Add resource-scoped bearer access metadata

crates/geth-control/src/lib.rs

@@ -4,7 +4,7 @@ use geth_document::DocumentResource;
 use geth_keychain::KeychainOp;
 use geth_kv::{KvEntry, KvResource};
 use geth_resource::ResourceDescriptor;
-use geth_secrets::ResourceMasterSecret;
+use geth_secrets::{BearerAccess, ResourceMasterSecret};
 use geth_ssh_identity::{
     SshCertApproval, SshCertRequest, SshCertificateRecord, SshRevocationEntry,
 };
@@ -56,6 +56,16 @@ pub enum ControlRequest {
     SecretRotate {
         resource: String,
     },
+    SecretBearerCreate {
+        resource: String,
+        capabilities: Vec<String>,
+        expires_at_ms: Option<i64>,
+    },
+    SecretBearerList,
+    SecretBearerRevoke {
+        resource: String,
+        secret: String,
+    },
     AuthExplain {
         subject: String,
         resource: String,
@@ -181,6 +191,16 @@ pub enum ControlResponse {
     SecretCreated {
         secret: ResourceMasterSecret,
     },
+    SecretBearerCreated {
+        access: BearerAccess,
+    },
+    SecretBearerList {
+        access: Vec<BearerAccess>,
+    },
+    SecretBearerRevoked {
+        resource: String,
+        secret: String,
+    },
     AuthExplain(AuthExplanation),
     AuthOpRecorded {
         op: AuthOp,