spiral-sdk 0.1.12

// Generated by tools/service-contracts/rust.py. Do not edit.
#![doc = "Transport-independent service interface for local and remote calls."]

use async_trait::async_trait;
use spiral_contract::auth::AuthHeader;
use spiral_contract::call::CallError;

use crate::api::authn::objects::*;
/// Service implementations authenticate Authorization headers and enforce resource permissions.
#[async_trait]
pub trait AuthnApi: Send + Sync + 'static {
    /// Only consent-enabled registrars may decide a challenge. Granted scopes must be within the
    /// request and current registration. Each challenge can be decided once.
    async fn decide_consent(
        &self,
        auth_header: AuthHeader,
        challenge: String,
        request: ConsentDecision,
    ) -> Result<ConsentRedirect, CallError<AuthnError>>;
    /// Delete a client that the caller owns. Tokens already issued to it stay valid until they
    /// expire.
    async fn delete_client(
        &self,
        auth_header: AuthHeader,
        client_id: String,
    ) -> Result<(), CallError<AuthnError>>;
    /// Remove a registrar-managed callback and its derived CORS origin. Removing a missing callback
    /// succeeds. Configured callbacks cannot be removed here. Tokens already issued retain their
    /// expiry.
    async fn delete_client_redirect(
        &self,
        auth_header: AuthHeader,
        client_id: String,
        name: String,
    ) -> Result<(), CallError<AuthnError>>;
    /// Read a client that the caller owns.
    async fn get_client(
        &self,
        auth_header: AuthHeader,
        client_id: String,
    ) -> Result<ClientRegistration, CallError<AuthnError>>;
    /// Only consent-enabled registrars may read a challenge.
    async fn get_consent_request(
        &self,
        auth_header: AuthHeader,
        challenge: String,
    ) -> Result<ConsentRequest, CallError<AuthnError>>;
    /// Read which third-party clients an Organization's users may sign in to. Only registrars
    /// permitted to manage app access may call it.
    async fn get_organization_app_access(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
    ) -> Result<OrganizationAppAccess, CallError<AuthnError>>;
    /// Register the client, or replace the registration of a client that the caller owns. Returns
    /// ClientConflict when a configured client or another registrar's client has the ID.
    async fn put_client(
        &self,
        auth_header: AuthHeader,
        client_id: String,
        request: ClientRegistration,
    ) -> Result<ClientRegistration, CallError<AuthnError>>;
    /// Add or replace one named callback on a configured public client. Only a registrar explicitly
    /// permitted to manage this client's redirects may call. The server permits at most 30 callback
    /// URIs including configured callbacks. The callback's exact origin is also registered for
    /// browser CORS.
    async fn put_client_redirect(
        &self,
        auth_header: AuthHeader,
        client_id: String,
        name: String,
        request: ClientRedirect,
    ) -> Result<ClientRedirect, CallError<AuthnError>>;
    /// Replace an Organization's app access. Sign-in and refresh check it on their next request;
    /// issued access tokens keep their expiry.
    async fn put_organization_app_access(
        &self,
        auth_header: AuthHeader,
        organization_id: String,
        request: OrganizationAppAccess,
    ) -> Result<OrganizationAppAccess, CallError<AuthnError>>;
    /// Withdraw every consent this client received from one user. Only its registrar may do so.
    async fn revoke_consent(
        &self,
        auth_header: AuthHeader,
        client_id: String,
        user_id: String,
    ) -> Result<(), CallError<AuthnError>>;
    /// Withdraw this user's consent for this client in one organization. Only its registrar may do
    /// so.
    async fn revoke_organization_consent(
        &self,
        auth_header: AuthHeader,
        client_id: String,
        user_id: String,
        organization_id: String,
    ) -> Result<(), CallError<AuthnError>>;
}