// SecretsService -- TARS KMS-fronted signing surface.
//
// Milestone A only needs Sign / Verify for the session JWT (purpose
// JWKS_SIGNING). PutSecret / GetSecret / RotateResourceDek / EraseSecret
// and the KEK-rotation RPCs (RotatePurposeKek / RotateMasterKek) land
// alongside this proto for shape parity with IA, but only Sign and
// Verify are required for `ia login` end-to-end. The day-one shortcut
// is a static EC P-256 key configured via env, replacing the multi-tier
// envelope flow until milestone C.
//
// All RPCs here are internal-only -- services consume secrets-svc over
// the mTLS-protected internal subdomain, not the public facade.
//
// Plan reference: A2 in check-ia-and-plan-optimized-cook.md.

// Code generated by protoc-gen-connect-go. DO NOT EDIT.
//
// Source: tars/kms/v1/secrets_svc.proto

package kmsv1connect

import (
	connect "connectrpc.com/connect"
	context "context"
	errors "errors"
	v1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/kms/v1"
	http "net/http"
	strings "strings"
)

// This is a compile-time assertion to ensure that this generated file and the connect package are
// compatible. If you get a compiler error that this constant is not defined, this code was
// generated with a version of connect newer than the one compiled into your binary. You can fix the
// problem by either regenerating this code with an older version of connect or updating the connect
// version compiled into your binary.
const _ = connect.IsAtLeastVersion1_13_0

const (
	// SecretsServiceName is the fully-qualified name of the SecretsService service.
	SecretsServiceName = "tars.kms.v1.SecretsService"
)

// These constants are the fully-qualified names of the RPCs defined in this package. They're
// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
//
// Note that these are different from the fully-qualified method names used by
// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
// period.
const (
	// SecretsServicePutSecretProcedure is the fully-qualified name of the SecretsService's PutSecret
	// RPC.
	SecretsServicePutSecretProcedure = "/tars.kms.v1.SecretsService/PutSecret"
	// SecretsServiceGetSecretProcedure is the fully-qualified name of the SecretsService's GetSecret
	// RPC.
	SecretsServiceGetSecretProcedure = "/tars.kms.v1.SecretsService/GetSecret"
	// SecretsServiceRotateResourceDekProcedure is the fully-qualified name of the SecretsService's
	// RotateResourceDek RPC.
	SecretsServiceRotateResourceDekProcedure = "/tars.kms.v1.SecretsService/RotateResourceDek"
	// SecretsServiceEraseSecretProcedure is the fully-qualified name of the SecretsService's
	// EraseSecret RPC.
	SecretsServiceEraseSecretProcedure = "/tars.kms.v1.SecretsService/EraseSecret"
	// SecretsServiceRotatePurposeKekProcedure is the fully-qualified name of the SecretsService's
	// RotatePurposeKek RPC.
	SecretsServiceRotatePurposeKekProcedure = "/tars.kms.v1.SecretsService/RotatePurposeKek"
	// SecretsServiceRotateMasterKekProcedure is the fully-qualified name of the SecretsService's
	// RotateMasterKek RPC.
	SecretsServiceRotateMasterKekProcedure = "/tars.kms.v1.SecretsService/RotateMasterKek"
	// SecretsServiceSignProcedure is the fully-qualified name of the SecretsService's Sign RPC.
	SecretsServiceSignProcedure = "/tars.kms.v1.SecretsService/Sign"
	// SecretsServiceVerifyProcedure is the fully-qualified name of the SecretsService's Verify RPC.
	SecretsServiceVerifyProcedure = "/tars.kms.v1.SecretsService/Verify"
)

// SecretsServiceClient is a client for the tars.kms.v1.SecretsService service.
type SecretsServiceClient interface {
	// PutSecret stores a caller-supplied secret encrypted with a fresh
	// resource-DEK wrapped by the requested purpose-KEK.
	PutSecret(context.Context, *connect.Request[v1.PutSecretRequest]) (*connect.Response[v1.PutSecretResponse], error)
	// GetSecret returns the plaintext for a stored secret. The requesting
	// identity is captured on every call and forms the audit trail.
	GetSecret(context.Context, *connect.Request[v1.GetSecretRequest]) (*connect.Response[v1.GetSecretResponse], error)
	// RotateResourceDek re-wraps a stored secret with a fresh DEK under
	// the active purpose-KEK version. Idempotent. Synchronous today; a
	// future milestone may move this to operations.v1 for a staged
	// long-running-operation surface.
	RotateResourceDek(context.Context, *connect.Request[v1.RotateResourceDekRequest]) (*connect.Response[v1.RotateResourceDekResponse], error)
	// EraseSecret deletes the wrapped DEK and ciphertext.
	EraseSecret(context.Context, *connect.Request[v1.EraseSecretRequest]) (*connect.Response[v1.EraseSecretResponse], error)
	// RotatePurposeKek mints a new active version for a purpose-KEK and
	// re-wraps every row of that purpose under the new active version.
	// Synchronous today; a future milestone may move this to operations.v1
	// for a staged long-running-operation surface.
	RotatePurposeKek(context.Context, *connect.Request[v1.RotatePurposeKekRequest]) (*connect.Response[v1.RotatePurposeKekResponse], error)
	// RotateMasterKek rotates the operator's master KEK and re-wraps every
	// purpose-KEK under the new master. Synchronous today; a future
	// milestone may move this to operations.v1 for a staged
	// long-running-operation surface.
	RotateMasterKek(context.Context, *connect.Request[v1.RotateMasterKekRequest]) (*connect.Response[v1.RotateMasterKekResponse], error)
	// Sign produces a signature over the supplied payload using the
	// active purpose-KEK. Used by identity-svc for session JWT signing.
	// This is the milestone-A entrypoint.
	Sign(context.Context, *connect.Request[v1.SignRequest]) (*connect.Response[v1.SignResponse], error)
	// Verify checks a signature against the active or any prior version
	// of the purpose-KEK. Used by the auth middleware to verify session
	// JWTs presented on inbound requests.
	Verify(context.Context, *connect.Request[v1.VerifyRequest]) (*connect.Response[v1.VerifyResponse], error)
}

// NewSecretsServiceClient constructs a client for the tars.kms.v1.SecretsService service. By
// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
// connect.WithGRPC() or connect.WithGRPCWeb() options.
//
// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
// http://api.acme.com or https://acme.com/grpc).
func NewSecretsServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SecretsServiceClient {
	baseURL = strings.TrimRight(baseURL, "/")
	secretsServiceMethods := v1.File_tars_kms_v1_secrets_svc_proto.Services().ByName("SecretsService").Methods()
	return &secretsServiceClient{
		putSecret: connect.NewClient[v1.PutSecretRequest, v1.PutSecretResponse](
			httpClient,
			baseURL+SecretsServicePutSecretProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("PutSecret")),
			connect.WithClientOptions(opts...),
		),
		getSecret: connect.NewClient[v1.GetSecretRequest, v1.GetSecretResponse](
			httpClient,
			baseURL+SecretsServiceGetSecretProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("GetSecret")),
			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
			connect.WithClientOptions(opts...),
		),
		rotateResourceDek: connect.NewClient[v1.RotateResourceDekRequest, v1.RotateResourceDekResponse](
			httpClient,
			baseURL+SecretsServiceRotateResourceDekProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("RotateResourceDek")),
			connect.WithClientOptions(opts...),
		),
		eraseSecret: connect.NewClient[v1.EraseSecretRequest, v1.EraseSecretResponse](
			httpClient,
			baseURL+SecretsServiceEraseSecretProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("EraseSecret")),
			connect.WithClientOptions(opts...),
		),
		rotatePurposeKek: connect.NewClient[v1.RotatePurposeKekRequest, v1.RotatePurposeKekResponse](
			httpClient,
			baseURL+SecretsServiceRotatePurposeKekProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("RotatePurposeKek")),
			connect.WithClientOptions(opts...),
		),
		rotateMasterKek: connect.NewClient[v1.RotateMasterKekRequest, v1.RotateMasterKekResponse](
			httpClient,
			baseURL+SecretsServiceRotateMasterKekProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("RotateMasterKek")),
			connect.WithClientOptions(opts...),
		),
		sign: connect.NewClient[v1.SignRequest, v1.SignResponse](
			httpClient,
			baseURL+SecretsServiceSignProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("Sign")),
			connect.WithClientOptions(opts...),
		),
		verify: connect.NewClient[v1.VerifyRequest, v1.VerifyResponse](
			httpClient,
			baseURL+SecretsServiceVerifyProcedure,
			connect.WithSchema(secretsServiceMethods.ByName("Verify")),
			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
			connect.WithClientOptions(opts...),
		),
	}
}

// secretsServiceClient implements SecretsServiceClient.
type secretsServiceClient struct {
	putSecret         *connect.Client[v1.PutSecretRequest, v1.PutSecretResponse]
	getSecret         *connect.Client[v1.GetSecretRequest, v1.GetSecretResponse]
	rotateResourceDek *connect.Client[v1.RotateResourceDekRequest, v1.RotateResourceDekResponse]
	eraseSecret       *connect.Client[v1.EraseSecretRequest, v1.EraseSecretResponse]
	rotatePurposeKek  *connect.Client[v1.RotatePurposeKekRequest, v1.RotatePurposeKekResponse]
	rotateMasterKek   *connect.Client[v1.RotateMasterKekRequest, v1.RotateMasterKekResponse]
	sign              *connect.Client[v1.SignRequest, v1.SignResponse]
	verify            *connect.Client[v1.VerifyRequest, v1.VerifyResponse]
}

// PutSecret calls tars.kms.v1.SecretsService.PutSecret.
func (c *secretsServiceClient) PutSecret(ctx context.Context, req *connect.Request[v1.PutSecretRequest]) (*connect.Response[v1.PutSecretResponse], error) {
	return c.putSecret.CallUnary(ctx, req)
}

// GetSecret calls tars.kms.v1.SecretsService.GetSecret.
func (c *secretsServiceClient) GetSecret(ctx context.Context, req *connect.Request[v1.GetSecretRequest]) (*connect.Response[v1.GetSecretResponse], error) {
	return c.getSecret.CallUnary(ctx, req)
}

// RotateResourceDek calls tars.kms.v1.SecretsService.RotateResourceDek.
func (c *secretsServiceClient) RotateResourceDek(ctx context.Context, req *connect.Request[v1.RotateResourceDekRequest]) (*connect.Response[v1.RotateResourceDekResponse], error) {
	return c.rotateResourceDek.CallUnary(ctx, req)
}

// EraseSecret calls tars.kms.v1.SecretsService.EraseSecret.
func (c *secretsServiceClient) EraseSecret(ctx context.Context, req *connect.Request[v1.EraseSecretRequest]) (*connect.Response[v1.EraseSecretResponse], error) {
	return c.eraseSecret.CallUnary(ctx, req)
}

// RotatePurposeKek calls tars.kms.v1.SecretsService.RotatePurposeKek.
func (c *secretsServiceClient) RotatePurposeKek(ctx context.Context, req *connect.Request[v1.RotatePurposeKekRequest]) (*connect.Response[v1.RotatePurposeKekResponse], error) {
	return c.rotatePurposeKek.CallUnary(ctx, req)
}

// RotateMasterKek calls tars.kms.v1.SecretsService.RotateMasterKek.
func (c *secretsServiceClient) RotateMasterKek(ctx context.Context, req *connect.Request[v1.RotateMasterKekRequest]) (*connect.Response[v1.RotateMasterKekResponse], error) {
	return c.rotateMasterKek.CallUnary(ctx, req)
}

// Sign calls tars.kms.v1.SecretsService.Sign.
func (c *secretsServiceClient) Sign(ctx context.Context, req *connect.Request[v1.SignRequest]) (*connect.Response[v1.SignResponse], error) {
	return c.sign.CallUnary(ctx, req)
}

// Verify calls tars.kms.v1.SecretsService.Verify.
func (c *secretsServiceClient) Verify(ctx context.Context, req *connect.Request[v1.VerifyRequest]) (*connect.Response[v1.VerifyResponse], error) {
	return c.verify.CallUnary(ctx, req)
}

// SecretsServiceHandler is an implementation of the tars.kms.v1.SecretsService service.
type SecretsServiceHandler interface {
	// PutSecret stores a caller-supplied secret encrypted with a fresh
	// resource-DEK wrapped by the requested purpose-KEK.
	PutSecret(context.Context, *connect.Request[v1.PutSecretRequest]) (*connect.Response[v1.PutSecretResponse], error)
	// GetSecret returns the plaintext for a stored secret. The requesting
	// identity is captured on every call and forms the audit trail.
	GetSecret(context.Context, *connect.Request[v1.GetSecretRequest]) (*connect.Response[v1.GetSecretResponse], error)
	// RotateResourceDek re-wraps a stored secret with a fresh DEK under
	// the active purpose-KEK version. Idempotent. Synchronous today; a
	// future milestone may move this to operations.v1 for a staged
	// long-running-operation surface.
	RotateResourceDek(context.Context, *connect.Request[v1.RotateResourceDekRequest]) (*connect.Response[v1.RotateResourceDekResponse], error)
	// EraseSecret deletes the wrapped DEK and ciphertext.
	EraseSecret(context.Context, *connect.Request[v1.EraseSecretRequest]) (*connect.Response[v1.EraseSecretResponse], error)
	// RotatePurposeKek mints a new active version for a purpose-KEK and
	// re-wraps every row of that purpose under the new active version.
	// Synchronous today; a future milestone may move this to operations.v1
	// for a staged long-running-operation surface.
	RotatePurposeKek(context.Context, *connect.Request[v1.RotatePurposeKekRequest]) (*connect.Response[v1.RotatePurposeKekResponse], error)
	// RotateMasterKek rotates the operator's master KEK and re-wraps every
	// purpose-KEK under the new master. Synchronous today; a future
	// milestone may move this to operations.v1 for a staged
	// long-running-operation surface.
	RotateMasterKek(context.Context, *connect.Request[v1.RotateMasterKekRequest]) (*connect.Response[v1.RotateMasterKekResponse], error)
	// Sign produces a signature over the supplied payload using the
	// active purpose-KEK. Used by identity-svc for session JWT signing.
	// This is the milestone-A entrypoint.
	Sign(context.Context, *connect.Request[v1.SignRequest]) (*connect.Response[v1.SignResponse], error)
	// Verify checks a signature against the active or any prior version
	// of the purpose-KEK. Used by the auth middleware to verify session
	// JWTs presented on inbound requests.
	Verify(context.Context, *connect.Request[v1.VerifyRequest]) (*connect.Response[v1.VerifyResponse], error)
}

// NewSecretsServiceHandler builds an HTTP handler from the service implementation. It returns the
// path on which to mount the handler and the handler itself.
//
// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
// and JSON codecs. They also support gzip compression.
func NewSecretsServiceHandler(svc SecretsServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	secretsServiceMethods := v1.File_tars_kms_v1_secrets_svc_proto.Services().ByName("SecretsService").Methods()
	secretsServicePutSecretHandler := connect.NewUnaryHandler(
		SecretsServicePutSecretProcedure,
		svc.PutSecret,
		connect.WithSchema(secretsServiceMethods.ByName("PutSecret")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceGetSecretHandler := connect.NewUnaryHandler(
		SecretsServiceGetSecretProcedure,
		svc.GetSecret,
		connect.WithSchema(secretsServiceMethods.ByName("GetSecret")),
		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceRotateResourceDekHandler := connect.NewUnaryHandler(
		SecretsServiceRotateResourceDekProcedure,
		svc.RotateResourceDek,
		connect.WithSchema(secretsServiceMethods.ByName("RotateResourceDek")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceEraseSecretHandler := connect.NewUnaryHandler(
		SecretsServiceEraseSecretProcedure,
		svc.EraseSecret,
		connect.WithSchema(secretsServiceMethods.ByName("EraseSecret")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceRotatePurposeKekHandler := connect.NewUnaryHandler(
		SecretsServiceRotatePurposeKekProcedure,
		svc.RotatePurposeKek,
		connect.WithSchema(secretsServiceMethods.ByName("RotatePurposeKek")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceRotateMasterKekHandler := connect.NewUnaryHandler(
		SecretsServiceRotateMasterKekProcedure,
		svc.RotateMasterKek,
		connect.WithSchema(secretsServiceMethods.ByName("RotateMasterKek")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceSignHandler := connect.NewUnaryHandler(
		SecretsServiceSignProcedure,
		svc.Sign,
		connect.WithSchema(secretsServiceMethods.ByName("Sign")),
		connect.WithHandlerOptions(opts...),
	)
	secretsServiceVerifyHandler := connect.NewUnaryHandler(
		SecretsServiceVerifyProcedure,
		svc.Verify,
		connect.WithSchema(secretsServiceMethods.ByName("Verify")),
		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
		connect.WithHandlerOptions(opts...),
	)
	return "/tars.kms.v1.SecretsService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case SecretsServicePutSecretProcedure:
			secretsServicePutSecretHandler.ServeHTTP(w, r)
		case SecretsServiceGetSecretProcedure:
			secretsServiceGetSecretHandler.ServeHTTP(w, r)
		case SecretsServiceRotateResourceDekProcedure:
			secretsServiceRotateResourceDekHandler.ServeHTTP(w, r)
		case SecretsServiceEraseSecretProcedure:
			secretsServiceEraseSecretHandler.ServeHTTP(w, r)
		case SecretsServiceRotatePurposeKekProcedure:
			secretsServiceRotatePurposeKekHandler.ServeHTTP(w, r)
		case SecretsServiceRotateMasterKekProcedure:
			secretsServiceRotateMasterKekHandler.ServeHTTP(w, r)
		case SecretsServiceSignProcedure:
			secretsServiceSignHandler.ServeHTTP(w, r)
		case SecretsServiceVerifyProcedure:
			secretsServiceVerifyHandler.ServeHTTP(w, r)
		default:
			http.NotFound(w, r)
		}
	})
}

// UnimplementedSecretsServiceHandler returns CodeUnimplemented from all methods.
type UnimplementedSecretsServiceHandler struct{}

func (UnimplementedSecretsServiceHandler) PutSecret(context.Context, *connect.Request[v1.PutSecretRequest]) (*connect.Response[v1.PutSecretResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.PutSecret is not implemented"))
}

func (UnimplementedSecretsServiceHandler) GetSecret(context.Context, *connect.Request[v1.GetSecretRequest]) (*connect.Response[v1.GetSecretResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.GetSecret is not implemented"))
}

func (UnimplementedSecretsServiceHandler) RotateResourceDek(context.Context, *connect.Request[v1.RotateResourceDekRequest]) (*connect.Response[v1.RotateResourceDekResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.RotateResourceDek is not implemented"))
}

func (UnimplementedSecretsServiceHandler) EraseSecret(context.Context, *connect.Request[v1.EraseSecretRequest]) (*connect.Response[v1.EraseSecretResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.EraseSecret is not implemented"))
}

func (UnimplementedSecretsServiceHandler) RotatePurposeKek(context.Context, *connect.Request[v1.RotatePurposeKekRequest]) (*connect.Response[v1.RotatePurposeKekResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.RotatePurposeKek is not implemented"))
}

func (UnimplementedSecretsServiceHandler) RotateMasterKek(context.Context, *connect.Request[v1.RotateMasterKekRequest]) (*connect.Response[v1.RotateMasterKekResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.RotateMasterKek is not implemented"))
}

func (UnimplementedSecretsServiceHandler) Sign(context.Context, *connect.Request[v1.SignRequest]) (*connect.Response[v1.SignResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.Sign is not implemented"))
}

func (UnimplementedSecretsServiceHandler) Verify(context.Context, *connect.Request[v1.VerifyRequest]) (*connect.Response[v1.VerifyResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.kms.v1.SecretsService.Verify is not implemented"))
}
