proto: make the generated kvproto modules public

[dina-kar]

Motivation

tikv_client::proto (the generated kvproto messages and gRPC clients) is private. An application that needs an RPC this crate does not wrap has to vendor kvproto and generate a second copy of the same types. Examples:

• TiCDC's ChangeData/EventFeed, for change data capture;
• PD's GC safe point RPCs (GetGCSafePoint, UpdateGCSafePoint, UpdateServiceGCSafePoint), for an application that runs its own GC worker;
• keyspace management (keyspacepb).

We hit this building a service on tikv-client that acts as the cluster's GC worker. We ended up vendoring 14 kvproto files and a tonic-build step just for four PD RPCs. Some generated types already leak into the public API (ProtoLockInfo, ProtoKeyError, ProtoRegionError), but not the modules they come from.

What is changed and how it works

• mod proto becomes pub mod proto.
• tikv_client::proto re-exports tonic and prost, the versions the clients are generated with. Callers can build a Channel and use prost::Message without pinning matching versions themselves.
• The module docs describe what is there and show a PD GetGCSafePoint call. They also say that the generated code follows kvproto, independently of the rest of the API.
• #[allow(rustdoc::all)] on the generated code, as clippy lints already are. Rustdoc warnings on kvproto comments would otherwise become this crate's.

A feature flag was considered and not used: the generated code is compiled anyway, and making it public adds no dependencies or build time. If maintainers would rather gate it (for example behind proto) or mark it #[doc(hidden)], that is a one-line change.

Tests

• tests/proto_tests.rs (no cluster needed): encodes and decodes a generated pdpb message with the re-exported prost, checks that ProtoLockInfo is the generated kvrpcpb::LockInfo, and builds PdClient and ChangeDataClient on a lazy channel from the re-exported tonic. It does not compile without the change (module proto is private).
• The module doc example is compile-tested (no_run).
• cargo test --lib, clippy with -D clippy::all, cargo fmt --check: clean. RUSTDOCFLAGS=-Dwarnings cargo doc still reports only the two warnings it reports on master ([put'] in transaction.rs, <Value> in raw/client.rs).

Check list

• Unit/compile tests
• Doc test
• DCO: the commit is signed off.

Release note: tikv_client::proto exposes the generated kvproto messages and gRPC clients, with the tonic and prost they are built on.

Summary by CodeRabbit

• New Features
  • The protobuf module is now accessible through the crate’s public API.
  • Added public re-exports for prost and tonic, along with documentation and an example for calling a PD RPC.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign connor1996 for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 25730b54-8ac7-4727-bfa6-5bb3d5aea2fb

📥 Commits

Reviewing files that changed from the base of the PR and between ab4be1c and ddd1063.

📒 Files selected for processing (3)

• src/lib.rs
• src/proto.rs
• tests/proto_tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The crate now exposes the generated protobuf module and re-exports prost and tonic. Module documentation describes the generated messages and clients. Tests cover message encoding and decoding, type assignment, and construction of PD and CDC clients.

Changes

Protobuf API

Layer / File(s)	Summary
Expose and verify the generated protobuf API src/lib.rs, src/proto.rs, tests/proto_tests.rs	The crate exposes the proto module and re-exports prost and tonic. Documentation describes the generated API and includes a PD RPC example. Tests check message round-tripping, type assignment, and client construction. The generated-code lint allowance includes rustdoc::all.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to ddd10

The generated protobuf API and documented usage appear compatible. No concrete regression is evident; the change appears mergeable subject to normal build and doctest checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to ddd10

Applications can now use PD and TiCDC RPC clients directly, but those clients do not inherit the crate’s configured TLS credentials. The new PD example uses an HTTP channel. This is a security-sensitive API boundary, although no deployed use or server-side authorization bypass is established.

Retained concerns

• Medium · security · inferred: Direct use of the newly public generated clients does not inherit the wrapped client’s configured TLS identity and connection policy; the new PD example demonstrates an HTTP connection. Applications must establish equivalent transport controls themselves.

Security review details

Security Blast Radius

• inferred — The new public path can reach PD or TiCDC RPCs that a downstream application can network-access and is authorized to invoke. The evidence does not establish new server-side access, deployed callers, or exposure beyond those applications and reachable services.

Security Findings and Attack Paths

• inferred — If a downstream application uses an unprotected channel where transport identity or confidentiality is required, its direct RPC traffic will not receive the wrapped client’s configured TLS treatment. The HTTP documentation makes that choice visible, but neither an affected deployment nor a successful attack is established.

Trust Boundaries and Controls

• observed — Generated clients accept caller-provided channels and offer interceptors, so applications can supply transport and request controls. They do not automatically use the wrapped client’s SecurityManager. Server-side authorization policy is not established by this client source.

Resilience and Maintainability Implications

• inferred — For a service managing GC safe points, identity, TTL refresh, ordering, retries, concurrent updates and cleanup are caller- or server-owned. The generated request and unary method do not establish those transition invariants.

Hardening Proposals

• proposed — Document that direct clients do not inherit configured TLS credentials or retry policy, and show a TLS-configured PD channel where authenticated transport is expected. State explicitly that GC safe-point lifecycle handling belongs to the caller and server.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: making the generated kvproto modules publicly accessible. It is concise and relevant to the changeset.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Some tools did not complete. Review the errors below.

🔧 Clippy (1.98.1)

Clippy execution failed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}