API for authenticate/deauthenticate (#151)

* Creating the authentication API.

internal/proto/local/controller/api/resources/authtokens/v1/authtoken.proto

@@ -0,0 +1,44 @@
+syntax = "proto3";
+
+package controller.api.resources.authtokens.v1;
+
+option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api/resources/authtokens;authtokens";
+
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/wrappers.proto";
+
+// AuthToken contains all fields related to an AuthToken resource
+message AuthToken {
+	// The ID of the AuthToken
+	// Output only.
+	string id = 1;
+
+	// The token.  This will only be populated after login and is only ever visible to the end user whose login
+	// request resulted in this auth token being created.
+	// Output only.
+	string token = 2;
+
+	// The id of the user of this AuthToken.
+	// Output only.
+	string user_id = 4 [json_name="user_id"];
+
+	// The id of the user of this AuthToken.
+	// Output only.
+	string auth_method_id = 5 [json_name="auth_method_id"];
+
+	// The time this resource was created
+	// Output only.
+	google.protobuf.Timestamp created_time = 6 [json_name="created_time"];
+
+	// The time this resource was last updated.
+	// Output only.
+	google.protobuf.Timestamp updated_time = 7 [json_name="updated_time"];
+
+	// The approximate time this AuthToken was last used.
+	// Output only.
+	google.protobuf.Timestamp approximate_last_used_time = 8 [json_name = "approximate_last_used_time"];
+
+	// The time this AuthToken expires.
+	// Output only.
+	google.protobuf.Timestamp expiration_time = 9 [json_name="expiration_time"];
+}

internal/proto/local/controller/api/services/v1/organization_service.proto

@@ -7,6 +7,7 @@ option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api
 import "protoc-gen-swagger/options/annotations.proto";
 import "google/api/annotations.proto";
 import "controller/api/resources/scopes/v1/organization.proto";
+import "controller/api/resources/authtokens/v1/authtoken.proto";
 
 service OrganizationService {
 
@@ -32,6 +33,28 @@ service OrganizationService {
       summary: "Lists all Organizations"
     };
   }
+
+  // Authenticate validates credentials provided and returns an auth token.
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse) {
+    option (google.api.http) = {
+      post: "/v1/orgs/{org_id}:authenticate"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
+      summary: "Authenticate a user to an Organization and retrieve an authentication token."
+    };
+  }
+
+  // Logout terminates a user's current session.
+  rpc Deauthenticate(DeauthenticateRequest) returns (DeauthenticateResponse) {
+    option (google.api.http) = {
+      post: "/v1/orgs/{org_id}:deauthenticate"
+    };
+    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
+      summary: "Deauthenticate an authentication token from an Organization."
+    };
+  }
 }
 
 message GetOrganizationRequest {
@@ -50,3 +73,28 @@ message ListOrganizationsRequest {
 message ListOrganizationsResponse {
   repeated resources.scopes.v1.Organization items = 1;
 }
+
+message PasswordCredential {
+  string login_name = 1;
+  string password = 2;
+}
+
+message AuthenticateRequest {
+  string org_id = 1;
+  // The id to the authmethod in the system being used for authentication.  The auth method must be in the org
+  // being logged in to.
+  string auth_method_id = 2;
+  // This can be "cookie" or "token".  If not provided, "token" will be used.  For now only type "token" is returned.
+  string token_type = 3;
+
+  PasswordCredential password_credential = 4;
+}
+
+message AuthenticateResponse {
+  resources.authtokens.v1.AuthToken item = 1;
+}
+
+message DeauthenticateRequest {
+  string org_id = 1;
+}
+message DeauthenticateResponse {}