auth

type AuthRequest struct {

	// target is what the call is addressing. It is what makes an authorization
	// decision possible: the same credential may be allowed to reach one namespace
	// or method and not another.
	Target *Target `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// credentials are the caller's credentials, one entry per header the operator
	// declared as carrying one. It is empty when the operator declared no headers
	// or the caller sent none of them, which a provider should treat as an
	// unauthenticated caller rather than a trusted one.
	Credentials []*Credential `protobuf:"bytes,2,rep,name=credentials,proto3" json:"credentials,omitempty"`
	// contains filtered or unexported fields
}

type AuthResponse struct {

	// decision is the verdict. Only DECISION_ALLOW admits; every other value,
	// including one this proxy is too old to recognize, denies.
	Decision AuthResponse_Decision `protobuf:"varint,1,opt,name=decision,proto3,enum=api.auth.v1.AuthResponse_Decision" json:"decision,omitempty"`
	// reason is why, written for whoever operates this server. The proxy records it
	// and keeps it out of what a refused caller is told, so it may name internal
	// systems or subjects. It is optional, and unused for an admitted caller.
	Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	// contains filtered or unexported fields
}

type AuthResponse_Decision int32

type AuthServiceClient interface {
	// Auth reports whether the caller behind the current stream may proceed. The
	// verdict travels in the response's decision, and only DECISION_ALLOW admits,
	// so a response left unfilled denies rather than admitting by accident.
	//
	// Return an error only for having reached no verdict at all, such as a backend
	// this server cannot itself reach. The proxy denies either way, but an error
	// keeps its status code, so UNAVAILABLE or DEADLINE_EXCEEDED tells a worker to
	// retry where a denial tells it not to bother. A provider that cannot reach its
	// own backend should report that rather than admit the caller: an authenticator
	// that fails open is worse than one that is down.
	Auth(ctx context.Context, in *AuthRequest, opts ...grpc.CallOption) (*AuthResponse, error)
}

type AuthServiceServer interface {
	// Auth reports whether the caller behind the current stream may proceed. The
	// verdict travels in the response's decision, and only DECISION_ALLOW admits,
	// so a response left unfilled denies rather than admitting by accident.
	//
	// Return an error only for having reached no verdict at all, such as a backend
	// this server cannot itself reach. The proxy denies either way, but an error
	// keeps its status code, so UNAVAILABLE or DEADLINE_EXCEEDED tells a worker to
	// retry where a denial tells it not to bother. A provider that cannot reach its
	// own backend should report that rather than admit the caller: an authenticator
	// that fails open is worse than one that is down.
	Auth(context.Context, *AuthRequest) (*AuthResponse, error)
	// contains filtered or unexported methods
}

type Credential struct {

	// header is the canonical (lowercase) metadata key the values arrived under,
	// so a provider can tell an opaque API key from a bearer token without
	// guessing from the format.
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// values are that header's values in the order the caller sent them. gRPC
	// metadata allows a key to repeat, so this preserves every value rather than
	// silently choosing one.
	Values []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
	// contains filtered or unexported fields
}

type Target struct {

	// full_name is the gRPC full method being invoked, leading slash included, as
	// in "/temporal.api.workflowservice.v1.WorkflowService/DescribeNamespace". It
	// is always set.
	FullName string `protobuf:"bytes,1,opt,name=full_name,json=fullName,proto3" json:"full_name,omitempty"`
	// namespace is the Temporal namespace the request names. It is empty when the
	// method has no namespace to name, as many do, when the caller sent no message
	// to read one from, or when the proxy does not forward this method's service and
	// so never looked. Empty therefore means "unknown", not "a namespace called
	// nothing": match a namespace-scoped rule against full_name as well, rather than
	// reading empty as a namespace that some rule might accept.
	Namespace string `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAuthServiceServer struct{}

type UnsafeAuthServiceServer interface {
	// contains filtered or unexported methods
}