rpc

type ChannelRef struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ChannelResponse struct {
	Channel *ChannelSummary `protobuf:"bytes,1,opt,name=channel,proto3" json:"channel,omitempty"`
	// contains filtered or unexported fields
}

type ChannelSummary struct {
	Name       string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	State      string `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"` // open | closed | deleted
	TtlSeconds int64  `protobuf:"varint,3,opt,name=ttl_seconds,json=ttlSeconds,proto3" json:"ttl_seconds,omitempty"`
	CreatedAt  string `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`    // RFC3339
	LastActive string `protobuf:"bytes,5,opt,name=last_active,json=lastActive,proto3" json:"last_active,omitempty"` // RFC3339
	// contains filtered or unexported fields
}

type CreatePrivateRequest struct {
	Name       string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	TtlSeconds int64  `protobuf:"varint,2,opt,name=ttl_seconds,json=ttlSeconds,proto3" json:"ttl_seconds,omitempty"`
	// Subject (sub claim) baked into the issued access + refresh tokens.
	// Empty means anonymous.
	Subject string `protobuf:"bytes,3,opt,name=subject,proto3" json:"subject,omitempty"`
	// Scopes is the optional pattern-grant set baked into both tokens.
	// Each scope binds a channel-name pattern (e.g. private:webapp.user.42.*)
	// to a list of verbs (subscribe, publish, manage). Empty produces a
	// token whose only authorization is the chs exact-match on `name`.
	// Patterns are validated against the channel grammar at issue time;
	// cross-visibility patterns (*:foo.bar) are rejected with
	// PARSEC_INVALID_ARGUMENT.
	Scopes []*Scope `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// contains filtered or unexported fields
}

type Credentials struct {
	Name               string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AccessToken        string `protobuf:"bytes,2,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	RefreshToken       string `protobuf:"bytes,3,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	AccessExpiresUnix  int64  `protobuf:"varint,4,opt,name=access_expires_unix,json=accessExpiresUnix,proto3" json:"access_expires_unix,omitempty"`
	RefreshExpiresUnix int64  `protobuf:"varint,5,opt,name=refresh_expires_unix,json=refreshExpiresUnix,proto3" json:"refresh_expires_unix,omitempty"`
	// contains filtered or unexported fields
}

type DlqCountRequest struct {
	Sink string `protobuf:"bytes,1,opt,name=sink,proto3" json:"sink,omitempty"`
	// contains filtered or unexported fields
}

type DlqCountResponse struct {
	Count int32 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"`
	// contains filtered or unexported fields
}

type DlqDiscardRequest struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type DlqItem struct {
	Id        string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Sink      string            `protobuf:"bytes,2,opt,name=sink,proto3" json:"sink,omitempty"`
	At        string            `protobuf:"bytes,3,opt,name=at,proto3" json:"at,omitempty"`               // RFC3339Nano
	Recipient []byte            `protobuf:"bytes,4,opt,name=recipient,proto3" json:"recipient,omitempty"` // JSON
	Subject   string            `protobuf:"bytes,5,opt,name=subject,proto3" json:"subject,omitempty"`
	Body      string            `protobuf:"bytes,6,opt,name=body,proto3" json:"body,omitempty"`
	Metadata  map[string]string `` /* 143-byte string literal not displayed */
	Attempts  int32             `protobuf:"varint,8,opt,name=attempts,proto3" json:"attempts,omitempty"`
	LastError string            `protobuf:"bytes,9,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"`
	// contains filtered or unexported fields
}

type DlqListRequest struct {
	Sink  string `protobuf:"bytes,1,opt,name=sink,proto3" json:"sink,omitempty"`
	Limit int32  `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	// contains filtered or unexported fields
}

type DlqListResponse struct {
	Items []*DlqItem `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
	// contains filtered or unexported fields
}

type DlqReplayRequest struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type Empty struct {
	// contains filtered or unexported fields
}

type GenerateKeyRequest struct {
	Alg string `protobuf:"bytes,1,opt,name=alg,proto3" json:"alg,omitempty"` // HS256 (default) | RS256 | EdDSA
	// contains filtered or unexported fields
}

type HTTPClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type IssueMgmtRequest struct {
	Subject    string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	TtlSeconds int64  `protobuf:"varint,2,opt,name=ttl_seconds,json=ttlSeconds,proto3" json:"ttl_seconds,omitempty"`
	// contains filtered or unexported fields
}

type IssueMgmtResponse struct {
	MgmtToken     string `protobuf:"bytes,1,opt,name=mgmt_token,json=mgmtToken,proto3" json:"mgmt_token,omitempty"`
	ExpiresUnix   int64  `protobuf:"varint,2,opt,name=expires_unix,json=expiresUnix,proto3" json:"expires_unix,omitempty"`
	SignedByKeyId string `protobuf:"bytes,3,opt,name=signed_by_key_id,json=signedByKeyId,proto3" json:"signed_by_key_id,omitempty"`
	// contains filtered or unexported fields
}

type JSONResponse struct {
	Payload []byte `protobuf:"bytes,1,opt,name=payload,proto3" json:"payload,omitempty"`
	// contains filtered or unexported fields
}

type KeyRef struct {
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// contains filtered or unexported fields
}

type KeySummary struct {
	Id        string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Role      string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`                            // active | verify-only | retired
	CreatedAt string `protobuf:"bytes,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"` // RFC3339
	RetiredAt string `protobuf:"bytes,4,opt,name=retired_at,json=retiredAt,proto3" json:"retired_at,omitempty"` // RFC3339, empty when not retired
	Alg       string `protobuf:"bytes,5,opt,name=alg,proto3" json:"alg,omitempty"`                              // HS256 (default) | RS256 | EdDSA
	// contains filtered or unexported fields
}

type ListChannelsResponse struct {
	Channels []*ChannelSummary `protobuf:"bytes,1,rep,name=channels,proto3" json:"channels,omitempty"`
	// contains filtered or unexported fields
}

type ListKeysResponse struct {
	ActiveKeyId string        `protobuf:"bytes,1,opt,name=active_key_id,json=activeKeyId,proto3" json:"active_key_id,omitempty"`
	Keys        []*KeySummary `protobuf:"bytes,2,rep,name=keys,proto3" json:"keys,omitempty"`
	// contains filtered or unexported fields
}

type OpenPublicRequest struct {
	Name       string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	TtlSeconds int64  `protobuf:"varint,2,opt,name=ttl_seconds,json=ttlSeconds,proto3" json:"ttl_seconds,omitempty"`
	// contains filtered or unexported fields
}

type ParsecService interface {
	// Read-only manifest. Public (no bearer required).
	Manifest(context.Context, *Empty) (*JSONResponse, error)

	// Channel CRUD and lifecycle.
	OpenPublic(context.Context, *OpenPublicRequest) (*ChannelResponse, error)

	CreatePrivate(context.Context, *CreatePrivateRequest) (*Credentials, error)

	ListChannels(context.Context, *Empty) (*ListChannelsResponse, error)

	GetChannel(context.Context, *ChannelRef) (*ChannelResponse, error)

	DeleteChannel(context.Context, *ChannelRef) (*Empty, error)

	// Publish + presence.
	Publish(context.Context, *PublishRequest) (*PublishResponse, error)

	Presence(context.Context, *ChannelRef) (*PresenceResponse, error)

	// Token operations. RefreshToken is public — the refresh token itself
	// is the credential. IssueMgmt mints a new mgmt bearer signed by the
	// currently active key (used during key rotation).
	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)

	IssueMgmt(context.Context, *IssueMgmtRequest) (*IssueMgmtResponse, error)

	// Key ring management.
	ListKeys(context.Context, *Empty) (*ListKeysResponse, error)

	GenerateKey(context.Context, *GenerateKeyRequest) (*KeySummary, error)

	PromoteKey(context.Context, *KeyRef) (*Empty, error)

	RetireKey(context.Context, *KeyRef) (*Empty, error)

	ReloadKeys(context.Context, *Empty) (*Empty, error)

	// Dead-letter queue inspection + maintenance.
	DlqList(context.Context, *DlqListRequest) (*DlqListResponse, error)

	DlqCount(context.Context, *DlqCountRequest) (*DlqCountResponse, error)

	DlqDiscard(context.Context, *DlqDiscardRequest) (*Empty, error)

	DlqReplay(context.Context, *DlqReplayRequest) (*Empty, error)

	// Token revocation. Operator-driven: gated by the mgmt bearer (NOT by
	// the user-facing /parsec/revoke handler which authenticates with the
	// user's own token). The store must be wired via
	// parsec.Options.RevocationStore; calls fail with PARSEC_INVALID_ARGUMENT
	// when no store is configured.
	RevokeToken(context.Context, *RevokeTokenRequest) (*Empty, error)

	RevokeUser(context.Context, *RevokeUserRequest) (*Empty, error)
}

type PresenceResponse struct {
	Subscribers int32 `protobuf:"varint,1,opt,name=subscribers,proto3" json:"subscribers,omitempty"`
	// contains filtered or unexported fields
}

type PublishRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type PublishResponse struct {
	Offset uint64 `protobuf:"varint,1,opt,name=offset,proto3" json:"offset,omitempty"`
	Epoch  string `protobuf:"bytes,2,opt,name=epoch,proto3" json:"epoch,omitempty"`
	// contains filtered or unexported fields
}

type RefreshTokenRequest struct {
	RefreshToken string `protobuf:"bytes,1,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

type RefreshTokenResponse struct {
	AccessToken        string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	AccessExpiresUnix  int64  `protobuf:"varint,2,opt,name=access_expires_unix,json=accessExpiresUnix,proto3" json:"access_expires_unix,omitempty"`
	RefreshToken       string `protobuf:"bytes,3,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	RefreshExpiresUnix int64  `protobuf:"varint,4,opt,name=refresh_expires_unix,json=refreshExpiresUnix,proto3" json:"refresh_expires_unix,omitempty"`
	Rotated            bool   `protobuf:"varint,5,opt,name=rotated,proto3" json:"rotated,omitempty"`
	// contains filtered or unexported fields
}

type RevokeTokenRequest struct {
	TokenId string `protobuf:"bytes,1,opt,name=token_id,json=tokenId,proto3" json:"token_id,omitempty"`
	UserId  string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	Reason  string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type RevokeUserRequest struct {
	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type Scope struct {

	// Pattern is the channel-name pattern, e.g. `private:webapp.user.42.*`.
	// Single-star matches one segment, double-star matches one-or-more
	// trailing segments (last position only).
	Pattern string `protobuf:"bytes,1,opt,name=pattern,proto3" json:"pattern,omitempty"`
	// Verbs is the set of granted actions. Allowed values:
	// "subscribe", "publish", "manage".
	Verbs []string `protobuf:"bytes,2,rep,name=verbs,proto3" json:"verbs,omitempty"`
	// Deny inverts the scope: when true, a matching (channel, verb) pair is
	// subtracted from the grant set with "deny wins" precedence. A scope
	// with deny=true on a pattern that overlaps an allow scope still wins
	// — denies are not unlocked by any allow. A deny scope without an
	// overlapping allow is a defensive no-op. The default (false) means a
	// plain allow scope.
	Deny bool `protobuf:"varint,3,opt,name=deny,proto3" json:"deny,omitempty"`
	// contains filtered or unexported fields
}

type TwirpServer interface {
	http.Handler

	// ServiceDescriptor returns gzipped bytes describing the .proto file that
	// this service was generated from. Once unzipped, the bytes can be
	// unmarshalled as a
	// google.golang.org/protobuf/types/descriptorpb.FileDescriptorProto.
	//
	// The returned integer is the index of this particular service within that
	// FileDescriptorProto's 'Service' slice of ServiceDescriptorProtos. This is a
	// low-level field, expected to be used for reflection.
	ServiceDescriptor() ([]byte, int)

	// ProtocGenTwirpVersion is the semantic version string of the version of
	// twirp used to generate this file.
	ProtocGenTwirpVersion() string

	// PathPrefix returns the HTTP URL path prefix for all methods handled by this
	// service. This can be used with an HTTP mux to route Twirp requests.
	// The path prefix is in the form: "/<prefix>/<package>.<Service>/"
	// that is, everything in a Twirp route except for the <Method> at the end.
	PathPrefix() string
}