kernelidentityv1

type ApplyAccountProjectionRequest struct {
	UserId  uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	Version uint64 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	Email   string `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
	IsAdmin bool   `protobuf:"varint,4,opt,name=is_admin,json=isAdmin,proto3" json:"is_admin,omitempty"`
	IsStaff bool   `protobuf:"varint,5,opt,name=is_staff,json=isStaff,proto3" json:"is_staff,omitempty"`
	Banned  bool   `protobuf:"varint,6,opt,name=banned,proto3" json:"banned,omitempty"`
	// legacy_mirror carries credentials back into the legacy tables until the
	// identity cutover is finalized, so a rollback to legacy routes works.
	LegacyMirror *LegacyCredentialMirror `protobuf:"bytes,7,opt,name=legacy_mirror,json=legacyMirror,proto3" json:"legacy_mirror,omitempty"`
	// token_version is the account's token version after the change. When the
	// change ends sessions and token_version is above the last one projected,
	// identity tokens with a smaller tv claim stop working and tokens issued
	// afterwards, even within the same second, keep working.
	TokenVersion uint64 `protobuf:"varint,8,opt,name=token_version,json=tokenVersion,proto3" json:"token_version,omitempty"`
	// contains filtered or unexported fields
}

type ApplyAccountProjectionResponse struct {
	Applied       bool   `protobuf:"varint,1,opt,name=applied,proto3" json:"applied,omitempty"`
	StoredVersion uint64 `protobuf:"varint,2,opt,name=stored_version,json=storedVersion,proto3" json:"stored_version,omitempty"`
	// contains filtered or unexported fields
}

type CreateSubscriberRequest struct {
	AccountUuid  string `protobuf:"bytes,1,opt,name=account_uuid,json=accountUuid,proto3" json:"account_uuid,omitempty"`
	Email        string `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
	InviteUserId uint64 `protobuf:"varint,3,opt,name=invite_user_id,json=inviteUserId,proto3" json:"invite_user_id,omitempty"`
	// invite_code, when set, is validated and consumed together with the new
	// subscriber: the code's owner becomes the inviter. Codes stay with the
	// kernel. Refusals are FailedPrecondition with the v2 message.
	InviteCode string `protobuf:"bytes,4,opt,name=invite_code,json=inviteCode,proto3" json:"invite_code,omitempty"`
	// is_admin and is_staff set the new subscriber's projected flags, for
	// accounts an administrator creates.
	IsAdmin bool `protobuf:"varint,5,opt,name=is_admin,json=isAdmin,proto3" json:"is_admin,omitempty"`
	IsStaff bool `protobuf:"varint,6,opt,name=is_staff,json=isStaff,proto3" json:"is_staff,omitempty"`
	// legacy_mirror sets the new subscriber's legacy credentials (until the
	// authority is finalized), so switching back to the legacy routes keeps
	// the account usable. Being part of the creation, it revokes nothing.
	LegacyMirror *LegacyCredentialMirror `protobuf:"bytes,7,opt,name=legacy_mirror,json=legacyMirror,proto3" json:"legacy_mirror,omitempty"`
	// contains filtered or unexported fields
}

type CreateSubscriberResponse struct {
	UserId  uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	Created bool   `protobuf:"varint,2,opt,name=created,proto3" json:"created,omitempty"`
	// contains filtered or unexported fields
}

type DeleteSubscriberRequest struct {
	UserId uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// contains filtered or unexported fields
}

type DeleteSubscriberResponse struct {
	// contains filtered or unexported fields
}

type GetIdentitySettingsRequest struct {
	// contains filtered or unexported fields
}

type GetIdentitySettingsResponse struct {

	// settings_json is the kernel's auth configuration: registration policy,
	// login rate limits and the admin MFA configuration.
	SettingsJson []byte `protobuf:"bytes,1,opt,name=settings_json,json=settingsJson,proto3" json:"settings_json,omitempty"`
	// contains filtered or unexported fields
}

type GetSubscriberRequest struct {
	UserId uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// contains filtered or unexported fields
}

type GetSubscriberResponse struct {

	// subscriber_json is the v2 user object with its plan. It carries no
	// password hash, but it does carry the subscription token and proxy uuid,
	// which the v2 admin API and the account's own profile show.
	SubscriberJson []byte `protobuf:"bytes,1,opt,name=subscriber_json,json=subscriberJson,proto3" json:"subscriber_json,omitempty"`
	// contains filtered or unexported fields
}

type KernelIdentityClient interface {
	// CreateSubscriber allocates the v2_user row (id, uuid, subscription
	// token) for a new account. It is idempotent on account_uuid.
	CreateSubscriber(ctx context.Context, in *CreateSubscriberRequest, opts ...grpc.CallOption) (*CreateSubscriberResponse, error)
	// UpdateSubscriber changes entitlement fields an administrator edits
	// together with identity fields.
	UpdateSubscriber(ctx context.Context, in *UpdateSubscriberRequest, opts ...grpc.CallOption) (*UpdateSubscriberResponse, error)
	// ApplyAccountProjection writes identity fields into the projection. Older
	// versions than the stored one are ignored.
	ApplyAccountProjection(ctx context.Context, in *ApplyAccountProjectionRequest, opts ...grpc.CallOption) (*ApplyAccountProjectionResponse, error)
	DeleteSubscriber(ctx context.Context, in *DeleteSubscriberRequest, opts ...grpc.CallOption) (*DeleteSubscriberResponse, error)
	// PublishRevocation makes tokens issued before a point, or with an older
	// token version, or with a session id, stop working in the kernel.
	PublishRevocation(ctx context.Context, in *PublishRevocationRequest, opts ...grpc.CallOption) (*PublishRevocationResponse, error)
	// ResolveActorAccess returns the plugin permissions the v2 login and
	// profile responses carry.
	ResolveActorAccess(ctx context.Context, in *ResolveActorAccessRequest, opts ...grpc.CallOption) (*ResolveActorAccessResponse, error)
	// GetIdentitySettings returns the kernel's legacy auth settings once, to
	// seed the identity installation configuration.
	GetIdentitySettings(ctx context.Context, in *GetIdentitySettingsRequest, opts ...grpc.CallOption) (*GetIdentitySettingsResponse, error)
	// GetSubscriber returns one subscriber as the v2 admin API shows it, with
	// its plan, for identity's administration answers and the account's own
	// profile and dashboard.
	GetSubscriber(ctx context.Context, in *GetSubscriberRequest, opts ...grpc.CallOption) (*GetSubscriberResponse, error)
}

type KernelIdentityServer interface {
	// CreateSubscriber allocates the v2_user row (id, uuid, subscription
	// token) for a new account. It is idempotent on account_uuid.
	CreateSubscriber(context.Context, *CreateSubscriberRequest) (*CreateSubscriberResponse, error)
	// UpdateSubscriber changes entitlement fields an administrator edits
	// together with identity fields.
	UpdateSubscriber(context.Context, *UpdateSubscriberRequest) (*UpdateSubscriberResponse, error)
	// ApplyAccountProjection writes identity fields into the projection. Older
	// versions than the stored one are ignored.
	ApplyAccountProjection(context.Context, *ApplyAccountProjectionRequest) (*ApplyAccountProjectionResponse, error)
	DeleteSubscriber(context.Context, *DeleteSubscriberRequest) (*DeleteSubscriberResponse, error)
	// PublishRevocation makes tokens issued before a point, or with an older
	// token version, or with a session id, stop working in the kernel.
	PublishRevocation(context.Context, *PublishRevocationRequest) (*PublishRevocationResponse, error)
	// ResolveActorAccess returns the plugin permissions the v2 login and
	// profile responses carry.
	ResolveActorAccess(context.Context, *ResolveActorAccessRequest) (*ResolveActorAccessResponse, error)
	// GetIdentitySettings returns the kernel's legacy auth settings once, to
	// seed the identity installation configuration.
	GetIdentitySettings(context.Context, *GetIdentitySettingsRequest) (*GetIdentitySettingsResponse, error)
	// GetSubscriber returns one subscriber as the v2 admin API shows it, with
	// its plan, for identity's administration answers and the account's own
	// profile and dashboard.
	GetSubscriber(context.Context, *GetSubscriberRequest) (*GetSubscriberResponse, error)
	// contains filtered or unexported methods
}

type LegacyCredentialMirror struct {
	PasswordHash     string   `protobuf:"bytes,1,opt,name=password_hash,json=passwordHash,proto3" json:"password_hash,omitempty"`
	PasswordAlgo     string   `protobuf:"bytes,2,opt,name=password_algo,json=passwordAlgo,proto3" json:"password_algo,omitempty"`
	PasswordSalt     string   `protobuf:"bytes,3,opt,name=password_salt,json=passwordSalt,proto3" json:"password_salt,omitempty"`
	MfaEnabled       bool     `protobuf:"varint,4,opt,name=mfa_enabled,json=mfaEnabled,proto3" json:"mfa_enabled,omitempty"`
	TotpSecret       string   `protobuf:"bytes,5,opt,name=totp_secret,json=totpSecret,proto3" json:"totp_secret,omitempty"`
	BackupCodeHashes []string `protobuf:"bytes,6,rep,name=backup_code_hashes,json=backupCodeHashes,proto3" json:"backup_code_hashes,omitempty"`
	// contains filtered or unexported fields
}

type PublishRevocationRequest struct {
	UserId uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// token_version: identity tokens with a smaller tv claim stop working; the
	// kernel's own tokens, which carry none, stop working if issued until
	// not_before (now when not_before is unset).
	TokenVersion uint64 `protobuf:"varint,2,opt,name=token_version,json=tokenVersion,proto3" json:"token_version,omitempty"`
	// not_before_unix: tokens issued before it stop working.
	NotBeforeUnix int64 `protobuf:"varint,3,opt,name=not_before_unix,json=notBeforeUnix,proto3" json:"not_before_unix,omitempty"`
	// session_id revokes one session (logout); tokens expire by exp anyway.
	SessionId            string `protobuf:"bytes,4,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	SessionExpiresAtUnix int64  `` /* 126-byte string literal not displayed */
	Reason               string `protobuf:"bytes,6,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type PublishRevocationResponse struct {
	// contains filtered or unexported fields
}

type ResolveActorAccessRequest struct {
	UserId  uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	IsAdmin bool   `protobuf:"varint,2,opt,name=is_admin,json=isAdmin,proto3" json:"is_admin,omitempty"`
	// contains filtered or unexported fields
}

type ResolveActorAccessResponse struct {
	PermissionMode    string   `protobuf:"bytes,1,opt,name=permission_mode,json=permissionMode,proto3" json:"permission_mode,omitempty"`
	Permissions       []string `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
	RestrictedPlugins []string `protobuf:"bytes,3,rep,name=restricted_plugins,json=restrictedPlugins,proto3" json:"restricted_plugins,omitempty"`
	// unrestricted actors get "permissions": null in v2 responses, which a
	// repeated field cannot express.
	Unrestricted bool `protobuf:"varint,4,opt,name=unrestricted,proto3" json:"unrestricted,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedKernelIdentityServer struct{}

type UnsafeKernelIdentityServer interface {
	// contains filtered or unexported methods
}

type UpdateSubscriberRequest struct {
	UserId uint64 `protobuf:"varint,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// entitlements_json holds only the entitlement fields of the v2 admin
	// user update (plan_id, group_id, transfer_enable, expired_at, limits,
	// balance); absent fields are unchanged.
	EntitlementsJson []byte `protobuf:"bytes,2,opt,name=entitlements_json,json=entitlementsJson,proto3" json:"entitlements_json,omitempty"`
	// contains filtered or unexported fields
}

type UpdateSubscriberResponse struct {
	// contains filtered or unexported fields
}