authzunsafev1alpha

type ClientCredentials struct {

	// Public client identifier.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Client secret used for authentication.
	ClientSecret string `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// contains filtered or unexported fields
}

type ClientServiceClient interface {
	// ShowClientCredentials shows the client credentials for a client.
	// It may be used by the unsafe client to obtain the client credentials.
	ShowClientCredentials(ctx context.Context, in *ShowClientCredentialsRequest, opts ...grpc.CallOption) (*ClientCredentials, error)
}

type ClientServiceServer interface {
	// ShowClientCredentials shows the client credentials for a client.
	// It may be used by the unsafe client to obtain the client credentials.
	ShowClientCredentials(context.Context, *ShowClientCredentialsRequest) (*ClientCredentials, error)
	// contains filtered or unexported methods
}

type IntrospectKeyTypeTokenRequest struct {
	KeyTypeId string `protobuf:"bytes,1,opt,name=key_type_id,json=keyTypeId,proto3" json:"key_type_id,omitempty"`
	Token     string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type IntrospectKeyTypeTokenResponse struct {
	TokenId     string `protobuf:"bytes,1,opt,name=token_id,json=tokenId,proto3" json:"token_id,omitempty"`
	JsonPayload []byte `protobuf:"bytes,2,opt,name=json_payload,json=jsonPayload,proto3" json:"json_payload,omitempty"`
	Active      bool   `protobuf:"varint,3,opt,name=active,proto3" json:"active,omitempty"`
	ExpiresAt   int64  `protobuf:"varint,4,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	IssuedAt    int64  `protobuf:"varint,5,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"`
	Issuer      string `protobuf:"bytes,6,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// contains filtered or unexported fields
}

type IntrospectSignatureRequest struct {

	// Required signature to introspect.
	Signature string `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type IntrospectSignatureResponse struct {

	// The claims returned by the introspection.
	Claims *structpb.Struct `protobuf:"bytes,1,opt,name=claims,proto3" json:"claims,omitempty"`
	// contains filtered or unexported fields
}

type IntrospectTokenRequest struct {

	// A required token to introspect.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type IntrospectTokenResponse struct {

	// Are the standard claims of the token.
	Claims *StandardTokenClaims `protobuf:"bytes,1,opt,name=claims,proto3" json:"claims,omitempty"`
	// Are the unspecified custom claims encoded in the token.
	CustomClaims string `protobuf:"bytes,2,opt,name=custom_claims,json=customClaims,proto3" json:"custom_claims,omitempty"`
	// contains filtered or unexported fields
}

type IssueIDTokenRequest struct {

	// Project is a resource name of the project that the token is issued for.
	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"`
	// Required, the subject of the token.
	// The subject is the unique identifier of the user or service account that the token represents.
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// Optional custom claims to be added to the token.
	// If provided this field must be a valid JSON object, otherwise the request will fail.
	// Any standard claims will not be included in the resulting token.
	// The list of standard claims are:
	// - sub: the subject of the token
	// - iss: the issuer of the token
	// - aud: the audience of the token
	// - iat: the time the token was issued
	// - exp: the time the token will expire
	Claims string `protobuf:"bytes,3,opt,name=claims,proto3" json:"claims,omitempty"`
	// Preferred algorithm to sign the token with.
	// If the given algorithm is not supported by the system, the request will fail with the error InvalidArgument.
	// If no algorithm is provided, the token will be signed with the default algorithm in the service.
	Algorithm signalgpb.SigningAlgorithm `protobuf:"varint,4,opt,name=algorithm,proto3,enum=blocky.authz.type.SigningAlgorithm" json:"algorithm,omitempty"`
	// Optional, identifier of the client that is requesting the token.
	// If not provided, the token
	// and no scope validation will be performed.
	// Note: this affects permissible scopes, not the validity of the token.
	Client string `protobuf:"bytes,5,opt,name=client,proto3" json:"client,omitempty"`
	// contains filtered or unexported fields
}

type IssueIDTokenResponse struct {

	// Is the ID token that can be used to authenticate requests.
	IdToken string `protobuf:"bytes,1,opt,name=id_token,json=idToken,proto3" json:"id_token,omitempty"`
	// contains filtered or unexported fields
}

type IssueTokenRequest struct {

	// Project is a resource name of the project that the token is issued for.
	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"`
	// Required, the subject of the token.
	// The subject is the unique identifier of the user or service account that the token represents.
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// Optional key resource name used to sign this token.
	// If not provided, the token will be signed with the default key.
	// If provided, it must be a valid key identifier, otherwise the request will fail,
	// with the error NotFound.
	Key string `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
	// Optional custom claims to be added to the token.
	// If provided this field must be a valid JSON object, otherwise the request will fail.
	// By default, the token will contain the following claims:
	// - sub: the subject of the token
	// - iss: the issuer of the token
	// - aud: the audience of the token
	// - iat: the time the token was issued
	// - exp: the time the token will expire
	// - jti: the unique identifier of the token
	Claims string `protobuf:"bytes,4,opt,name=claims,proto3" json:"claims,omitempty"`
	// Required, the scope of the token.
	// The scope is a list of strings that represent the permissions that the token grants.
	Scope string `protobuf:"bytes,5,opt,name=scope,proto3" json:"scope,omitempty"`
	// Algorithm used to sign the token.
	// If the given algorithm is not supported by the system, the request will fail with the error InvalidArgument.
	// If not provided, the token will be signed with the default algorithm for the key.
	Algorithm signalgpb.SigningAlgorithm `protobuf:"varint,6,opt,name=algorithm,proto3,enum=blocky.authz.type.SigningAlgorithm" json:"algorithm,omitempty"`
	// Optional, identifier of the client that is requesting the token.
	// If not provided, the token
	// and no scope validation will be performed.
	// Note: this affects permissible scopes, not the validity of the token.
	Client string `protobuf:"bytes,7,opt,name=client,proto3" json:"client,omitempty"`
	// contains filtered or unexported fields
}

type IssueTokenRequest_AccessTokenOptions struct {

	// An optional signing algorithm  on the access token creation.
	Algorithm signalgpb.SigningAlgorithm `protobuf:"varint,1,opt,name=algorithm,proto3,enum=blocky.authz.type.SigningAlgorithm" json:"algorithm,omitempty"`
	// An optional 'kid' - key revision unique identifier - to use for signing the access token.
	// If not provided, the highest priority or default per instance key will be used.
	Kid string `protobuf:"bytes,2,opt,name=kid,proto3" json:"kid,omitempty"`
	// An optional set of custom claims to be added to the access token.
	// These claims needs to be encoded as a valid JSON object.
	// All the standard fields will override custom claim keys with the same key.
	Claims string `protobuf:"bytes,3,opt,name=claims,proto3" json:"claims,omitempty"`
	// contains filtered or unexported fields
}

type IssueTokenResponse struct {

	// Is the access token that can be used to authenticate requests.
	AccessToken string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// Is an optional refresh token that can be used to issue new tokens.
	RefreshToken string `protobuf:"bytes,2,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// Is the expiration time of the access token.
	ExpiresIn int64 `protobuf:"varint,3,opt,name=expires_in,json=expiresIn,proto3" json:"expires_in,omitempty"`
	// contains filtered or unexported fields
}

type RefreshTokenRequest struct {
	RefreshToken              string `protobuf:"bytes,1,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	ForceConfigurationOptions bool   `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type RefreshTokenResponse struct {
	TokenId string `protobuf:"bytes,1,opt,name=token_id,json=tokenId,proto3" json:"token_id,omitempty"`
	// contains filtered or unexported fields
}

type RevokeRefreshTokenRequest struct {
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type ShowClientCredentialsRequest struct {

	// Is a resource reference to the client for which the client credentials
	// should be shown.
	// The format of a client resource name is:
	// 'projects/{project}/clients/{client}'.
	// If the client has an alias it can be used instead of the client id in the
	// resource name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type SignClaimsRequest struct {

	// The claims to sign.
	Claims *structpb.Struct `protobuf:"bytes,1,opt,name=claims,proto3" json:"claims,omitempty"`
	// Optional signature type to use.
	// If not specified a signature is generated using the default key
	// and the default signing algorithm.
	// The signature type may be used to override the default key and algorithm.
	// This field relates to the signature type id in the
	// [SignatureType][blocky.authz.unsafe.v1alpha.SignatureType] message.
	SignatureTypeId string `protobuf:"bytes,2,opt,name=signature_type_id,json=signatureTypeId,proto3" json:"signature_type_id,omitempty"`
	// Optional key id to use.
	// If not specified the default key id is used.
	// This field relates to the field:
	// [Key][blocky.authz.unsafe.v1alpha.Key.key_id].
	KeyId string `protobuf:"bytes,3,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// Optional signing algorithm to use.
	// If not specified the default signing algorithm is used.
	// If no matching algorithm is found, an error is returned.
	SigningAlgorithm signalgpb.SigningAlgorithm `` /* 150-byte string literal not displayed */
	// contains filtered or unexported fields
}

type SignClaimsResponse struct {

	// The compacted JWS token as defined in RFC 7515.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type SignaturesServiceClient interface {
	// Signs the input payload and returns a signed string token.
	// The result is a Json Web Signature (JWS) as defined in RFC 7515.
	SignClaims(ctx context.Context, in *SignClaimsRequest, opts ...grpc.CallOption) (*SignClaimsResponse, error)
	// Introspects the signature and returns the claims.
	// Once the signature is verified, the claims are returned as a Struct.
	IntrospectSignature(ctx context.Context, in *IntrospectSignatureRequest, opts ...grpc.CallOption) (*IntrospectSignatureResponse, error)
}

type SignaturesServiceServer interface {
	// Signs the input payload and returns a signed string token.
	// The result is a Json Web Signature (JWS) as defined in RFC 7515.
	SignClaims(context.Context, *SignClaimsRequest) (*SignClaimsResponse, error)
	// Introspects the signature and returns the claims.
	// Once the signature is verified, the claims are returned as a Struct.
	IntrospectSignature(context.Context, *IntrospectSignatureRequest) (*IntrospectSignatureResponse, error)
	// contains filtered or unexported methods
}

type StandardTokenClaims struct {

	// Is the token unique identifier.
	TokenId string `protobuf:"bytes,1,opt,name=token_id,json=jti,proto3" json:"token_id,omitempty"`
	// States if the token is active.
	Active bool `protobuf:"varint,2,opt,name=active,proto3" json:"active,omitempty"`
	// Is the subject of the token.
	Subject string `protobuf:"bytes,3,opt,name=subject,json=sub,omitempty,proto3" json:"subject,omitempty"`
	// Is the expiration time of the token.
	ExpiresAt int64 `protobuf:"varint,4,opt,name=expires_at,json=exp,omitempty,proto3" json:"expires_at,omitempty"`
	// Is the time the token was issued.
	IssuedAt int64 `protobuf:"varint,5,opt,name=issued_at,json=iat,omitempty,proto3" json:"issued_at,omitempty"`
	// Is the time the token was revoked.
	RevokedAt int64 `protobuf:"varint,6,opt,name=revoked_at,json=rat,omitempty,proto3" json:"revoked_at,omitempty"`
	// Is the time the token was not valid before.
	NotBefore int64 `protobuf:"varint,7,opt,name=not_before,json=nbf,omitempty,proto3" json:"not_before,omitempty"`
	// Is the issuer of the token.
	Issuer string `protobuf:"bytes,8,opt,name=issuer,json=iss,omitempty,proto3" json:"issuer,omitempty"`
	// Is a comma separated list of scopes that the token grants.
	Scope string `protobuf:"bytes,9,opt,name=scope,proto3" json:"scope,omitempty"`
	// Is the audience of the token,
	Audience []string `protobuf:"bytes,10,rep,name=audience,json=aud,omitempty,proto3" json:"audience,omitempty"`
	// Is the client that requested the token.
	Client string `protobuf:"bytes,11,opt,name=client,json=client_id,omitempty,proto3" json:"client,omitempty"`
	// contains filtered or unexported fields
}

type TokensServiceClient interface {
	// IssueIDToken issues a new ID token for the input subject.
	IssueIDToken(ctx context.Context, in *IssueIDTokenRequest, opts ...grpc.CallOption) (*IssueIDTokenResponse, error)
	// Issues a new authorization token for the input subject.
	IssueToken(ctx context.Context, in *IssueTokenRequest, opts ...grpc.CallOption) (*IssueTokenResponse, error)
	// Creates a new access, refresh token pair on top of the input refresh token.
	// The input refresh token needs to be non-expired, non-revoked and active.
	// Resulting tokens will share the claims provided during the [IssueTokenRequest].
	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
	// Revokes the input refresh token.
	// Revoked refresh tokens will not be able to be used to issue new tokens.
	// This makes the refresh token invalid.
	RevokeRefreshToken(ctx context.Context, in *RevokeRefreshTokenRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Checks if the input token is valid, and if so, returns the claims of the token.
	// If the token is invalid, the response will contain an error.
	IntrospectToken(ctx context.Context, in *IntrospectTokenRequest, opts ...grpc.CallOption) (*IntrospectTokenResponse, error)
}

type TokensServiceServer interface {
	// IssueIDToken issues a new ID token for the input subject.
	IssueIDToken(context.Context, *IssueIDTokenRequest) (*IssueIDTokenResponse, error)
	// Issues a new authorization token for the input subject.
	IssueToken(context.Context, *IssueTokenRequest) (*IssueTokenResponse, error)
	// Creates a new access, refresh token pair on top of the input refresh token.
	// The input refresh token needs to be non-expired, non-revoked and active.
	// Resulting tokens will share the claims provided during the [IssueTokenRequest].
	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
	// Revokes the input refresh token.
	// Revoked refresh tokens will not be able to be used to issue new tokens.
	// This makes the refresh token invalid.
	RevokeRefreshToken(context.Context, *RevokeRefreshTokenRequest) (*emptypb.Empty, error)
	// Checks if the input token is valid, and if so, returns the claims of the token.
	// If the token is invalid, the response will contain an error.
	IntrospectToken(context.Context, *IntrospectTokenRequest) (*IntrospectTokenResponse, error)
	// contains filtered or unexported methods
}

type UnimplementedClientServiceServer struct {
}

type UnimplementedSignaturesServiceServer struct {
}

type UnimplementedTokensServiceServer struct {
}

type UnsafeClientServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeSignaturesServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeTokensServiceServer interface {
	// contains filtered or unexported methods
}