serviceaccounts

type GrantLogger func(context.Context, *MintedGrantInfo) error

type ImportServiceAccountsConfigsRPC struct {
	RulesCache *RulesCache // usually GlobalRulesCache, but replaced in tests
}

type InspectOAuthTokenGrantRPC struct {
	// Signer is mocked in tests.
	//
	// In prod it is the default server signer that uses server's service account.
	Signer signing.Signer

	// Rules returns service account rules to use for the request.
	//
	// In prod it is GlobalRulesCache.Rules.
	Rules func(context.Context) (*Rules, error)
}

type MintOAuthTokenGrantRPC struct {
	// Signer is mocked in tests.
	//
	// In prod it is the default server signer that uses server's service account.
	Signer signing.Signer

	// Rules returns service account rules to use for the request.
	//
	// In prod it is GlobalRulesCache.Rules.
	Rules func(context.Context) (*Rules, error)

	// LogGrant is mocked in tests.
	//
	// In prod it is produced by NewGrantLogger.
	LogGrant GrantLogger
	// contains filtered or unexported fields
}

type MintOAuthTokenViaGrantRPC struct {
	// Signer is mocked in tests.
	//
	// In prod it is the default server signer that uses server's service account.
	Signer signing.Signer

	// Rules returns service account rules to use for the request.
	//
	// In prod it is GlobalRulesCache.Rules.
	Rules func(context.Context) (*Rules, error)

	// MintAccessToken produces an OAuth token for a service account.
	//
	// In prod it is auth.MintAccessTokenForServiceAccount.
	MintAccessToken func(context.Context, auth.MintAccessTokenParams) (*auth.Token, error)

	// LogOAuthToken is mocked in tests.
	//
	// In prod it is produced by NewOAuthTokenLogger.
	LogOAuthToken OAuthTokenLogger
}

type MintedGrantInfo struct {
	Request   *minter.MintOAuthTokenGrantRequest  // RPC input, as is
	Response  *minter.MintOAuthTokenGrantResponse // RPC output, as is
	GrantBody *tokenserver.OAuthTokenGrantBody    // deserialized grant
	ConfigRev string                              // revision of the service_accounts.cfg used
	Rule      *admin.ServiceAccountRule           // the particular rule used to authorize the request
	PeerIP    net.IP                              // caller IP address
	RequestID string                              // GAE request ID that handled the RPC
	AuthDBRev int64                               // revision of groups database (or 0 if unknown)
}

type MintedOAuthTokenInfo struct {
	RequestedAt time.Time                              // when the RPC happened
	Request     *minter.MintOAuthTokenViaGrantRequest  // RPC input, as is
	Response    *minter.MintOAuthTokenViaGrantResponse // RPC output, as is
	GrantBody   *tokenserver.OAuthTokenGrantBody       // deserialized grant
	ConfigRev   string                                 // revision of the service_accounts.cfg used
	Rule        *admin.ServiceAccountRule              // the particular rule used to authorize the request
	PeerIP      net.IP                                 // caller IP address
	RequestID   string                                 // GAE request ID that handled the RPC
	AuthDBRev   int64                                  // revision of groups database (or 0 if unknown)
}

type OAuthTokenLogger func(context.Context, *MintedOAuthTokenInfo) error

type Rule struct {
	Rule           *admin.ServiceAccountRule // original proto with the rule
	Revision       string                    // revision of the file with the rule
	AllowedScopes  stringset.Set             // parsed 'allowed_scope'
	EndUsers       *identityset.Set          // parsed 'end_user'
	Proxies        *identityset.Set          // parsed 'proxy'
	TrustedProxies *identityset.Set          // parsed 'trusted_proxy'
	AllProxies     *identityset.Set          // union of 'proxy' and 'trusted_proxy'
}

type Rules struct {
	// contains filtered or unexported fields
}

type RulesCache struct {
	// contains filtered or unexported fields
}

type RulesQuery struct {
	ServiceAccount string            // email of an account being used
	Rule           *Rule             // the matching rule, if already known
	Proxy          identity.Identity // who's calling the Token Server
	EndUser        identity.Identity // who initiates the usage of an account
}