nominal_api_conjure/conjure/clients/authorization/
authorization_service.rs

1use conjure_http::endpoint;
2/// Authorization service manages the permissions for a user
3/// to access resources.
4#[conjure_http::conjure_client(name = "AuthorizationService")]
5pub trait AuthorizationService<
6    #[response_body]
7    I: Iterator<
8            Item = Result<conjure_http::private::Bytes, conjure_http::private::Error>,
9        >,
10> {
11    /// Given a set of resources, returns the set of resources that the
12    /// user is authorized to access.
13    #[endpoint(
14        method = POST,
15        path = "/authorization/v1/authorize",
16        name = "authorize",
17        accept = conjure_http::client::conjure::CollectionResponseDeserializer
18    )]
19    fn authorize(
20        &self,
21        #[auth]
22        auth_: &conjure_object::BearerToken,
23        #[body(serializer = conjure_http::client::StdRequestSerializer)]
24        request: &super::super::super::objects::authorization::AuthorizationRequest,
25    ) -> Result<
26        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
27        conjure_http::private::Error,
28    >;
29    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
30    /// is not authorized on the resource, will omit the resource from the response.
31    #[endpoint(
32        method = POST,
33        path = "/authorization/v1/batch-get-workspace-for-resource",
34        name = "batchGetWorkspaceForResource",
35        accept = conjure_http::client::conjure::CollectionResponseDeserializer
36    )]
37    fn batch_get_workspace_for_resource(
38        &self,
39        #[auth]
40        auth_: &conjure_object::BearerToken,
41        #[body(serializer = conjure_http::client::StdRequestSerializer)]
42        request: &std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
43    ) -> Result<
44        std::collections::BTreeMap<
45            conjure_object::ResourceIdentifier,
46            super::super::super::objects::api::rids::WorkspaceRid,
47        >,
48        conjure_http::private::Error,
49    >;
50    /// Marks a set of resources as belonging to a workspace. Either all resources are
51    /// registered or none are.
52    /// If the user is not in the workspace, this will throw.
53    /// If a resource already belongs to a different workspace, this will throw.
54    /// If a resource already belongs to this workspace, this is a no-op.
55    #[endpoint(
56        method = POST,
57        path = "/authorization/v1/register-in-workspace",
58        name = "registerInWorkspace",
59        accept = conjure_http::client::conjure::EmptyResponseDeserializer
60    )]
61    fn register_in_workspace(
62        &self,
63        #[auth]
64        auth_: &conjure_object::BearerToken,
65        #[body(serializer = conjure_http::client::StdRequestSerializer)]
66        request: &super::super::super::objects::authorization::RegisterInWorkspaceRequest,
67    ) -> Result<(), conjure_http::private::Error>;
68    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
69    /// authenticated user is an admin and HTTP 403 otherwise.
70    #[endpoint(
71        method = GET,
72        path = "/authorization/v1/checkAdmin",
73        name = "checkAdmin",
74        accept = conjure_http::client::conjure::EmptyResponseDeserializer
75    )]
76    fn check_admin(
77        &self,
78        #[auth]
79        auth_: &conjure_object::BearerToken,
80    ) -> Result<(), conjure_http::private::Error>;
81    /// Checks if the email is allowed to register.
82    #[endpoint(
83        method = POST,
84        path = "/authorization/v1/is-email-allowed",
85        name = "isEmailAllowed",
86        accept = conjure_http::client::StdResponseDeserializer
87    )]
88    fn is_email_allowed(
89        &self,
90        #[body(serializer = conjure_http::client::StdRequestSerializer)]
91        request: &super::super::super::objects::authorization::IsEmailAllowedRequest,
92    ) -> Result<
93        super::super::super::objects::authorization::IsEmailAllowedResponse,
94        conjure_http::private::Error,
95    >;
96    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
97    #[endpoint(
98        method = POST,
99        path = "/authorization/v1/is-email-allowed-okta",
100        name = "isEmailAllowedOkta",
101        accept = conjure_http::client::StdResponseDeserializer
102    )]
103    fn is_email_allowed_okta(
104        &self,
105        #[body(serializer = conjure_http::client::StdRequestSerializer)]
106        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
107    ) -> Result<
108        super::super::super::objects::authorization::OktaRegistrationResponse,
109        conjure_http::private::Error,
110    >;
111    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
112    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
113    /// inline hook, but always responds with ALLOW.
114    #[endpoint(
115        method = POST,
116        path = "/authorization/v1/is-email-allowed-freemium-okta",
117        name = "isEmailAllowedFreemiumOkta",
118        accept = conjure_http::client::StdResponseDeserializer
119    )]
120    fn is_email_allowed_freemium_okta(
121        &self,
122        #[body(serializer = conjure_http::client::StdRequestSerializer)]
123        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
124    ) -> Result<
125        super::super::super::objects::authorization::OktaRegistrationResponse,
126        conjure_http::private::Error,
127    >;
128    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
129    /// is invalid or if the OIDC provider is not known.
130    #[endpoint(
131        method = POST,
132        path = "/authorization/v1/user-orgs",
133        name = "getUserOrgs",
134        accept = conjure_http::client::StdResponseDeserializer
135    )]
136    fn get_user_orgs(
137        &self,
138        #[body(serializer = conjure_http::client::StdRequestSerializer)]
139        request: &super::super::super::objects::authorization::GetUserOrgsRequest,
140    ) -> Result<
141        super::super::super::objects::authorization::GetUserOrgsResponse,
142        conjure_http::private::Error,
143    >;
144    /// Switch the authenticated session to the provided org rid.
145    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
146    #[endpoint(
147        method = POST,
148        path = "/authorization/v1/set-user-org",
149        name = "setUserOrg",
150        accept = conjure_http::client::StdResponseDeserializer
151    )]
152    fn set_user_org(
153        &self,
154        #[auth]
155        auth_: &conjure_object::BearerToken,
156        #[body(serializer = conjure_http::client::StdRequestSerializer)]
157        request: &super::super::super::objects::authorization::SetUserOrgRequest,
158    ) -> Result<
159        super::super::super::objects::authorization::GetAccessTokenResponse,
160        conjure_http::private::Error,
161    >;
162    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
163    #[endpoint(
164        method = POST,
165        path = "/authorization/v1/access-token",
166        name = "getAccessToken",
167        accept = conjure_http::client::StdResponseDeserializer
168    )]
169    fn get_access_token(
170        &self,
171        #[body(serializer = conjure_http::client::StdRequestSerializer)]
172        request: &super::super::super::objects::authorization::GetAccessTokenRequest,
173    ) -> Result<
174        super::super::super::objects::authorization::GetAccessTokenResponse,
175        conjure_http::private::Error,
176    >;
177    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
178    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
179    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
180    /// known.
181    #[endpoint(
182        method = POST,
183        path = "/authorization/v1/refresh-access-token",
184        name = "refreshAccessToken",
185        accept = conjure_http::client::StdResponseDeserializer
186    )]
187    fn refresh_access_token(
188        &self,
189        #[body(serializer = conjure_http::client::StdRequestSerializer)]
190        request: &super::super::super::objects::authorization::RefreshAccessTokenRequest,
191    ) -> Result<
192        super::super::super::objects::authorization::RefreshAccessTokenResponse,
193        conjure_http::private::Error,
194    >;
195    /// Given an IDP issued id token, return the end session endpoint, accessed through the
196    /// .well-known/openid-configuration endpoint.
197    #[endpoint(
198        method = POST,
199        path = "/authorization/v1/get-idp-end-session-endpoint",
200        name = "getIdpEndSessionEndpoint",
201        accept = conjure_http::client::StdResponseDeserializer
202    )]
203    fn get_idp_end_session_endpoint(
204        &self,
205        #[body(serializer = conjure_http::client::StdRequestSerializer)]
206        request: &super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
207    ) -> Result<
208        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
209        conjure_http::private::Error,
210    >;
211    /// Provide a long-lived API key for making API requests.
212    /// The API key is irretrievable after initial creation.
213    #[endpoint(
214        method = POST,
215        path = "/authorization/v1/api-key",
216        name = "createApiKey",
217        accept = conjure_http::client::StdResponseDeserializer
218    )]
219    fn create_api_key(
220        &self,
221        #[auth]
222        auth_: &conjure_object::BearerToken,
223        #[body(serializer = conjure_http::client::StdRequestSerializer)]
224        request: &super::super::super::objects::authorization::CreateApiKeyRequest,
225    ) -> Result<
226        super::super::super::objects::authorization::CreateApiKeyResponse,
227        conjure_http::private::Error,
228    >;
229    /// List all API keys in the organization.
230    #[endpoint(
231        method = POST,
232        path = "/authorization/v1/api-keys/org",
233        name = "listApiKeysInOrg",
234        accept = conjure_http::client::StdResponseDeserializer
235    )]
236    fn list_api_keys_in_org(
237        &self,
238        #[auth]
239        auth_: &conjure_object::BearerToken,
240        #[body(serializer = conjure_http::client::StdRequestSerializer)]
241        request: &super::super::super::objects::authorization::ListApiKeyRequest,
242    ) -> Result<
243        super::super::super::objects::authorization::ListApiKeyResponse,
244        conjure_http::private::Error,
245    >;
246    /// List all API keys for the user.
247    #[endpoint(
248        method = POST,
249        path = "/authorization/v1/api-keys/user",
250        name = "listUserApiKeys",
251        accept = conjure_http::client::StdResponseDeserializer
252    )]
253    fn list_user_api_keys(
254        &self,
255        #[auth]
256        auth_: &conjure_object::BearerToken,
257        #[body(serializer = conjure_http::client::StdRequestSerializer)]
258        request: &super::super::super::objects::authorization::ListApiKeyRequest,
259    ) -> Result<
260        super::super::super::objects::authorization::ListApiKeyResponse,
261        conjure_http::private::Error,
262    >;
263    /// Delete an API key.
264    #[endpoint(
265        method = PUT,
266        path = "/authorization/v1/api-key/{rid}/delete",
267        name = "revokeApiKey",
268        accept = conjure_http::client::conjure::EmptyResponseDeserializer
269    )]
270    fn revoke_api_key(
271        &self,
272        #[auth]
273        auth_: &conjure_object::BearerToken,
274        #[path(name = "rid", encoder = conjure_http::client::conjure::PlainEncoder)]
275        rid: &super::super::super::objects::authorization::ApiKeyRid,
276    ) -> Result<(), conjure_http::private::Error>;
277}
278/// Authorization service manages the permissions for a user
279/// to access resources.
280#[conjure_http::conjure_client(name = "AuthorizationService")]
281pub trait AsyncAuthorizationService<
282    #[response_body]
283    I: conjure_http::private::Stream<
284            Item = Result<conjure_http::private::Bytes, conjure_http::private::Error>,
285        >,
286> {
287    /// Given a set of resources, returns the set of resources that the
288    /// user is authorized to access.
289    #[endpoint(
290        method = POST,
291        path = "/authorization/v1/authorize",
292        name = "authorize",
293        accept = conjure_http::client::conjure::CollectionResponseDeserializer
294    )]
295    async fn authorize(
296        &self,
297        #[auth]
298        auth_: &conjure_object::BearerToken,
299        #[body(serializer = conjure_http::client::StdRequestSerializer)]
300        request: &super::super::super::objects::authorization::AuthorizationRequest,
301    ) -> Result<
302        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
303        conjure_http::private::Error,
304    >;
305    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
306    /// is not authorized on the resource, will omit the resource from the response.
307    #[endpoint(
308        method = POST,
309        path = "/authorization/v1/batch-get-workspace-for-resource",
310        name = "batchGetWorkspaceForResource",
311        accept = conjure_http::client::conjure::CollectionResponseDeserializer
312    )]
313    async fn batch_get_workspace_for_resource(
314        &self,
315        #[auth]
316        auth_: &conjure_object::BearerToken,
317        #[body(serializer = conjure_http::client::StdRequestSerializer)]
318        request: &std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
319    ) -> Result<
320        std::collections::BTreeMap<
321            conjure_object::ResourceIdentifier,
322            super::super::super::objects::api::rids::WorkspaceRid,
323        >,
324        conjure_http::private::Error,
325    >;
326    /// Marks a set of resources as belonging to a workspace. Either all resources are
327    /// registered or none are.
328    /// If the user is not in the workspace, this will throw.
329    /// If a resource already belongs to a different workspace, this will throw.
330    /// If a resource already belongs to this workspace, this is a no-op.
331    #[endpoint(
332        method = POST,
333        path = "/authorization/v1/register-in-workspace",
334        name = "registerInWorkspace",
335        accept = conjure_http::client::conjure::EmptyResponseDeserializer
336    )]
337    async fn register_in_workspace(
338        &self,
339        #[auth]
340        auth_: &conjure_object::BearerToken,
341        #[body(serializer = conjure_http::client::StdRequestSerializer)]
342        request: &super::super::super::objects::authorization::RegisterInWorkspaceRequest,
343    ) -> Result<(), conjure_http::private::Error>;
344    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
345    /// authenticated user is an admin and HTTP 403 otherwise.
346    #[endpoint(
347        method = GET,
348        path = "/authorization/v1/checkAdmin",
349        name = "checkAdmin",
350        accept = conjure_http::client::conjure::EmptyResponseDeserializer
351    )]
352    async fn check_admin(
353        &self,
354        #[auth]
355        auth_: &conjure_object::BearerToken,
356    ) -> Result<(), conjure_http::private::Error>;
357    /// Checks if the email is allowed to register.
358    #[endpoint(
359        method = POST,
360        path = "/authorization/v1/is-email-allowed",
361        name = "isEmailAllowed",
362        accept = conjure_http::client::StdResponseDeserializer
363    )]
364    async fn is_email_allowed(
365        &self,
366        #[body(serializer = conjure_http::client::StdRequestSerializer)]
367        request: &super::super::super::objects::authorization::IsEmailAllowedRequest,
368    ) -> Result<
369        super::super::super::objects::authorization::IsEmailAllowedResponse,
370        conjure_http::private::Error,
371    >;
372    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
373    #[endpoint(
374        method = POST,
375        path = "/authorization/v1/is-email-allowed-okta",
376        name = "isEmailAllowedOkta",
377        accept = conjure_http::client::StdResponseDeserializer
378    )]
379    async fn is_email_allowed_okta(
380        &self,
381        #[body(serializer = conjure_http::client::StdRequestSerializer)]
382        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
383    ) -> Result<
384        super::super::super::objects::authorization::OktaRegistrationResponse,
385        conjure_http::private::Error,
386    >;
387    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
388    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
389    /// inline hook, but always responds with ALLOW.
390    #[endpoint(
391        method = POST,
392        path = "/authorization/v1/is-email-allowed-freemium-okta",
393        name = "isEmailAllowedFreemiumOkta",
394        accept = conjure_http::client::StdResponseDeserializer
395    )]
396    async fn is_email_allowed_freemium_okta(
397        &self,
398        #[body(serializer = conjure_http::client::StdRequestSerializer)]
399        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
400    ) -> Result<
401        super::super::super::objects::authorization::OktaRegistrationResponse,
402        conjure_http::private::Error,
403    >;
404    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
405    /// is invalid or if the OIDC provider is not known.
406    #[endpoint(
407        method = POST,
408        path = "/authorization/v1/user-orgs",
409        name = "getUserOrgs",
410        accept = conjure_http::client::StdResponseDeserializer
411    )]
412    async fn get_user_orgs(
413        &self,
414        #[body(serializer = conjure_http::client::StdRequestSerializer)]
415        request: &super::super::super::objects::authorization::GetUserOrgsRequest,
416    ) -> Result<
417        super::super::super::objects::authorization::GetUserOrgsResponse,
418        conjure_http::private::Error,
419    >;
420    /// Switch the authenticated session to the provided org rid.
421    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
422    #[endpoint(
423        method = POST,
424        path = "/authorization/v1/set-user-org",
425        name = "setUserOrg",
426        accept = conjure_http::client::StdResponseDeserializer
427    )]
428    async fn set_user_org(
429        &self,
430        #[auth]
431        auth_: &conjure_object::BearerToken,
432        #[body(serializer = conjure_http::client::StdRequestSerializer)]
433        request: &super::super::super::objects::authorization::SetUserOrgRequest,
434    ) -> Result<
435        super::super::super::objects::authorization::GetAccessTokenResponse,
436        conjure_http::private::Error,
437    >;
438    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
439    #[endpoint(
440        method = POST,
441        path = "/authorization/v1/access-token",
442        name = "getAccessToken",
443        accept = conjure_http::client::StdResponseDeserializer
444    )]
445    async fn get_access_token(
446        &self,
447        #[body(serializer = conjure_http::client::StdRequestSerializer)]
448        request: &super::super::super::objects::authorization::GetAccessTokenRequest,
449    ) -> Result<
450        super::super::super::objects::authorization::GetAccessTokenResponse,
451        conjure_http::private::Error,
452    >;
453    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
454    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
455    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
456    /// known.
457    #[endpoint(
458        method = POST,
459        path = "/authorization/v1/refresh-access-token",
460        name = "refreshAccessToken",
461        accept = conjure_http::client::StdResponseDeserializer
462    )]
463    async fn refresh_access_token(
464        &self,
465        #[body(serializer = conjure_http::client::StdRequestSerializer)]
466        request: &super::super::super::objects::authorization::RefreshAccessTokenRequest,
467    ) -> Result<
468        super::super::super::objects::authorization::RefreshAccessTokenResponse,
469        conjure_http::private::Error,
470    >;
471    /// Given an IDP issued id token, return the end session endpoint, accessed through the
472    /// .well-known/openid-configuration endpoint.
473    #[endpoint(
474        method = POST,
475        path = "/authorization/v1/get-idp-end-session-endpoint",
476        name = "getIdpEndSessionEndpoint",
477        accept = conjure_http::client::StdResponseDeserializer
478    )]
479    async fn get_idp_end_session_endpoint(
480        &self,
481        #[body(serializer = conjure_http::client::StdRequestSerializer)]
482        request: &super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
483    ) -> Result<
484        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
485        conjure_http::private::Error,
486    >;
487    /// Provide a long-lived API key for making API requests.
488    /// The API key is irretrievable after initial creation.
489    #[endpoint(
490        method = POST,
491        path = "/authorization/v1/api-key",
492        name = "createApiKey",
493        accept = conjure_http::client::StdResponseDeserializer
494    )]
495    async fn create_api_key(
496        &self,
497        #[auth]
498        auth_: &conjure_object::BearerToken,
499        #[body(serializer = conjure_http::client::StdRequestSerializer)]
500        request: &super::super::super::objects::authorization::CreateApiKeyRequest,
501    ) -> Result<
502        super::super::super::objects::authorization::CreateApiKeyResponse,
503        conjure_http::private::Error,
504    >;
505    /// List all API keys in the organization.
506    #[endpoint(
507        method = POST,
508        path = "/authorization/v1/api-keys/org",
509        name = "listApiKeysInOrg",
510        accept = conjure_http::client::StdResponseDeserializer
511    )]
512    async fn list_api_keys_in_org(
513        &self,
514        #[auth]
515        auth_: &conjure_object::BearerToken,
516        #[body(serializer = conjure_http::client::StdRequestSerializer)]
517        request: &super::super::super::objects::authorization::ListApiKeyRequest,
518    ) -> Result<
519        super::super::super::objects::authorization::ListApiKeyResponse,
520        conjure_http::private::Error,
521    >;
522    /// List all API keys for the user.
523    #[endpoint(
524        method = POST,
525        path = "/authorization/v1/api-keys/user",
526        name = "listUserApiKeys",
527        accept = conjure_http::client::StdResponseDeserializer
528    )]
529    async fn list_user_api_keys(
530        &self,
531        #[auth]
532        auth_: &conjure_object::BearerToken,
533        #[body(serializer = conjure_http::client::StdRequestSerializer)]
534        request: &super::super::super::objects::authorization::ListApiKeyRequest,
535    ) -> Result<
536        super::super::super::objects::authorization::ListApiKeyResponse,
537        conjure_http::private::Error,
538    >;
539    /// Delete an API key.
540    #[endpoint(
541        method = PUT,
542        path = "/authorization/v1/api-key/{rid}/delete",
543        name = "revokeApiKey",
544        accept = conjure_http::client::conjure::EmptyResponseDeserializer
545    )]
546    async fn revoke_api_key(
547        &self,
548        #[auth]
549        auth_: &conjure_object::BearerToken,
550        #[path(name = "rid", encoder = conjure_http::client::conjure::PlainEncoder)]
551        rid: &super::super::super::objects::authorization::ApiKeyRid,
552    ) -> Result<(), conjure_http::private::Error>;
553}
554/// Authorization service manages the permissions for a user
555/// to access resources.
556#[conjure_http::conjure_client(name = "AuthorizationService", local)]
557pub trait LocalAsyncAuthorizationService<
558    #[response_body]
559    I: conjure_http::private::Stream<
560            Item = Result<conjure_http::private::Bytes, conjure_http::private::Error>,
561        >,
562> {
563    /// Given a set of resources, returns the set of resources that the
564    /// user is authorized to access.
565    #[endpoint(
566        method = POST,
567        path = "/authorization/v1/authorize",
568        name = "authorize",
569        accept = conjure_http::client::conjure::CollectionResponseDeserializer
570    )]
571    async fn authorize(
572        &self,
573        #[auth]
574        auth_: &conjure_object::BearerToken,
575        #[body(serializer = conjure_http::client::StdRequestSerializer)]
576        request: &super::super::super::objects::authorization::AuthorizationRequest,
577    ) -> Result<
578        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
579        conjure_http::private::Error,
580    >;
581    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
582    /// is not authorized on the resource, will omit the resource from the response.
583    #[endpoint(
584        method = POST,
585        path = "/authorization/v1/batch-get-workspace-for-resource",
586        name = "batchGetWorkspaceForResource",
587        accept = conjure_http::client::conjure::CollectionResponseDeserializer
588    )]
589    async fn batch_get_workspace_for_resource(
590        &self,
591        #[auth]
592        auth_: &conjure_object::BearerToken,
593        #[body(serializer = conjure_http::client::StdRequestSerializer)]
594        request: &std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
595    ) -> Result<
596        std::collections::BTreeMap<
597            conjure_object::ResourceIdentifier,
598            super::super::super::objects::api::rids::WorkspaceRid,
599        >,
600        conjure_http::private::Error,
601    >;
602    /// Marks a set of resources as belonging to a workspace. Either all resources are
603    /// registered or none are.
604    /// If the user is not in the workspace, this will throw.
605    /// If a resource already belongs to a different workspace, this will throw.
606    /// If a resource already belongs to this workspace, this is a no-op.
607    #[endpoint(
608        method = POST,
609        path = "/authorization/v1/register-in-workspace",
610        name = "registerInWorkspace",
611        accept = conjure_http::client::conjure::EmptyResponseDeserializer
612    )]
613    async fn register_in_workspace(
614        &self,
615        #[auth]
616        auth_: &conjure_object::BearerToken,
617        #[body(serializer = conjure_http::client::StdRequestSerializer)]
618        request: &super::super::super::objects::authorization::RegisterInWorkspaceRequest,
619    ) -> Result<(), conjure_http::private::Error>;
620    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
621    /// authenticated user is an admin and HTTP 403 otherwise.
622    #[endpoint(
623        method = GET,
624        path = "/authorization/v1/checkAdmin",
625        name = "checkAdmin",
626        accept = conjure_http::client::conjure::EmptyResponseDeserializer
627    )]
628    async fn check_admin(
629        &self,
630        #[auth]
631        auth_: &conjure_object::BearerToken,
632    ) -> Result<(), conjure_http::private::Error>;
633    /// Checks if the email is allowed to register.
634    #[endpoint(
635        method = POST,
636        path = "/authorization/v1/is-email-allowed",
637        name = "isEmailAllowed",
638        accept = conjure_http::client::StdResponseDeserializer
639    )]
640    async fn is_email_allowed(
641        &self,
642        #[body(serializer = conjure_http::client::StdRequestSerializer)]
643        request: &super::super::super::objects::authorization::IsEmailAllowedRequest,
644    ) -> Result<
645        super::super::super::objects::authorization::IsEmailAllowedResponse,
646        conjure_http::private::Error,
647    >;
648    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
649    #[endpoint(
650        method = POST,
651        path = "/authorization/v1/is-email-allowed-okta",
652        name = "isEmailAllowedOkta",
653        accept = conjure_http::client::StdResponseDeserializer
654    )]
655    async fn is_email_allowed_okta(
656        &self,
657        #[body(serializer = conjure_http::client::StdRequestSerializer)]
658        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
659    ) -> Result<
660        super::super::super::objects::authorization::OktaRegistrationResponse,
661        conjure_http::private::Error,
662    >;
663    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
664    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
665    /// inline hook, but always responds with ALLOW.
666    #[endpoint(
667        method = POST,
668        path = "/authorization/v1/is-email-allowed-freemium-okta",
669        name = "isEmailAllowedFreemiumOkta",
670        accept = conjure_http::client::StdResponseDeserializer
671    )]
672    async fn is_email_allowed_freemium_okta(
673        &self,
674        #[body(serializer = conjure_http::client::StdRequestSerializer)]
675        request: &super::super::super::objects::authorization::OktaRegistrationRequest,
676    ) -> Result<
677        super::super::super::objects::authorization::OktaRegistrationResponse,
678        conjure_http::private::Error,
679    >;
680    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
681    /// is invalid or if the OIDC provider is not known.
682    #[endpoint(
683        method = POST,
684        path = "/authorization/v1/user-orgs",
685        name = "getUserOrgs",
686        accept = conjure_http::client::StdResponseDeserializer
687    )]
688    async fn get_user_orgs(
689        &self,
690        #[body(serializer = conjure_http::client::StdRequestSerializer)]
691        request: &super::super::super::objects::authorization::GetUserOrgsRequest,
692    ) -> Result<
693        super::super::super::objects::authorization::GetUserOrgsResponse,
694        conjure_http::private::Error,
695    >;
696    /// Switch the authenticated session to the provided org rid.
697    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
698    #[endpoint(
699        method = POST,
700        path = "/authorization/v1/set-user-org",
701        name = "setUserOrg",
702        accept = conjure_http::client::StdResponseDeserializer
703    )]
704    async fn set_user_org(
705        &self,
706        #[auth]
707        auth_: &conjure_object::BearerToken,
708        #[body(serializer = conjure_http::client::StdRequestSerializer)]
709        request: &super::super::super::objects::authorization::SetUserOrgRequest,
710    ) -> Result<
711        super::super::super::objects::authorization::GetAccessTokenResponse,
712        conjure_http::private::Error,
713    >;
714    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
715    #[endpoint(
716        method = POST,
717        path = "/authorization/v1/access-token",
718        name = "getAccessToken",
719        accept = conjure_http::client::StdResponseDeserializer
720    )]
721    async fn get_access_token(
722        &self,
723        #[body(serializer = conjure_http::client::StdRequestSerializer)]
724        request: &super::super::super::objects::authorization::GetAccessTokenRequest,
725    ) -> Result<
726        super::super::super::objects::authorization::GetAccessTokenResponse,
727        conjure_http::private::Error,
728    >;
729    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
730    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
731    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
732    /// known.
733    #[endpoint(
734        method = POST,
735        path = "/authorization/v1/refresh-access-token",
736        name = "refreshAccessToken",
737        accept = conjure_http::client::StdResponseDeserializer
738    )]
739    async fn refresh_access_token(
740        &self,
741        #[body(serializer = conjure_http::client::StdRequestSerializer)]
742        request: &super::super::super::objects::authorization::RefreshAccessTokenRequest,
743    ) -> Result<
744        super::super::super::objects::authorization::RefreshAccessTokenResponse,
745        conjure_http::private::Error,
746    >;
747    /// Given an IDP issued id token, return the end session endpoint, accessed through the
748    /// .well-known/openid-configuration endpoint.
749    #[endpoint(
750        method = POST,
751        path = "/authorization/v1/get-idp-end-session-endpoint",
752        name = "getIdpEndSessionEndpoint",
753        accept = conjure_http::client::StdResponseDeserializer
754    )]
755    async fn get_idp_end_session_endpoint(
756        &self,
757        #[body(serializer = conjure_http::client::StdRequestSerializer)]
758        request: &super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
759    ) -> Result<
760        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
761        conjure_http::private::Error,
762    >;
763    /// Provide a long-lived API key for making API requests.
764    /// The API key is irretrievable after initial creation.
765    #[endpoint(
766        method = POST,
767        path = "/authorization/v1/api-key",
768        name = "createApiKey",
769        accept = conjure_http::client::StdResponseDeserializer
770    )]
771    async fn create_api_key(
772        &self,
773        #[auth]
774        auth_: &conjure_object::BearerToken,
775        #[body(serializer = conjure_http::client::StdRequestSerializer)]
776        request: &super::super::super::objects::authorization::CreateApiKeyRequest,
777    ) -> Result<
778        super::super::super::objects::authorization::CreateApiKeyResponse,
779        conjure_http::private::Error,
780    >;
781    /// List all API keys in the organization.
782    #[endpoint(
783        method = POST,
784        path = "/authorization/v1/api-keys/org",
785        name = "listApiKeysInOrg",
786        accept = conjure_http::client::StdResponseDeserializer
787    )]
788    async fn list_api_keys_in_org(
789        &self,
790        #[auth]
791        auth_: &conjure_object::BearerToken,
792        #[body(serializer = conjure_http::client::StdRequestSerializer)]
793        request: &super::super::super::objects::authorization::ListApiKeyRequest,
794    ) -> Result<
795        super::super::super::objects::authorization::ListApiKeyResponse,
796        conjure_http::private::Error,
797    >;
798    /// List all API keys for the user.
799    #[endpoint(
800        method = POST,
801        path = "/authorization/v1/api-keys/user",
802        name = "listUserApiKeys",
803        accept = conjure_http::client::StdResponseDeserializer
804    )]
805    async fn list_user_api_keys(
806        &self,
807        #[auth]
808        auth_: &conjure_object::BearerToken,
809        #[body(serializer = conjure_http::client::StdRequestSerializer)]
810        request: &super::super::super::objects::authorization::ListApiKeyRequest,
811    ) -> Result<
812        super::super::super::objects::authorization::ListApiKeyResponse,
813        conjure_http::private::Error,
814    >;
815    /// Delete an API key.
816    #[endpoint(
817        method = PUT,
818        path = "/authorization/v1/api-key/{rid}/delete",
819        name = "revokeApiKey",
820        accept = conjure_http::client::conjure::EmptyResponseDeserializer
821    )]
822    async fn revoke_api_key(
823        &self,
824        #[auth]
825        auth_: &conjure_object::BearerToken,
826        #[path(name = "rid", encoder = conjure_http::client::conjure::PlainEncoder)]
827        rid: &super::super::super::objects::authorization::ApiKeyRid,
828    ) -> Result<(), conjure_http::private::Error>;
829}
nominal_api_conjure/conjure/clients/authorization/authorization_service.rs

nominal_api_conjure/conjure/clients/authorization/
authorization_service.rs
