bq

type DelegationToken struct {

	// First 16 bytes of SHA256 of the token body, hex-encoded.
	Fingerprint string `protobuf:"bytes,1,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
	// Kind of the token.
	TokenKind messages.Subtoken_Kind `protobuf:"varint,2,opt,name=token_kind,json=tokenKind,proto3,enum=messages.Subtoken_Kind" json:"token_kind,omitempty"`
	// Identifier of this token as generated by the token server.
	TokenId string `protobuf:"bytes,3,opt,name=token_id,json=tokenId,proto3" json:"token_id,omitempty"`
	// Identity whose authority is delegated.
	DelegatedIdentity string `protobuf:"bytes,4,opt,name=delegated_identity,json=delegatedIdentity,proto3" json:"delegated_identity,omitempty"`
	// Who requested this token.
	RequestorIdentity string `protobuf:"bytes,5,opt,name=requestor_identity,json=requestorIdentity,proto3" json:"requestor_identity,omitempty"`
	// When the token was generated.
	IssuedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"`
	// When the token expires.
	Expiration *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=expiration,proto3" json:"expiration,omitempty"`
	// Who can present this token.
	TargetAudience []string `protobuf:"bytes,8,rep,name=target_audience,json=targetAudience,proto3" json:"target_audience,omitempty"`
	// What services should accept this token
	TargetServices []string `protobuf:"bytes,9,rep,name=target_services,json=targetServices,proto3" json:"target_services,omitempty"`
	// Token validity duration (in seconds), as requested by the caller.
	RequestedValidity int64 `protobuf:"varint,10,opt,name=requested_validity,json=requestedValidity,proto3" json:"requested_validity,omitempty"`
	// An intent string provided by the caller.
	RequestedIntent string `protobuf:"bytes,11,opt,name=requested_intent,json=requestedIntent,proto3" json:"requested_intent,omitempty"`
	// Arbitrary key:value pairs embedded into the token.
	Tags []string `protobuf:"bytes,12,rep,name=tags,proto3" json:"tags,omitempty"`
	// Revision of the luci-config repo with rules.
	ConfigRev string `protobuf:"bytes,13,opt,name=config_rev,json=configRev,proto3" json:"config_rev,omitempty"`
	// Name of the rule used to authorize this call.
	ConfigRule string `protobuf:"bytes,14,opt,name=config_rule,json=configRule,proto3" json:"config_rule,omitempty"`
	// IP address of the caller.
	PeerIp string `protobuf:"bytes,15,opt,name=peer_ip,json=peerIp,proto3" json:"peer_ip,omitempty"`
	// Identifier of the token server GAE app and version.
	ServiceVersion string `protobuf:"bytes,16,opt,name=service_version,json=serviceVersion,proto3" json:"service_version,omitempty"`
	// ID of the GAE request that handled the call.
	GaeRequestId string `protobuf:"bytes,17,opt,name=gae_request_id,json=gaeRequestId,proto3" json:"gae_request_id,omitempty"`
	// Revision of the authorization database used to authorize this call.
	AuthDbRev int64 `protobuf:"varint,18,opt,name=auth_db_rev,json=authDbRev,proto3" json:"auth_db_rev,omitempty"`
	// contains filtered or unexported fields
}

type MachineToken struct {

	// First 16 bytes of SHA256 of the token body, hex-encoded.
	Fingerprint string `protobuf:"bytes,1,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
	// Machine domain name encoded in the token.
	MachineFqdn string `protobuf:"bytes,2,opt,name=machine_fqdn,json=machineFqdn,proto3" json:"machine_fqdn,omitempty"`
	// Type of the machine token.
	TokenType api.MachineTokenType `protobuf:"varint,3,opt,name=token_type,json=tokenType,proto3,enum=tokenserver.MachineTokenType" json:"token_type,omitempty"`
	// When the token was generated.
	IssuedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=issued_at,json=issuedAt,proto3" json:"issued_at,omitempty"`
	// When the token expires.
	Expiration *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=expiration,proto3" json:"expiration,omitempty"`
	// Serial number of the peer certificate.
	CertSerialNumber string `protobuf:"bytes,6,opt,name=cert_serial_number,json=certSerialNumber,proto3" json:"cert_serial_number,omitempty"`
	// Type of the signature used to proof possession of the private key.
	SignatureAlgorithm v1.SignatureAlgorithm `` /* 159-byte string literal not displayed */
	// Common Name of a CA that signed the peer certificate.
	CaCommonName string `protobuf:"bytes,8,opt,name=ca_common_name,json=caCommonName,proto3" json:"ca_common_name,omitempty"`
	// Revision of the luci-config repo that contains the CA.
	CaConfigRev string `protobuf:"bytes,9,opt,name=ca_config_rev,json=caConfigRev,proto3" json:"ca_config_rev,omitempty"`
	// IP address of the caller.
	PeerIp string `protobuf:"bytes,10,opt,name=peer_ip,json=peerIp,proto3" json:"peer_ip,omitempty"`
	// Identifier of the token server GAE app and version.
	ServiceVersion string `protobuf:"bytes,11,opt,name=service_version,json=serviceVersion,proto3" json:"service_version,omitempty"`
	// ID of the GAE request that handled the call.
	GaeRequestId string `protobuf:"bytes,12,opt,name=gae_request_id,json=gaeRequestId,proto3" json:"gae_request_id,omitempty"`
	// contains filtered or unexported fields
}

type ProjectToken struct {

	// First 16 bytes of SHA256 of the token body, hex-encoded.
	Fingerprint string `protobuf:"bytes,1,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
	// Service account email the luci service wants to act as.
	ServiceAccount string `protobuf:"bytes,2,opt,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
	// Requested OAuth scopes.
	OauthScopes []string `protobuf:"bytes,3,rep,name=oauth_scopes,json=oauthScopes,proto3" json:"oauth_scopes,omitempty"`
	// LUCI project for which token is requested.
	LuciProject string `protobuf:"bytes,4,opt,name=luci_project,json=luciProject,proto3" json:"luci_project,omitempty"`
	// Who requested and who can use this token.
	ServiceIdentity string `protobuf:"bytes,5,opt,name=service_identity,json=serviceIdentity,proto3" json:"service_identity,omitempty"`
	// When this request happened.
	RequestedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=requested_at,json=requestedAt,proto3" json:"requested_at,omitempty"`
	// When the token expires.
	Expiration *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=expiration,proto3" json:"expiration,omitempty"`
	// Arbitrary key:value pairs provided by the caller.
	AuditTags []string `protobuf:"bytes,8,rep,name=audit_tags,json=auditTags,proto3" json:"audit_tags,omitempty"`
	// IP address of the caller.
	PeerIp string `protobuf:"bytes,9,opt,name=peer_ip,json=peerIp,proto3" json:"peer_ip,omitempty"`
	// Identifier of the token server GAE app and version.
	ServiceVersion string `protobuf:"bytes,10,opt,name=service_version,json=serviceVersion,proto3" json:"service_version,omitempty"`
	// ID of the GAE request that handled the call.
	GaeRequestId string `protobuf:"bytes,11,opt,name=gae_request_id,json=gaeRequestId,proto3" json:"gae_request_id,omitempty"`
	// Revision of the authorization database used to authorize this call.
	AuthDbRev int64 `protobuf:"varint,12,opt,name=auth_db_rev,json=authDbRev,proto3" json:"auth_db_rev,omitempty"`
	// contains filtered or unexported fields
}

type ServiceAccountToken struct {

	// First 16 bytes of SHA256 of the token body, hex-encoded.
	Fingerprint string `protobuf:"bytes,1,opt,name=fingerprint,proto3" json:"fingerprint,omitempty"`
	// The kind of the token requested (OAuth2 access token or ID token).
	Kind v1.ServiceAccountTokenKind `protobuf:"varint,2,opt,name=kind,proto3,enum=tokenserver.minter.ServiceAccountTokenKind" json:"kind,omitempty"`
	// Service account email the luci service wants to act as.
	ServiceAccount string `protobuf:"bytes,3,opt,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
	// LUCI realm used to authorize the call.
	Realm string `protobuf:"bytes,4,opt,name=realm,proto3" json:"realm,omitempty"`
	// Requested OAuth scopes when minting OAuth tokens.
	OauthScopes []string `protobuf:"bytes,5,rep,name=oauth_scopes,json=oauthScopes,proto3" json:"oauth_scopes,omitempty"`
	// Requested audience when minting ID tokens.
	IdTokenAudience string `protobuf:"bytes,6,opt,name=id_token_audience,json=idTokenAudience,proto3" json:"id_token_audience,omitempty"`
	// Identity used to authorize the call.
	RequestIdentity string `protobuf:"bytes,7,opt,name=request_identity,json=requestIdentity,proto3" json:"request_identity,omitempty"`
	// Identity of a service that made the RPC.
	PeerIdentity string `protobuf:"bytes,8,opt,name=peer_identity,json=peerIdentity,proto3" json:"peer_identity,omitempty"`
	// When this request happened.
	RequestedAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=requested_at,json=requestedAt,proto3" json:"requested_at,omitempty"`
	// When the token expires.
	Expiration *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=expiration,proto3" json:"expiration,omitempty"`
	// Arbitrary key:value pairs provided by the caller.
	AuditTags []string `protobuf:"bytes,11,rep,name=audit_tags,json=auditTags,proto3" json:"audit_tags,omitempty"`
	// Revision of the luci-config repo with project_owned_accounts.cfg.
	ConfigRev string `protobuf:"bytes,12,opt,name=config_rev,json=configRev,proto3" json:"config_rev,omitempty"`
	// IP address of the caller.
	PeerIp string `protobuf:"bytes,13,opt,name=peer_ip,json=peerIp,proto3" json:"peer_ip,omitempty"`
	// Identifier of the token server GAE app and version.
	ServiceVersion string `protobuf:"bytes,14,opt,name=service_version,json=serviceVersion,proto3" json:"service_version,omitempty"`
	// ID of the GAE request that handled the call.
	GaeRequestId string `protobuf:"bytes,15,opt,name=gae_request_id,json=gaeRequestId,proto3" json:"gae_request_id,omitempty"`
	// Revision of the authorization database used to authorize this call.
	AuthDbRev int64 `protobuf:"varint,16,opt,name=auth_db_rev,json=authDbRev,proto3" json:"auth_db_rev,omitempty"`
	// contains filtered or unexported fields
}