Authenticate Handler API and SDK, and much more (#183)

internal/proto/local/controller/api/resources/roles/v1/role.proto

@@ -7,6 +7,26 @@ option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api
 import "google/protobuf/timestamp.proto";
 import "google/protobuf/wrappers.proto";
 
+message Principal {
+	// The ID of the principal.
+	// Output only.
+	string id = 1;
+
+	// The type of the principal.
+	// Output only.
+	string type = 2;
+
+	// The scope ID of the principal.
+	// Output only.
+	string scope_id = 3 [json_name="scope_id"];
+}
+
+message Grant {
+	// The user-supplied string.
+	// Output only.
+
+}
+
 // Role contains all fields related to a Role resource
 message Role {
 	// The ID of the Role
@@ -42,13 +62,15 @@ message Role {
 	// Output only.
 	uint32 version = 8;
 
-	// The principals that are assigned this role.
+	// The IDs (only) of principals that are assigned to this role.
 	// Output only.
-	repeated string user_ids = 9;
-	// Output only.
-	repeated string group_ids = 10;
+	repeated string principal_ids = 9 [json_name="principal_ids"];
 
-	// The grants that this role provides for it's principals.
+	// The principals that are assigned to this role.
+	// Output only.
+	repeated Principal principals = 10;
+
+	// The grants that this role provides for its principals.
 	// Output only.
 	repeated string grants = 11;
 

internal/proto/local/controller/api/services/v1/authenticate_service.proto

@@ -0,0 +1,63 @@
+syntax = "proto3";
+
+package controller.api.services.v1;
+
+option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api/services;services";
+
+import "protoc-gen-swagger/options/annotations.proto";
+import "google/api/annotations.proto";
+import "google/protobuf/struct.proto";
+import "controller/api/resources/authtokens/v1/authtoken.proto";
+
+service AuthenticationService {
+  // Authenticate validates credentials provided and returns an auth token.
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse) {
+    option (google.api.http) = {
+      post: "/v1/orgs/{org_id}/auth-methods/{auth_method_id}:authenticate"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
+      summary: "Authenticate a user to an Org and retrieve an authentication token."
+    };
+  }
+
+  // Logout terminates a user's current session.
+  rpc Deauthenticate(DeauthenticateRequest) returns (DeauthenticateResponse) {
+    option (google.api.http) = {
+      post: "/v1/orgs/{org_id}:deauthenticate"
+    };
+    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
+      summary: "Deauthenticate an authentication token from an Org."
+    };
+  }
+}
+
+// The layout of the struct for "credentials" field in AuthenticateRequest.  This message isn't
+// directly referenced anywhere but is used here to define the expected field names and types.
+message PasswordCredentials {
+  string name = 1;
+  string password = 2;
+}
+
+message AuthenticateRequest {
+  string org_id = 1;
+  // The id to the authmethod in the system being used for authentication.  The auth method must be in the org
+  // being logged in to.
+  string auth_method_id = 2;
+  // This can be "cookie" or "token".  If not provided, "token" will be used.  For now only type "token" is returned.
+  string token_type = 3;
+
+  // credentials are the different possible credential names depending on what type of auth method is used.
+  // For password auth method: should include only "name" and "password".
+  google.protobuf.Struct credentials = 8;
+}
+
+message AuthenticateResponse {
+  resources.authtokens.v1.AuthToken item = 1;
+}
+
+message DeauthenticateRequest {
+  string org_id = 1;
+}
+message DeauthenticateResponse {}

internal/proto/local/controller/api/services/v1/org_service.proto

@@ -7,7 +7,6 @@ option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api
 import "protoc-gen-swagger/options/annotations.proto";
 import "google/api/annotations.proto";
 import "controller/api/resources/scopes/v1/org.proto";
-import "controller/api/resources/authtokens/v1/authtoken.proto";
 
 service OrgService {
 
@@ -33,28 +32,6 @@ service OrgService {
       summary: "Lists all Orgs"
     };
   }
-
-  // Authenticate validates credentials provided and returns an auth token.
-  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse) {
-    option (google.api.http) = {
-      post: "/v1/orgs/{org_id}:authenticate"
-      body: "*"
-      response_body: "item"
-    };
-    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
-      summary: "Authenticate a user to an Org and retrieve an authentication token."
-    };
-  }
-
-  // Logout terminates a user's current session.
-  rpc Deauthenticate(DeauthenticateRequest) returns (DeauthenticateResponse) {
-    option (google.api.http) = {
-      post: "/v1/orgs/{org_id}:deauthenticate"
-    };
-    option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
-      summary: "Deauthenticate an authentication token from an Org."
-    };
-  }
 }
 
 message GetOrgRequest {
@@ -73,28 +50,3 @@ message ListOrgsRequest {
 message ListOrgsResponse {
   repeated resources.scopes.v1.Org items = 1;
 }
-
-message PasswordCredential {
-  string login_name = 1;
-  string password = 2;
-}
-
-message AuthenticateRequest {
-  string org_id = 1;
-  // The id to the authmethod in the system being used for authentication.  The auth method must be in the org
-  // being logged in to.
-  string auth_method_id = 2;
-  // This can be "cookie" or "token".  If not provided, "token" will be used.  For now only type "token" is returned.
-  string token_type = 3;
-
-  PasswordCredential password_credential = 4;
-}
-
-message AuthenticateResponse {
-  resources.authtokens.v1.AuthToken item = 1;
-}
-
-message DeauthenticateRequest {
-  string org_id = 1;
-}
-message DeauthenticateResponse {}

internal/proto/local/controller/api/services/v1/role_service.proto

@@ -296,8 +296,7 @@ message AddRolePrincipalsRequest {
   // The version ensures the role hasn't changed since it was last retrieved and if
   // it has the request will fail.
   google.protobuf.UInt32Value version = 4;
-  repeated string user_ids = 5 [json_name="user_ids"];
-  repeated string group_ids = 6 [json_name="group_ids"];
+  repeated string principal_ids = 5 [json_name="principal_ids"];
 }
 
 message AddRolePrincipalsResponse {
@@ -311,8 +310,7 @@ message SetRolePrincipalsRequest {
   // The version ensures the role hasn't changed since it was last retrieved and if
   // it has the request will fail.
   google.protobuf.UInt32Value version = 4;
-  repeated string user_ids = 5 [json_name="user_ids"];
-  repeated string group_ids = 6 [json_name="group_ids"];
+  repeated string principal_ids = 5 [json_name="principal_ids"];
 }
 
 message SetRolePrincipalsResponse {
@@ -326,8 +324,7 @@ message RemoveRolePrincipalsRequest {
   // The version ensures the role hasn't changed since it was last retrieved and if
   // it has the request will fail.
   google.protobuf.UInt32Value version = 4;
-  repeated string user_ids = 5 [json_name="user_ids"];
-  repeated string group_ids = 6 [json_name="group_ids"];
+  repeated string principal_ids = 5 [json_name="principal_ids"];
 }
 
 message RemoveRolePrincipalsResponse {