config

type AuthConfig struct {

	// Asserted, not just recorded: LabKit ignores a version mismatch when no
	// migration is registered. To roll a version, widen to `in: [1, 2]`, ship the
	// migration, narrow again.
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// Relative to this file's directory, so CONFIG_DIR alone reaches every input.
	// Deployed environments use an absolute path because `appConfig` renders only
	// one file into CONFIG_DIR and secrets arrive on a separate mount.
	SecretsFile string    `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	// Default to ":5004" and ":8084" respectively when omitted.
	GrpcAddress *string `protobuf:"bytes,4,opt,name=grpc_address,json=grpcAddress,proto3,oneof" json:"grpc_address,omitempty"`
	HttpAddress *string `protobuf:"bytes,5,opt,name=http_address,json=httpAddress,proto3,oneof" json:"http_address,omitempty"`
	// Externally reachable base URL, used to build OAuth redirect URIs.
	BaseUrl string       `protobuf:"bytes,6,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
	Oauth   *OauthServer `protobuf:"bytes,7,opt,name=oauth,proto3" json:"oauth,omitempty"`
	// Omitting this block, or leaving `providers` empty, disables third-party
	// sign-in.
	OauthClient *OauthClient `protobuf:"bytes,8,opt,name=oauth_client,json=oauthClient,proto3,oneof" json:"oauth_client,omitempty"`
	// Required, not optional: the legacy loader validated allowed_origins for every
	// service, so leaving this optional would let an auth deployment come up with no
	// origins at all. `required` also propagates the nested min_items rule.
	Cors *Cors `protobuf:"bytes,9,opt,name=cors,proto3" json:"cors,omitempty"`
	// contains filtered or unexported fields
}

type AuthSecrets struct {
	Version  int32            `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database *DatabaseSecrets `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	// The token iam-auth requires of its own callers. Required so the nested
	// min_len rule applies; an absent block would otherwise pass validation and
	// fail later at request time.
	ServiceTokens *ServiceTokens `protobuf:"bytes,3,opt,name=service_tokens,json=serviceTokens,proto3" json:"service_tokens,omitempty"`
	Oauth         *OauthSecrets  `protobuf:"bytes,4,opt,name=oauth,proto3" json:"oauth,omitempty"`
	// Keyed as in AuthConfig.oauth_client.providers.
	OauthProviders map[string]*OauthClientCredentials `` /* 177-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Cors struct {
	AllowedOrigins []string `protobuf:"bytes,1,rep,name=allowed_origins,json=allowedOrigins,proto3" json:"allowed_origins,omitempty"`
	// Omitting these defaults them to the methods and headers the handler sends
	// today.
	AllowedMethods   []string `protobuf:"bytes,2,rep,name=allowed_methods,json=allowedMethods,proto3" json:"allowed_methods,omitempty"`
	AllowedHeaders   []string `protobuf:"bytes,3,rep,name=allowed_headers,json=allowedHeaders,proto3" json:"allowed_headers,omitempty"`
	AllowCredentials *bool    `protobuf:"varint,4,opt,name=allow_credentials,json=allowCredentials,proto3,oneof" json:"allow_credentials,omitempty"`
	MaxAge           *int32   `protobuf:"varint,5,opt,name=max_age,json=maxAge,proto3,oneof" json:"max_age,omitempty"` // omitted: 300
	// contains filtered or unexported fields
}

type DataAccessConfig struct {

	// See AuthConfig.version.
	Version int32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// See AuthConfig.secrets_file.
	SecretsFile string    `protobuf:"bytes,2,opt,name=secrets_file,json=secretsFile,proto3" json:"secrets_file,omitempty"`
	Platform    *Platform `protobuf:"bytes,3,opt,name=platform,proto3" json:"platform,omitempty"`
	// Defaults to ":5005" when omitted. Must match `containerPort` in
	// .runway/fairway.yaml.
	GrpcAddress *string `protobuf:"bytes,4,opt,name=grpc_address,json=grpcAddress,proto3,oneof" json:"grpc_address,omitempty"`
	// Prometheus scrape endpoint, separate from the gRPC port. Defaults to ":9090"
	// when omitted.
	// Must match `metricPorts` in .runway/fairway.yaml.
	MetricsAddress *string   `protobuf:"bytes,5,opt,name=metrics_address,json=metricsAddress,proto3,oneof" json:"metrics_address,omitempty"`
	Auth           *UserAuth `protobuf:"bytes,6,opt,name=auth,proto3" json:"auth,omitempty"`
	// contains filtered or unexported fields
}

type DataAccessSecrets struct {
	Version  int32            `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Database *DatabaseSecrets `protobuf:"bytes,2,opt,name=database,proto3,oneof" json:"database,omitempty"`
	// The token iam-data-access requires of its own callers. When iam-auth becomes
	// one of those callers it gains a separate client credential; it does not
	// borrow this one. Required — see AuthSecrets.service_tokens.
	ServiceTokens *ServiceTokens `protobuf:"bytes,3,opt,name=service_tokens,json=serviceTokens,proto3" json:"service_tokens,omitempty"`
	// contains filtered or unexported fields
}

type Database struct {

	// driver and ssl_mode sit here rather than in a source arm because Fairway can
	// express neither (no yugabyte backend type, no ssl field), so both must be
	// stated whichever source is used. driver also picks the goose migration dir.
	Driver Database_Driver `protobuf:"varint,1,opt,name=driver,proto3,enum=gitlab.iam.config.v1.Database_Driver" json:"driver,omitempty"`
	// Mandatory: `defined_only` alone would let an omitted key take
	// SSL_MODE_UNSPECIFIED. The legacy platformconfig/database.go refused to boot
	// without it, and Fairway cannot supply it either (fairway#36).
	SslMode Database_SslMode `` /* 126-byte string literal not displayed */
	// Declared, not discovered: infrastructure.DefaultConfig() is fatal and caches
	// its failure process-wide when /etc/labkit/infrastructure.yaml is absent, so
	// environments without a Fairway chart must never reach it.
	//
	// Types that are valid to be assigned to Source:
	//
	//	*Database_Infrastructure
	//	*Database_Endpoint
	Source isDatabase_Source `protobuf_oneof:"source"`
	// Pgx pool property, not endpoint. Omit for default max(4, NumCPU) per node.
	MaxConnections *int32 `protobuf:"varint,5,opt,name=max_connections,json=maxConnections,proto3,oneof" json:"max_connections,omitempty"`
	// An idle floor above the ceiling is accepted silently by pgx and never
	// reached, hence the two CEL rules above.
	MinIdleConnections *int32 `protobuf:"varint,6,opt,name=min_idle_connections,json=minIdleConnections,proto3,oneof" json:"min_idle_connections,omitempty"`
	// contains filtered or unexported fields
}

type DatabaseSecrets struct {

	// Service role (DML only). Omitted when platform.database.source is
	// `infrastructure`, which supplies these from the Fairway secret mount.
	Username *string `protobuf:"bytes,1,opt,name=username,proto3,oneof" json:"username,omitempty"`
	// sensitive: must never appear in logs or error messages.
	Password *string `protobuf:"bytes,2,opt,name=password,proto3,oneof" json:"password,omitempty"`
	// Migration role (DDL). Always from this file: Fairway's PostgreSQL message has
	// one username and one secret_ref, so it cannot express a second role. Used
	// only by cmd/migrate, which errors clearly if it is missing.
	MigrationUsername *string `protobuf:"bytes,3,opt,name=migration_username,json=migrationUsername,proto3,oneof" json:"migration_username,omitempty"`
	// sensitive: must never appear in logs or error messages.
	MigrationPassword *string `protobuf:"bytes,4,opt,name=migration_password,json=migrationPassword,proto3,oneof" json:"migration_password,omitempty"`
	// contains filtered or unexported fields
}

type Database_Driver int32

type Database_Endpoint struct {
	Endpoint *Endpoint `protobuf:"bytes,4,opt,name=endpoint,proto3,oneof"`
}

type Database_Infrastructure struct {
	Infrastructure *Infrastructure `protobuf:"bytes,3,opt,name=infrastructure,proto3,oneof"`
}

type Database_SslMode int32

type Endpoint struct {
	Host         string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port         int32  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	DatabaseName string `protobuf:"bytes,3,opt,name=database_name,json=databaseName,proto3" json:"database_name,omitempty"`
	// contains filtered or unexported fields
}

type Grpc struct {

	// Reflection is a stream RPC, so the unary service-token interceptors do not
	// cover it: it is unauthenticated wherever it is on. Omitting the block turns
	// reflection off.
	EnableReflection *bool `protobuf:"varint,1,opt,name=enable_reflection,json=enableReflection,proto3,oneof" json:"enable_reflection,omitempty"`
	// contains filtered or unexported fields
}

type Http struct {

	// Omitting these defaults them to 30s read, 30s write, 60s idle.
	ReadTimeout  *durationpb.Duration `protobuf:"bytes,1,opt,name=read_timeout,json=readTimeout,proto3,oneof" json:"read_timeout,omitempty"`
	WriteTimeout *durationpb.Duration `protobuf:"bytes,2,opt,name=write_timeout,json=writeTimeout,proto3,oneof" json:"write_timeout,omitempty"`
	IdleTimeout  *durationpb.Duration `protobuf:"bytes,3,opt,name=idle_timeout,json=idleTimeout,proto3,oneof" json:"idle_timeout,omitempty"`
	// contains filtered or unexported fields
}

type Infrastructure struct {

	// Both unset: LabKit's default locations. Both set: build the infrastructure
	// config by hand from these paths.
	Path       *string `protobuf:"bytes,1,opt,name=path,proto3,oneof" json:"path,omitempty"`
	SecretsDir *string `protobuf:"bytes,2,opt,name=secrets_dir,json=secretsDir,proto3,oneof" json:"secrets_dir,omitempty"`
	// contains filtered or unexported fields
}

type Issuer struct {
	Url     string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
	KeysUrl string `protobuf:"bytes,2,opt,name=keys_url,json=keysUrl,proto3" json:"keys_url,omitempty"`
	// contains filtered or unexported fields
}

type OauthClient struct {

	// The GitLab instance third-party identities are linked into.
	GitlabUrl *string `protobuf:"bytes,1,opt,name=gitlab_url,json=gitlabUrl,proto3,oneof" json:"gitlab_url,omitempty"`
	// Closed key set: each name selects a distinct construction path in
	// auth/oauth/client, so an unknown key would be silently ignored.
	Providers map[string]*OauthProvider `` /* 145-byte string literal not displayed */
	// contains filtered or unexported fields
}

type OauthClientCredentials struct {
	ClientId string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	// sensitive: must never appear in logs or error messages.
	ClientSecret string `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
	// contains filtered or unexported fields
}

type OauthProvider struct {
	Issuer      *string `protobuf:"bytes,1,opt,name=issuer,proto3,oneof" json:"issuer,omitempty"`
	AuthUrl     *string `protobuf:"bytes,2,opt,name=auth_url,json=authUrl,proto3,oneof" json:"auth_url,omitempty"`
	TokenUrl    *string `protobuf:"bytes,3,opt,name=token_url,json=tokenUrl,proto3,oneof" json:"token_url,omitempty"`
	UserInfoUrl *string `protobuf:"bytes,4,opt,name=user_info_url,json=userInfoUrl,proto3,oneof" json:"user_info_url,omitempty"`
	// Omitting this uses the provider's conventional scopes, from pkg/config.
	// No min_items: repeated fields have no presence, so that would make the
	// default unreachable (see common.proto).
	Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// contains filtered or unexported fields
}

type OauthSecrets struct {

	// sensitive. Signs opaque authorization codes and refresh tokens.
	HmacSecret string `protobuf:"bytes,1,opt,name=hmac_secret,json=hmacSecret,proto3" json:"hmac_secret,omitempty"`
	// A base64-encoded PKCS#8 PEM RSA private key
	// staging/production inject it as SERVICES_AUTH_OAUTH_SIGNING_KEY, and
	// dev/CI use the fixed key in configs/environments/secrets.toml
	// sensitive. required.
	SigningKey string `protobuf:"bytes,2,opt,name=signing_key,json=signingKey,proto3" json:"signing_key,omitempty"`
	// contains filtered or unexported fields
}

type OauthServer struct {

	// The `iss` claim, and the base for the OIDC discovery document.
	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	// Rails routes: where to send an unauthenticated user, and where to approve
	// a client's scopes.
	LoginUrl   string `protobuf:"bytes,2,opt,name=login_url,json=loginUrl,proto3" json:"login_url,omitempty"`
	ConsentUrl string `protobuf:"bytes,3,opt,name=consent_url,json=consentUrl,proto3" json:"consent_url,omitempty"`
	// The `aud` claim on issued access tokens (RFC 9068). Defaults to
	// "gitlab-rails" when omitted.
	AccessTokenAudience *string `` /* 126-byte string literal not displayed */
	// How long a fetched JWKS is cached. Omitting it leaves 0, which is what the
	// service resolves today; changing that is deliberately out of scope here.
	JwksCacheDuration *durationpb.Duration `protobuf:"bytes,5,opt,name=jwks_cache_duration,json=jwksCacheDuration,proto3,oneof" json:"jwks_cache_duration,omitempty"`
	// GitLab Rails' `/api/v4/iam/userinfo` endpoint. Called at token-exchange
	// time to fetch ID token claims, authenticated with the access token
	// minted for the same exchange as a bearer credential (see
	// core.ClaimsEnrichedIDTokenHandler). Unlike the OIDC `/oauth/userinfo`
	// endpoint, this one accepts only an IAM-issued OAuth JWT.
	//
	// SECURITY-SENSITIVE: every openid-scoped token exchange sends a bearer
	// access token to this URL. Must resolve to a trusted, TLS-protected
	// GitLab Rails instance; never an attacker-controlled address.
	UserInfoUrl string `protobuf:"bytes,6,opt,name=user_info_url,json=userInfoUrl,proto3" json:"user_info_url,omitempty"`
	// contains filtered or unexported fields
}

type Platform struct {
	Database *Database `protobuf:"bytes,1,opt,name=database,proto3" json:"database,omitempty"`
	// Omitting a block leaves its fields at their Go defaults — see the note above.
	Grpc *Grpc `protobuf:"bytes,2,opt,name=grpc,proto3,oneof" json:"grpc,omitempty"`
	Http *Http `protobuf:"bytes,3,opt,name=http,proto3,oneof" json:"http,omitempty"`
	// contains filtered or unexported fields
}

type ServiceTokens struct {

	// sensitive: must never appear in logs or error messages.
	ServiceToken string `protobuf:"bytes,1,opt,name=service_token,json=serviceToken,proto3" json:"service_token,omitempty"`
	// sensitive. Accepted alongside service_token during rotation; empty otherwise.
	NextServiceToken *string `protobuf:"bytes,2,opt,name=next_service_token,json=nextServiceToken,proto3,oneof" json:"next_service_token,omitempty"`
	// contains filtered or unexported fields
}

type UserAuth struct {

	// Issuers whose tokens are accepted. At least one is required: with none, the
	// service would reject every request.
	Issuers []*Issuer `protobuf:"bytes,1,rep,name=issuers,proto3" json:"issuers,omitempty"`
	// Audiences accepted in the `aud` claim. Checked twice on purpose:
	// pkg/userauth/config.go validates it separately and cannot import these
	// protos, so repeating the set here catches a typo at config load.
	ExpectedAudiences []string `protobuf:"bytes,2,rep,name=expected_audiences,json=expectedAudiences,proto3" json:"expected_audiences,omitempty"`
	// contains filtered or unexported fields
}