protocol

type AuthDB struct {

	// OAuth2 client_id to use to mint new OAuth2 tokens.
	OauthClientId string `protobuf:"bytes,1,opt,name=oauth_client_id,json=oauthClientId,proto3" json:"oauth_client_id,omitempty"`
	// OAuth2 client secret. Not so secret really, since it's passed to clients.
	OauthClientSecret string `protobuf:"bytes,2,opt,name=oauth_client_secret,json=oauthClientSecret,proto3" json:"oauth_client_secret,omitempty"`
	// Additional OAuth2 client_ids allowed to access the services.
	OauthAdditionalClientIds []string `` /* 137-byte string literal not displayed */
	// All groups.
	Groups []*AuthGroup `protobuf:"bytes,4,rep,name=groups,proto3" json:"groups,omitempty"`
	// All IP whitelists.
	IpWhitelists []*AuthIPWhitelist `protobuf:"bytes,6,rep,name=ip_whitelists,json=ipWhitelists,proto3" json:"ip_whitelists,omitempty"`
	// Mapping 'account -> IP whitlist to use for that account'.
	IpWhitelistAssignments []*AuthIPWhitelistAssignment `` /* 129-byte string literal not displayed */
	// URL of a token server to use to generate delegation tokens.
	TokenServerUrl string `protobuf:"bytes,8,opt,name=token_server_url,json=tokenServerUrl,proto3" json:"token_server_url,omitempty"`
	// Serialized security_config.SecurityConfig proto with security-related
	// configuration to distribute across all services.
	//
	// It is distributed in a serialized form to make sure old services ingest it
	// fully, even if they don't understand some SecurityConfig proto fields
	// (yet). As soon as their code is updated, they SHOULD start using all
	// SecurityConfig fields, without waiting for another push from Auth Service.
	//
	// If we use SecurityConfig directly here, old services would just drop fields
	// they don't understand when accepting an AuthDB push.
	SecurityConfig []byte `protobuf:"bytes,9,opt,name=security_config,json=securityConfig,proto3" json:"security_config,omitempty"`
	// Definition of all known permissions and realms in a LUCI deployment.
	//
	// It is ultimately used by LUCI services for authorizing access to resources.
	// See realms.proto for more details.
	Realms *Realms `protobuf:"bytes,11,opt,name=realms,proto3" json:"realms,omitempty"`
	// contains filtered or unexported fields
}

type AuthDBRevision struct {

	// GAE App ID of a service holding primary copy of Auth DB.
	PrimaryId string `protobuf:"bytes,1,opt,name=primary_id,json=primaryId,proto3" json:"primary_id,omitempty"`
	// Revision of Auth DB being pushed.
	AuthDbRev int64 `protobuf:"varint,2,opt,name=auth_db_rev,json=authDbRev,proto3" json:"auth_db_rev,omitempty"`
	// Timestamp of that revision by Primary's clock, microseconds since epoch.
	ModifiedTs int64 `protobuf:"varint,3,opt,name=modified_ts,json=modifiedTs,proto3" json:"modified_ts,omitempty"`
	// contains filtered or unexported fields
}

type AuthGroup struct {

	// Name of the group.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// List of members that are explicitly in this group.
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// List of identity-glob expressions (like 'user:*@example.com').
	Globs []string `protobuf:"bytes,3,rep,name=globs,proto3" json:"globs,omitempty"`
	// List of nested group names.
	Nested []string `protobuf:"bytes,4,rep,name=nested,proto3" json:"nested,omitempty"`
	// Human readable description.
	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	// When the group was created. Microseconds since epoch.
	CreatedTs int64 `protobuf:"varint,6,opt,name=created_ts,json=createdTs,proto3" json:"created_ts,omitempty"`
	// Who created the group.
	CreatedBy string `protobuf:"bytes,7,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
	// When the group was modified last time. Microseconds since epoch.
	ModifiedTs int64 `protobuf:"varint,8,opt,name=modified_ts,json=modifiedTs,proto3" json:"modified_ts,omitempty"`
	// Who modified the group last time.
	ModifiedBy string `protobuf:"bytes,9,opt,name=modified_by,json=modifiedBy,proto3" json:"modified_by,omitempty"`
	// A name of the group that can modify or delete this group.
	Owners string `protobuf:"bytes,10,opt,name=owners,proto3" json:"owners,omitempty"`
	// contains filtered or unexported fields
}

type AuthIPWhitelist struct {

	// Name of the IP whitelist.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The list of IP subnets.
	Subnets []string `protobuf:"bytes,2,rep,name=subnets,proto3" json:"subnets,omitempty"`
	// Human readable description.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// When the list was created. Microseconds since epoch.
	CreatedTs int64 `protobuf:"varint,4,opt,name=created_ts,json=createdTs,proto3" json:"created_ts,omitempty"`
	// Who created the list.
	CreatedBy string `protobuf:"bytes,5,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
	// When the list was modified. Microseconds since epoch.
	ModifiedTs int64 `protobuf:"varint,6,opt,name=modified_ts,json=modifiedTs,proto3" json:"modified_ts,omitempty"`
	// Who modified the list the last time.
	ModifiedBy string `protobuf:"bytes,7,opt,name=modified_by,json=modifiedBy,proto3" json:"modified_by,omitempty"`
	// contains filtered or unexported fields
}

type AuthIPWhitelistAssignment struct {

	// Identity name to limit by IP whitelist.
	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
	// Name of IP whitelist to use (see AuthIPWhitelist).
	IpWhitelist string `protobuf:"bytes,2,opt,name=ip_whitelist,json=ipWhitelist,proto3" json:"ip_whitelist,omitempty"`
	// Why the assignment was created.
	Comment string `protobuf:"bytes,3,opt,name=comment,proto3" json:"comment,omitempty"`
	// When the assignment was created. Microseconds since epoch.
	CreatedTs int64 `protobuf:"varint,4,opt,name=created_ts,json=createdTs,proto3" json:"created_ts,omitempty"`
	// Who created the assignment.
	CreatedBy string `protobuf:"bytes,5,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
	// contains filtered or unexported fields
}

type Binding struct {

	// Permissions in increasing order of their indexes.
	//
	// This set is a subset of `permissions` in the Realms message. Each element
	// is an index of a permission in the `permissions` list in the Realms
	// message.
	//
	// These indexes are not stable across different copies of Realms message.
	// They must not be stored or processed in isolation from the containing
	// Realms message.
	Permissions []uint32 `protobuf:"varint,1,rep,packed,name=permissions,proto3" json:"permissions,omitempty"`
	// A set of principals to grant all above permissions to.
	//
	// Each entry can either be an identity string (like "user:<email>") or a
	// LUCI group reference "group:<name>".
	//
	// Ordered alphabetically.
	Principals []string `protobuf:"bytes,2,rep,name=principals,proto3" json:"principals,omitempty"`
	// Conditions in increasing order of their indexes.
	//
	// Each element is an index of a condition in the `conditions` list in the
	// Realms message. These conditions are ANDed together. See the public API for
	// details of the semantics.
	//
	// These indexes are not stable across different copies of Realms message.
	// They must not be stored or processed in isolation from the containing
	// Realms message.
	Conditions []uint32 `protobuf:"varint,3,rep,packed,name=conditions,proto3" json:"conditions,omitempty"`
	// contains filtered or unexported fields
}

type ChangeNotification struct {

	// New revision of the AuthDB.
	Revision *AuthDBRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
	// contains filtered or unexported fields
}

type Condition struct {

	// Types that are assignable to Op:
	//
	//	*Condition_Restrict
	Op isCondition_Op `protobuf_oneof:"op"`
	// contains filtered or unexported fields
}

type Condition_AttributeRestriction struct {
	Attribute string   `protobuf:"bytes,1,opt,name=attribute,proto3" json:"attribute,omitempty"`
	Values    []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"` // sorted alphabetically, no dups
	// contains filtered or unexported fields
}

type Condition_Restrict struct {
	Restrict *Condition_AttributeRestriction `protobuf:"bytes,1,opt,name=restrict,proto3,oneof"`
}

type Permission struct {
	Name     string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`          // "<service>.<subject>.<verb>"
	Internal bool   `protobuf:"varint,2,opt,name=internal,proto3" json:"internal,omitempty"` // internal permissions cannot be used in project realms
	// contains filtered or unexported fields
}

type Realm struct {

	// Name of the realm as "<project>:<realm>" string, where:
	//
	//	"<project>" matches `^([a-z0-9\-_]{1,100}|@internal)$`.
	//	"<realm>" matches `^([a-z0-9_\.\-/]{1,400}|@root|@legacy|@project)$`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// A list of bindings in lexicographical order of their `permissions` fields.
	Bindings []*Binding `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// Associated data extracted from the realms.cfg project config.
	Data *RealmData `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type RealmData struct {

	// Used only during Realms migration to gradually roll out the enforcement.
	EnforceInService []string `protobuf:"bytes,1,rep,name=enforce_in_service,json=enforceInService,proto3" json:"enforce_in_service,omitempty"`
	// contains filtered or unexported fields
}

type Realms struct {

	// API version is incremented whenever the semantic meaning of Realms message
	// changes in some backward incompatible way (e.g. some message grows a new
	// field that *must* be checked by services). LUCI services must reject Realms
	// messages that have API versions they don't recognize. It is a precaution
	// against misinterpreting the realms configuration.
	//
	// The current version is 1.
	ApiVersion int64 `protobuf:"varint,1,opt,name=api_version,json=apiVersion,proto3" json:"api_version,omitempty"`
	// List of all possible permissions in alphabetical order.
	//
	// Acts as a universal set of permissions in Binding messages.
	//
	// Services may also use this field to check that permissions they are about
	// to use are actually known to the LUCI auth system. This is useful for
	// debugging when adding or removing permissions.
	//
	// See Permission message for more details.
	Permissions []*Permission `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// List of all conditions referenced by bindings.
	//
	// Bindings reference them by their zero-based index in this list.
	Conditions []*Condition `protobuf:"bytes,4,rep,name=conditions,proto3" json:"conditions,omitempty"`
	// List of all registered realms in alphabetical order.
	//
	// See Realm message for more details.
	Realms []*Realm `protobuf:"bytes,3,rep,name=realms,proto3" json:"realms,omitempty"`
	// contains filtered or unexported fields
}

type ReplicationPushRequest struct {

	// Revision that is being pushed.
	Revision *AuthDBRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
	// An entire database of auth configuration for specific revision.
	AuthDb *AuthDB `protobuf:"bytes,2,opt,name=auth_db,json=authDb,proto3" json:"auth_db,omitempty"`
	// Version of 'auth' component on Primary, see components/auth/version.py.
	AuthCodeVersion string `protobuf:"bytes,3,opt,name=auth_code_version,json=authCodeVersion,proto3" json:"auth_code_version,omitempty"`
	// contains filtered or unexported fields
}

type ReplicationPushResponse struct {

	// Overall status of the operation.
	Status ReplicationPushResponse_Status `protobuf:"varint,1,opt,name=status,proto3,enum=components.auth.ReplicationPushResponse_Status" json:"status,omitempty"`
	// Revision known by Replica (set for APPLIED and SKIPPED statuses).
	CurrentRevision *AuthDBRevision `protobuf:"bytes,2,opt,name=current_revision,json=currentRevision,proto3" json:"current_revision,omitempty"`
	// Present for TRANSIENT_ERROR and FATAL_ERROR statuses.
	ErrorCode ReplicationPushResponse_ErrorCode `` /* 144-byte string literal not displayed */
	// Version of 'auth' component on Replica, see components/auth/version.py.
	AuthCodeVersion string `protobuf:"bytes,4,opt,name=auth_code_version,json=authCodeVersion,proto3" json:"auth_code_version,omitempty"`
	// contains filtered or unexported fields
}

type ReplicationPushResponse_ErrorCode int32

type ReplicationPushResponse_Status int32

type SecurityConfig struct {

	// A list of regular expressions matching hostnames that should be recognized
	// as being a part of single LUCI deployment.
	//
	// Different microservices within a single LUCI deployment may trust each
	// other. This setting (coupled with the TLS certificate check) allows
	// a service to recognize that a target of an RPC is another internal service
	// belonging to the same LUCI deployment.
	//
	// '^' and '$' are implied. The regexp language is intersection of Python and
	// Golang regexp languages and thus should use only very standard features
	// common to both.
	//
	// Example: "(.*-dot-)?chromium-swarm\.appspot\.com".
	InternalServiceRegexp []string `` /* 126-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ServiceLinkRequest struct {

	// Same ticket that was passed to Replica via ServiceLinkTicket.
	Ticket []byte `protobuf:"bytes,1,opt,name=ticket,proto3" json:"ticket,omitempty"`
	// URL to use when making requests to Replica from Primary.
	ReplicaUrl string `protobuf:"bytes,2,opt,name=replica_url,json=replicaUrl,proto3" json:"replica_url,omitempty"`
	// Identity of a user that accepted the ticket and initiated this request.
	InitiatedBy string `protobuf:"bytes,3,opt,name=initiated_by,json=initiatedBy,proto3" json:"initiated_by,omitempty"`
	// contains filtered or unexported fields
}

type ServiceLinkResponse struct {
	Status ServiceLinkResponse_Status `protobuf:"varint,1,opt,name=status,proto3,enum=components.auth.ServiceLinkResponse_Status" json:"status,omitempty"`
	// contains filtered or unexported fields
}

type ServiceLinkResponse_Status int32

type ServiceLinkTicket struct {

	// GAE application ID of Primary that generated this ticket. Replica will send
	// ServiceLinkRequest to this service when it processes the ticket.
	PrimaryId string `protobuf:"bytes,1,opt,name=primary_id,json=primaryId,proto3" json:"primary_id,omitempty"`
	// URL to the root page of a primary service, i.e. https://<...>.appspot.com.
	// Useful when testing on dev appserver and on non-default version.
	PrimaryUrl string `protobuf:"bytes,2,opt,name=primary_url,json=primaryUrl,proto3" json:"primary_url,omitempty"`
	// Identity of a user that generated this ticket.
	GeneratedBy string `protobuf:"bytes,3,opt,name=generated_by,json=generatedBy,proto3" json:"generated_by,omitempty"`
	// Opaque blob passed back to Primary in ServiceLinkRequest. Its exact
	// structure is an implementation detail of Primary. It contains app_id of
	// a replica this ticket is intended for, timestamp and HMAC tag.
	Ticket []byte `protobuf:"bytes,4,opt,name=ticket,proto3" json:"ticket,omitempty"`
	// contains filtered or unexported fields
}

type SignedAuthDB struct {

	// Serialized ReplicationPushRequest message with actual data.
	//
	// Contains revision information and AuthDB itself.
	AuthDbBlob []byte `protobuf:"bytes,1,opt,name=auth_db_blob,json=authDbBlob,proto3" json:"auth_db_blob,omitempty"`
	// Service account name whose key was used to sign the AuthDB blob.
	SignerId string `protobuf:"bytes,2,opt,name=signer_id,json=signerId,proto3" json:"signer_id,omitempty"`
	// ID of the signing key.
	SigningKeyId string `protobuf:"bytes,3,opt,name=signing_key_id,json=signingKeyId,proto3" json:"signing_key_id,omitempty"`
	// The signature of auth_db_blob field.
	//
	// It is RS256(SHA512(auth_db_blob)).
	//
	// Where:
	//   - RS256 is RSASSA-PKCS1-v1_5 using SHA-256, see RS256 algo in RFC7518.
	//   - SHA512 is a byte string (64 bytes) with SHA-512 digest of its input.
	//
	// Such peculiar structure is due to limitations of GAE signing infrastructure
	// (RS256 function can accept at most 8KB of input).
	//
	// Consumers of SignedAuthDB are expected to do the following:
	//  1. Check 'signer_id' is what they expect.
	//  2. Use https://www.googleapis.com/service_accounts/v1/metadata/x509/...
	//     endpoint to get the signer's public key with ID 'signing_key_id'.
	//  3. Construct to-be-signed string as SHA512(auth_db_blob).
	//  4. Verify 'signature' matches to-be-signed string using the public key
	//     from step 2.
	Signature []byte `protobuf:"bytes,4,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}