storage

type AuthCode struct {
	// Actual string returned as the "code" value.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// The client this code value is valid for. When exchanging the code for a
	// token response, the client must use its client_secret to authenticate.
	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// As part of the OAuth2 spec when a client makes a token request it MUST
	// present the same redirect_uri as the initial redirect. This values is saved
	// to make this check.
	//
	// https://tools.ietf.org/html/rfc6749#section-4.1.3
	RedirectUri string `protobuf:"bytes,3,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// If provided by the client in the initial request, the provider MUST create
	// a ID Token with this nonce in the JWT payload.
	Nonce string `protobuf:"bytes,4,opt,name=nonce,proto3" json:"nonce,omitempty"`
	// Scopes authorized by the end user for the client.
	Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Authentication data provided by an upstream source.
	ConnectorId          string               `protobuf:"bytes,6,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
	ConnectorData        []byte               `protobuf:"bytes,7,opt,name=connector_data,json=connectorData,proto3" json:"connector_data,omitempty"`
	Claims               *Claims              `protobuf:"bytes,8,opt,name=claims,proto3" json:"claims,omitempty"`
	Expiry               *timestamp.Timestamp `protobuf:"bytes,9,opt,name=expiry,proto3" json:"expiry,omitempty"`
	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
	XXX_unrecognized     []byte               `json:"-"`
	XXX_sizecache        int32                `json:"-"`
}

type AuthRequest struct {
	// ID used to identify the authorization request.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// ID of the client requesting authorization from a user.
	ClientId string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Values parsed from the initial request. These describe the resources the
	// client is
	// requesting as well as values describing the form of the response.
	ResponseTypes []string `protobuf:"bytes,3,rep,name=response_types,json=responseTypes,proto3" json:"response_types,omitempty"`
	Scopes        []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
	RedirectUri   string   `protobuf:"bytes,5,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	Nonce         string   `protobuf:"bytes,6,opt,name=nonce,proto3" json:"nonce,omitempty"`
	State         string   `protobuf:"bytes,7,opt,name=state,proto3" json:"state,omitempty"`
	// OPTIONAL. Requested Authentication Context Class Reference values.
	// Space-separated string that specifies the acr values that the Authorization
	// Server is being requested to use for processing this Authentication
	// Request, with the values appearing in order of preference.
	// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
	AcrValues []string `protobuf:"bytes,14,rep,name=acr_values,json=acrValues,proto3" json:"acr_values,omitempty"`
	// The client has indicated that the end user must be shown an approval prompt
	// on all requests. The server cannot cache their initial action for
	// subsequent attempts.
	ForceApprovalPrompt bool                 `protobuf:"varint,8,opt,name=force_approval_prompt,json=forceApprovalPrompt,proto3" json:"force_approval_prompt,omitempty"`
	Expiry              *timestamp.Timestamp `protobuf:"bytes,9,opt,name=expiry,proto3" json:"expiry,omitempty"`
	// Has the user proved their identity through a backing identity provider?
	//
	// If false, the following fields are invalid.
	LoggedIn bool `protobuf:"varint,10,opt,name=loggedIn,proto3" json:"loggedIn,omitempty"`
	// The identity of the end user. Generally nil until the user authenticates
	// with a backend.
	Claims *Claims `protobuf:"bytes,11,opt,name=claims,proto3" json:"claims,omitempty"`
	// The connector used to login the user and any data the connector wishes to
	// persists. Set when the user authenticates.
	ConnectorId string `protobuf:"bytes,12,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
	// arbitrary connector data. Usually JSON blob
	ConnectorData        []byte   `protobuf:"bytes,13,opt,name=connector_data,json=connectorData,proto3" json:"connector_data,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type Claims struct {
	UserId               string                `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	Username             string                `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
	Email                string                `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
	EmailVerified        bool                  `protobuf:"varint,4,opt,name=email_verified,json=emailVerified,proto3" json:"email_verified,omitempty"`
	Groups               []string              `protobuf:"bytes,5,rep,name=groups,proto3" json:"groups,omitempty"`
	Acr                  *wrappers.StringValue `protobuf:"bytes,6,opt,name=acr,proto3" json:"acr,omitempty"`
	Amr                  []string              `protobuf:"bytes,7,rep,name=amr,proto3" json:"amr,omitempty"`
	XXX_NoUnkeyedLiteral struct{}              `json:"-"`
	XXX_unrecognized     []byte                `json:"-"`
	XXX_sizecache        int32                 `json:"-"`
}

type Keys struct {
	// Key for creating and verifying signatures. These may be nil. They are
	// store a JWK JSON Blobs
	SigningKey    []byte `protobuf:"bytes,1,opt,name=SigningKey,json=signing_key,proto3" json:"SigningKey,omitempty"`
	SigningKeyPub []byte `protobuf:"bytes,2,opt,name=SigningKeyPub,json=signing_key_pub,proto3" json:"SigningKeyPub,omitempty"`
	// Old signing keys which have been rotated but can still be used to validate
	// existing signatures.
	VerificationKeys []*VerificationKey `protobuf:"bytes,3,rep,name=verification_keys,proto3" json:"verification_keys,omitempty"`
	// The next time the signing key will rotate.
	//
	// For caching purposes, implementations MUST NOT update keys before this
	// time.
	NextRotation         *timestamp.Timestamp `protobuf:"bytes,4,opt,name=next_rotation,proto3" json:"next_rotation,omitempty"`
	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
	XXX_unrecognized     []byte               `json:"-"`
	XXX_sizecache        int32                `json:"-"`
}

type OfflineSessions struct {
	// UserID of an end user who has logged in to the server.
	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// The ID of the connector used to login the user.
	ConnId string `protobuf:"bytes,2,opt,name=conn_id,json=connId,proto3" json:"conn_id,omitempty"`
	// Refresh is a hash table of refresh token reference objects
	// indexed by the ClientID of the refresh token.
	Refresh              map[string]*RefreshTokenRef `` /* 155-byte string literal not displayed */
	XXX_NoUnkeyedLiteral struct{}                    `json:"-"`
	XXX_unrecognized     []byte                      `json:"-"`
	XXX_sizecache        int32                       `json:"-"`
}

type RefreshToken struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// A single token that's rotated every time the refresh token is refreshed.
	//
	// May be empty.
	Token     string               `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	CreatedAt *timestamp.Timestamp `protobuf:"bytes,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	LastUsed  *timestamp.Timestamp `protobuf:"bytes,4,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
	// Client this refresh token is valid for.
	ClientId string `protobuf:"bytes,5,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Authentication data provided by an upstream source.
	ConnectorId   string  `protobuf:"bytes,6,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
	ConnectorData []byte  `protobuf:"bytes,7,opt,name=connector_data,json=connectorData,proto3" json:"connector_data,omitempty"`
	Claims        *Claims `protobuf:"bytes,8,opt,name=claims,proto3" json:"claims,omitempty"`
	// Scopes present in the initial request. Refresh requests may specify a set
	// of scopes different from the initial request when refreshing a token,
	// however those scopes must be encompassed by this set.
	Scopes []string `protobuf:"bytes,9,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Nonce value supplied during the initial redirect. This is required to be
	// part of the claims of any future id_token generated by the client.
	Nonce                string   `protobuf:"bytes,10,opt,name=nonce,proto3" json:"nonce,omitempty"`
	XXX_NoUnkeyedLiteral struct{} `json:"-"`
	XXX_unrecognized     []byte   `json:"-"`
	XXX_sizecache        int32    `json:"-"`
}

type RefreshTokenRef struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Client the refresh token is valid for.
	ClientId             string               `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	CreatedAt            *timestamp.Timestamp `protobuf:"bytes,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	LastUsed             *timestamp.Timestamp `protobuf:"bytes,4,opt,name=last_used,json=lastUsed,proto3" json:"last_used,omitempty"`
	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
	XXX_unrecognized     []byte               `json:"-"`
	XXX_sizecache        int32                `json:"-"`
}

type VerificationKey struct {
	// Stored as JWK JSON blob
	PublicKey            []byte               `protobuf:"bytes,1,opt,name=public_key,proto3" json:"public_key,omitempty"`
	Expiry               *timestamp.Timestamp `protobuf:"bytes,2,opt,name=expiry,proto3" json:"expiry,omitempty"`
	XXX_NoUnkeyedLiteral struct{}             `json:"-"`
	XXX_unrecognized     []byte               `json:"-"`
	XXX_sizecache        int32                `json:"-"`
}