admin

type AdminClient interface {
	// ImportCAConfigs makes the server read 'tokenserver.cfg'.
	ImportCAConfigs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ImportedConfigs, error)
	// ImportDelegationConfigs makes the server read 'delegation.cfg'.
	ImportDelegationConfigs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ImportedConfigs, error)
	// ImportServiceAccountsConfigs makes the server read 'service_accounts.cfg'.
	ImportServiceAccountsConfigs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ImportedConfigs, error)
	// ImportProjectIdentityConfigs makes the server read 'projects.cfg'.
	ImportProjectIdentityConfigs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ImportedConfigs, error)
	// ImportProjectOwnedAccountsConfigs makes the server read 'project_owned_accounts.cfg'.
	ImportProjectOwnedAccountsConfigs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ImportedConfigs, error)
	// InspectMachineToken decodes a machine token and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time and revocation status.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. it checks for revocation status even if token is already
	// expired).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectMachineTokenResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectMachineToken(ctx context.Context, in *InspectMachineTokenRequest, opts ...grpc.CallOption) (*InspectMachineTokenResponse, error)
	// InspectDelegationToken decodes a delegation token and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. attempts to decode the body even if the signing key has been
	// rotated already).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectDelegationTokenResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectDelegationToken(ctx context.Context, in *InspectDelegationTokenRequest, opts ...grpc.CallOption) (*InspectDelegationTokenResponse, error)
	// InspectOAuthTokenGrant decodes OAuth token grant and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. attempts to decode the body even if the signing key has been
	// rotated already).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectOAuthTokenGrantResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectOAuthTokenGrant(ctx context.Context, in *InspectOAuthTokenGrantRequest, opts ...grpc.CallOption) (*InspectOAuthTokenGrantResponse, error)
}

type AdminServer interface {
	// ImportCAConfigs makes the server read 'tokenserver.cfg'.
	ImportCAConfigs(context.Context, *emptypb.Empty) (*ImportedConfigs, error)
	// ImportDelegationConfigs makes the server read 'delegation.cfg'.
	ImportDelegationConfigs(context.Context, *emptypb.Empty) (*ImportedConfigs, error)
	// ImportServiceAccountsConfigs makes the server read 'service_accounts.cfg'.
	ImportServiceAccountsConfigs(context.Context, *emptypb.Empty) (*ImportedConfigs, error)
	// ImportProjectIdentityConfigs makes the server read 'projects.cfg'.
	ImportProjectIdentityConfigs(context.Context, *emptypb.Empty) (*ImportedConfigs, error)
	// ImportProjectOwnedAccountsConfigs makes the server read 'project_owned_accounts.cfg'.
	ImportProjectOwnedAccountsConfigs(context.Context, *emptypb.Empty) (*ImportedConfigs, error)
	// InspectMachineToken decodes a machine token and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time and revocation status.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. it checks for revocation status even if token is already
	// expired).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectMachineTokenResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectMachineToken(context.Context, *InspectMachineTokenRequest) (*InspectMachineTokenResponse, error)
	// InspectDelegationToken decodes a delegation token and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. attempts to decode the body even if the signing key has been
	// rotated already).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectDelegationTokenResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectDelegationToken(context.Context, *InspectDelegationTokenRequest) (*InspectDelegationTokenResponse, error)
	// InspectOAuthTokenGrant decodes OAuth token grant and verifies it is valid.
	//
	// It verifies the token was signed by a private key of the token server and
	// checks token's expiration time.
	//
	// It tries to give as much information about the token and its status as
	// possible (e.g. attempts to decode the body even if the signing key has been
	// rotated already).
	//
	// Administrators can use this call to debug issues with tokens.
	//
	// Returns:
	//   InspectOAuthTokenGrantResponse for tokens of supported kind.
	//   grpc.InvalidArgument error for unsupported token kind.
	//   grpc.Internal error for transient errors.
	InspectOAuthTokenGrant(context.Context, *InspectOAuthTokenGrantRequest) (*InspectOAuthTokenGrantResponse, error)
	// contains filtered or unexported methods
}

type CRLStatus struct {
	LastUpdateTime    *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=last_update_time,json=lastUpdateTime,proto3" json:"last_update_time,omitempty"`           // time when CRL was generated by the CA
	LastFetchTime     *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=last_fetch_time,json=lastFetchTime,proto3" json:"last_fetch_time,omitempty"`              // time when CRL was fetched
	LastFetchEtag     string                 `protobuf:"bytes,3,opt,name=last_fetch_etag,json=lastFetchEtag,proto3" json:"last_fetch_etag,omitempty"`              // etag of last successfully fetched CRL
	RevokedCertsCount int64                  `protobuf:"varint,4,opt,name=revoked_certs_count,json=revokedCertsCount,proto3" json:"revoked_certs_count,omitempty"` // number of revoked certificates in the CRL
	// contains filtered or unexported fields
}

type CertificateAuthoritiesClient interface {
	// FetchCRL makes the server fetch a CRL for some CA.
	FetchCRL(ctx context.Context, in *FetchCRLRequest, opts ...grpc.CallOption) (*FetchCRLResponse, error)
	// ListCAs returns a list of Common Names of registered CAs.
	ListCAs(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCAsResponse, error)
	// GetCAStatus returns configuration of some CA defined in the config.
	GetCAStatus(ctx context.Context, in *GetCAStatusRequest, opts ...grpc.CallOption) (*GetCAStatusResponse, error)
	// IsRevokedCert says whether a certificate serial number is in the CRL.
	IsRevokedCert(ctx context.Context, in *IsRevokedCertRequest, opts ...grpc.CallOption) (*IsRevokedCertResponse, error)
	// CheckCertificate says whether a certificate is valid or not.
	CheckCertificate(ctx context.Context, in *CheckCertificateRequest, opts ...grpc.CallOption) (*CheckCertificateResponse, error)
}

type CertificateAuthoritiesServer interface {
	// FetchCRL makes the server fetch a CRL for some CA.
	FetchCRL(context.Context, *FetchCRLRequest) (*FetchCRLResponse, error)
	// ListCAs returns a list of Common Names of registered CAs.
	ListCAs(context.Context, *emptypb.Empty) (*ListCAsResponse, error)
	// GetCAStatus returns configuration of some CA defined in the config.
	GetCAStatus(context.Context, *GetCAStatusRequest) (*GetCAStatusResponse, error)
	// IsRevokedCert says whether a certificate serial number is in the CRL.
	IsRevokedCert(context.Context, *IsRevokedCertRequest) (*IsRevokedCertResponse, error)
	// CheckCertificate says whether a certificate is valid or not.
	CheckCertificate(context.Context, *CheckCertificateRequest) (*CheckCertificateResponse, error)
	// contains filtered or unexported methods
}

type CertificateAuthorityConfig struct {
	UniqueId    int64    `protobuf:"varint,6,opt,name=unique_id,json=uniqueId,proto3" json:"unique_id,omitempty"`         // ID of this CA, will be embedded into tokens.
	Cn          string   `protobuf:"bytes,1,opt,name=cn,proto3" json:"cn,omitempty"`                                      // CA Common Name, must match Subject CN in the cert
	CertPath    string   `protobuf:"bytes,2,opt,name=cert_path,json=certPath,proto3" json:"cert_path,omitempty"`          // path to the root certificate file in luci-config
	CrlUrl      string   `protobuf:"bytes,3,opt,name=crl_url,json=crlUrl,proto3" json:"crl_url,omitempty"`                // where to fetch CRL from
	UseOauth    bool     `protobuf:"varint,4,opt,name=use_oauth,json=useOauth,proto3" json:"use_oauth,omitempty"`         // true to send Authorization header when fetching CRL
	OauthScopes []string `protobuf:"bytes,7,rep,name=oauth_scopes,json=oauthScopes,proto3" json:"oauth_scopes,omitempty"` // OAuth scopes to use when fetching CRL
	// KnownDomains describes parameters to use for each particular domain.
	KnownDomains []*DomainConfig `protobuf:"bytes,5,rep,name=known_domains,json=knownDomains,proto3" json:"known_domains,omitempty"`
	// contains filtered or unexported fields
}

type CheckCertificateRequest struct {
	CertPem string `protobuf:"bytes,1,opt,name=cert_pem,json=certPem,proto3" json:"cert_pem,omitempty"` // pem encoded certificate to check for validity
	// contains filtered or unexported fields
}

type CheckCertificateResponse struct {
	IsValid       bool   `protobuf:"varint,1,opt,name=is_valid,json=isValid,proto3" json:"is_valid,omitempty"`                  // true when certificate is valid
	InvalidReason string `protobuf:"bytes,2,opt,name=invalid_reason,json=invalidReason,proto3" json:"invalid_reason,omitempty"` // a reason for certificate invalidity if it is invalid
	// contains filtered or unexported fields
}

type DelegationPermissions struct {

	// Rules specify what calls to MintDelegationToken are allowed.
	//
	// Rules are evaluated independently. One and only one rule should match the
	// request to allow the operation. If none rules or more than one rule match,
	// the request will be denied.
	//
	// See DelegationRule comments for more details.
	Rules []*DelegationRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// contains filtered or unexported fields
}

type DelegationRule struct {

	// A descriptive name of this rule, for the audit log.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Email of developers that own this rule, to know who to contact.
	Owner []string `protobuf:"bytes,2,rep,name=owner,proto3" json:"owner,omitempty"`
	// A set of callers to which this rule applies.
	//
	// Matched against verified credentials of a caller of MintDelegationToken.
	//
	// Each element is either:
	//  * An identity string ("user:<email>").
	//  * A group reference ("group:<name>").
	//
	// The groups specified here are expanded when MintDelegationTokenRequest is
	// evaluated.
	Requestor []string `protobuf:"bytes,3,rep,name=requestor,proto3" json:"requestor,omitempty"`
	// Identities that are allowed to be delegated/impersonated by the requestor.
	//
	// Matched against 'delegated_identity' field of MintDelegationTokenRequest.
	//
	// Each element is either:
	//  * An identity string ("user:<email>").
	//  * A group reference ("group:<name>").
	//  * A special identifier "REQUESTOR" that is substituted by the requestor
	//    identity when evaluating the rule.
	//
	// "REQUESTOR" allows one to generate tokens that delegate their own identity
	// to some target audience.
	//
	// The groups specified here are expanded when MintDelegationTokenRequest is
	// evaluated.
	AllowedToImpersonate []string `protobuf:"bytes,4,rep,name=allowed_to_impersonate,json=allowedToImpersonate,proto3" json:"allowed_to_impersonate,omitempty"`
	// A set of identities that should be able to use the new token.
	//
	// Matched against 'audience' field of MintDelegationTokenRequest.
	//
	// Each element is either:
	//  * An identity string ("user:<email>").
	//  * A group reference ("group:<name>").
	//  * A special identifier "REQUESTOR" that is substituted by the requestor
	//    identity when evaluating the rule.
	//  * A special token "*" that means "any bearer can use the new token,
	//    including anonymous".
	//
	// "REQUESTOR" is typically used here for rules that allow requestors to
	// impersonate someone else. The corresponding tokens have the requestor as
	// the only allowed audience.
	//
	// The groups specified here are NOT expanded when MintDelegationTokenRequest
	// is evaluated. To match the rule, MintDelegationTokenRequest must specify
	// subset of 'allowed_audience' groups explicitly in 'audience' field.
	AllowedAudience []string `protobuf:"bytes,5,rep,name=allowed_audience,json=allowedAudience,proto3" json:"allowed_audience,omitempty"`
	// A set of services that should be able to accept the new token.
	//
	// Matched against 'services' field of MintDelegationTokenRequest.
	//
	// Each element is either:
	//  * A service identity string ("service:<id>").
	//  * A special token "*" that mean "any LUCI service should accept the
	//    token".
	TargetService []string `protobuf:"bytes,6,rep,name=target_service,json=targetService,proto3" json:"target_service,omitempty"`
	// Maximum allowed validity duration (sec) of minted delegation tokens.
	//
	// Default is 12 hours.
	MaxValidityDuration int64 `protobuf:"varint,7,opt,name=max_validity_duration,json=maxValidityDuration,proto3" json:"max_validity_duration,omitempty"`
	// contains filtered or unexported fields
}

type DomainConfig struct {

	// Domain is domain names of hosts this config applies to.
	//
	// Machines that reside in a subdomain of given domain are also considered
	// part of it, e.g. both FQDNs "host.example.com" and "host.abc.example.com"
	// match domain "example.com".
	Domain []string `protobuf:"bytes,1,rep,name=domain,proto3" json:"domain,omitempty"`
	// MachineTokenLifetime is how long generated machine tokens live, in seconds.
	//
	// If 0, machine tokens are not allowed.
	MachineTokenLifetime int64 `protobuf:"varint,5,opt,name=machine_token_lifetime,json=machineTokenLifetime,proto3" json:"machine_token_lifetime,omitempty"`
	// contains filtered or unexported fields
}

type FetchCRLRequest struct {
	Cn    string `protobuf:"bytes,1,opt,name=cn,proto3" json:"cn,omitempty"`        // Common Name of the CA
	Force bool   `protobuf:"varint,2,opt,name=force,proto3" json:"force,omitempty"` // fetch and parse CRL even if we have it already
	// contains filtered or unexported fields
}

type FetchCRLResponse struct {
	CrlStatus *CRLStatus `protobuf:"bytes,1,opt,name=crl_status,json=crlStatus,proto3" json:"crl_status,omitempty"` // status of the CRL after the fetch
	// contains filtered or unexported fields
}

type GetCAStatusRequest struct {
	Cn string `protobuf:"bytes,1,opt,name=cn,proto3" json:"cn,omitempty"` // Common Name of the CA
	// contains filtered or unexported fields
}

type GetCAStatusResponse struct {
	Config     *CertificateAuthorityConfig `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`                           // current config
	Cert       string                      `protobuf:"bytes,2,opt,name=cert,proto3" json:"cert,omitempty"`                               // pem-encoded CA certificate
	Removed    bool                        `protobuf:"varint,3,opt,name=removed,proto3" json:"removed,omitempty"`                        // true if this CA was removed from the config
	Ready      bool                        `protobuf:"varint,4,opt,name=ready,proto3" json:"ready,omitempty"`                            // true if this CA is ready for usage
	AddedRev   string                      `protobuf:"bytes,5,opt,name=added_rev,json=addedRev,proto3" json:"added_rev,omitempty"`       // config rev when this CA appeared
	UpdatedRev string                      `protobuf:"bytes,6,opt,name=updated_rev,json=updatedRev,proto3" json:"updated_rev,omitempty"` // config rev when this CA was updated
	RemovedRev string                      `protobuf:"bytes,7,opt,name=removed_rev,json=removedRev,proto3" json:"removed_rev,omitempty"` // config rev when this CA was removed
	CrlStatus  *CRLStatus                  `protobuf:"bytes,8,opt,name=crl_status,json=crlStatus,proto3" json:"crl_status,omitempty"`    // last known status of the CRL for this CA
	// contains filtered or unexported fields
}

type ImportedConfigs struct {

	// The revision of the configs that are now in the datastore.
	//
	// It's either the imported revision, if configs change, or a previously known
	// revision, if configs at HEAD are same.
	Revision string `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
	// contains filtered or unexported fields
}

type InspectDelegationTokenRequest struct {

	// The token body.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type InspectDelegationTokenResponse struct {

	// True if the token is valid.
	//
	// A token is valid if its signature is correct and it hasn't expired yet.
	Valid bool `protobuf:"varint,1,opt,name=valid,proto3" json:"valid,omitempty"`
	// Human readable summary of why token is invalid.
	//
	// Summarizes the rest of the fields of this struct. Set only if 'valid' is
	// false.
	InvalidityReason string `protobuf:"bytes,2,opt,name=invalidity_reason,json=invalidityReason,proto3" json:"invalidity_reason,omitempty"`
	// True if the token signature was verified.
	//
	// It means the token was generated by the token server and its body is not
	// a garbage. Note that a token can be correctly signed, but invalid (if it
	// has expired).
	//
	// If 'signed' is false, the fields below may (or may not) be a garbage.
	//
	// The token server uses private keys managed by Google Cloud Platform, they
	// are constantly being rotated and "old" signatures become invalid over time
	// (when corresponding keys are rotated out of existence).
	//
	// If 'signed' is false, use the rest of the response only as FYI, possibly
	// invalid or even maliciously constructed.
	Signed bool `protobuf:"varint,3,opt,name=signed,proto3" json:"signed,omitempty"`
	// True if the token signature was verified and token hasn't expired yet.
	//
	// We use "non_" prefix to make default 'false' value safer.
	NonExpired bool `protobuf:"varint,4,opt,name=non_expired,json=nonExpired,proto3" json:"non_expired,omitempty"`
	// The deserialized token envelope.
	//
	// May be empty if token was malformed and couldn't be deserialized.
	Envelope *messages.DelegationToken `protobuf:"bytes,5,opt,name=envelope,proto3" json:"envelope,omitempty"`
	// The deserialized token body (deserialized 'envelope.serialized_subtoken').
	//
	// May be empty if token was malformed and couldn't be deserialized.
	Subtoken *messages.Subtoken `protobuf:"bytes,6,opt,name=subtoken,proto3" json:"subtoken,omitempty"`
	// contains filtered or unexported fields
}

type InspectMachineTokenRequest struct {

	// The type of token being checked.
	//
	// Currently only LUCI_MACHINE_TOKEN is supported. This is also the default.
	TokenType api.MachineTokenType `protobuf:"varint,1,opt,name=token_type,json=tokenType,proto3,enum=tokenserver.MachineTokenType" json:"token_type,omitempty"`
	// The token body. Exact meaning depends on token_type.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type InspectMachineTokenResponse struct {

	// True if the token is valid.
	//
	// A token is valid if its signature is correct, it hasn't expired yet and
	// the credentials it was built from (e.g. a certificate) wasn't revoked.
	Valid bool `protobuf:"varint,1,opt,name=valid,proto3" json:"valid,omitempty"`
	// Human readable summary of why token is invalid.
	//
	// Summarizes the rest of the fields of this struct. Set only if 'valid' is
	// false.
	InvalidityReason string `protobuf:"bytes,2,opt,name=invalidity_reason,json=invalidityReason,proto3" json:"invalidity_reason,omitempty"`
	// True if the token signature was verified.
	//
	// It means the token was generated by the token server and its body is not
	// a garbage. Note that a token can be correctly signed, but invalid (if it
	// has expired or was revoked).
	//
	// If 'signed' is false, the fields below may (or may not) be a garbage.
	//
	// The token server uses private keys managed by Google Cloud Platform, they
	// are constantly being rotated and "old" signatures become invalid over time
	// (when corresponding keys are rotated out of existence).
	//
	// If 'signed' is false, use the rest of the response only as FYI, possibly
	// invalid or even maliciously constructed.
	Signed bool `protobuf:"varint,3,opt,name=signed,proto3" json:"signed,omitempty"`
	// True if the token signature was verified and token hasn't expired yet.
	//
	// We use "non_" prefix to make default 'false' value safer.
	NonExpired bool `protobuf:"varint,4,opt,name=non_expired,json=nonExpired,proto3" json:"non_expired,omitempty"`
	// True if the token signature was verified and the token wasn't revoked.
	//
	// It is possible for an expired token to be non revoked. They are independent
	// properties.
	//
	// We use "non_" prefix to make default 'false' value safer.
	NonRevoked bool `protobuf:"varint,5,opt,name=non_revoked,json=nonRevoked,proto3" json:"non_revoked,omitempty"`
	// Id of a private key used to sign this token, if applicable.
	SigningKeyId string `protobuf:"bytes,6,opt,name=signing_key_id,json=signingKeyId,proto3" json:"signing_key_id,omitempty"`
	// Name of a CA that issued the cert the token is based on, if applicable.
	//
	// Resolved from 'ca_id' field of the token body.
	CertCaName string `protobuf:"bytes,7,opt,name=cert_ca_name,json=certCaName,proto3" json:"cert_ca_name,omitempty"`
	// The decoded token body (depends on token_type request parameter). Empty if
	// token was malformed and couldn't be deserialized.
	//
	// Types that are assignable to TokenType:
	//	*InspectMachineTokenResponse_LuciMachineToken
	TokenType isInspectMachineTokenResponse_TokenType `protobuf_oneof:"token_type"`
	// contains filtered or unexported fields
}

type InspectMachineTokenResponse_LuciMachineToken struct {
	LuciMachineToken *api.MachineTokenBody `protobuf:"bytes,20,opt,name=luci_machine_token,json=luciMachineToken,proto3,oneof"`
}

type InspectOAuthTokenGrantRequest struct {

	// The token body.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type InspectOAuthTokenGrantResponse struct {

	// True if the token is valid.
	//
	// A token is valid if its signature is correct, it hasn't expired yet and
	// token server rules still allow it.
	Valid bool `protobuf:"varint,1,opt,name=valid,proto3" json:"valid,omitempty"`
	// Human readable summary of why token is invalid.
	//
	// Summarizes the rest of the fields of this struct. Set only if 'valid' is
	// false.
	InvalidityReason string `protobuf:"bytes,2,opt,name=invalidity_reason,json=invalidityReason,proto3" json:"invalidity_reason,omitempty"`
	// True if the token signature was verified.
	//
	// It means the token was generated by the token server and its body is not
	// a garbage. Note that a token can be correctly signed, but invalid (if it
	// has expired).
	//
	// If 'signed' is false, the fields below may (or may not) be a garbage.
	//
	// The token server uses private keys managed by Google Cloud Platform, they
	// are constantly being rotated and "old" signatures become invalid over time
	// (when corresponding keys are rotated out of existence).
	//
	// If 'signed' is false, use the rest of the response only as FYI, possibly
	// invalid or even maliciously constructed.
	Signed bool `protobuf:"varint,3,opt,name=signed,proto3" json:"signed,omitempty"`
	// True if the token signature was verified and token hasn't expired yet.
	//
	// We use "non_" prefix to make default 'false' value safer.
	NonExpired bool `protobuf:"varint,4,opt,name=non_expired,json=nonExpired,proto3" json:"non_expired,omitempty"`
	// ID of a token server private key used to sign the token.
	SigningKeyId string `protobuf:"bytes,5,opt,name=signing_key_id,json=signingKeyId,proto3" json:"signing_key_id,omitempty"`
	// The deserialized token body.
	//
	// May be empty if token was malformed and couldn't be deserialized.
	TokenBody *api.OAuthTokenGrantBody `protobuf:"bytes,6,opt,name=token_body,json=tokenBody,proto3" json:"token_body,omitempty"`
	// The service_accounts.cfg rule that governs the service account usage.
	//
	// May be present even if the token is not allowed by it.
	MatchingRule *ServiceAccountRule `protobuf:"bytes,7,opt,name=matching_rule,json=matchingRule,proto3" json:"matching_rule,omitempty"`
	// True if current service_accounts.cfg rules allow this token.
	AllowedByRules bool `protobuf:"varint,8,opt,name=allowed_by_rules,json=allowedByRules,proto3" json:"allowed_by_rules,omitempty"`
	// contains filtered or unexported fields
}

type IsRevokedCertRequest struct {
	Ca string `protobuf:"bytes,1,opt,name=ca,proto3" json:"ca,omitempty"` // Common Name of the CA
	Sn string `protobuf:"bytes,2,opt,name=sn,proto3" json:"sn,omitempty"` // cert's serial number (big.Int encoded as a decimal string)
	// contains filtered or unexported fields
}

type IsRevokedCertResponse struct {
	Revoked bool `protobuf:"varint,1,opt,name=revoked,proto3" json:"revoked,omitempty"` // true if the cert with given SN is in CRL
	// contains filtered or unexported fields
}

type ListCAsResponse struct {
	Cn []string `protobuf:"bytes,1,rep,name=cn,proto3" json:"cn,omitempty"` // Common Name of the CA
	// contains filtered or unexported fields
}

type ServiceAccountRule struct {

	// A descriptive name of this rule, for the audit log.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Email of developers that own this rule, to know who to contact.
	Owner []string `protobuf:"bytes,2,rep,name=owner,proto3" json:"owner,omitempty"`
	// Email of service accounts that this rule applies to.
	//
	// Can be used to explicitly list service accounts in the config.
	ServiceAccount []string `protobuf:"bytes,3,rep,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
	// Name of a group with service account emails this rules applies to.
	//
	// Works in addition to the explicit service account listing.
	ServiceAccountGroup []string `protobuf:"bytes,9,rep,name=service_account_group,json=serviceAccountGroup,proto3" json:"service_account_group,omitempty"`
	// OAuth scopes we allow to be granted to the OAuth token.
	//
	// Any subset of given scopes is allowed. This field is evaluated in
	// MintOAuthTokenViaGrant RPC handler, right before generating the OAuth
	// token.
	//
	// Merged with corresponding list from ServiceAccountRuleDefaults.
	AllowedScope []string `protobuf:"bytes,4,rep,name=allowed_scope,json=allowedScope,proto3" json:"allowed_scope,omitempty"`
	// A set of identities that are allowed to act as the service account (perhaps
	// indirectly through some other intermediary "proxy" service like Swarming).
	//
	// Users listed here are ultimately able to grab an OAuth token belonging to
	// the service account.
	//
	// Each element is either:
	//  * An identity string ("user:<email>").
	//  * A group reference ("group:<name>").
	EndUser []string `protobuf:"bytes,5,rep,name=end_user,json=endUser,proto3" json:"end_user,omitempty"`
	// A set of identities that are allowed to act on behalf of end users when
	// grabbing an OAuth token for the service account.
	//
	// These identities represent "proxy" services that do something with service
	// accounts on behalf of end users. Only identities in this set are allowed
	// to perform MintOAuthTokenGrant RPC.
	//
	// Each element is either:
	//  * An identity string ("user:<email>").
	//  * A group reference ("group:<name>").
	Proxy []string `protobuf:"bytes,6,rep,name=proxy,proto3" json:"proxy,omitempty"`
	// Same as 'proxy', except for proxies specified here the end_user check is
	// skipped: these proxies can grab a token for _any_ service account listed
	// in the rule, regardless of who the end user is.
	//
	// The trusted proxies are assumed to authorize the end user already and
	// the token server trusts this decision (thus the name of the field).
	TrustedProxy []string `protobuf:"bytes,8,rep,name=trusted_proxy,json=trustedProxy,proto3" json:"trusted_proxy,omitempty"`
	// Maximum allowed validity duration (sec) of OAuth token grants.
	//
	// The grant is minted by MintOAuthTokenGrant RPC (called, for example, when
	// Swarming task is posted), and checked by MintOAuthTokenViaGrant RPC (called
	// when the task actually runs). So the allowed validity duration should
	// account for possible queuing delays.
	//
	// This duration has no relation to the OAuth token lifetime. The OAuth token
	// produced by MintOAuthTokenViaGrant can always live up to 1h regardless of
	// validity duration of the grant.
	//
	// Default is taken from ServiceAccountRuleDefaults or 48 hours if not
	// specified there.
	MaxGrantValidityDuration int64 `` /* 138-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ServiceAccountRuleDefaults struct {

	// OAuth scopes we allow to be granted to all generated OAuth tokens.
	//
	// Always merged with 'allowed_scope' fields of ServiceAccountRule rule to
	// get the final list of scopes.
	AllowedScope []string `protobuf:"bytes,1,rep,name=allowed_scope,json=allowedScope,proto3" json:"allowed_scope,omitempty"`
	// Default value for corresponding ServiceAccountRule field, if not specified
	// there.
	//
	// Default is 48 hours.
	MaxGrantValidityDuration int64 `` /* 138-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ServiceAccountsPermissions struct {

	// Rules specify how MintOAuthTokenViaGrant can be used.
	//
	// Rules define a mapping {service account email -> authorization config},
	// where 'service account email' is matched to a set of emails specified via
	// 'service_account' and 'service_account_group' fields of ServiceAccountRule,
	// and 'authorization config' is the rest of fields in ServiceAccountRule that
	// define how exactly the given service account is allowed to be used.
	//
	// If a service account email matches two (or more) rules, perhaps via
	// different groups, an error will be returned. Ambiguity is not allowed.
	//
	// See ServiceAccountRule comments for more details.
	Rules []*ServiceAccountRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"`
	// Defaults specifies some default values applied to all rules, to reduce
	// duplication.
	//
	// See docs for individual fields to figure out how defaults are merged into
	// the rules.
	Defaults *ServiceAccountRuleDefaults `protobuf:"bytes,2,opt,name=defaults,proto3" json:"defaults,omitempty"`
	// contains filtered or unexported fields
}

type ServiceAccountsProjectMapping struct {

	// Each entry maps a bunch of service accounts to one or more projects.
	Mapping []*ServiceAccountsProjectMapping_Mapping `protobuf:"bytes,1,rep,name=mapping,proto3" json:"mapping,omitempty"`
	// contains filtered or unexported fields
}

type ServiceAccountsProjectMapping_Mapping struct {

	// Names of LUCI projects.
	Project []string `protobuf:"bytes,1,rep,name=project,proto3" json:"project,omitempty"`
	// Emails of service accounts allowed to be used by all these projects.
	ServiceAccount []string `protobuf:"bytes,2,rep,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
	// contains filtered or unexported fields
}

type TokenServerConfig struct {

	// List of CAs we trust.
	CertificateAuthority []*CertificateAuthorityConfig `protobuf:"bytes,1,rep,name=certificate_authority,json=certificateAuthority,proto3" json:"certificate_authority,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAdminServer struct {
}

type UnimplementedCertificateAuthoritiesServer struct {
}

type UnsafeAdminServer interface {
	// contains filtered or unexported methods
}

type UnsafeCertificateAuthoritiesServer interface {
	// contains filtered or unexported methods
}