auth

type AuthEvent struct {
	Identity Identity
}

type AuthOption func(*AuthPlugin)

type AuthPlugin struct {
	// contains filtered or unexported fields
}

type AuthServiceClient interface {
	// Login allows a client to provide credentials which can be used to
	// authenticate the client's identity. POST is preferred, some providers need
	// credentials to be passed as GET.
	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*LoginResponse, error)
	// Logout clears the prefab id cookie. It should be noted that by default the
	// identity token will remain valid until its expiry. Token invalidatation is
	// supported via the addition of a blocklist.
	Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*LogoutResponse, error)
	// Identity returns information about the authenticated user.
	Identity(ctx context.Context, in *IdentityRequest, opts ...grpc.CallOption) (*IdentityResponse, error)
}

type AuthServiceServer interface {
	// Login allows a client to provide credentials which can be used to
	// authenticate the client's identity. POST is preferred, some providers need
	// credentials to be passed as GET.
	Login(context.Context, *LoginRequest) (*LoginResponse, error)
	// Logout clears the prefab id cookie. It should be noted that by default the
	// identity token will remain valid until its expiry. Token invalidatation is
	// supported via the addition of a blocklist.
	Logout(context.Context, *LogoutRequest) (*LogoutResponse, error)
	// Identity returns information about the authenticated user.
	Identity(context.Context, *IdentityRequest) (*IdentityResponse, error)
	// contains filtered or unexported methods
}

type BlockedToken struct {
	Key string
}

type Blocklist interface {
	// IsBlocked checks if a token with the given key is blocked.
	IsBlocked(key string) (bool, error)

	// Block adds a token to the blocklist. Key can be the token itself or a
	// unique ID.
	Block(key string) error
}

type Claims struct {
	// Standard public JWT claims per https://www.iana.org/assignments/jwt/jwt.xhtml
	jwt.RegisteredClaims
	Name          string           `json:"name"`
	Email         string           `json:"email"`
	EmailVerified bool             `json:"email_verified"`
	AuthTime      *jwt.NumericDate `json:"auth_time,omitempty"`

	// Custom claims.
	Provider string `json:"idp"`
}

type ConfigRequest struct {
	// contains filtered or unexported fields
}

type ConfigResponse struct {

	// Token that should be used in non-XHR requests to avoid cross-site request
	// forgery attacks.
	CsrfToken string `protobuf:"bytes,1,opt,name=csrf_token,json=csrfToken,proto3" json:"csrf_token,omitempty"`
	// A map of key-value pairs configured by available auth plugins, for example
	// google.client_id.
	Configs map[string]string `` /* 141-byte string literal not displayed */
	// contains filtered or unexported fields
}

type Identity struct {

	// Unique identifier for the session that authenticated the identity. Maps to
	// the `jti` JWT claim.
	SessionID string

	// The time at which the identity was authenticated. Maps to `auth_time` JWT
	// claim. May differ from IssuedAt if a token is refreshed.
	AuthTime time.Time

	// Identity provider specific identifier. Maps to `sub` JWT claim.
	Subject string

	// Name of the identity provider used to authenticate the user. Maps to custom
	// `idp` JWT claim.
	Provider string

	// The email address received from the identity provider, if available. Maps
	// to `email` JWT claim.
	Email string

	// Whether the identity provider has verified the email address. Maps to
	// `email_verified` JWT claim.
	EmailVerified bool

	// Name received from the identity provider, if available. Maps to `name` JWT
	// claim.
	Name string
}

type IdentityExtractor func(ctx context.Context) (Identity, error)

type IdentityRequest struct {
	// contains filtered or unexported fields
}

type IdentityResponse struct {
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// An auth provider specific identifier used to authenticate the user.
	Subject string `protobuf:"bytes,2,opt,name=subject,proto3" json:"subject,omitempty"`
	// An email address associated with the identity, if available.
	Email string `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
	// Whether the email is thought to have been verified.
	EmailVerified bool `protobuf:"varint,4,opt,name=email_verified,json=emailVerified,proto3" json:"email_verified,omitempty"`
	// A name associated with the identity, if available.
	Name string `protobuf:"bytes,5,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type LoginHandler func(ctx context.Context, req *LoginRequest) (*LoginResponse, error)

type LoginRequest struct {

	// Name of the auth-provider to use to process the creds.
	Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Creds contains key/value pairs of provider specific credentials.
	Creds map[string]string `` /* 137-byte string literal not displayed */
	// Whether a token should be returned in the response. If false, a cookie will
	// be set on the API root.
	IssueToken bool `protobuf:"varint,3,opt,name=issue_token,json=issueToken,proto3" json:"issue_token,omitempty"`
	// The URL where the user should be redirected after the cookie is set.
	// Incompatible with `issue_token`.
	RedirectUri string `protobuf:"bytes,4,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LoginResponse struct {

	// Whether the token was issued. False does not necessarily indicate an error,
	// some auth providers may require an additional step. For example, magiclink
	// requires the user follow a URL that was sent to their email.
	Issued bool `protobuf:"varint,1,opt,name=issued,proto3" json:"issued,omitempty"`
	// An auth token which can be used to make subsequently authenticated requests
	// only set if `issue_token` is true.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Destination where the client should be redirected to, if applicable. HTTP
	// headers will be added to GRPC metadata which will cause a 302 redirect if
	// the RPC is called via the GRPC Gateway. Not compatible with `issue_token`
	// set to true.
	RedirectUri string `protobuf:"bytes,3,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutRequest struct {

	// The URL where the user should be redirected after a successful logout.
	RedirectUri string `protobuf:"bytes,4,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type LogoutResponse struct {

	// Destination where the client should be redirected to, if applicable. HTTP
	// headers will be added to GRPC metadata which will cause a 302 redirect if
	// the RPC is called via the GRPC Gateway.
	RedirectUri string `protobuf:"bytes,1,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAuthServiceServer struct{}

type UnsafeAuthServiceServer interface {
	// contains filtered or unexported methods
}