auth

type APIKeyInfo struct {
	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Name          string                 `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	RedactedValue string                 `protobuf:"bytes,3,opt,name=redacted_value,json=redactedValue,proto3" json:"redacted_value,omitempty"`
	RoleId        *string                `protobuf:"bytes,4,opt,name=role_id,json=roleId,proto3,oneof" json:"role_id,omitempty"`
	RoleName      *string                `protobuf:"bytes,5,opt,name=role_name,json=roleName,proto3,oneof" json:"role_name,omitempty"`
	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	UpdatedAt     *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	LastUsedAt    *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=last_used_at,json=lastUsedAt,proto3,oneof" json:"last_used_at,omitempty"`
	ExpiresAt     *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=expires_at,json=expiresAt,proto3,oneof" json:"expires_at,omitempty"`
	RevokedAt     *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=revoked_at,json=revokedAt,proto3,oneof" json:"revoked_at,omitempty"`
	RoleTypeCode  *string                `protobuf:"bytes,11,opt,name=role_type_code,json=roleTypeCode,proto3,oneof" json:"role_type_code,omitempty"`
	// contains filtered or unexported fields
}

type AccountMode int32

type AuthServiceClient interface {
	// Verifies a bearer token (JWT or API key) and returns the resolved Identity.
	ValidateCredential(ctx context.Context, in *Credential, opts ...grpc.CallOption) (*Identity, error)
	// Authenticates a user by identifier + password and returns a token pair + user profile.
	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Creates a new user and returns a token pair for immediate login.
	Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Exchanges a valid refresh token for a new access token.
	RefreshToken(ctx context.Context, in *RefreshTokenRequest, opts ...grpc.CallOption) (*RefreshTokenResponse, error)
	// Sends a password reset email. Returns Empty regardless of whether the
	// identifier exists (to prevent user enumeration).
	RequestPasswordReset(ctx context.Context, in *RequestPasswordResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Completes password reset using the email token and returns a token pair.
	ResetPassword(ctx context.Context, in *ResetPasswordRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Invalidates a refresh token. Used on logout.
	RevokeRefreshToken(ctx context.Context, in *RevokeRefreshTokenRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Changes the authenticated user's password (requires old password).
	UpdatePassword(ctx context.Context, in *UpdatePasswordRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Creates a new API key. Returns the full secret (shown once) and metadata.
	CreateAPIKey(ctx context.Context, in *CreateAPIKeyRequest, opts ...grpc.CallOption) (*CreateAPIKeyResponse, error)
	// Revokes an API key and creates a replacement with the same name/role/owner.
	RotateAPIKey(ctx context.Context, in *RotateAPIKeyRequest, opts ...grpc.CallOption) (*RotateAPIKeyResponse, error)
	// Permanently revokes an API key with no replacement.
	RevokeAPIKey(ctx context.Context, in *RevokeAPIKeyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Returns a paginated list of API keys for the target account.
	ListAPIKeys(ctx context.Context, in *ListAPIKeysRequest, opts ...grpc.CallOption) (*ListAPIKeysResponse, error)
	// Returns a single API key's metadata by ID.
	GetAPIKey(ctx context.Context, in *GetAPIKeyRequest, opts ...grpc.CallOption) (*GetAPIKeyResponse, error)
	// Returns API keys matching the given IDs for the caller's target account.
	BatchGetAPIKeysByIDs(ctx context.Context, in *BatchGetAPIKeysByIDsRequest, opts ...grpc.CallOption) (*BatchGetAPIKeysByIDsResponse, error)
	// Returns a sandbox API key for API docs, reusing or creating as needed.
	GetOrCreateDocAPIKey(ctx context.Context, in *GetOrCreateDocAPIKeyRequest, opts ...grpc.CallOption) (*GetOrCreateDocAPIKeyResponse, error)
	// Creates a registration session (or returns existing). Sends a verification email.
	CreateRegistrationSession(ctx context.Context, in *CreateRegistrationSessionRequest, opts ...grpc.CallOption) (*CreateRegistrationSessionResponse, error)
	// Resends the verification email for a registration session.
	ResendVerificationEmail(ctx context.Context, in *ResendVerificationEmailRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
	// Verifies the email token and advances the session step. Idempotent.
	VerifyRegistrationToken(ctx context.Context, in *VerifyRegistrationTokenRequest, opts ...grpc.CallOption) (*VerifyRegistrationTokenResponse, error)
	// Returns the current state of a registration session.
	GetRegistrationSession(ctx context.Context, in *GetRegistrationSessionRequest, opts ...grpc.CallOption) (*GetRegistrationSessionResponse, error)
	// Creates or resolves a user for a registration session. Returns user ID and tokens.
	CreateUserForRegistration(ctx context.Context, in *CreateUserForRegistrationRequest, opts ...grpc.CallOption) (*CreateUserForRegistrationResponse, error)
	// Updates a registration session's step, form data, or Stripe fields.
	UpdateRegistrationSession(ctx context.Context, in *UpdateRegistrationSessionRequest, opts ...grpc.CallOption) (*UpdateRegistrationSessionResponse, error)
	// Returns a paginated list of open registration sessions for the authenticated user.
	ListRegistrationSessions(ctx context.Context, in *ListRegistrationSessionsRequest, opts ...grpc.CallOption) (*ListRegistrationSessionsResponse, error)
	// Creates a Stripe customer and billing profile for a registration session.
	SetupRegistrationBilling(ctx context.Context, in *SetupRegistrationBillingRequest, opts ...grpc.CallOption) (*SetupRegistrationBillingResponse, error)
	// Verifies a Setup Intent succeeded and marks payment as completed.
	ConfirmRegistrationPayment(ctx context.Context, in *ConfirmRegistrationPaymentRequest, opts ...grpc.CallOption) (*ConfirmRegistrationPaymentResponse, error)
	// Finalizes registration: creates accounts, roles, permissions, and account-users.
	CompleteRegistration(ctx context.Context, in *CompleteRegistrationRequest, opts ...grpc.CallOption) (*CompleteRegistrationResponse, error)
	// Exchanges a magic-login token (from the "already registered" email) for a token pair.
	MagicLogin(ctx context.Context, in *MagicLoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Returns the caller's most recent incomplete registration session, or no session if none exists.
	GetIncompleteRegistrationSession(ctx context.Context, in *GetIncompleteRegistrationSessionRequest, opts ...grpc.CallOption) (*GetIncompleteRegistrationSessionResponse, error)
}

type AuthServiceServer interface {
	// Verifies a bearer token (JWT or API key) and returns the resolved Identity.
	ValidateCredential(context.Context, *Credential) (*Identity, error)
	// Authenticates a user by identifier + password and returns a token pair + user profile.
	Login(context.Context, *LoginRequest) (*LoginResponse, error)
	// Creates a new user and returns a token pair for immediate login.
	Register(context.Context, *RegisterRequest) (*LoginResponse, error)
	// Exchanges a valid refresh token for a new access token.
	RefreshToken(context.Context, *RefreshTokenRequest) (*RefreshTokenResponse, error)
	// Sends a password reset email. Returns Empty regardless of whether the
	// identifier exists (to prevent user enumeration).
	RequestPasswordReset(context.Context, *RequestPasswordResetRequest) (*emptypb.Empty, error)
	// Completes password reset using the email token and returns a token pair.
	ResetPassword(context.Context, *ResetPasswordRequest) (*LoginResponse, error)
	// Invalidates a refresh token. Used on logout.
	RevokeRefreshToken(context.Context, *RevokeRefreshTokenRequest) (*emptypb.Empty, error)
	// Changes the authenticated user's password (requires old password).
	UpdatePassword(context.Context, *UpdatePasswordRequest) (*emptypb.Empty, error)
	// Creates a new API key. Returns the full secret (shown once) and metadata.
	CreateAPIKey(context.Context, *CreateAPIKeyRequest) (*CreateAPIKeyResponse, error)
	// Revokes an API key and creates a replacement with the same name/role/owner.
	RotateAPIKey(context.Context, *RotateAPIKeyRequest) (*RotateAPIKeyResponse, error)
	// Permanently revokes an API key with no replacement.
	RevokeAPIKey(context.Context, *RevokeAPIKeyRequest) (*emptypb.Empty, error)
	// Returns a paginated list of API keys for the target account.
	ListAPIKeys(context.Context, *ListAPIKeysRequest) (*ListAPIKeysResponse, error)
	// Returns a single API key's metadata by ID.
	GetAPIKey(context.Context, *GetAPIKeyRequest) (*GetAPIKeyResponse, error)
	// Returns API keys matching the given IDs for the caller's target account.
	BatchGetAPIKeysByIDs(context.Context, *BatchGetAPIKeysByIDsRequest) (*BatchGetAPIKeysByIDsResponse, error)
	// Returns a sandbox API key for API docs, reusing or creating as needed.
	GetOrCreateDocAPIKey(context.Context, *GetOrCreateDocAPIKeyRequest) (*GetOrCreateDocAPIKeyResponse, error)
	// Creates a registration session (or returns existing). Sends a verification email.
	CreateRegistrationSession(context.Context, *CreateRegistrationSessionRequest) (*CreateRegistrationSessionResponse, error)
	// Resends the verification email for a registration session.
	ResendVerificationEmail(context.Context, *ResendVerificationEmailRequest) (*emptypb.Empty, error)
	// Verifies the email token and advances the session step. Idempotent.
	VerifyRegistrationToken(context.Context, *VerifyRegistrationTokenRequest) (*VerifyRegistrationTokenResponse, error)
	// Returns the current state of a registration session.
	GetRegistrationSession(context.Context, *GetRegistrationSessionRequest) (*GetRegistrationSessionResponse, error)
	// Creates or resolves a user for a registration session. Returns user ID and tokens.
	CreateUserForRegistration(context.Context, *CreateUserForRegistrationRequest) (*CreateUserForRegistrationResponse, error)
	// Updates a registration session's step, form data, or Stripe fields.
	UpdateRegistrationSession(context.Context, *UpdateRegistrationSessionRequest) (*UpdateRegistrationSessionResponse, error)
	// Returns a paginated list of open registration sessions for the authenticated user.
	ListRegistrationSessions(context.Context, *ListRegistrationSessionsRequest) (*ListRegistrationSessionsResponse, error)
	// Creates a Stripe customer and billing profile for a registration session.
	SetupRegistrationBilling(context.Context, *SetupRegistrationBillingRequest) (*SetupRegistrationBillingResponse, error)
	// Verifies a Setup Intent succeeded and marks payment as completed.
	ConfirmRegistrationPayment(context.Context, *ConfirmRegistrationPaymentRequest) (*ConfirmRegistrationPaymentResponse, error)
	// Finalizes registration: creates accounts, roles, permissions, and account-users.
	CompleteRegistration(context.Context, *CompleteRegistrationRequest) (*CompleteRegistrationResponse, error)
	// Exchanges a magic-login token (from the "already registered" email) for a token pair.
	MagicLogin(context.Context, *MagicLoginRequest) (*LoginResponse, error)
	// Returns the caller's most recent incomplete registration session, or no session if none exists.
	GetIncompleteRegistrationSession(context.Context, *GetIncompleteRegistrationSessionRequest) (*GetIncompleteRegistrationSessionResponse, error)
	// contains filtered or unexported methods
}

type BatchGetAPIKeysByIDsRequest struct {
	Ids []string `protobuf:"bytes,1,rep,name=ids,proto3" json:"ids,omitempty"`
	// contains filtered or unexported fields
}

type BatchGetAPIKeysByIDsResponse struct {
	ApiKeys []*APIKeyInfo `protobuf:"bytes,1,rep,name=api_keys,json=apiKeys,proto3" json:"api_keys,omitempty"`
	// contains filtered or unexported fields
}

type CompleteRegistrationRequest struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type CompleteRegistrationResponse struct {
	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
	SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// contains filtered or unexported fields
}

type ConfirmRegistrationPaymentRequest struct {
	SessionId     string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	SetupIntentId string `protobuf:"bytes,2,opt,name=setup_intent_id,json=setupIntentId,proto3" json:"setup_intent_id,omitempty"`
	// contains filtered or unexported fields
}

type ConfirmRegistrationPaymentResponse struct {
	Status          string  `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	PaymentMethodId *string `protobuf:"bytes,2,opt,name=payment_method_id,json=paymentMethodId,proto3,oneof" json:"payment_method_id,omitempty"`
	// contains filtered or unexported fields
}

type CreateAPIKeyRequest struct {
	RoleId    string                 `protobuf:"bytes,1,opt,name=role_id,json=roleId,proto3" json:"role_id,omitempty"`
	Name      string                 `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3,oneof" json:"expires_at,omitempty"`
	Includes  []string               `protobuf:"bytes,4,rep,name=includes,proto3" json:"includes,omitempty"`
	// contains filtered or unexported fields
}

type CreateAPIKeyResponse struct {

	// Full secret value, shown only at creation time.
	ApiKeySecret string      `protobuf:"bytes,1,opt,name=api_key_secret,json=apiKeySecret,proto3" json:"api_key_secret,omitempty"`
	ApiKey       *APIKeyInfo `protobuf:"bytes,2,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
	// contains filtered or unexported fields
}

type CreateRegistrationSessionRequest struct {
	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
	PlanCode string `protobuf:"bytes,2,opt,name=plan_code,json=planCode,proto3" json:"plan_code,omitempty"`
	// contains filtered or unexported fields
}

type CreateRegistrationSessionResponse struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type CreateUserForRegistrationRequest struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	Name      string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Password  string `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
	// contains filtered or unexported fields
}

type CreateUserForRegistrationResponse struct {
	UserId       string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	AccessToken  string `protobuf:"bytes,2,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	RefreshToken string `protobuf:"bytes,3,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

type Credential struct {

	// Bearer token from Authorization header. May be a JWT or API key;
	// the auth-service determines the type by inspecting the format.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// From the OpenMRP-Account header. When absent, the user's default account is used.
	TargetAccountId *string `protobuf:"bytes,2,opt,name=target_account_id,json=targetAccountId,proto3,oneof" json:"target_account_id,omitempty"`
	// From the OpenMRP-Actor-Account header. When present, the identity is resolved
	// against this account instead of the target account.
	ActorAccountId *string `protobuf:"bytes,3,opt,name=actor_account_id,json=actorAccountId,proto3,oneof" json:"actor_account_id,omitempty"`
	// contains filtered or unexported fields
}

type GetAPIKeyRequest struct {
	ApiKeyId string   `protobuf:"bytes,1,opt,name=api_key_id,json=apiKeyId,proto3" json:"api_key_id,omitempty"`
	Includes []string `protobuf:"bytes,2,rep,name=includes,proto3" json:"includes,omitempty"`
	// contains filtered or unexported fields
}

type GetAPIKeyResponse struct {
	ApiKey *APIKeyInfo `protobuf:"bytes,1,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
	// contains filtered or unexported fields
}

type GetIncompleteRegistrationSessionRequest struct {
	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
	// contains filtered or unexported fields
}

type GetIncompleteRegistrationSessionResponse struct {
	Session *IncompleteRegistrationSessionProto `protobuf:"bytes,1,opt,name=session,proto3,oneof" json:"session,omitempty"`
	// contains filtered or unexported fields
}

type GetOrCreateDocAPIKeyRequest struct {
	Includes []string `protobuf:"bytes,1,rep,name=includes,proto3" json:"includes,omitempty"`
	// contains filtered or unexported fields
}

type GetOrCreateDocAPIKeyResponse struct {
	ApiKeySecret string      `protobuf:"bytes,1,opt,name=api_key_secret,json=apiKeySecret,proto3" json:"api_key_secret,omitempty"`
	ApiKey       *APIKeyInfo `protobuf:"bytes,2,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
	// contains filtered or unexported fields
}

type GetRegistrationSessionRequest struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type GetRegistrationSessionResponse struct {
	Session *RegistrationSessionInfo `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// contains filtered or unexported fields
}

type Identity struct {
	Type               IdentityActorType `protobuf:"varint,1,opt,name=type,proto3,enum=auth.IdentityActorType" json:"type,omitempty"`
	Actor              *IdentityActor    `protobuf:"bytes,3,opt,name=actor,proto3" json:"actor,omitempty"`
	AccountMode        AccountMode       `protobuf:"varint,4,opt,name=account_mode,json=accountMode,proto3,enum=auth.AccountMode" json:"account_mode,omitempty"`
	SubscriptionStatus *string           `protobuf:"bytes,5,opt,name=subscription_status,json=subscriptionStatus,proto3,oneof" json:"subscription_status,omitempty"`
	Target             *IdentityTarget   `protobuf:"bytes,7,opt,name=target,proto3" json:"target,omitempty"`
	// contains filtered or unexported fields
}

type IdentityActor struct {
	RelationType IdentityRelationType `` /* 129-byte string literal not displayed */
	Id           string               `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
	Name         *string              `protobuf:"bytes,3,opt,name=name,proto3,oneof" json:"name,omitempty"`
	// The actor's "home" account, which may differ from the target's account_id in cross-account scenarios.
	AccountId    *string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3,oneof" json:"account_id,omitempty"`
	RoleId       *string `protobuf:"bytes,5,opt,name=role_id,json=roleId,proto3,oneof" json:"role_id,omitempty"`
	RoleTypeCode *string `protobuf:"bytes,6,opt,name=role_type_code,json=roleTypeCode,proto3,oneof" json:"role_type_code,omitempty"`
	// Keys are permission codes (e.g. "invoices.create"); only granted permissions are present.
	Permissions map[string]bool `` /* 150-byte string literal not displayed */
	// The role's display name, used to explain an authorization failure in terms the
	// caller recognizes.
	RoleName *string `protobuf:"bytes,8,opt,name=role_name,json=roleName,proto3,oneof" json:"role_name,omitempty"`
	// contains filtered or unexported fields
}

type IdentityActorType int32

type IdentityRelationType int32

type IdentityTarget struct {
	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
	// The relationship type when the target account differs from the actor's account
	// (e.g. "customer" or "supplier"). Empty when targeting the actor's own account.
	RelationType *string `protobuf:"bytes,2,opt,name=relation_type,json=relationType,proto3,oneof" json:"relation_type,omitempty"`
	// contains filtered or unexported fields
}

type IncompleteRegistrationSessionProto struct {
	SessionId string                 `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	PlanCode  string                 `protobuf:"bytes,2,opt,name=plan_code,json=planCode,proto3" json:"plan_code,omitempty"`
	Step      string                 `protobuf:"bytes,3,opt,name=step,proto3" json:"step,omitempty"`
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	// contains filtered or unexported fields
}

type ListAPIKeysRequest struct {
	Cursor *string `protobuf:"bytes,1,opt,name=cursor,proto3,oneof" json:"cursor,omitempty"`
	Limit  int32   `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	Query  *string `protobuf:"bytes,3,opt,name=query,proto3,oneof" json:"query,omitempty"`
	// Valid values: "active", "expired", "revoked". When empty, all statuses are included.
	Statuses []string `protobuf:"bytes,4,rep,name=statuses,proto3" json:"statuses,omitempty"`
	Includes []string `protobuf:"bytes,5,rep,name=includes,proto3" json:"includes,omitempty"`
	// contains filtered or unexported fields
}

type ListAPIKeysResponse struct {
	ApiKeys  []*APIKeyInfo `protobuf:"bytes,1,rep,name=api_keys,json=apiKeys,proto3" json:"api_keys,omitempty"`
	PageInfo *PageInfo     `protobuf:"bytes,2,opt,name=page_info,json=pageInfo,proto3" json:"page_info,omitempty"`
	// contains filtered or unexported fields
}

type ListRegistrationSessionsRequest struct {
	Cursor *string `protobuf:"bytes,1,opt,name=cursor,proto3,oneof" json:"cursor,omitempty"`
	Limit  int32   `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	// contains filtered or unexported fields
}

type ListRegistrationSessionsResponse struct {
	Sessions []*RegistrationSessionInfo `protobuf:"bytes,1,rep,name=sessions,proto3" json:"sessions,omitempty"`
	PageInfo *PageInfo                  `protobuf:"bytes,2,opt,name=page_info,json=pageInfo,proto3" json:"page_info,omitempty"`
	// contains filtered or unexported fields
}

type LoginRequest struct {

	// Email address, username, or user ID. The auth-service resolves by trying each format in order.
	Identifier string `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
	Password   string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
	// contains filtered or unexported fields
}

type LoginResponse struct {
	AccessToken  string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	RefreshToken string `protobuf:"bytes,2,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	User         *User  `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
	// contains filtered or unexported fields
}

type MagicLoginRequest struct {
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type PageInfo struct {
	NextCursor  *string `protobuf:"bytes,1,opt,name=next_cursor,json=nextCursor,proto3,oneof" json:"next_cursor,omitempty"`
	PrevCursor  *string `protobuf:"bytes,2,opt,name=prev_cursor,json=prevCursor,proto3,oneof" json:"prev_cursor,omitempty"`
	HasNextPage bool    `protobuf:"varint,3,opt,name=has_next_page,json=hasNextPage,proto3" json:"has_next_page,omitempty"`
	HasPrevPage bool    `protobuf:"varint,4,opt,name=has_prev_page,json=hasPrevPage,proto3" json:"has_prev_page,omitempty"`
	// contains filtered or unexported fields
}

type RefreshTokenRequest struct {
	RefreshToken string `protobuf:"bytes,1,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

type RefreshTokenResponse struct {
	AccessToken string `protobuf:"bytes,1,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
	// contains filtered or unexported fields
}

type RegisterRequest struct {
	Email    string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
	Name     string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// When registering from a customer portal, the account slug scopes the
	// magic-login link in the "already registered" email.
	AccountSlug *string `protobuf:"bytes,4,opt,name=account_slug,json=accountSlug,proto3,oneof" json:"account_slug,omitempty"`
	// Base URL of the account's verified custom portal domain (e.g. https://shop.acme.com). Resolved server-side by the gateway, never taken from the client; when set, email links use it instead of the slug-prefixed dashboard URL.
	PortalBaseUrl *string `protobuf:"bytes,5,opt,name=portal_base_url,json=portalBaseUrl,proto3,oneof" json:"portal_base_url,omitempty"`
	// contains filtered or unexported fields
}

type RegistrationSessionData struct {
	UserName                 *string `protobuf:"bytes,1,opt,name=user_name,json=userName,proto3,oneof" json:"user_name,omitempty"`
	AccountName              *string `protobuf:"bytes,2,opt,name=account_name,json=accountName,proto3,oneof" json:"account_name,omitempty"`
	BillingAddressLine1      *string `` /* 126-byte string literal not displayed */
	BillingAddressLine2      *string `` /* 126-byte string literal not displayed */
	BillingAddressCity       *string `protobuf:"bytes,5,opt,name=billing_address_city,json=billingAddressCity,proto3,oneof" json:"billing_address_city,omitempty"`
	BillingAddressState      *string `` /* 126-byte string literal not displayed */
	BillingAddressPostalCode *string `` /* 143-byte string literal not displayed */
	BillingAddressCountry    *string `` /* 132-byte string literal not displayed */
	// contains filtered or unexported fields
}

type RegistrationSessionInfo struct {
	Id                      string                   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Email                   string                   `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
	PlanCode                string                   `protobuf:"bytes,3,opt,name=plan_code,json=planCode,proto3" json:"plan_code,omitempty"`
	Step                    string                   `protobuf:"bytes,4,opt,name=step,proto3" json:"step,omitempty"`
	IsEmailVerified         bool                     `protobuf:"varint,5,opt,name=is_email_verified,json=isEmailVerified,proto3" json:"is_email_verified,omitempty"`
	IsExistingUser          *bool                    `protobuf:"varint,6,opt,name=is_existing_user,json=isExistingUser,proto3,oneof" json:"is_existing_user,omitempty"`
	UserId                  *string                  `protobuf:"bytes,7,opt,name=user_id,json=userId,proto3,oneof" json:"user_id,omitempty"`
	AccountId               *string                  `protobuf:"bytes,8,opt,name=account_id,json=accountId,proto3,oneof" json:"account_id,omitempty"`
	StripeCustomerId        *string                  `protobuf:"bytes,9,opt,name=stripe_customer_id,json=stripeCustomerId,proto3,oneof" json:"stripe_customer_id,omitempty"`
	StripeCheckoutSessionId *string                  `` /* 141-byte string literal not displayed */
	StripeSubscriptionId    *string                  `` /* 130-byte string literal not displayed */
	PaymentCompleted        bool                     `protobuf:"varint,12,opt,name=payment_completed,json=paymentCompleted,proto3" json:"payment_completed,omitempty"`
	SessionData             *RegistrationSessionData `protobuf:"bytes,13,opt,name=session_data,json=sessionData,proto3" json:"session_data,omitempty"`
	CompletedAt             *timestamppb.Timestamp   `protobuf:"bytes,14,opt,name=completed_at,json=completedAt,proto3,oneof" json:"completed_at,omitempty"`
	CreatedAt               *timestamppb.Timestamp   `protobuf:"bytes,15,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	UpdatedAt               *timestamppb.Timestamp   `protobuf:"bytes,16,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	// contains filtered or unexported fields
}

type RequestPasswordResetRequest struct {
	Identifier string `protobuf:"bytes,1,opt,name=identifier,proto3" json:"identifier,omitempty"`
	// Scopes the reset email's branding/links to a specific account context.
	AccountSlug *string `protobuf:"bytes,2,opt,name=account_slug,json=accountSlug,proto3,oneof" json:"account_slug,omitempty"`
	// Base URL of the account's verified custom portal domain. Resolved server-side by the gateway, never taken from the client; when set, the reset link uses it instead of the slug-prefixed dashboard URL.
	PortalBaseUrl *string `protobuf:"bytes,3,opt,name=portal_base_url,json=portalBaseUrl,proto3,oneof" json:"portal_base_url,omitempty"`
	// contains filtered or unexported fields
}

type ResendVerificationEmailRequest struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type ResetPasswordRequest struct {
	Token    string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
	// contains filtered or unexported fields
}

type RevokeAPIKeyRequest struct {
	ApiKeyId string `protobuf:"bytes,1,opt,name=api_key_id,json=apiKeyId,proto3" json:"api_key_id,omitempty"`
	// contains filtered or unexported fields
}

type RevokeRefreshTokenRequest struct {
	RefreshToken string `protobuf:"bytes,1,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

type RotateAPIKeyRequest struct {
	ApiKeyId string `protobuf:"bytes,1,opt,name=api_key_id,json=apiKeyId,proto3" json:"api_key_id,omitempty"`
	// If not set, the new key inherits the old key's expiration.
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expires_at,json=expiresAt,proto3,oneof" json:"expires_at,omitempty"`
	Includes  []string               `protobuf:"bytes,3,rep,name=includes,proto3" json:"includes,omitempty"`
	// When to revoke the old key. If not set (or in the past), the old key is
	// revoked immediately. A future value schedules revocation (max 30 days out),
	// keeping the old key valid until then.
	RevokeAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=revoke_at,json=revokeAt,proto3,oneof" json:"revoke_at,omitempty"`
	// contains filtered or unexported fields
}

type RotateAPIKeyResponse struct {

	// Full secret value, shown only once.
	ApiKeySecret string      `protobuf:"bytes,1,opt,name=api_key_secret,json=apiKeySecret,proto3" json:"api_key_secret,omitempty"`
	ApiKey       *APIKeyInfo `protobuf:"bytes,2,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
	// contains filtered or unexported fields
}

type SetupRegistrationBillingRequest struct {
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// contains filtered or unexported fields
}

type SetupRegistrationBillingResponse struct {
	StripeCustomerId string `protobuf:"bytes,1,opt,name=stripe_customer_id,json=stripeCustomerId,proto3" json:"stripe_customer_id,omitempty"`
	BillingProfileId string `protobuf:"bytes,2,opt,name=billing_profile_id,json=billingProfileId,proto3" json:"billing_profile_id,omitempty"`
	BillingCadenceId string `protobuf:"bytes,3,opt,name=billing_cadence_id,json=billingCadenceId,proto3" json:"billing_cadence_id,omitempty"`
	// Stripe Setup Intent client secret for Stripe.js.
	ClientSecret string `protobuf:"bytes,4,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// Stripe publishable key for Stripe.js initialization.
	PublishableKey string `protobuf:"bytes,5,opt,name=publishable_key,json=publishableKey,proto3" json:"publishable_key,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAuthServiceServer struct{}

type UnsafeAuthServiceServer interface {
	// contains filtered or unexported methods
}

type UpdatePasswordRequest struct {
	OldPassword string `protobuf:"bytes,1,opt,name=old_password,json=oldPassword,proto3" json:"old_password,omitempty"`
	NewPassword string `protobuf:"bytes,2,opt,name=new_password,json=newPassword,proto3" json:"new_password,omitempty"`
	// contains filtered or unexported fields
}

type UpdateRegistrationSessionRequest struct {
	SessionId            string                   `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	Step                 *string                  `protobuf:"bytes,2,opt,name=step,proto3,oneof" json:"step,omitempty"`
	SessionData          *RegistrationSessionData `protobuf:"bytes,3,opt,name=session_data,json=sessionData,proto3,oneof" json:"session_data,omitempty"`
	StripeCustomerId     *string                  `protobuf:"bytes,4,opt,name=stripe_customer_id,json=stripeCustomerId,proto3,oneof" json:"stripe_customer_id,omitempty"`
	PaymentCompleted     *bool                    `protobuf:"varint,5,opt,name=payment_completed,json=paymentCompleted,proto3,oneof" json:"payment_completed,omitempty"`
	StripeSubscriptionId *string                  `` /* 129-byte string literal not displayed */
	// contains filtered or unexported fields
}

type UpdateRegistrationSessionResponse struct {
	Session *RegistrationSessionInfo `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// contains filtered or unexported fields
}

type User struct {
	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Email         *string                `protobuf:"bytes,2,opt,name=email,proto3,oneof" json:"email,omitempty"`
	Name          *string                `protobuf:"bytes,3,opt,name=name,proto3,oneof" json:"name,omitempty"`
	Username      *string                `protobuf:"bytes,4,opt,name=username,proto3,oneof" json:"username,omitempty"`
	ImageUrl      *string                `protobuf:"bytes,5,opt,name=image_url,json=imageUrl,proto3,oneof" json:"image_url,omitempty"`
	EmailVerified *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=email_verified,json=emailVerified,proto3,oneof" json:"email_verified,omitempty"`
	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	UpdatedAt     *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	// contains filtered or unexported fields
}

type VerifyRegistrationTokenRequest struct {
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// contains filtered or unexported fields
}

type VerifyRegistrationTokenResponse struct {
	Session *RegistrationSessionInfo `protobuf:"bytes,1,opt,name=session,proto3" json:"session,omitempty"`
	// contains filtered or unexported fields
}