sidecar

type AuthClient interface {
	// Authenticate receives metadata of the incoming call and uses it to
	// authenticate the caller, i.e. it extracts appropriate credentials and
	// verifies they are valid.
	//
	// Optionally checks if the authenticated identity is a member of groups
	// given by `groups` request field, returning groups the identity is a member
	// of in `groups` response field (which will be a subset of groups passed in
	// the request). This is useful for implementing simple broad group-based
	// authorization checks skipping extra RPCs. For more flexible checks see
	// IsMember and HasPermission RPCs.
	//
	// Returns:
	//   - OK if the server understood the request and performed the
	//     authentication. The outcome (which can include an error if credentials
	//     are invalid) is available as part of AuthenticateResponse. OK is
	//     returned as well if the request doesn't have credentials attached at
	//     all or they were invalid. In that case AuthenticateResponse contains
	//     `anonymous` or `error` outcomes respectively.
	//   - UNAUTHENTICATED if the call to the sidecar server itself failed due to
	//     invalid (corrupted, expired, etc) RPC credentials, i.e. credentials of
	//     the sidecar client itself, not credentials inside AuthenticateRequest.
	//     This response MUST be presented as INTERNAL error to the end user,
	//     since it indicates some internal misconfiguration between the
	//     application server and the sidecar service, unrelated to credentials
	//     sent by the end-user.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	Authenticate(ctx context.Context, in *AuthenticateRequest, opts ...grpc.CallOption) (*AuthenticateResponse, error)
	// IsMember checks if an identity belongs to any of the given groups.
	//
	// Returns:
	//   - OK with the outcome of the check (which may be negative) if the check
	//     was performed successfully.
	//   - INVALID_ARGUMENT if the request is malformed.
	//   - UNAUTHENTICATED if the call to the sidecar server failed due to invalid
	//     (corrupted, expired, etc) RPC credentials. This response MUST be
	//     presented as INTERNAL error to the end user, since it indicates some
	//     internal misconfiguration between the application server and the
	//     sidecar service.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	IsMember(ctx context.Context, in *IsMemberRequest, opts ...grpc.CallOption) (*IsMemberResponse, error)
	// HasPermission check if an identity has a permission in a realm.
	//
	// Can only check permissions registered when the sidecar server was started
	// via `-sidecar-subscribe-to-permission` command line flag. Checks for any
	// other permission will end up with INVALID_ARGUMENT error.
	//
	// Returns:
	//   - OK with the outcome of the check (which may be negative) if the check
	//     was performed successfully.
	//   - INVALID_ARGUMENT if the request is malformed or the specified
	//     permission was not registered with the sidecar server via
	//     `-sidecar-subscribe-to-permission` command line flag.
	//   - UNAUTHENTICATED if the call to the sidecar server failed due to invalid
	//     (corrupted, expired, etc) RPC credentials. This response MUST be
	//     presented as INTERNAL error to the end user, since it indicates some
	//     internal misconfiguration between the application server and the
	//     sidecar service.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	HasPermission(ctx context.Context, in *HasPermissionRequest, opts ...grpc.CallOption) (*HasPermissionResponse, error)
}

type AuthServer interface {
	// Authenticate receives metadata of the incoming call and uses it to
	// authenticate the caller, i.e. it extracts appropriate credentials and
	// verifies they are valid.
	//
	// Optionally checks if the authenticated identity is a member of groups
	// given by `groups` request field, returning groups the identity is a member
	// of in `groups` response field (which will be a subset of groups passed in
	// the request). This is useful for implementing simple broad group-based
	// authorization checks skipping extra RPCs. For more flexible checks see
	// IsMember and HasPermission RPCs.
	//
	// Returns:
	//   - OK if the server understood the request and performed the
	//     authentication. The outcome (which can include an error if credentials
	//     are invalid) is available as part of AuthenticateResponse. OK is
	//     returned as well if the request doesn't have credentials attached at
	//     all or they were invalid. In that case AuthenticateResponse contains
	//     `anonymous` or `error` outcomes respectively.
	//   - UNAUTHENTICATED if the call to the sidecar server itself failed due to
	//     invalid (corrupted, expired, etc) RPC credentials, i.e. credentials of
	//     the sidecar client itself, not credentials inside AuthenticateRequest.
	//     This response MUST be presented as INTERNAL error to the end user,
	//     since it indicates some internal misconfiguration between the
	//     application server and the sidecar service, unrelated to credentials
	//     sent by the end-user.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	Authenticate(context.Context, *AuthenticateRequest) (*AuthenticateResponse, error)
	// IsMember checks if an identity belongs to any of the given groups.
	//
	// Returns:
	//   - OK with the outcome of the check (which may be negative) if the check
	//     was performed successfully.
	//   - INVALID_ARGUMENT if the request is malformed.
	//   - UNAUTHENTICATED if the call to the sidecar server failed due to invalid
	//     (corrupted, expired, etc) RPC credentials. This response MUST be
	//     presented as INTERNAL error to the end user, since it indicates some
	//     internal misconfiguration between the application server and the
	//     sidecar service.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	IsMember(context.Context, *IsMemberRequest) (*IsMemberResponse, error)
	// HasPermission check if an identity has a permission in a realm.
	//
	// Can only check permissions registered when the sidecar server was started
	// via `-sidecar-subscribe-to-permission` command line flag. Checks for any
	// other permission will end up with INVALID_ARGUMENT error.
	//
	// Returns:
	//   - OK with the outcome of the check (which may be negative) if the check
	//     was performed successfully.
	//   - INVALID_ARGUMENT if the request is malformed or the specified
	//     permission was not registered with the sidecar server via
	//     `-sidecar-subscribe-to-permission` command line flag.
	//   - UNAUTHENTICATED if the call to the sidecar server failed due to invalid
	//     (corrupted, expired, etc) RPC credentials. This response MUST be
	//     presented as INTERNAL error to the end user, since it indicates some
	//     internal misconfiguration between the application server and the
	//     sidecar service.
	//   - PERMISSION_DENIED if the call to the sidecar server itself is not
	//     allowed. This response MUST also be presented as INTERNAL error to
	//     the end user.
	//   - INTERNAL on transient internal errors that SHOULD be retried.
	HasPermission(context.Context, *HasPermissionRequest) (*HasPermissionResponse, error)
	// contains filtered or unexported methods
}

type AuthenticateRequest struct {
	Protocol AuthenticateRequest_Protocol    `protobuf:"varint,1,opt,name=protocol,proto3,enum=luci.sidecar.AuthenticateRequest_Protocol" json:"protocol,omitempty"`
	Metadata []*AuthenticateRequest_Metadata `protobuf:"bytes,2,rep,name=metadata,proto3" json:"metadata,omitempty"`
	// List of groups to check an authenticated identity is a member of.
	//
	// The result of this check is returned via `groups` response field.
	Groups []string `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateRequest_Metadata struct {

	// Metadata key. Case-insensitive.
	//
	// If `protocol` is `GRPC`, keys ending with `-bin` indicate the value
	// is base64-encoded. The application server MUST base64-encode binary
	// metadata values before passing them to the sidecar server.
	//
	// For other protocols, keys ending with `-bin` have no special meaning,
	// since they don't support arbitrary binary headers.
	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	// Metadata value.
	//
	// If `protocol` is `GRPC` and the key ends with `-bin`, this MUST be
	// the base64-encoded value. The sidecar server will decode it into its
	// original binary form before using it.
	//
	// For other protocols, keys ending with `-bin` have no special meaning,
	// since they don't support arbitrary binary headers.
	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateRequest_Protocol int32

type AuthenticateResponse struct {

	// An authenticated identity (`<kind>:<value>`). Details are in `outcome`.
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// Sidecar server information for logging and debugging.
	ServerInfo *ServerInfo `protobuf:"bytes,2,opt,name=server_info,json=serverInfo,proto3" json:"server_info,omitempty"`
	// List of groups the identity is a member of.
	//
	// This is a subset of groups passed via `groups` request field.
	Groups []string `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
	// Types that are assignable to Outcome:
	//
	//	*AuthenticateResponse_Error
	//	*AuthenticateResponse_Anonymous_
	//	*AuthenticateResponse_User_
	//	*AuthenticateResponse_Project_
	Outcome isAuthenticateResponse_Outcome `protobuf_oneof:"outcome"`
	// contains filtered or unexported fields
}

type AuthenticateResponse_Anonymous struct {
	// contains filtered or unexported fields
}

type AuthenticateResponse_Anonymous_ struct {
	// The request had no recognized credentials attached.
	Anonymous *AuthenticateResponse_Anonymous `protobuf:"bytes,11,opt,name=anonymous,proto3,oneof"`
}

type AuthenticateResponse_Error struct {
	// Set if the RPC to the sidecar succeeded, but passed credentials are bad.
	Error *status.Status `protobuf:"bytes,10,opt,name=error,proto3,oneof"`
}

type AuthenticateResponse_Project struct {

	// LUCI project name representing the context of the call.
	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"`
	// Identity string of the LUCI service that makes the call.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateResponse_Project_ struct {
	// The request is an internal LUCI call from another LUCI service.
	Project *AuthenticateResponse_Project `protobuf:"bytes,13,opt,name=project,proto3,oneof"`
}

type AuthenticateResponse_User struct {

	// An authenticated user email. Always set.
	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
	// A full user name, if available.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// An URL to profile picture, if available.
	Picture string `protobuf:"bytes,3,opt,name=picture,proto3" json:"picture,omitempty"`
	// OAuth client ID if the request was authenticated using OAuth.
	ClientId string `protobuf:"bytes,4,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// contains filtered or unexported fields
}

type AuthenticateResponse_User_ struct {
	// The request had an end-user credentials attached.
	User *AuthenticateResponse_User `protobuf:"bytes,12,opt,name=user,proto3,oneof"`
}

type HasPermissionRequest struct {

	// Identity to check a permission of as a `<kind>:<value>` string.
	//
	// This is the same identity as returned in AuthenticateResponse. Possible
	// formats:
	//   - `anonymous:anonymous` for an anonymous caller.
	//   - `user:<email>` for an end user or a service account.
	//   - `project:<name>` for a LUCI project calling a LUCI service.
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// Permission to check as `<service>.<subject>.<verb>` string.
	//
	// The sidecar server can only check permissions registered when it was
	// started via `-sidecar-subscribe-to-permission` command line flag. Checks
	// for any other permission will end up with INVALID_ARGUMENT error.
	Permission string `protobuf:"bytes,2,opt,name=permission,proto3" json:"permission,omitempty"`
	// A realm to check the permission in as `<project>:<realm>` string.
	//
	// A non-existing realm is replaced with the corresponding root realm (e.g. if
	// `projectA:some/realm` doesn't exist, `projectA:@root` will be used in its
	// place). If the project doesn't exist, all its realms (including the root
	// realm) are considered empty. The permission check ends with negative
	// outcome in that case.
	Realm string `protobuf:"bytes,3,opt,name=realm,proto3" json:"realm,omitempty"`
	// Attributes are the context of this particular permission check and are used
	// as inputs to `conditions` predicates in conditional bindings. If a service
	// supports conditional bindings, it must document what attributes it passes
	// with each permission it checks.
	Attributes map[string]string `` /* 161-byte string literal not displayed */
	// contains filtered or unexported fields
}

type HasPermissionResponse struct {

	// True if the identity has the requested permission.
	HasPermission bool `protobuf:"varint,1,opt,name=has_permission,json=hasPermission,proto3" json:"has_permission,omitempty"`
	// Sidecar server information for logging and debugging.
	ServerInfo *ServerInfo `protobuf:"bytes,2,opt,name=server_info,json=serverInfo,proto3" json:"server_info,omitempty"`
	// contains filtered or unexported fields
}

type IsMemberRequest struct {

	// Identity to check a membership of as a `<kind>:<value>` string.
	//
	// This is the same identity as returned in AuthenticateResponse. Possible
	// formats:
	//   - `anonymous:anonymous` for an anonymous caller.
	//   - `user:<email>` for an end user or a service account.
	//   - `project:<name>` for a LUCI project calling a LUCI service.
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// List of groups to check memberships in, must have at least one entry.
	//
	// The check is overall positive if `identity` is a member of at least one
	// group here.
	Groups []string `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
	// contains filtered or unexported fields
}

type IsMemberResponse struct {

	// True if the identity is a member of at least one group.
	IsMember bool `protobuf:"varint,1,opt,name=is_member,json=isMember,proto3" json:"is_member,omitempty"`
	// Sidecar server information for logging and debugging.
	ServerInfo *ServerInfo `protobuf:"bytes,2,opt,name=server_info,json=serverInfo,proto3" json:"server_info,omitempty"`
	// contains filtered or unexported fields
}

type ServerInfo struct {

	// Service name of the LUCI Sidecar server to identify its monitoring metrics.
	SidecarService string `protobuf:"bytes,1,opt,name=sidecar_service,json=sidecarService,proto3" json:"sidecar_service,omitempty"`
	// Job name of the LUCI Sidecar server to identify its monitoring metrics.
	SidecarJob string `protobuf:"bytes,2,opt,name=sidecar_job,json=sidecarJob,proto3" json:"sidecar_job,omitempty"`
	// Hostname of the LUCI Sidecar server to identify its monitoring metrics.
	SidecarHost string `protobuf:"bytes,3,opt,name=sidecar_host,json=sidecarHost,proto3" json:"sidecar_host,omitempty"`
	// Version of the LUCI Sidecar server for logs.
	SidecarVersion string `protobuf:"bytes,4,opt,name=sidecar_version,json=sidecarVersion,proto3" json:"sidecar_version,omitempty"`
	// Hostname of LUCI Auth service that produced AuthDB.
	AuthDbService string `protobuf:"bytes,5,opt,name=auth_db_service,json=authDbService,proto3" json:"auth_db_service,omitempty"`
	// Revision of LUCI AuthDB used during authorization checks.
	AuthDbRev int64 `protobuf:"varint,6,opt,name=auth_db_rev,json=authDbRev,proto3" json:"auth_db_rev,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAuthServer struct {
}

type UnsafeAuthServer interface {
	// contains filtered or unexported methods
}