fri, 02 Dec 2025 08:57:48 +0100
+ -- Christophe Andral <christophe@andral.fr>  Thu, 12 Feb 2026 15:22:51 +0100
 
 python3-pirogue-admin-api (2.0.1) bookworm; urgency=medium
 

src/python/pirogue_admin_api/access_pb2.py

@@ -0,0 +1,55 @@
+from google.protobuf import empty_pb2 as _empty_pb2
+from google.protobuf import wrappers_pb2 as _wrappers_pb2
+from google.protobuf.internal import containers as _containers
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from typing import ClassVar as _ClassVar, Iterable as _Iterable, Mapping as _Mapping, Optional as _Optional, Union as _Union
+
+DESCRIPTOR: _descriptor.FileDescriptor
+
+class MethodAccess(_message.Message):
+    __slots__ = ["permission"]
+    PERMISSION_FIELD_NUMBER: _ClassVar[int]
+    permission: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, permission: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class PermissionChanges(_message.Message):
+    __slots__ = ["adds", "removes", "sets", "user_access_idx"]
+    ADDS_FIELD_NUMBER: _ClassVar[int]
+    REMOVES_FIELD_NUMBER: _ClassVar[int]
+    SETS_FIELD_NUMBER: _ClassVar[int]
+    USER_ACCESS_IDX_FIELD_NUMBER: _ClassVar[int]
+    adds: ServiceAccess
+    removes: ServiceAccess
+    sets: ServiceAccess
+    user_access_idx: int
+    def __init__(self, user_access_idx: _Optional[int] = ..., sets: _Optional[_Union[ServiceAccess, _Mapping]] = ..., adds: _Optional[_Union[ServiceAccess, _Mapping]] = ..., removes: _Optional[_Union[ServiceAccess, _Mapping]] = ...) -> None: ...
+
+class ServiceAccess(_message.Message):
+    __slots__ = ["services"]
+    class ServicesEntry(_message.Message):
+        __slots__ = ["key", "value"]
+        KEY_FIELD_NUMBER: _ClassVar[int]
+        VALUE_FIELD_NUMBER: _ClassVar[int]
+        key: str
+        value: MethodAccess
+        def __init__(self, key: _Optional[str] = ..., value: _Optional[_Union[MethodAccess, _Mapping]] = ...) -> None: ...
+    SERVICES_FIELD_NUMBER: _ClassVar[int]
+    services: _containers.MessageMap[str, MethodAccess]
+    def __init__(self, services: _Optional[_Mapping[str, MethodAccess]] = ...) -> None: ...
+
+class UserAccess(_message.Message):
+    __slots__ = ["idx", "permissions", "token"]
+    IDX_FIELD_NUMBER: _ClassVar[int]
+    PERMISSIONS_FIELD_NUMBER: _ClassVar[int]
+    TOKEN_FIELD_NUMBER: _ClassVar[int]
+    idx: int
+    permissions: ServiceAccess
+    token: str
+    def __init__(self, idx: _Optional[int] = ..., token: _Optional[str] = ..., permissions: _Optional[_Union[ServiceAccess, _Mapping]] = ...) -> None: ...
+
+class UserAccessList(_message.Message):
+    __slots__ = ["user_accesses"]
+    USER_ACCESSES_FIELD_NUMBER: _ClassVar[int]
+    user_accesses: _containers.RepeatedCompositeFieldContainer[UserAccess]
+    def __init__(self, user_accesses: _Optional[_Iterable[_Union[UserAccess, _Mapping]]] = ...) -> None: ...