/vault/unlock/{channel}

Kind 9: a key unlocked; ok or an error, in exactly one message.

The ask is kind 9 on /requests:

[9][key …]

The server answers on /vault/unlock/{channel} by sending exactly one message and closing the connection. A path that the proxy or the server closes cleanly with no message before the close states that the ask was not served. An abrupt end of the path leaves the operation failed, and the proxy does not ask it again, as Vault provides.

• Only the holder unlocks. An unlock of a key the container does not hold is refused, and the server sends 1 and a message.

The ask is defined by diverge-provider-sdk/src/shared/containers/vault/unlock/request/request.rs:

//! Release a key's lock early. Answered `Ok`, or `Error` when the

use std::convert::Infallible;

use super::super::super::RequestError;
use crate::encode::{Encode, Writer};

/// Release a key's lock early. Answered `Ok`, or `Error` when the
/// asking container does not hold it.
///
/// ```text
/// [key: utf8…]
/// ```
///
/// The key is the whole payload: nothing follows it, so nothing
/// delimits it. Answered with one
/// [`response::Frame`](super::super::response::Frame).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Request<'a> {
    /// The key.
    pub key: &'a str,
}

impl Encode for Request<'_> {
    /// [`Infallible`]: bytes copied.
    type Error = Infallible;

    fn encode(&self, out: &mut Writer<'_>) -> Result<(), Infallible> {
        out.extend_from_slice(self.key.as_bytes());
        Ok(())
    }
}

impl<'a> Request<'a> {
    /// Decode from the bytes after the ask's kind. The key borrows
    /// from `bytes`.
    pub fn decode(bytes: &'a [u8]) -> Result<Self, RequestError> {
        std::str::from_utf8(bytes)
            .map(|key| Request { key })
            .map_err(|_| RequestError::KeyUtf8)
    }
}

The answer is the frame defined on Vault: a first byte of 0 states that the operation was done; a first byte of 1 is followed by a message stating why it was not.