auth

type AuthServiceClient interface {
	// Unauthenticated: the only public method; no service token required.
	Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error)
}

type AuthServiceServer interface {
	// Unauthenticated: the only public method; no service token required.
	Health(context.Context, *HealthRequest) (*HealthResponse, error)
	// contains filtered or unexported methods
}

type Client struct {
	ClientId    string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	ClientName  string                 `protobuf:"bytes,2,opt,name=client_name,json=clientName,proto3" json:"client_name,omitempty"`
	Scopes      []string               `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	ClientOwner string                 `protobuf:"bytes,4,opt,name=client_owner,json=clientOwner,proto3" json:"client_owner,omitempty"`
	CreatedAt   *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	Trusted     bool                   `protobuf:"varint,6,opt,name=trusted,proto3" json:"trusted,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceAcceptRequest struct {

	// sensitive: OAuth challenge; never log or return to clients.
	Challenge     string   `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	GrantedScopes []string `protobuf:"bytes,2,rep,name=granted_scopes,json=grantedScopes,proto3" json:"granted_scopes,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceAcceptResponse struct {
	RedirectTo string `protobuf:"bytes,1,opt,name=redirect_to,json=redirectTo,proto3" json:"redirect_to,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceClient interface {
	Get(ctx context.Context, in *ConsentServiceGetRequest, opts ...grpc.CallOption) (*ConsentServiceGetResponse, error)
	Accept(ctx context.Context, in *ConsentServiceAcceptRequest, opts ...grpc.CallOption) (*ConsentServiceAcceptResponse, error)
	Reject(ctx context.Context, in *ConsentServiceRejectRequest, opts ...grpc.CallOption) (*ConsentServiceRejectResponse, error)
}

type ConsentServiceGetRequest struct {

	// sensitive: OAuth challenge; never log or return to clients.
	Challenge string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceGetResponse struct {
	Subject         string   `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	Client          *Client  `protobuf:"bytes,2,opt,name=client,proto3" json:"client,omitempty"`
	RequestedScopes []string `protobuf:"bytes,3,rep,name=requested_scopes,json=requestedScopes,proto3" json:"requested_scopes,omitempty"`
	Skip            bool     `protobuf:"varint,4,opt,name=skip,proto3" json:"skip,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceRejectRequest struct {

	// sensitive: OAuth challenge; never log or return to clients.
	Challenge string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceRejectResponse struct {
	RedirectTo string `protobuf:"bytes,1,opt,name=redirect_to,json=redirectTo,proto3" json:"redirect_to,omitempty"`
	// contains filtered or unexported fields
}

type ConsentServiceServer interface {
	Get(context.Context, *ConsentServiceGetRequest) (*ConsentServiceGetResponse, error)
	Accept(context.Context, *ConsentServiceAcceptRequest) (*ConsentServiceAcceptResponse, error)
	Reject(context.Context, *ConsentServiceRejectRequest) (*ConsentServiceRejectResponse, error)
	// contains filtered or unexported methods
}

type HealthRequest struct {
	// contains filtered or unexported fields
}

type HealthResponse struct {
	Status string `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceClient interface {
	// CreateClient stores a new client. Returns INVALID_ARGUMENT when client_id
	// is empty and ALREADY_EXISTS when a client with that ID already exists.
	CreateClient(ctx context.Context, in *InternalOAuthClientsServiceCreateClientRequest, opts ...grpc.CallOption) (*InternalOAuthClientsServiceCreateClientResponse, error)
	// GetClient returns a client by ID. Returns INVALID_ARGUMENT when client_id
	// is empty and NOT_FOUND when no client matches.
	GetClient(ctx context.Context, in *InternalOAuthClientsServiceGetClientRequest, opts ...grpc.CallOption) (*InternalOAuthClientsServiceGetClientResponse, error)
	// DeleteClient removes a client by ID. Returns INVALID_ARGUMENT when
	// client_id is empty and NOT_FOUND when no client matches.
	DeleteClient(ctx context.Context, in *InternalOAuthClientsServiceDeleteClientRequest, opts ...grpc.CallOption) (*InternalOAuthClientsServiceDeleteClientResponse, error)
}

type InternalOAuthClientsServiceCreateClientRequest struct {

	// Required. Unique client identifier; the handler rejects an empty value.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// Sensitive: plaintext
	// client secret; never log. Hashed before storage.
	ClientSecret  string   `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	RedirectUris  []string `protobuf:"bytes,3,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
	GrantTypes    []string `protobuf:"bytes,4,rep,name=grant_types,json=grantTypes,proto3" json:"grant_types,omitempty"`
	ResponseTypes []string `protobuf:"bytes,5,rep,name=response_types,json=responseTypes,proto3" json:"response_types,omitempty"`
	Scopes        []string `protobuf:"bytes,6,rep,name=scopes,proto3" json:"scopes,omitempty"`
	Public        bool     `protobuf:"varint,7,opt,name=public,proto3" json:"public,omitempty"`
	ClientName    string   `protobuf:"bytes,8,opt,name=client_name,json=clientName,proto3" json:"client_name,omitempty"`
	Owner         string   `protobuf:"bytes,9,opt,name=owner,proto3" json:"owner,omitempty"`
	Trusted       bool     `protobuf:"varint,10,opt,name=trusted,proto3" json:"trusted,omitempty"`
	// created_at/updated_at are supplied by the caller (mirrored from
	// gitlab-rails cells), not set server-side.
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceCreateClientResponse struct {
	Client *ManagedClient `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceDeleteClientRequest struct {

	// Required. The handler rejects an empty value with INVALID_ARGUMENT.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceDeleteClientResponse struct {
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceGetClientRequest struct {

	// Required. The handler rejects an empty value with INVALID_ARGUMENT.
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceGetClientResponse struct {
	Client *ManagedClient `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthClientsServiceServer interface {
	// CreateClient stores a new client. Returns INVALID_ARGUMENT when client_id
	// is empty and ALREADY_EXISTS when a client with that ID already exists.
	CreateClient(context.Context, *InternalOAuthClientsServiceCreateClientRequest) (*InternalOAuthClientsServiceCreateClientResponse, error)
	// GetClient returns a client by ID. Returns INVALID_ARGUMENT when client_id
	// is empty and NOT_FOUND when no client matches.
	GetClient(context.Context, *InternalOAuthClientsServiceGetClientRequest) (*InternalOAuthClientsServiceGetClientResponse, error)
	// DeleteClient removes a client by ID. Returns INVALID_ARGUMENT when
	// client_id is empty and NOT_FOUND when no client matches.
	DeleteClient(context.Context, *InternalOAuthClientsServiceDeleteClientRequest) (*InternalOAuthClientsServiceDeleteClientResponse, error)
	// contains filtered or unexported methods
}

type InternalOAuthSessionsServiceClient interface {
	Create(ctx context.Context, in *InternalOAuthSessionsServiceCreateRequest, opts ...grpc.CallOption) (*InternalOAuthSessionsServiceCreateResponse, error)
	Get(ctx context.Context, in *InternalOAuthSessionsServiceGetRequest, opts ...grpc.CallOption) (*InternalOAuthSessionsServiceGetResponse, error)
	Delete(ctx context.Context, in *InternalOAuthSessionsServiceDeleteRequest, opts ...grpc.CallOption) (*InternalOAuthSessionsServiceDeleteResponse, error)
}

type InternalOAuthSessionsServiceCreateRequest struct {
	Payload *SessionPayload `protobuf:"bytes,1,opt,name=payload,proto3" json:"payload,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceCreateResponse struct {
	Payload   *SessionPayload        `protobuf:"bytes,1,opt,name=payload,proto3" json:"payload,omitempty"`
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceDeleteRequest struct {
	State string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceDeleteResponse struct {
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceGetRequest struct {
	State string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceGetResponse struct {
	Payload   *SessionPayload        `protobuf:"bytes,1,opt,name=payload,proto3" json:"payload,omitempty"`
	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"`
	// contains filtered or unexported fields
}

type InternalOAuthSessionsServiceServer interface {
	Create(context.Context, *InternalOAuthSessionsServiceCreateRequest) (*InternalOAuthSessionsServiceCreateResponse, error)
	Get(context.Context, *InternalOAuthSessionsServiceGetRequest) (*InternalOAuthSessionsServiceGetResponse, error)
	Delete(context.Context, *InternalOAuthSessionsServiceDeleteRequest) (*InternalOAuthSessionsServiceDeleteResponse, error)
	// contains filtered or unexported methods
}

type LoginServiceAcceptRequest struct {

	// sensitive: OAuth challenge; never log or return to clients.
	Challenge string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
	// Caller-supplied end-user identity; not bound to challenge server-side.
	// Trust assumption: IAM relies on the caller (gitlab-rails, the only
	// intended caller of this RPC) to have already authenticated the user and
	// to supply the correct subject for this challenge — IAM has no
	// independent way to verify it.
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// sensitive: end-user display name (PII); mask before logging. Optional.
	Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
	// sensitive: end-user email (PII); mask before logging.
	Email string `protobuf:"bytes,4,opt,name=email,proto3" json:"email,omitempty"`
	// contains filtered or unexported fields
}

type LoginServiceAcceptResponse struct {
	RedirectTo string `protobuf:"bytes,1,opt,name=redirect_to,json=redirectTo,proto3" json:"redirect_to,omitempty"`
	// contains filtered or unexported fields
}

type LoginServiceClient interface {
	Accept(ctx context.Context, in *LoginServiceAcceptRequest, opts ...grpc.CallOption) (*LoginServiceAcceptResponse, error)
}

type LoginServiceServer interface {
	Accept(context.Context, *LoginServiceAcceptRequest) (*LoginServiceAcceptResponse, error)
	// contains filtered or unexported methods
}

type ManagedClient struct {
	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	RedirectUris  []string               `protobuf:"bytes,2,rep,name=redirect_uris,json=redirectUris,proto3" json:"redirect_uris,omitempty"`
	GrantTypes    []string               `protobuf:"bytes,3,rep,name=grant_types,json=grantTypes,proto3" json:"grant_types,omitempty"`
	ResponseTypes []string               `protobuf:"bytes,4,rep,name=response_types,json=responseTypes,proto3" json:"response_types,omitempty"`
	Scopes        []string               `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	Public        bool                   `protobuf:"varint,6,opt,name=public,proto3" json:"public,omitempty"`
	ClientName    string                 `protobuf:"bytes,7,opt,name=client_name,json=clientName,proto3" json:"client_name,omitempty"`
	Owner         string                 `protobuf:"bytes,8,opt,name=owner,proto3" json:"owner,omitempty"`
	Trusted       bool                   `protobuf:"varint,9,opt,name=trusted,proto3" json:"trusted,omitempty"`
	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
	UpdatedAt     *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
	// contains filtered or unexported fields
}

type SessionPayload struct {

	// sensitive: anti-CSRF session-binding token; never log. 64-char hex token.
	State string `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
	// sensitive: OIDC anti-replay token; optional (absent in non-OIDC flows).
	Nonce string `protobuf:"bytes,2,opt,name=nonce,proto3" json:"nonce,omitempty"`
	// sensitive: PKCE code_verifier is a cryptographic secret; never log. Not
	// validated here for Doorkeeper parity: Doorkeeper doesn't enforce RFC
	// 7636's length/charset constraints.
	PkceVerifier string `protobuf:"bytes,3,opt,name=pkce_verifier,json=pkceVerifier,proto3" json:"pkce_verifier,omitempty"`
	// required: origin URL the OAuth flow started from.
	Origin string `protobuf:"bytes,4,opt,name=origin,proto3" json:"origin,omitempty"`
	// sensitive: arbitrary OAuth passthrough params; may carry sensitive values.
	Params map[string]string `` /* 139-byte string literal not displayed */
	// contains filtered or unexported fields
}

type UnimplementedAuthServiceServer struct{}

type UnimplementedConsentServiceServer struct{}

type UnimplementedInternalOAuthClientsServiceServer struct{}

type UnimplementedInternalOAuthSessionsServiceServer struct{}

type UnimplementedLoginServiceServer struct{}

type UnsafeAuthServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeConsentServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeInternalOAuthClientsServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeInternalOAuthSessionsServiceServer interface {
	// contains filtered or unexported methods
}

type UnsafeLoginServiceServer interface {
	// contains filtered or unexported methods
}