gestalt-sdk 0.0.1-alpha.26

// Code generated by sdkgen. DO NOT EDIT.

//! Generated native types and clients for identity.proto.

use crate::codec::host_service::{HostServiceChannel, connect_host_service, plain_channel};
use crate::codec::identity::{
    from_wire_authorize_response, from_wire_get_grant_response, from_wire_introspect_response,
    from_wire_list_grants_response, from_wire_revoke_grant_response, from_wire_token_response,
    from_wire_user_info_response, to_wire_authorize_request, to_wire_get_grant_request,
    to_wire_introspect_request, to_wire_list_grants_request, to_wire_revoke_grant_request,
    to_wire_token_request, to_wire_user_info_request,
};
use crate::generated::v1;
use crate::rpc_support::GestaltError;

/// AuthorizeRequest models RFC 6749 authorization endpoint parameters.
///
/// Native message type for `gestalt.provider.v1.AuthorizeRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizeRequest {
    /// response_type is typically "code".
    ///
    /// The `response_type` field.
    pub response_type: String,
    /// The `client_id` field.
    pub client_id: String,
    /// The `redirect_uri` field.
    pub redirect_uri: String,
    /// The `scope` field.
    pub scope: String,
    /// The `state` field.
    pub state: String,
}

/// AuthorizeResponse returns the HTTP Location redirect URI containing RFC 6749
/// response parameters.
///
/// Native message type for `gestalt.provider.v1.AuthorizeResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizeResponse {
    /// The `redirect_uri` field.
    pub redirect_uri: String,
}

/// GetGrantRequest retrieves one API-token grant by ID.
///
/// Native message type for `gestalt.provider.v1.GetGrantRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct GetGrantRequest {
    /// The `grant_id` field.
    pub grant_id: String,
}

/// GetGrantResponse returns OIDF-shaped grant details.
///
/// Native message type for `gestalt.provider.v1.GetGrantResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct GetGrantResponse {
    /// The `scopes` field.
    pub scopes: Vec<GrantScope>,
    /// The `created_at` field.
    pub created_at: i64,
    /// The `expires_at` field.
    pub expires_at: i64,
}

/// GrantScope describes one authorized scope and optional resources.
///
/// Native message type for `gestalt.provider.v1.GrantScope`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct GrantScope {
    /// The `scope` field.
    pub scope: String,
    /// The `resource` field.
    pub resource: Vec<String>,
}

/// IntrospectRequest models RFC 7662 token introspection parameters.
///
/// Native message type for `gestalt.provider.v1.IntrospectRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct IntrospectRequest {
    /// The `token` field.
    pub token: String,
    /// token_type_hint is "access_token" or "refresh_token".
    ///
    /// The `token_type_hint` field.
    pub token_type_hint: String,
}

/// IntrospectResponse models RFC 7662 token introspection response fields.
/// subject must be a canonical Gestalt subject ID, for example a user: subject
/// using a stable user identifier or verified email. It must not be a raw
/// upstream OIDC sub. Empty scope means full first-party/Gestalt access for
/// that grant.
///
/// Native message type for `gestalt.provider.v1.IntrospectResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct IntrospectResponse {
    /// The `active` field.
    pub active: bool,
    /// The `subject` field.
    pub subject: String,
    /// The `scope` field.
    pub scope: String,
    /// The `client_id` field.
    pub client_id: String,
    /// The `audience` field.
    pub audience: Vec<String>,
}

/// ListGrantsRequest lists API-token grant IDs visible to the caller.
///
/// Native message type for `gestalt.provider.v1.ListGrantsRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct ListGrantsRequest {}

/// ListGrantsResponse returns caller-visible API-token grant IDs created via
/// token exchange. It must not include transient login or session grants.
///
/// Native message type for `gestalt.provider.v1.ListGrantsResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct ListGrantsResponse {
    /// The `grant_ids` field.
    pub grant_ids: Vec<String>,
}

/// RevokeGrantRequest revokes one caller-visible API-token grant by ID.
///
/// Native message type for `gestalt.provider.v1.RevokeGrantRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct RevokeGrantRequest {
    /// The `grant_id` field.
    pub grant_id: String,
}

/// RevokeGrantResponse acknowledges grant revocation.
///
/// Native message type for `gestalt.provider.v1.RevokeGrantResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct RevokeGrantResponse {}

/// TokenRequest models RFC 6749 token endpoint parameters and RFC 8693 token
/// exchange inputs.
///
/// Native message type for `gestalt.provider.v1.TokenRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct TokenRequest {
    /// grant_type is "authorization_code" or
    /// "urn:ietf:params:oauth:grant-type:token-exchange".
    ///
    /// The `grant_type` field.
    pub grant_type: String,
    /// The `code` field.
    pub code: String,
    /// The `redirect_uri` field.
    pub redirect_uri: String,
    /// The `client_id` field.
    pub client_id: String,
    /// state correlates authorization-code exchanges with Authorize.
    ///
    /// The `state` field.
    pub state: String,
    /// scope is the requested scope for issued tokens.
    ///
    /// The `scope` field.
    pub scope: String,
    /// subject_token is the bearer token being exchanged per RFC 8693.
    ///
    /// The `subject_token` field.
    pub subject_token: String,
    /// subject_token_type is the RFC 8693 token type for subject_token.
    ///
    /// The `subject_token_type` field.
    pub subject_token_type: String,
    /// expires_in is a Gestalt request-side extension for the desired access-token
    /// lifetime in seconds. The provider MAY clamp or default it; expires_in in
    /// TokenResponse remains authoritative per RFC 6749 §5.1. 0 means use the grant
    /// default.
    ///
    /// The `expires_in` field.
    pub expires_in: i64,
}

/// TokenResponse models RFC 6749 token endpoint response fields.
///
/// Native message type for `gestalt.provider.v1.TokenResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct TokenResponse {
    /// The `access_token` field.
    pub access_token: String,
    /// The `token_type` field.
    pub token_type: String,
    /// The `expires_in` field.
    pub expires_in: i64,
    /// The `refresh_token` field.
    pub refresh_token: String,
    /// The `scope` field.
    pub scope: String,
    /// grant_id is the OIDF Grant Management extension when available.
    ///
    /// The `grant_id` field.
    pub grant_id: String,
}

/// UserInfoRequest is intentionally empty. The caller bearer token is supplied
/// through provider-call metadata, analogous to OIDC Authorization: Bearer.
///
/// Native message type for `gestalt.provider.v1.UserInfoRequest`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct UserInfoRequest {}

/// UserInfoResponse models profile claims about the authenticated end user.
///
/// Native message type for `gestalt.provider.v1.UserInfoResponse`.
#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct UserInfoResponse {
    /// The `subject_id` field.
    pub subject_id: String,
    /// The `email` field.
    pub email: String,
    /// The `name` field.
    pub name: String,
}

/// Identity models the shared Gestalt authentication protocol.
///
/// Client for the `gestalt.provider.v1.Identity` service.
pub struct Identity {
    inner: v1::identity_client::IdentityClient<HostServiceChannel>,
    timeout: Option<std::time::Duration>,
}

impl Identity {
    /// Creates a client over an established channel.
    pub fn new(channel: tonic::transport::Channel) -> Self {
        Self {
            inner: v1::identity_client::IdentityClient::new(plain_channel(channel)),
            timeout: None,
        }
    }

    /// Sets a deadline applied to every unary call; calls that run past it
    /// fail with DEADLINE_EXCEEDED. Streaming calls are unaffected.
    pub fn with_timeout(mut self, timeout: std::time::Duration) -> Self {
        self.timeout = Some(timeout);
        self
    }

    /// Connects to the `identity` host service described by the environment.
    pub async fn connect() -> Result<Self, GestaltError> {
        Self::connect_named("").await
    }

    /// Connects to the named `identity` host-service binding.
    pub async fn connect_named(name: &str) -> Result<Self, GestaltError> {
        Ok(Self {
            inner: v1::identity_client::IdentityClient::new(
                connect_host_service("identity", name).await?,
            ),
            timeout: None,
        })
    }

    /// Calls `gestalt.provider.v1.Identity.Authorize`.
    pub async fn authorize(
        &mut self,
        response_type: String,
        client_id: String,
        redirect_uri: String,
        scope: String,
        state: String,
    ) -> Result<AuthorizeResponse, GestaltError> {
        let request = AuthorizeRequest {
            response_type,
            client_id,
            redirect_uri,
            scope,
            state,
        };
        let mut tonic_request = tonic::Request::new(to_wire_authorize_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.authorize(tonic_request).await?;
        Ok(from_wire_authorize_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.Authorize` with the full request and response messages.
    pub async fn authorize_raw(
        &mut self,
        request: AuthorizeRequest,
    ) -> Result<AuthorizeResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_authorize_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.authorize(tonic_request).await?;
        Ok(from_wire_authorize_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.Token`.
    #[allow(clippy::too_many_arguments)]
    pub async fn token(
        &mut self,
        grant_type: String,
        code: String,
        redirect_uri: String,
        client_id: String,
        state: String,
        scope: String,
        subject_token: String,
        subject_token_type: String,
        options: IdentityTokenOptions,
    ) -> Result<TokenResponse, GestaltError> {
        let request = TokenRequest {
            grant_type,
            code,
            redirect_uri,
            client_id,
            state,
            scope,
            subject_token,
            subject_token_type,
            expires_in: options.expires_in,
        };
        let mut tonic_request = tonic::Request::new(to_wire_token_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.token(tonic_request).await?;
        Ok(from_wire_token_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.Token` with the full request and response messages.
    pub async fn token_raw(
        &mut self,
        request: TokenRequest,
    ) -> Result<TokenResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_token_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.token(tonic_request).await?;
        Ok(from_wire_token_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.Introspect`.
    pub async fn introspect(
        &mut self,
        token: String,
        token_type_hint: String,
    ) -> Result<IntrospectResponse, GestaltError> {
        let request = IntrospectRequest {
            token,
            token_type_hint,
        };
        let mut tonic_request = tonic::Request::new(to_wire_introspect_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.introspect(tonic_request).await?;
        Ok(from_wire_introspect_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.Introspect` with the full request and response messages.
    pub async fn introspect_raw(
        &mut self,
        request: IntrospectRequest,
    ) -> Result<IntrospectResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_introspect_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.introspect(tonic_request).await?;
        Ok(from_wire_introspect_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.UserInfo`.
    pub async fn user_info(
        &mut self,
        request: UserInfoRequest,
    ) -> Result<UserInfoResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_user_info_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.user_info(tonic_request).await?;
        Ok(from_wire_user_info_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.ListGrants`.
    pub async fn list_grants(
        &mut self,
        request: ListGrantsRequest,
    ) -> Result<ListGrantsResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_list_grants_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.list_grants(tonic_request).await?;
        Ok(from_wire_list_grants_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.GetGrant`.
    pub async fn get_grant(&mut self, grant_id: String) -> Result<GetGrantResponse, GestaltError> {
        let request = GetGrantRequest { grant_id };
        let mut tonic_request = tonic::Request::new(to_wire_get_grant_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.get_grant(tonic_request).await?;
        Ok(from_wire_get_grant_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.GetGrant` with the full request and response messages.
    pub async fn get_grant_raw(
        &mut self,
        request: GetGrantRequest,
    ) -> Result<GetGrantResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_get_grant_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.get_grant(tonic_request).await?;
        Ok(from_wire_get_grant_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.RevokeGrant`.
    pub async fn revoke_grant(
        &mut self,
        grant_id: String,
    ) -> Result<RevokeGrantResponse, GestaltError> {
        let request = RevokeGrantRequest { grant_id };
        let mut tonic_request = tonic::Request::new(to_wire_revoke_grant_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.revoke_grant(tonic_request).await?;
        Ok(from_wire_revoke_grant_response(response.into_inner()))
    }

    /// Calls `gestalt.provider.v1.Identity.RevokeGrant` with the full request and response messages.
    pub async fn revoke_grant_raw(
        &mut self,
        request: RevokeGrantRequest,
    ) -> Result<RevokeGrantResponse, GestaltError> {
        let mut tonic_request = tonic::Request::new(to_wire_revoke_grant_request(request));
        if let Some(timeout) = self.timeout {
            tonic_request.set_timeout(timeout);
        }
        let response = self.inner.revoke_grant(tonic_request).await?;
        Ok(from_wire_revoke_grant_response(response.into_inner()))
    }
}

/// Optional parameters of [`Identity::token`]; the default value leaves every
/// option unset.
#[derive(Clone, Debug, Default)]
pub struct IdentityTokenOptions {
    /// expires_in is a Gestalt request-side extension for the desired access-token
    /// lifetime in seconds. The provider MAY clamp or default it; expires_in in
    /// TokenResponse remains authoritative per RFC 6749 §5.1. 0 means use the grant
    /// default.
    ///
    /// The `expires_in` field.
    pub expires_in: i64,
}