auth

type AdminChecker func(ctx context.Context, identity Identity) (bool, error)

type AssumeIdentityRequest struct {

	// Target user's identity provider (e.g., "google")
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Target user's subject identifier
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// Reason for assuming this identity (required for audit trail)
	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type AssumeIdentityResponse struct {

	// JWT token with the assumed identity and delegation metadata
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type AuthEvent struct {
	Identity  Identity
	Timestamp time.Time // When the event occurred
}

type AuthOption func(*AuthPlugin)

type AuthPlugin struct {
	// contains filtered or unexported fields
}

type AuthServiceClient interface {
	// Login allows a client to provide credentials which can be used to
	// authenticate the client's identity. POST is preferred, some providers need
	// credentials to be passed as GET.
	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Logout clears the prefab id cookie. It should be noted that by default the
	// identity token will remain valid until its expiry. Token invalidatation is
	// supported via the addition of a blocklist.
	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
	// Identity returns information about the authenticated user.
	Identity(ctx context.Context, in *IdentityRequest, opts ...grpc.CallOption) (*IdentityResponse, error)
	// AssumeIdentity allows admin users to assume another user's identity.
	// Requires delegation to be enabled and the caller to have admin privileges.
	AssumeIdentity(ctx context.Context, in *AssumeIdentityRequest, opts ...grpc.CallOption) (*AssumeIdentityResponse, error)
}

type AuthServiceServer interface {
	// Login allows a client to provide credentials which can be used to
	// authenticate the client's identity. POST is preferred, some providers need
	// credentials to be passed as GET.
	Login(context.Context, *LoginRequest) (*LoginResponse, error)
	// Logout clears the prefab id cookie. It should be noted that by default the
	// identity token will remain valid until its expiry. Token invalidatation is
	// supported via the addition of a blocklist.
	Logout(context.Context, *LogoutRequest) (*LogoutResponse, error)
	// Identity returns information about the authenticated user.
	Identity(context.Context, *IdentityRequest) (*IdentityResponse, error)
	// AssumeIdentity allows admin users to assume another user's identity.
	// Requires delegation to be enabled and the caller to have admin privileges.
	AssumeIdentity(context.Context, *AssumeIdentityRequest) (*AssumeIdentityResponse, error)
	// contains filtered or unexported methods
}

type AuthorizeParams struct {
	// ObjectKey identifies the type of resource (e.g., "auth:delegation")
	ObjectKey string

	// ObjectID is the specific resource instance, if applicable
	ObjectID any

	// Scope limits the authorization check to a specific scope
	Scope string

	// Action is the operation being performed (e.g., "auth.assume_identity")
	Action string

	// DefaultEffect specifies what to do if no policy matches (0=Deny, 1=Allow)
	DefaultEffect int

	// Info provides additional context for logging/debugging
	Info string
}

type Authorizer interface {
	// Authorize checks if the current user (from context) has permission to perform
	// the specified action on the specified resource.
	//
	// The params argument should be an AuthorizeParams struct. It's declared as any
	// to avoid import cycles between auth and authz plugins.
	//
	// Returns nil if authorized, or an error with codes.PermissionDenied if denied.
	Authorize(ctx context.Context, params any) error
}

type BlockedToken struct {
	Key string
}

type Blocklist interface {
	// IsBlocked checks if a token with the given key is blocked.
	IsBlocked(ctx context.Context, key string) (bool, error)

	// Block adds a token to the blocklist. Key can be the token itself or a
	// unique ID.
	Block(ctx context.Context, key string) error
}

type Claims struct {
	// Standard public JWT claims per https://www.iana.org/assignments/jwt/jwt.xhtml
	jwt.RegisteredClaims
	Name          string           `json:"name"`
	Email         string           `json:"email"`
	EmailVerified bool             `json:"email_verified"`
	AuthTime      *jwt.NumericDate `json:"auth_time,omitempty"`

	// Custom claims.
	Provider string `json:"idp"`

	// Delegation claims (optional, only present when identity was assumed).
	DelegatorSub       string `json:"delegator_sub,omitempty"`
	DelegatorProvider  string `json:"delegator_provider,omitempty"`
	DelegatorSessionID string `json:"delegator_session_id,omitempty"`
	DelegationReason   string `json:"delegation_reason,omitempty"`
	DelegatedAt        int64  `json:"delegated_at,omitempty"`
}

type ConfigRequest struct {
	// contains filtered or unexported fields
}

type ConfigResponse struct {

	// Token that should be used in non-XHR requests to avoid cross-site request
	// forgery attacks.
	CsrfToken string `protobuf:"bytes,1,opt,name=csrf_token,json=csrfToken,proto3" json:"csrf_token,omitempty"`
	// A map of key-value pairs configured by available auth plugins, for example
	// google.client_id.
	Configs map[string]string `` /* 141-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DelegationEventData struct {
	// The admin user who is assuming the identity
	Admin Identity

	// The identity that was assumed (includes delegation metadata)
	AssumedIdentity Identity

	// Reason provided for the delegation
	Reason string
}

type DelegationInfo struct {

	// Original admin's subject identifier (e.g., "google123")
	DelegatorSub string `protobuf:"bytes,1,opt,name=delegator_sub,json=delegatorSub,proto3" json:"delegator_sub,omitempty"`
	// Original admin's identity provider (e.g., "google")
	DelegatorProvider string `protobuf:"bytes,2,opt,name=delegator_provider,json=delegatorProvider,proto3" json:"delegator_provider,omitempty"`
	// Original admin's session ID (jti claim)
	DelegatorSessionId string `protobuf:"bytes,3,opt,name=delegator_session_id,json=delegatorSessionId,proto3" json:"delegator_session_id,omitempty"`
	// Reason provided for the delegation (e.g., "support-case-873")
	Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
	// Timestamp when the delegation occurred (Unix timestamp in seconds)
	DelegatedAt int64 `protobuf:"varint,5,opt,name=delegated_at,json=delegatedAt,proto3" json:"delegated_at,omitempty"`
	// contains filtered or unexported fields
}

type Identity struct {

	// Unique identifier for the session that authenticated the identity. Maps to
	// the `jti` JWT claim.
	SessionID string

	// The time at which the identity was authenticated. Maps to `auth_time` JWT
	// claim. May differ from IssuedAt if a token is refreshed.
	AuthTime time.Time

	// Identity provider specific identifier. Maps to `sub` JWT claim.
	Subject string

	// Name of the identity provider used to authenticate the user. Maps to custom
	// `idp` JWT claim.
	Provider string

	// The email address received from the identity provider, if available. Maps
	// to `email` JWT claim.
	Email string

	// Whether the identity provider has verified the email address. Maps to
	// `email_verified` JWT claim.
	EmailVerified bool

	// Name received from the identity provider, if available. Maps to `name` JWT
	// claim.
	Name string

	// Delegation contains metadata when this identity was assumed by an admin user.
	// If nil, this is a normal (non-delegated) identity.
	Delegation *DelegationInfo
}

type IdentityExtractor func(ctx context.Context) (Identity, error)

type IdentityRequest struct {
	// contains filtered or unexported fields
}

type IdentityResponse struct {
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// An auth provider specific identifier used to authenticate the user.
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// An email address associated with the identity, if available.
	Email string `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
	// Whether the email is thought to have been verified.
	EmailVerified bool `protobuf:"varint,4,opt,name=email_verified,json=emailVerified,proto3" json:"email_verified,omitempty"`
	// A name associated with the identity, if available.
	Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
	// Delegation information if this identity was assumed by an admin.
	Delegation *DelegationInfo `protobuf:"bytes,6,opt,name=delegation,proto3" json:"delegation,omitempty"`
	// contains filtered or unexported fields
}

type IdentityValidator func(ctx context.Context, provider, subject string) error

type LoginHandler func(ctx context.Context, req *LoginRequest) (*LoginResponse, error)

type LoginRequest struct {

	// Name of the auth-provider to use to process the creds.
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Creds contains key/value pairs of provider specific credentials.
	Creds map[string]string `` /* 137-byte string literal not displayed */
	// Whether a token should be returned in the response. If false, a cookie will
	// be set on the API root.
	IssueToken bool `protobuf:"varint,3,opt,name=issue_token,json=issueToken,proto3" json:"issue_token,omitempty"`
	// The URL where the user should be redirected after the cookie is set.
	// Incompatible with `issue_token`.
	RedirectUri string `protobuf:"bytes,4,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LoginResponse struct {

	// Whether the token was issued. False does not necessarily indicate an error,
	// some auth providers may require an additional step. For example, magiclink
	// requires the user follow a URL that was sent to their email.
	Issued bool `protobuf:"varint,1,opt,name=issued,proto3" json:"issued,omitempty"`
	// An auth token which can be used to make subsequently authenticated requests
	// only set if `issue_token` is true.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Destination where the client should be redirected to, if applicable. HTTP
	// headers will be added to GRPC metadata which will cause a 302 redirect if
	// the RPC is called via the GRPC Gateway. Not compatible with `issue_token`
	// set to true.
	RedirectUri string `protobuf:"bytes,3,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutRequest struct {

	// The URL where the user should be redirected after a successful logout.
	RedirectUri string `protobuf:"bytes,4,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutResponse struct {

	// Destination where the client should be redirected to, if applicable. HTTP
	// headers will be added to GRPC metadata which will cause a 302 redirect if
	// the RPC is called via the GRPC Gateway.
	RedirectUri string `protobuf:"bytes,1,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAuthServiceServer struct{}

type UnsafeAuthServiceServer interface {
	// contains filtered or unexported methods
}