lookup

type HealthRequest struct {
	// contains filtered or unexported fields
}

type HealthResponse struct {
	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	// contains filtered or unexported fields
}

type LookupFilter struct {
	Kinds []relationships.Kind  `protobuf:"varint,1,rep,packed,name=kinds,proto3,enum=gitlab.iam.relationships.v1.Kind" json:"kinds,omitempty"`
	Roles []*relationships.Role `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
	// contains filtered or unexported fields
}

type LookupRelationshipsRequest struct {

	// required; the organization to scan. Must be a canonical lowercase UUIDv7.
	OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"`
	// optional; scopes the scan to these objects. Empty scans the whole org and
	// requires the org owner; non-empty requires a relationships-admin grant on
	// the ancestor or on each object.
	Objects []*relationships.Object `protobuf:"bytes,2,rep,name=objects,proto3" json:"objects,omitempty"`
	// optional; an ancestor object the caller administers. With objects set, a
	// relationships-admin grant on it authorizes the scan, mirroring
	// WriteRelationships. When set, must be a canonical lowercase UUIDv7.
	//
	// Security: this service stores no resource hierarchy, so it cannot confirm
	// the scanned objects are descendants of ancestor_id. A caller with a
	// relationships-admin grant on ancestor_id can therefore scan any objects,
	// regardless of whether they are actual descendants. Upstream callers must
	// guarantee that relationship; this is the same accepted trust model as
	// WriteRelationships.
	AncestorId string        `protobuf:"bytes,3,opt,name=ancestor_id,json=ancestorId,proto3" json:"ancestor_id,omitempty"`
	Filter     *LookupFilter `protobuf:"bytes,4,opt,name=filter,proto3" json:"filter,omitempty"`                        // optional
	PageSize   int32         `protobuf:"varint,5,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`   // 0 = server default; clamped to server cap
	PageToken  string        `protobuf:"bytes,6,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` // empty for first page; otherwise opaque server-issued
	// contains filtered or unexported fields
}

type LookupRelationshipsResponse struct {
	Relationships []*relationships.Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
	NextPageToken string                        `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` // empty = no more pages
	// contains filtered or unexported fields
}

type LookupResourcesRequest struct {
	Subject   *relationships.Subject `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`                      // subject.identity must be set
	Filter    *LookupFilter          `protobuf:"bytes,2,opt,name=filter,proto3" json:"filter,omitempty"`                        // optional
	PageSize  int32                  `protobuf:"varint,3,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`   // 0 = server default; clamped to server cap
	PageToken string                 `protobuf:"bytes,4,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` // empty for first page; otherwise opaque server-issued
	// contains filtered or unexported fields
}

type LookupResourcesResponse struct {
	Relationships []*relationships.Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
	NextPageToken string                        `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` // empty = no more pages
	// contains filtered or unexported fields
}

type LookupServiceClient interface {
	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
	// Bounded read for the auth path. objects required and non-empty.
	// Unresolvable subject → NOT_FOUND.
	ReadRelationships(ctx context.Context, in *ReadRelationshipsRequest, opts ...grpc.CallOption) (*ReadRelationshipsResponse, error)
	// Paginated subject-first scan for UI/admin. Not on the auth path.
	// Unresolvable subject → NOT_FOUND (distinct from empty page).
	LookupResources(ctx context.Context, in *LookupResourcesRequest, opts ...grpc.CallOption) (*LookupResourcesResponse, error)
	// Paginated object-first scan for UI/admin. Not on the auth path.
	LookupSubjects(ctx context.Context, in *LookupSubjectsRequest, opts ...grpc.CallOption) (*LookupSubjectsResponse, error)
	// Paginated org-scoped scan for UI/admin. With objects set, the scan is
	// scoped to them and the caller needs a relationships-admin grant on each;
	// without objects, the whole org is returned and the caller must be the org
	// owner. Not on the auth path. Requires an AR-scoped token from the Rails
	// token exchange; authorization is enforced in the handler.
	LookupRelationships(ctx context.Context, in *LookupRelationshipsRequest, opts ...grpc.CallOption) (*LookupRelationshipsResponse, error)
}

type LookupServiceServer interface {
	Health(context.Context, *HealthRequest) (*HealthResponse, error)
	// Bounded read for the auth path. objects required and non-empty.
	// Unresolvable subject → NOT_FOUND.
	ReadRelationships(context.Context, *ReadRelationshipsRequest) (*ReadRelationshipsResponse, error)
	// Paginated subject-first scan for UI/admin. Not on the auth path.
	// Unresolvable subject → NOT_FOUND (distinct from empty page).
	LookupResources(context.Context, *LookupResourcesRequest) (*LookupResourcesResponse, error)
	// Paginated object-first scan for UI/admin. Not on the auth path.
	LookupSubjects(context.Context, *LookupSubjectsRequest) (*LookupSubjectsResponse, error)
	// Paginated org-scoped scan for UI/admin. With objects set, the scan is
	// scoped to them and the caller needs a relationships-admin grant on each;
	// without objects, the whole org is returned and the caller must be the org
	// owner. Not on the auth path. Requires an AR-scoped token from the Rails
	// token exchange; authorization is enforced in the handler.
	LookupRelationships(context.Context, *LookupRelationshipsRequest) (*LookupRelationshipsResponse, error)
	// contains filtered or unexported methods
}

type LookupSubjectsRequest struct {
	Object    *relationships.Object `protobuf:"bytes,1,opt,name=object,proto3" json:"object,omitempty"`
	Filter    *LookupFilter         `protobuf:"bytes,2,opt,name=filter,proto3" json:"filter,omitempty"`                        // optional
	PageSize  int32                 `protobuf:"varint,3,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`   // 0 = server default; clamped to server cap
	PageToken string                `protobuf:"bytes,4,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` // empty for first page; otherwise opaque server-issued
	// contains filtered or unexported fields
}

type LookupSubjectsResponse struct {
	Relationships []*relationships.Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
	NextPageToken string                        `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` // empty = no more pages
	// contains filtered or unexported fields
}

type ReadRelationshipsRequest struct {
	Subject *relationships.Subject  `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`                                           // subject.identity must be set
	Objects []*relationships.Object `protobuf:"bytes,2,rep,name=objects,proto3" json:"objects,omitempty"`                                           // required, non-empty
	Kinds   []relationships.Kind    `protobuf:"varint,3,rep,packed,name=kinds,proto3,enum=gitlab.iam.relationships.v1.Kind" json:"kinds,omitempty"` // empty = all
	// contains filtered or unexported fields
}

type ReadRelationshipsResponse struct {

	// Flat list of matched tuples. subject.principal is set on each record.
	Relationships []*relationships.Relationship `protobuf:"bytes,1,rep,name=relationships,proto3" json:"relationships,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedLookupServiceServer struct{}

type UnsafeLookupServiceServer interface {
	// contains filtered or unexported methods
}