gestalt/
identity.rs

1// Code generated by sdkgen. DO NOT EDIT.
2
3//! Generated native types and clients for identity.proto.
4
5use crate::codec::host_service::{HostServiceChannel, connect_host_service, plain_channel};
6use crate::codec::identity::{
7    from_wire_authorize_response, from_wire_get_grant_response, from_wire_introspect_response,
8    from_wire_list_grants_response, from_wire_revoke_grant_response, from_wire_token_response,
9    from_wire_user_info_response, to_wire_authorize_request, to_wire_get_grant_request,
10    to_wire_introspect_request, to_wire_list_grants_request, to_wire_revoke_grant_request,
11    to_wire_token_request, to_wire_user_info_request,
12};
13use crate::generated::v1;
14use crate::rpc_support::GestaltError;
15
16/// AuthorizeRequest models RFC 6749 authorization endpoint parameters.
17///
18/// Native message type for `gestalt.provider.v1.AuthorizeRequest`.
19#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
20#[serde(rename_all = "camelCase")]
21pub struct AuthorizeRequest {
22    /// response_type is typically "code".
23    ///
24    /// The `response_type` field.
25    pub response_type: String,
26    /// The `client_id` field.
27    pub client_id: String,
28    /// The `redirect_uri` field.
29    pub redirect_uri: String,
30    /// The `scope` field.
31    pub scope: String,
32    /// The `state` field.
33    pub state: String,
34}
35
36/// AuthorizeResponse returns the HTTP Location redirect URI containing RFC 6749
37/// response parameters.
38///
39/// Native message type for `gestalt.provider.v1.AuthorizeResponse`.
40#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
41#[serde(rename_all = "camelCase")]
42pub struct AuthorizeResponse {
43    /// The `redirect_uri` field.
44    pub redirect_uri: String,
45}
46
47/// GetGrantRequest retrieves one API-token grant by ID.
48///
49/// Native message type for `gestalt.provider.v1.GetGrantRequest`.
50#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
51#[serde(rename_all = "camelCase")]
52pub struct GetGrantRequest {
53    /// The `grant_id` field.
54    pub grant_id: String,
55}
56
57/// GetGrantResponse returns OIDF-shaped grant details.
58///
59/// Native message type for `gestalt.provider.v1.GetGrantResponse`.
60#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
61#[serde(rename_all = "camelCase")]
62pub struct GetGrantResponse {
63    /// The `scopes` field.
64    pub scopes: Vec<GrantScope>,
65    /// The `created_at` field.
66    pub created_at: i64,
67    /// The `expires_at` field.
68    pub expires_at: i64,
69}
70
71/// GrantScope describes one authorized scope and optional resources.
72///
73/// Native message type for `gestalt.provider.v1.GrantScope`.
74#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
75#[serde(rename_all = "camelCase")]
76pub struct GrantScope {
77    /// The `scope` field.
78    pub scope: String,
79    /// The `resource` field.
80    pub resource: Vec<String>,
81}
82
83/// IntrospectRequest models RFC 7662 token introspection parameters.
84///
85/// Native message type for `gestalt.provider.v1.IntrospectRequest`.
86#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
87#[serde(rename_all = "camelCase")]
88pub struct IntrospectRequest {
89    /// The `token` field.
90    pub token: String,
91    /// token_type_hint is "access_token" or "refresh_token".
92    ///
93    /// The `token_type_hint` field.
94    pub token_type_hint: String,
95}
96
97/// IntrospectResponse models RFC 7662 token introspection response fields.
98/// subject must be a canonical Gestalt subject ID, for example a user: subject
99/// using a stable user identifier or verified email. It must not be a raw
100/// upstream OIDC sub. Empty scope means full first-party/Gestalt access for
101/// that grant.
102///
103/// Native message type for `gestalt.provider.v1.IntrospectResponse`.
104#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
105#[serde(rename_all = "camelCase")]
106pub struct IntrospectResponse {
107    /// The `active` field.
108    pub active: bool,
109    /// The `subject` field.
110    pub subject: String,
111    /// The `scope` field.
112    pub scope: String,
113    /// The `client_id` field.
114    pub client_id: String,
115    /// The `audience` field.
116    pub audience: Vec<String>,
117}
118
119/// ListGrantsRequest lists API-token grant IDs visible to the caller.
120///
121/// Native message type for `gestalt.provider.v1.ListGrantsRequest`.
122#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
123#[serde(rename_all = "camelCase")]
124pub struct ListGrantsRequest {}
125
126/// ListGrantsResponse returns caller-visible API-token grant IDs created via
127/// token exchange. It must not include transient login or session grants.
128///
129/// Native message type for `gestalt.provider.v1.ListGrantsResponse`.
130#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
131#[serde(rename_all = "camelCase")]
132pub struct ListGrantsResponse {
133    /// The `grant_ids` field.
134    pub grant_ids: Vec<String>,
135}
136
137/// RevokeGrantRequest revokes one caller-visible API-token grant by ID.
138///
139/// Native message type for `gestalt.provider.v1.RevokeGrantRequest`.
140#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
141#[serde(rename_all = "camelCase")]
142pub struct RevokeGrantRequest {
143    /// The `grant_id` field.
144    pub grant_id: String,
145}
146
147/// RevokeGrantResponse acknowledges grant revocation.
148///
149/// Native message type for `gestalt.provider.v1.RevokeGrantResponse`.
150#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
151#[serde(rename_all = "camelCase")]
152pub struct RevokeGrantResponse {}
153
154/// TokenRequest models RFC 6749 token endpoint parameters and RFC 8693 token
155/// exchange inputs.
156///
157/// Native message type for `gestalt.provider.v1.TokenRequest`.
158#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
159#[serde(rename_all = "camelCase")]
160pub struct TokenRequest {
161    /// grant_type is "authorization_code" or
162    /// "urn:ietf:params:oauth:grant-type:token-exchange".
163    ///
164    /// The `grant_type` field.
165    pub grant_type: String,
166    /// The `code` field.
167    pub code: String,
168    /// The `redirect_uri` field.
169    pub redirect_uri: String,
170    /// The `client_id` field.
171    pub client_id: String,
172    /// state correlates authorization-code exchanges with Authorize.
173    ///
174    /// The `state` field.
175    pub state: String,
176    /// scope is the requested scope for issued tokens.
177    ///
178    /// The `scope` field.
179    pub scope: String,
180    /// subject_token is the bearer token being exchanged per RFC 8693.
181    ///
182    /// The `subject_token` field.
183    pub subject_token: String,
184    /// subject_token_type is the RFC 8693 token type for subject_token.
185    ///
186    /// The `subject_token_type` field.
187    pub subject_token_type: String,
188    /// expires_in is a Gestalt request-side extension for the desired access-token
189    /// lifetime in seconds. The provider MAY clamp or default it; expires_in in
190    /// TokenResponse remains authoritative per RFC 6749 §5.1. 0 means use the grant
191    /// default.
192    ///
193    /// The `expires_in` field.
194    pub expires_in: i64,
195}
196
197/// TokenResponse models RFC 6749 token endpoint response fields.
198///
199/// Native message type for `gestalt.provider.v1.TokenResponse`.
200#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
201#[serde(rename_all = "camelCase")]
202pub struct TokenResponse {
203    /// The `access_token` field.
204    pub access_token: String,
205    /// The `token_type` field.
206    pub token_type: String,
207    /// The `expires_in` field.
208    pub expires_in: i64,
209    /// The `refresh_token` field.
210    pub refresh_token: String,
211    /// The `scope` field.
212    pub scope: String,
213    /// grant_id is the OIDF Grant Management extension when available.
214    ///
215    /// The `grant_id` field.
216    pub grant_id: String,
217}
218
219/// UserInfoRequest is intentionally empty. The caller bearer token is supplied
220/// through provider-call metadata, analogous to OIDC Authorization: Bearer.
221///
222/// Native message type for `gestalt.provider.v1.UserInfoRequest`.
223#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
224#[serde(rename_all = "camelCase")]
225pub struct UserInfoRequest {}
226
227/// UserInfoResponse models profile claims about the authenticated end user.
228///
229/// Native message type for `gestalt.provider.v1.UserInfoResponse`.
230#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
231#[serde(rename_all = "camelCase")]
232pub struct UserInfoResponse {
233    /// The `subject_id` field.
234    pub subject_id: String,
235    /// The `email` field.
236    pub email: String,
237    /// The `name` field.
238    pub name: String,
239}
240
241/// Identity models the shared Gestalt authentication protocol.
242///
243/// Client for the `gestalt.provider.v1.Identity` service.
244pub struct Identity {
245    inner: v1::identity_client::IdentityClient<HostServiceChannel>,
246    timeout: Option<std::time::Duration>,
247}
248
249impl Identity {
250    /// Creates a client over an established channel.
251    pub fn new(channel: tonic::transport::Channel) -> Self {
252        Self {
253            inner: v1::identity_client::IdentityClient::new(plain_channel(channel)),
254            timeout: None,
255        }
256    }
257
258    /// Sets a deadline applied to every unary call; calls that run past it
259    /// fail with DEADLINE_EXCEEDED. Streaming calls are unaffected.
260    pub fn with_timeout(mut self, timeout: std::time::Duration) -> Self {
261        self.timeout = Some(timeout);
262        self
263    }
264
265    /// Connects to the `identity` host service described by the environment.
266    pub async fn connect() -> Result<Self, GestaltError> {
267        Self::connect_named("").await
268    }
269
270    /// Connects to the named `identity` host-service binding.
271    pub async fn connect_named(name: &str) -> Result<Self, GestaltError> {
272        Ok(Self {
273            inner: v1::identity_client::IdentityClient::new(
274                connect_host_service("identity", name).await?,
275            ),
276            timeout: None,
277        })
278    }
279
280    /// Calls `gestalt.provider.v1.Identity.Authorize`.
281    pub async fn authorize(
282        &mut self,
283        response_type: String,
284        client_id: String,
285        redirect_uri: String,
286        scope: String,
287        state: String,
288    ) -> Result<AuthorizeResponse, GestaltError> {
289        let request = AuthorizeRequest {
290            response_type,
291            client_id,
292            redirect_uri,
293            scope,
294            state,
295        };
296        let mut tonic_request = tonic::Request::new(to_wire_authorize_request(request));
297        if let Some(timeout) = self.timeout {
298            tonic_request.set_timeout(timeout);
299        }
300        let response = self.inner.authorize(tonic_request).await?;
301        Ok(from_wire_authorize_response(response.into_inner()))
302    }
303
304    /// Calls `gestalt.provider.v1.Identity.Authorize` with the full request and response messages.
305    pub async fn authorize_raw(
306        &mut self,
307        request: AuthorizeRequest,
308    ) -> Result<AuthorizeResponse, GestaltError> {
309        let mut tonic_request = tonic::Request::new(to_wire_authorize_request(request));
310        if let Some(timeout) = self.timeout {
311            tonic_request.set_timeout(timeout);
312        }
313        let response = self.inner.authorize(tonic_request).await?;
314        Ok(from_wire_authorize_response(response.into_inner()))
315    }
316
317    /// Calls `gestalt.provider.v1.Identity.Token`.
318    #[allow(clippy::too_many_arguments)]
319    pub async fn token(
320        &mut self,
321        grant_type: String,
322        code: String,
323        redirect_uri: String,
324        client_id: String,
325        state: String,
326        scope: String,
327        subject_token: String,
328        subject_token_type: String,
329        options: IdentityTokenOptions,
330    ) -> Result<TokenResponse, GestaltError> {
331        let request = TokenRequest {
332            grant_type,
333            code,
334            redirect_uri,
335            client_id,
336            state,
337            scope,
338            subject_token,
339            subject_token_type,
340            expires_in: options.expires_in,
341        };
342        let mut tonic_request = tonic::Request::new(to_wire_token_request(request));
343        if let Some(timeout) = self.timeout {
344            tonic_request.set_timeout(timeout);
345        }
346        let response = self.inner.token(tonic_request).await?;
347        Ok(from_wire_token_response(response.into_inner()))
348    }
349
350    /// Calls `gestalt.provider.v1.Identity.Token` with the full request and response messages.
351    pub async fn token_raw(
352        &mut self,
353        request: TokenRequest,
354    ) -> Result<TokenResponse, GestaltError> {
355        let mut tonic_request = tonic::Request::new(to_wire_token_request(request));
356        if let Some(timeout) = self.timeout {
357            tonic_request.set_timeout(timeout);
358        }
359        let response = self.inner.token(tonic_request).await?;
360        Ok(from_wire_token_response(response.into_inner()))
361    }
362
363    /// Calls `gestalt.provider.v1.Identity.Introspect`.
364    pub async fn introspect(
365        &mut self,
366        token: String,
367        token_type_hint: String,
368    ) -> Result<IntrospectResponse, GestaltError> {
369        let request = IntrospectRequest {
370            token,
371            token_type_hint,
372        };
373        let mut tonic_request = tonic::Request::new(to_wire_introspect_request(request));
374        if let Some(timeout) = self.timeout {
375            tonic_request.set_timeout(timeout);
376        }
377        let response = self.inner.introspect(tonic_request).await?;
378        Ok(from_wire_introspect_response(response.into_inner()))
379    }
380
381    /// Calls `gestalt.provider.v1.Identity.Introspect` with the full request and response messages.
382    pub async fn introspect_raw(
383        &mut self,
384        request: IntrospectRequest,
385    ) -> Result<IntrospectResponse, GestaltError> {
386        let mut tonic_request = tonic::Request::new(to_wire_introspect_request(request));
387        if let Some(timeout) = self.timeout {
388            tonic_request.set_timeout(timeout);
389        }
390        let response = self.inner.introspect(tonic_request).await?;
391        Ok(from_wire_introspect_response(response.into_inner()))
392    }
393
394    /// Calls `gestalt.provider.v1.Identity.UserInfo`.
395    pub async fn user_info(
396        &mut self,
397        request: UserInfoRequest,
398    ) -> Result<UserInfoResponse, GestaltError> {
399        let mut tonic_request = tonic::Request::new(to_wire_user_info_request(request));
400        if let Some(timeout) = self.timeout {
401            tonic_request.set_timeout(timeout);
402        }
403        let response = self.inner.user_info(tonic_request).await?;
404        Ok(from_wire_user_info_response(response.into_inner()))
405    }
406
407    /// Calls `gestalt.provider.v1.Identity.ListGrants`.
408    pub async fn list_grants(
409        &mut self,
410        request: ListGrantsRequest,
411    ) -> Result<ListGrantsResponse, GestaltError> {
412        let mut tonic_request = tonic::Request::new(to_wire_list_grants_request(request));
413        if let Some(timeout) = self.timeout {
414            tonic_request.set_timeout(timeout);
415        }
416        let response = self.inner.list_grants(tonic_request).await?;
417        Ok(from_wire_list_grants_response(response.into_inner()))
418    }
419
420    /// Calls `gestalt.provider.v1.Identity.GetGrant`.
421    pub async fn get_grant(&mut self, grant_id: String) -> Result<GetGrantResponse, GestaltError> {
422        let request = GetGrantRequest { grant_id };
423        let mut tonic_request = tonic::Request::new(to_wire_get_grant_request(request));
424        if let Some(timeout) = self.timeout {
425            tonic_request.set_timeout(timeout);
426        }
427        let response = self.inner.get_grant(tonic_request).await?;
428        Ok(from_wire_get_grant_response(response.into_inner()))
429    }
430
431    /// Calls `gestalt.provider.v1.Identity.GetGrant` with the full request and response messages.
432    pub async fn get_grant_raw(
433        &mut self,
434        request: GetGrantRequest,
435    ) -> Result<GetGrantResponse, GestaltError> {
436        let mut tonic_request = tonic::Request::new(to_wire_get_grant_request(request));
437        if let Some(timeout) = self.timeout {
438            tonic_request.set_timeout(timeout);
439        }
440        let response = self.inner.get_grant(tonic_request).await?;
441        Ok(from_wire_get_grant_response(response.into_inner()))
442    }
443
444    /// Calls `gestalt.provider.v1.Identity.RevokeGrant`.
445    pub async fn revoke_grant(
446        &mut self,
447        grant_id: String,
448    ) -> Result<RevokeGrantResponse, GestaltError> {
449        let request = RevokeGrantRequest { grant_id };
450        let mut tonic_request = tonic::Request::new(to_wire_revoke_grant_request(request));
451        if let Some(timeout) = self.timeout {
452            tonic_request.set_timeout(timeout);
453        }
454        let response = self.inner.revoke_grant(tonic_request).await?;
455        Ok(from_wire_revoke_grant_response(response.into_inner()))
456    }
457
458    /// Calls `gestalt.provider.v1.Identity.RevokeGrant` with the full request and response messages.
459    pub async fn revoke_grant_raw(
460        &mut self,
461        request: RevokeGrantRequest,
462    ) -> Result<RevokeGrantResponse, GestaltError> {
463        let mut tonic_request = tonic::Request::new(to_wire_revoke_grant_request(request));
464        if let Some(timeout) = self.timeout {
465            tonic_request.set_timeout(timeout);
466        }
467        let response = self.inner.revoke_grant(tonic_request).await?;
468        Ok(from_wire_revoke_grant_response(response.into_inner()))
469    }
470}
471
472/// Optional parameters of [`Identity::token`]; the default value leaves every
473/// option unset.
474#[derive(Clone, Debug, Default)]
475pub struct IdentityTokenOptions {
476    /// expires_in is a Gestalt request-side extension for the desired access-token
477    /// lifetime in seconds. The provider MAY clamp or default it; expires_in in
478    /// TokenResponse remains authoritative per RFC 6749 §5.1. 0 means use the grant
479    /// default.
480    ///
481    /// The `expires_in` field.
482    pub expires_in: i64,
483}
gestalt/identity.rs

gestalt/
identity.rs
