/*
* Hanzo Cloud API
*
* The Hanzo Cloud API as a customer calls it: every operation under /v1/ except the operator's admin product, relay routes, legacy spellings and capabilities still reached by flag. Tagged by product: the first path segment after /v1/.
*
* The version of the OpenAPI document: v1
*
* Generated by: https://openapi-generator.tech
*/
use crate::models;
use serde::{Deserialize, Serialize};
#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
pub struct IamPeriodToken {
#[serde(rename = "accessToken", skip_serializing_if = "Option::is_none")]
pub access_token: Option<String>,
#[serde(rename = "accessTokenHash", skip_serializing_if = "Option::is_none")]
pub access_token_hash: Option<String>,
#[serde(rename = "application", skip_serializing_if = "Option::is_none")]
pub application: Option<String>,
#[serde(rename = "code", skip_serializing_if = "Option::is_none")]
pub code: Option<String>,
#[serde(rename = "codeChallenge", skip_serializing_if = "Option::is_none")]
pub code_challenge: Option<String>,
#[serde(rename = "codeChallengeMethod", skip_serializing_if = "Option::is_none")]
pub code_challenge_method: Option<String>,
#[serde(rename = "codeExpireIn", skip_serializing_if = "Option::is_none")]
pub code_expire_in: Option<i32>,
#[serde(rename = "codeIsUsed", skip_serializing_if = "Option::is_none")]
pub code_is_used: Option<bool>,
#[serde(rename = "createdAt", skip_serializing_if = "Option::is_none")]
pub created_at: Option<String>,
#[serde(rename = "createdTime", skip_serializing_if = "Option::is_none")]
pub created_time: Option<String>,
#[serde(rename = "deleted", skip_serializing_if = "Option::is_none")]
pub deleted: Option<bool>,
#[serde(rename = "expiresIn", skip_serializing_if = "Option::is_none")]
pub expires_in: Option<i32>,
#[serde(rename = "id", skip_serializing_if = "Option::is_none")]
pub id: Option<String>,
#[serde(rename = "name", skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
/// Nonce is the OIDC authorize nonce, stored on the code and echoed into the id_token minted at the exchange (OIDC Core §3.1.3.6) so a relying party binds the id_token to its own request and detects replay.
#[serde(rename = "nonce", skip_serializing_if = "Option::is_none")]
pub nonce: Option<String>,
#[serde(rename = "organization", skip_serializing_if = "Option::is_none")]
pub organization: Option<String>,
#[serde(rename = "owner", skip_serializing_if = "Option::is_none")]
pub owner: Option<String>,
/// PublicGrant records that this grant was established WITHOUT client authentication — a PKCE code exchange from a client that presented no secret. Whether a client is confidential is a property of the GRANT, not only of the registration: `hanzo-cli` and every @hanzo/iam SPA keep a registered secret for a BACKEND path while the surface that actually signs in is a public PKCE client that cannot hold one. authorizationCodeGrant already makes exactly that bounded relaxation; this is the same fact, recorded so refreshTokenGrant can honour it instead of demanding a secret the client never had (which 401s invalid_client and kills the session at the access token's expiry). Carried across rotation, so the second refresh behaves like the first.
#[serde(rename = "publicGrant", skip_serializing_if = "Option::is_none")]
pub public_grant: Option<bool>,
/// RedirectUri binds the authorization code to the exact redirect URI of the authorize request (RFC 6749 §4.1.3): the token endpoint refuses a code redeemed with a different redirect_uri, closing code-injection across a client's registered URIs.
#[serde(rename = "redirectUri", skip_serializing_if = "Option::is_none")]
pub redirect_uri: Option<String>,
#[serde(rename = "refreshConsumed", skip_serializing_if = "Option::is_none")]
pub refresh_consumed: Option<bool>,
#[serde(rename = "refreshExpireIn", skip_serializing_if = "Option::is_none")]
pub refresh_expire_in: Option<i32>,
/// Refresh-token rotation state (v2). Each refresh belongs to a family (the grant); rotation mints a new row in the same family and marks the prior one consumed. Presenting a consumed refresh is reuse — the whole family is revoked (RFC 9700 §4.14.2). RefreshExpireIn is the refresh token's own absolute expiry (unix), independent of the access token's shorter life.
#[serde(rename = "refreshFamily", skip_serializing_if = "Option::is_none")]
pub refresh_family: Option<String>,
#[serde(rename = "refreshToken", skip_serializing_if = "Option::is_none")]
pub refresh_token: Option<String>,
#[serde(rename = "refreshTokenHash", skip_serializing_if = "Option::is_none")]
pub refresh_token_hash: Option<String>,
/// RFC 8707 resource indicator
#[serde(rename = "resource", skip_serializing_if = "Option::is_none")]
pub resource: Option<String>,
#[serde(rename = "scope", skip_serializing_if = "Option::is_none")]
pub scope: Option<String>,
#[serde(rename = "tokenType", skip_serializing_if = "Option::is_none")]
pub token_type: Option<String>,
#[serde(rename = "updatedAt", skip_serializing_if = "Option::is_none")]
pub updated_at: Option<String>,
#[serde(rename = "user", skip_serializing_if = "Option::is_none")]
pub user: Option<String>,
#[serde(rename = "userCode", skip_serializing_if = "Option::is_none")]
pub user_code: Option<String>,
}
impl IamPeriodToken {
pub fn new() -> IamPeriodToken {
IamPeriodToken {
access_token: None,
access_token_hash: None,
application: None,
code: None,
code_challenge: None,
code_challenge_method: None,
code_expire_in: None,
code_is_used: None,
created_at: None,
created_time: None,
deleted: None,
expires_in: None,
id: None,
name: None,
nonce: None,
organization: None,
owner: None,
public_grant: None,
redirect_uri: None,
refresh_consumed: None,
refresh_expire_in: None,
refresh_family: None,
refresh_token: None,
refresh_token_hash: None,
resource: None,
scope: None,
token_type: None,
updated_at: None,
user: None,
user_code: None,
}
}
}