nominal_api_conjure/conjure/endpoints/authorization/
authorization_service.rs

1use conjure_http::endpoint;
2/// Authorization service manages the permissions for a user
3/// to access resources.
4#[conjure_http::conjure_endpoints(
5    name = "AuthorizationService",
6    use_legacy_error_serialization
7)]
8pub trait AuthorizationService {
9    /// Given a set of resources, returns the set of resources that the
10    /// user is authorized to access.
11    #[endpoint(
12        method = POST,
13        path = "/authorization/v1/authorize",
14        name = "authorize",
15        produces = conjure_http::server::conjure::CollectionResponseSerializer
16    )]
17    fn authorize(
18        &self,
19        #[auth]
20        auth_: conjure_object::BearerToken,
21        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
22        request: super::super::super::objects::authorization::AuthorizationRequest,
23    ) -> Result<
24        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
25        conjure_http::private::Error,
26    >;
27    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
28    /// is not authorized on the resource, will omit the resource from the response.
29    #[endpoint(
30        method = POST,
31        path = "/authorization/v1/batch-get-workspace-for-resource",
32        name = "batchGetWorkspaceForResource",
33        produces = conjure_http::server::conjure::CollectionResponseSerializer
34    )]
35    fn batch_get_workspace_for_resource(
36        &self,
37        #[auth]
38        auth_: conjure_object::BearerToken,
39        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
40        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
41    ) -> Result<
42        std::collections::BTreeMap<
43            conjure_object::ResourceIdentifier,
44            super::super::super::objects::api::rids::WorkspaceRid,
45        >,
46        conjure_http::private::Error,
47    >;
48    /// Marks a set of resources as belonging to a workspace. Either all resources are
49    /// registered or none are.
50    /// If the user is not in the workspace, this will throw.
51    /// If a resource already belongs to a different workspace, this will throw.
52    /// If a resource already belongs to this workspace, this is a no-op.
53    #[endpoint(
54        method = POST,
55        path = "/authorization/v1/register-in-workspace",
56        name = "registerInWorkspace"
57    )]
58    fn register_in_workspace(
59        &self,
60        #[auth]
61        auth_: conjure_object::BearerToken,
62        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
63        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
64    ) -> Result<(), conjure_http::private::Error>;
65    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
66    /// authenticated user is an admin and HTTP 403 otherwise.
67    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
68    fn check_admin(
69        &self,
70        #[auth]
71        auth_: conjure_object::BearerToken,
72    ) -> Result<(), conjure_http::private::Error>;
73    /// Checks if the email is allowed to register.
74    #[endpoint(
75        method = POST,
76        path = "/authorization/v1/is-email-allowed",
77        name = "isEmailAllowed",
78        produces = conjure_http::server::StdResponseSerializer
79    )]
80    fn is_email_allowed(
81        &self,
82        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
83        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
84    ) -> Result<
85        super::super::super::objects::authorization::IsEmailAllowedResponse,
86        conjure_http::private::Error,
87    >;
88    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
89    #[endpoint(
90        method = POST,
91        path = "/authorization/v1/is-email-allowed-okta",
92        name = "isEmailAllowedOkta",
93        produces = conjure_http::server::StdResponseSerializer
94    )]
95    fn is_email_allowed_okta(
96        &self,
97        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
98        request: super::super::super::objects::authorization::OktaRegistrationRequest,
99    ) -> Result<
100        super::super::super::objects::authorization::OktaRegistrationResponse,
101        conjure_http::private::Error,
102    >;
103    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
104    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
105    /// inline hook, but always responds with ALLOW.
106    #[endpoint(
107        method = POST,
108        path = "/authorization/v1/is-email-allowed-freemium-okta",
109        name = "isEmailAllowedFreemiumOkta",
110        produces = conjure_http::server::StdResponseSerializer
111    )]
112    fn is_email_allowed_freemium_okta(
113        &self,
114        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
115        request: super::super::super::objects::authorization::OktaRegistrationRequest,
116    ) -> Result<
117        super::super::super::objects::authorization::OktaRegistrationResponse,
118        conjure_http::private::Error,
119    >;
120    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
121    /// is invalid or if the OIDC provider is not known.
122    #[endpoint(
123        method = POST,
124        path = "/authorization/v1/user-orgs",
125        name = "getUserOrgs",
126        produces = conjure_http::server::StdResponseSerializer
127    )]
128    fn get_user_orgs(
129        &self,
130        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
131        request: super::super::super::objects::authorization::GetUserOrgsRequest,
132    ) -> Result<
133        super::super::super::objects::authorization::GetUserOrgsResponse,
134        conjure_http::private::Error,
135    >;
136    /// Switch the authenticated session to the provided org rid.
137    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
138    #[endpoint(
139        method = POST,
140        path = "/authorization/v1/set-user-org",
141        name = "setUserOrg",
142        produces = conjure_http::server::StdResponseSerializer
143    )]
144    fn set_user_org(
145        &self,
146        #[auth]
147        auth_: conjure_object::BearerToken,
148        #[body(deserializer = conjure_http::server::StdRequestDeserializer, safe)]
149        request: super::super::super::objects::authorization::SetUserOrgRequest,
150    ) -> Result<
151        super::super::super::objects::authorization::GetAccessTokenResponse,
152        conjure_http::private::Error,
153    >;
154    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
155    #[endpoint(
156        method = POST,
157        path = "/authorization/v1/access-token",
158        name = "getAccessToken",
159        produces = conjure_http::server::StdResponseSerializer
160    )]
161    fn get_access_token(
162        &self,
163        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
164        request: super::super::super::objects::authorization::GetAccessTokenRequest,
165    ) -> Result<
166        super::super::super::objects::authorization::GetAccessTokenResponse,
167        conjure_http::private::Error,
168    >;
169    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
170    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
171    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
172    /// known.
173    #[endpoint(
174        method = POST,
175        path = "/authorization/v1/refresh-access-token",
176        name = "refreshAccessToken",
177        produces = conjure_http::server::StdResponseSerializer
178    )]
179    fn refresh_access_token(
180        &self,
181        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
182        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
183    ) -> Result<
184        super::super::super::objects::authorization::RefreshAccessTokenResponse,
185        conjure_http::private::Error,
186    >;
187    /// Given an IDP issued id token, return the end session endpoint, accessed through the
188    /// .well-known/openid-configuration endpoint.
189    #[endpoint(
190        method = POST,
191        path = "/authorization/v1/get-idp-end-session-endpoint",
192        name = "getIdpEndSessionEndpoint",
193        produces = conjure_http::server::StdResponseSerializer
194    )]
195    fn get_idp_end_session_endpoint(
196        &self,
197        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
198        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
199    ) -> Result<
200        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
201        conjure_http::private::Error,
202    >;
203    /// Provide a long-lived API key for making API requests.
204    /// The API key is irretrievable after initial creation.
205    #[endpoint(
206        method = POST,
207        path = "/authorization/v1/api-key",
208        name = "createApiKey",
209        produces = conjure_http::server::StdResponseSerializer
210    )]
211    fn create_api_key(
212        &self,
213        #[auth]
214        auth_: conjure_object::BearerToken,
215        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
216        request: super::super::super::objects::authorization::CreateApiKeyRequest,
217    ) -> Result<
218        super::super::super::objects::authorization::CreateApiKeyResponse,
219        conjure_http::private::Error,
220    >;
221    /// List all API keys in the organization.
222    #[endpoint(
223        method = POST,
224        path = "/authorization/v1/api-keys/org",
225        name = "listApiKeysInOrg",
226        produces = conjure_http::server::StdResponseSerializer
227    )]
228    fn list_api_keys_in_org(
229        &self,
230        #[auth]
231        auth_: conjure_object::BearerToken,
232        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
233        request: super::super::super::objects::authorization::ListApiKeyRequest,
234    ) -> Result<
235        super::super::super::objects::authorization::ListApiKeyResponse,
236        conjure_http::private::Error,
237    >;
238    /// List all API keys for the user.
239    #[endpoint(
240        method = POST,
241        path = "/authorization/v1/api-keys/user",
242        name = "listUserApiKeys",
243        produces = conjure_http::server::StdResponseSerializer
244    )]
245    fn list_user_api_keys(
246        &self,
247        #[auth]
248        auth_: conjure_object::BearerToken,
249        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
250        request: super::super::super::objects::authorization::ListApiKeyRequest,
251    ) -> Result<
252        super::super::super::objects::authorization::ListApiKeyResponse,
253        conjure_http::private::Error,
254    >;
255    /// Delete an API key.
256    #[endpoint(
257        method = PUT,
258        path = "/authorization/v1/api-key/{rid}/delete",
259        name = "revokeApiKey"
260    )]
261    fn revoke_api_key(
262        &self,
263        #[auth]
264        auth_: conjure_object::BearerToken,
265        #[path(
266            name = "rid",
267            decoder = conjure_http::server::conjure::FromPlainDecoder,
268            safe
269        )]
270        rid: super::super::super::objects::authorization::ApiKeyRid,
271    ) -> Result<(), conjure_http::private::Error>;
272}
273/// Authorization service manages the permissions for a user
274/// to access resources.
275#[conjure_http::conjure_endpoints(
276    name = "AuthorizationService",
277    use_legacy_error_serialization
278)]
279pub trait AsyncAuthorizationService {
280    /// Given a set of resources, returns the set of resources that the
281    /// user is authorized to access.
282    #[endpoint(
283        method = POST,
284        path = "/authorization/v1/authorize",
285        name = "authorize",
286        produces = conjure_http::server::conjure::CollectionResponseSerializer
287    )]
288    async fn authorize(
289        &self,
290        #[auth]
291        auth_: conjure_object::BearerToken,
292        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
293        request: super::super::super::objects::authorization::AuthorizationRequest,
294    ) -> Result<
295        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
296        conjure_http::private::Error,
297    >;
298    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
299    /// is not authorized on the resource, will omit the resource from the response.
300    #[endpoint(
301        method = POST,
302        path = "/authorization/v1/batch-get-workspace-for-resource",
303        name = "batchGetWorkspaceForResource",
304        produces = conjure_http::server::conjure::CollectionResponseSerializer
305    )]
306    async fn batch_get_workspace_for_resource(
307        &self,
308        #[auth]
309        auth_: conjure_object::BearerToken,
310        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
311        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
312    ) -> Result<
313        std::collections::BTreeMap<
314            conjure_object::ResourceIdentifier,
315            super::super::super::objects::api::rids::WorkspaceRid,
316        >,
317        conjure_http::private::Error,
318    >;
319    /// Marks a set of resources as belonging to a workspace. Either all resources are
320    /// registered or none are.
321    /// If the user is not in the workspace, this will throw.
322    /// If a resource already belongs to a different workspace, this will throw.
323    /// If a resource already belongs to this workspace, this is a no-op.
324    #[endpoint(
325        method = POST,
326        path = "/authorization/v1/register-in-workspace",
327        name = "registerInWorkspace"
328    )]
329    async fn register_in_workspace(
330        &self,
331        #[auth]
332        auth_: conjure_object::BearerToken,
333        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
334        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
335    ) -> Result<(), conjure_http::private::Error>;
336    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
337    /// authenticated user is an admin and HTTP 403 otherwise.
338    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
339    async fn check_admin(
340        &self,
341        #[auth]
342        auth_: conjure_object::BearerToken,
343    ) -> Result<(), conjure_http::private::Error>;
344    /// Checks if the email is allowed to register.
345    #[endpoint(
346        method = POST,
347        path = "/authorization/v1/is-email-allowed",
348        name = "isEmailAllowed",
349        produces = conjure_http::server::StdResponseSerializer
350    )]
351    async fn is_email_allowed(
352        &self,
353        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
354        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
355    ) -> Result<
356        super::super::super::objects::authorization::IsEmailAllowedResponse,
357        conjure_http::private::Error,
358    >;
359    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
360    #[endpoint(
361        method = POST,
362        path = "/authorization/v1/is-email-allowed-okta",
363        name = "isEmailAllowedOkta",
364        produces = conjure_http::server::StdResponseSerializer
365    )]
366    async fn is_email_allowed_okta(
367        &self,
368        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
369        request: super::super::super::objects::authorization::OktaRegistrationRequest,
370    ) -> Result<
371        super::super::super::objects::authorization::OktaRegistrationResponse,
372        conjure_http::private::Error,
373    >;
374    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
375    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
376    /// inline hook, but always responds with ALLOW.
377    #[endpoint(
378        method = POST,
379        path = "/authorization/v1/is-email-allowed-freemium-okta",
380        name = "isEmailAllowedFreemiumOkta",
381        produces = conjure_http::server::StdResponseSerializer
382    )]
383    async fn is_email_allowed_freemium_okta(
384        &self,
385        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
386        request: super::super::super::objects::authorization::OktaRegistrationRequest,
387    ) -> Result<
388        super::super::super::objects::authorization::OktaRegistrationResponse,
389        conjure_http::private::Error,
390    >;
391    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
392    /// is invalid or if the OIDC provider is not known.
393    #[endpoint(
394        method = POST,
395        path = "/authorization/v1/user-orgs",
396        name = "getUserOrgs",
397        produces = conjure_http::server::StdResponseSerializer
398    )]
399    async fn get_user_orgs(
400        &self,
401        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
402        request: super::super::super::objects::authorization::GetUserOrgsRequest,
403    ) -> Result<
404        super::super::super::objects::authorization::GetUserOrgsResponse,
405        conjure_http::private::Error,
406    >;
407    /// Switch the authenticated session to the provided org rid.
408    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
409    #[endpoint(
410        method = POST,
411        path = "/authorization/v1/set-user-org",
412        name = "setUserOrg",
413        produces = conjure_http::server::StdResponseSerializer
414    )]
415    async fn set_user_org(
416        &self,
417        #[auth]
418        auth_: conjure_object::BearerToken,
419        #[body(deserializer = conjure_http::server::StdRequestDeserializer, safe)]
420        request: super::super::super::objects::authorization::SetUserOrgRequest,
421    ) -> Result<
422        super::super::super::objects::authorization::GetAccessTokenResponse,
423        conjure_http::private::Error,
424    >;
425    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
426    #[endpoint(
427        method = POST,
428        path = "/authorization/v1/access-token",
429        name = "getAccessToken",
430        produces = conjure_http::server::StdResponseSerializer
431    )]
432    async fn get_access_token(
433        &self,
434        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
435        request: super::super::super::objects::authorization::GetAccessTokenRequest,
436    ) -> Result<
437        super::super::super::objects::authorization::GetAccessTokenResponse,
438        conjure_http::private::Error,
439    >;
440    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
441    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
442    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
443    /// known.
444    #[endpoint(
445        method = POST,
446        path = "/authorization/v1/refresh-access-token",
447        name = "refreshAccessToken",
448        produces = conjure_http::server::StdResponseSerializer
449    )]
450    async fn refresh_access_token(
451        &self,
452        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
453        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
454    ) -> Result<
455        super::super::super::objects::authorization::RefreshAccessTokenResponse,
456        conjure_http::private::Error,
457    >;
458    /// Given an IDP issued id token, return the end session endpoint, accessed through the
459    /// .well-known/openid-configuration endpoint.
460    #[endpoint(
461        method = POST,
462        path = "/authorization/v1/get-idp-end-session-endpoint",
463        name = "getIdpEndSessionEndpoint",
464        produces = conjure_http::server::StdResponseSerializer
465    )]
466    async fn get_idp_end_session_endpoint(
467        &self,
468        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
469        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
470    ) -> Result<
471        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
472        conjure_http::private::Error,
473    >;
474    /// Provide a long-lived API key for making API requests.
475    /// The API key is irretrievable after initial creation.
476    #[endpoint(
477        method = POST,
478        path = "/authorization/v1/api-key",
479        name = "createApiKey",
480        produces = conjure_http::server::StdResponseSerializer
481    )]
482    async fn create_api_key(
483        &self,
484        #[auth]
485        auth_: conjure_object::BearerToken,
486        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
487        request: super::super::super::objects::authorization::CreateApiKeyRequest,
488    ) -> Result<
489        super::super::super::objects::authorization::CreateApiKeyResponse,
490        conjure_http::private::Error,
491    >;
492    /// List all API keys in the organization.
493    #[endpoint(
494        method = POST,
495        path = "/authorization/v1/api-keys/org",
496        name = "listApiKeysInOrg",
497        produces = conjure_http::server::StdResponseSerializer
498    )]
499    async fn list_api_keys_in_org(
500        &self,
501        #[auth]
502        auth_: conjure_object::BearerToken,
503        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
504        request: super::super::super::objects::authorization::ListApiKeyRequest,
505    ) -> Result<
506        super::super::super::objects::authorization::ListApiKeyResponse,
507        conjure_http::private::Error,
508    >;
509    /// List all API keys for the user.
510    #[endpoint(
511        method = POST,
512        path = "/authorization/v1/api-keys/user",
513        name = "listUserApiKeys",
514        produces = conjure_http::server::StdResponseSerializer
515    )]
516    async fn list_user_api_keys(
517        &self,
518        #[auth]
519        auth_: conjure_object::BearerToken,
520        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
521        request: super::super::super::objects::authorization::ListApiKeyRequest,
522    ) -> Result<
523        super::super::super::objects::authorization::ListApiKeyResponse,
524        conjure_http::private::Error,
525    >;
526    /// Delete an API key.
527    #[endpoint(
528        method = PUT,
529        path = "/authorization/v1/api-key/{rid}/delete",
530        name = "revokeApiKey"
531    )]
532    async fn revoke_api_key(
533        &self,
534        #[auth]
535        auth_: conjure_object::BearerToken,
536        #[path(
537            name = "rid",
538            decoder = conjure_http::server::conjure::FromPlainDecoder,
539            safe
540        )]
541        rid: super::super::super::objects::authorization::ApiKeyRid,
542    ) -> Result<(), conjure_http::private::Error>;
543}
544/// Authorization service manages the permissions for a user
545/// to access resources.
546#[conjure_http::conjure_endpoints(
547    name = "AuthorizationService",
548    use_legacy_error_serialization,
549    local
550)]
551pub trait LocalAsyncAuthorizationService {
552    /// Given a set of resources, returns the set of resources that the
553    /// user is authorized to access.
554    #[endpoint(
555        method = POST,
556        path = "/authorization/v1/authorize",
557        name = "authorize",
558        produces = conjure_http::server::conjure::CollectionResponseSerializer
559    )]
560    async fn authorize(
561        &self,
562        #[auth]
563        auth_: conjure_object::BearerToken,
564        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
565        request: super::super::super::objects::authorization::AuthorizationRequest,
566    ) -> Result<
567        std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
568        conjure_http::private::Error,
569    >;
570    /// Given a set of resources, returns the workspace that each resource belongs to. If a user
571    /// is not authorized on the resource, will omit the resource from the response.
572    #[endpoint(
573        method = POST,
574        path = "/authorization/v1/batch-get-workspace-for-resource",
575        name = "batchGetWorkspaceForResource",
576        produces = conjure_http::server::conjure::CollectionResponseSerializer
577    )]
578    async fn batch_get_workspace_for_resource(
579        &self,
580        #[auth]
581        auth_: conjure_object::BearerToken,
582        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
583        request: std::collections::BTreeSet<conjure_object::ResourceIdentifier>,
584    ) -> Result<
585        std::collections::BTreeMap<
586            conjure_object::ResourceIdentifier,
587            super::super::super::objects::api::rids::WorkspaceRid,
588        >,
589        conjure_http::private::Error,
590    >;
591    /// Marks a set of resources as belonging to a workspace. Either all resources are
592    /// registered or none are.
593    /// If the user is not in the workspace, this will throw.
594    /// If a resource already belongs to a different workspace, this will throw.
595    /// If a resource already belongs to this workspace, this is a no-op.
596    #[endpoint(
597        method = POST,
598        path = "/authorization/v1/register-in-workspace",
599        name = "registerInWorkspace"
600    )]
601    async fn register_in_workspace(
602        &self,
603        #[auth]
604        auth_: conjure_object::BearerToken,
605        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
606        request: super::super::super::objects::authorization::RegisterInWorkspaceRequest,
607    ) -> Result<(), conjure_http::private::Error>;
608    /// Given an authenticated session, this endpoint returns a HTTP 204 if the
609    /// authenticated user is an admin and HTTP 403 otherwise.
610    #[endpoint(method = GET, path = "/authorization/v1/checkAdmin", name = "checkAdmin")]
611    async fn check_admin(
612        &self,
613        #[auth]
614        auth_: conjure_object::BearerToken,
615    ) -> Result<(), conjure_http::private::Error>;
616    /// Checks if the email is allowed to register.
617    #[endpoint(
618        method = POST,
619        path = "/authorization/v1/is-email-allowed",
620        name = "isEmailAllowed",
621        produces = conjure_http::server::StdResponseSerializer
622    )]
623    async fn is_email_allowed(
624        &self,
625        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
626        request: super::super::super::objects::authorization::IsEmailAllowedRequest,
627    ) -> Result<
628        super::super::super::objects::authorization::IsEmailAllowedResponse,
629        conjure_http::private::Error,
630    >;
631    /// Checks if the email is allowed to register, following Okta "registration inline hook" API.
632    #[endpoint(
633        method = POST,
634        path = "/authorization/v1/is-email-allowed-okta",
635        name = "isEmailAllowedOkta",
636        produces = conjure_http::server::StdResponseSerializer
637    )]
638    async fn is_email_allowed_okta(
639        &self,
640        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
641        request: super::super::super::objects::authorization::OktaRegistrationRequest,
642    ) -> Result<
643        super::super::super::objects::authorization::OktaRegistrationResponse,
644        conjure_http::private::Error,
645    >;
646    /// Freemium variant of the Okta "registration inline hook" API: allows any email to register.
647    /// Uses the same request/response shape as isEmailAllowedOkta so it can be wired up as an Okta
648    /// inline hook, but always responds with ALLOW.
649    #[endpoint(
650        method = POST,
651        path = "/authorization/v1/is-email-allowed-freemium-okta",
652        name = "isEmailAllowedFreemiumOkta",
653        produces = conjure_http::server::StdResponseSerializer
654    )]
655    async fn is_email_allowed_freemium_okta(
656        &self,
657        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
658        request: super::super::super::objects::authorization::OktaRegistrationRequest,
659    ) -> Result<
660        super::super::super::objects::authorization::OktaRegistrationResponse,
661        conjure_http::private::Error,
662    >;
663    /// Provides an OIDC ID token to get the orgs that the user is a member of. Throws NotAuthorized if the ID token
664    /// is invalid or if the OIDC provider is not known.
665    #[endpoint(
666        method = POST,
667        path = "/authorization/v1/user-orgs",
668        name = "getUserOrgs",
669        produces = conjure_http::server::StdResponseSerializer
670    )]
671    async fn get_user_orgs(
672        &self,
673        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
674        request: super::super::super::objects::authorization::GetUserOrgsRequest,
675    ) -> Result<
676        super::super::super::objects::authorization::GetUserOrgsResponse,
677        conjure_http::private::Error,
678    >;
679    /// Switch the authenticated session to the provided org rid.
680    /// Throws NotAuthorized if the session is invalid or the user is not a member of the org.
681    #[endpoint(
682        method = POST,
683        path = "/authorization/v1/set-user-org",
684        name = "setUserOrg",
685        produces = conjure_http::server::StdResponseSerializer
686    )]
687    async fn set_user_org(
688        &self,
689        #[auth]
690        auth_: conjure_object::BearerToken,
691        #[body(deserializer = conjure_http::server::StdRequestDeserializer, safe)]
692        request: super::super::super::objects::authorization::SetUserOrgRequest,
693    ) -> Result<
694        super::super::super::objects::authorization::GetAccessTokenResponse,
695        conjure_http::private::Error,
696    >;
697    /// Provide an OIDC ID token to get a (24h) Nominal access token suitable for making API requests.
698    #[endpoint(
699        method = POST,
700        path = "/authorization/v1/access-token",
701        name = "getAccessToken",
702        produces = conjure_http::server::StdResponseSerializer
703    )]
704    async fn get_access_token(
705        &self,
706        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
707        request: super::super::super::objects::authorization::GetAccessTokenRequest,
708    ) -> Result<
709        super::super::super::objects::authorization::GetAccessTokenResponse,
710        conjure_http::private::Error,
711    >;
712    /// Given an authenticated session, provide an OIDC access token to get a Nominal access token suitable
713    /// for making API requests. Its expiry will match that of the input access token, capped at 24h. TODO(MGMT-933):
714    /// reduce this duration. Throws NotAuthorized if the access token is invalid or if the OIDC provider is not
715    /// known.
716    #[endpoint(
717        method = POST,
718        path = "/authorization/v1/refresh-access-token",
719        name = "refreshAccessToken",
720        produces = conjure_http::server::StdResponseSerializer
721    )]
722    async fn refresh_access_token(
723        &self,
724        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
725        request: super::super::super::objects::authorization::RefreshAccessTokenRequest,
726    ) -> Result<
727        super::super::super::objects::authorization::RefreshAccessTokenResponse,
728        conjure_http::private::Error,
729    >;
730    /// Given an IDP issued id token, return the end session endpoint, accessed through the
731    /// .well-known/openid-configuration endpoint.
732    #[endpoint(
733        method = POST,
734        path = "/authorization/v1/get-idp-end-session-endpoint",
735        name = "getIdpEndSessionEndpoint",
736        produces = conjure_http::server::StdResponseSerializer
737    )]
738    async fn get_idp_end_session_endpoint(
739        &self,
740        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
741        request: super::super::super::objects::authorization::GetIdpEndSessionEndpointRequest,
742    ) -> Result<
743        super::super::super::objects::authorization::GetIdpEndSessionEndpointResponse,
744        conjure_http::private::Error,
745    >;
746    /// Provide a long-lived API key for making API requests.
747    /// The API key is irretrievable after initial creation.
748    #[endpoint(
749        method = POST,
750        path = "/authorization/v1/api-key",
751        name = "createApiKey",
752        produces = conjure_http::server::StdResponseSerializer
753    )]
754    async fn create_api_key(
755        &self,
756        #[auth]
757        auth_: conjure_object::BearerToken,
758        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
759        request: super::super::super::objects::authorization::CreateApiKeyRequest,
760    ) -> Result<
761        super::super::super::objects::authorization::CreateApiKeyResponse,
762        conjure_http::private::Error,
763    >;
764    /// List all API keys in the organization.
765    #[endpoint(
766        method = POST,
767        path = "/authorization/v1/api-keys/org",
768        name = "listApiKeysInOrg",
769        produces = conjure_http::server::StdResponseSerializer
770    )]
771    async fn list_api_keys_in_org(
772        &self,
773        #[auth]
774        auth_: conjure_object::BearerToken,
775        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
776        request: super::super::super::objects::authorization::ListApiKeyRequest,
777    ) -> Result<
778        super::super::super::objects::authorization::ListApiKeyResponse,
779        conjure_http::private::Error,
780    >;
781    /// List all API keys for the user.
782    #[endpoint(
783        method = POST,
784        path = "/authorization/v1/api-keys/user",
785        name = "listUserApiKeys",
786        produces = conjure_http::server::StdResponseSerializer
787    )]
788    async fn list_user_api_keys(
789        &self,
790        #[auth]
791        auth_: conjure_object::BearerToken,
792        #[body(deserializer = conjure_http::server::StdRequestDeserializer)]
793        request: super::super::super::objects::authorization::ListApiKeyRequest,
794    ) -> Result<
795        super::super::super::objects::authorization::ListApiKeyResponse,
796        conjure_http::private::Error,
797    >;
798    /// Delete an API key.
799    #[endpoint(
800        method = PUT,
801        path = "/authorization/v1/api-key/{rid}/delete",
802        name = "revokeApiKey"
803    )]
804    async fn revoke_api_key(
805        &self,
806        #[auth]
807        auth_: conjure_object::BearerToken,
808        #[path(
809            name = "rid",
810            decoder = conjure_http::server::conjure::FromPlainDecoder,
811            safe
812        )]
813        rid: super::super::super::objects::authorization::ApiKeyRid,
814    ) -> Result<(), conjure_http::private::Error>;
815}
nominal_api_conjure/conjure/endpoints/authorization/authorization_service.rs

nominal_api_conjure/conjure/endpoints/authorization/
authorization_service.rs
