Johan Brandhorst-Satzkorn
53481146fd
Add well typed attribute options to the authmethods proto definitions, while hiding them from being rendered in the openapiv2 spec.
237 lines
9.6 KiB
Protocol Buffer
237 lines
9.6 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package controller.api.services.v1;
|
|
|
|
option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";
|
|
|
|
import "protoc-gen-openapiv2/options/annotations.proto";
|
|
import "google/api/annotations.proto";
|
|
import "google/api/visibility.proto";
|
|
import "google/protobuf/field_mask.proto";
|
|
import "google/protobuf/struct.proto";
|
|
import "controller/api/resources/authmethods/v1/auth_method.proto";
|
|
import "controller/custom_options/v1/options.proto";
|
|
|
|
option (custom_options.v1.domain) = "auth";
|
|
|
|
service AuthMethodService {
|
|
// GetAuthMethod returns a stored Auth Method if present. The provided request
|
|
// must include the Auth Method id. If missing, malformed or referencing a
|
|
// non existing resource an error is returned.
|
|
rpc GetAuthMethod(GetAuthMethodRequest) returns (GetAuthMethodResponse) {
|
|
option (google.api.http) = {
|
|
get: "/v1/auth-methods/{id}"
|
|
response_body: "item"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Gets a single Auth Method."
|
|
};
|
|
}
|
|
|
|
// ListAuthMethods returns a list of stored Auth Methods which are in the
|
|
// provided scope. The request must include the scope id and if missing,
|
|
// malformed, or referencing a non existing scope, an error is returned.
|
|
rpc ListAuthMethods(ListAuthMethodsRequest) returns (ListAuthMethodsResponse) {
|
|
option (google.api.http) = {
|
|
get: "/v1/auth-methods"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Lists all Auth Methods."
|
|
};
|
|
}
|
|
|
|
// CreateAuthMethod creates and stores an Auth Method in boundary. The
|
|
// provided request must include the scope in which the Auth Method will be
|
|
// created. If the scope id is missing, malformed or referencing a
|
|
// non existing resource an error is returned. If a name is provided that is
|
|
// in use in another Auth Method in the same scope, an error is returned.
|
|
rpc CreateAuthMethod(CreateAuthMethodRequest) returns (CreateAuthMethodResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/auth-methods"
|
|
body: "item"
|
|
response_body: "item"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Creates a single Auth Method."
|
|
};
|
|
}
|
|
|
|
// UpdateAuthMethod updates an existing Auth Method in boundary. The provided
|
|
// Auth Method must not have any read only fields set. The update mask must be
|
|
// included in the request and contain at least 1 mutable field. To unset
|
|
// a field's value, include the field in the update mask and don't set it
|
|
// in the provided user. An error is returned if the Auth Method id is missing
|
|
// or reference a non existing resource. An error is also returned if the
|
|
// request attempts to update the name to one that is already in use by
|
|
// another Auth Method in the parent scope.
|
|
rpc UpdateAuthMethod(UpdateAuthMethodRequest) returns (UpdateAuthMethodResponse) {
|
|
option (google.api.http) = {
|
|
patch: "/v1/auth-methods/{id}"
|
|
body: "item"
|
|
response_body: "item"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Updates an Auth Method."
|
|
};
|
|
}
|
|
|
|
// DeleteAuthMethod removes an Auth Method from Boundary. If the Auth Method id
|
|
// is malformed or not provided an error is returned.
|
|
rpc DeleteAuthMethod(DeleteAuthMethodRequest) returns (DeleteAuthMethodResponse) {
|
|
option (google.api.http) = {
|
|
delete: "/v1/auth-methods/{id}"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Deletes an AuthMethod"
|
|
};
|
|
}
|
|
|
|
// ChangeState changes the state of an Auth Method from Boundary.
|
|
rpc ChangeState(ChangeStateRequest) returns (ChangeStateResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/auth-methods/{id}:change-state"
|
|
body: "*"
|
|
response_body: "item"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Changes the state of an OIDC AuthMethod"
|
|
};
|
|
}
|
|
|
|
// Authenticate validates credentials provided and returns an Auth Token.
|
|
rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/auth-methods/{auth_method_id}:authenticate"
|
|
body: "*"
|
|
};
|
|
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
|
|
summary: "Authenticate a user to an scope and retrieve an authentication token."
|
|
};
|
|
}
|
|
}
|
|
|
|
message GetAuthMethodRequest {
|
|
string id = 1; // @gotags: `class:"public"`
|
|
}
|
|
|
|
message GetAuthMethodResponse {
|
|
resources.authmethods.v1.AuthMethod item = 1;
|
|
}
|
|
|
|
message ListAuthMethodsRequest {
|
|
string scope_id = 1 [json_name = "scope_id"];
|
|
bool recursive = 20 [json_name = "recursive"];
|
|
string filter = 30 [json_name = "filter"];
|
|
}
|
|
|
|
message ListAuthMethodsResponse {
|
|
repeated resources.authmethods.v1.AuthMethod items = 1;
|
|
}
|
|
|
|
message CreateAuthMethodRequest {
|
|
resources.authmethods.v1.AuthMethod item = 1;
|
|
}
|
|
|
|
message CreateAuthMethodResponse {
|
|
string uri = 1; // @gotags: `class:"public"`
|
|
resources.authmethods.v1.AuthMethod item = 2;
|
|
}
|
|
|
|
message UpdateAuthMethodRequest {
|
|
string id = 1; // @gotags: `class:"public"`
|
|
resources.authmethods.v1.AuthMethod item = 2;
|
|
google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
|
|
}
|
|
|
|
message UpdateAuthMethodResponse {
|
|
resources.authmethods.v1.AuthMethod item = 1;
|
|
}
|
|
|
|
message DeleteAuthMethodRequest {
|
|
string id = 1;
|
|
}
|
|
|
|
message DeleteAuthMethodResponse {}
|
|
|
|
// Attributes specific to changing the state of an oidc auth method.
|
|
message OidcChangeStateAttributes {
|
|
// state must be `inactive`, `active-private`, or `active-public`
|
|
string state = 1;
|
|
// This flag is only useful for an oidc auth method. It should not be used
|
|
// unless the oidc provider's config is incorrectly set and is stopping the
|
|
// activation of this auth method.
|
|
bool disable_discovered_config_validation = 2 [json_name = "disable_discovered_config_validation"];
|
|
}
|
|
|
|
message ChangeStateRequest {
|
|
string id = 1; // @gotags: `class:"public"`
|
|
// Version is used to ensure this resource has not changed.
|
|
// The mutation will fail if the version does not match the latest known good version.
|
|
uint32 version = 2;
|
|
|
|
oneof attrs {
|
|
// The attributes specific to this auth method's state.
|
|
google.protobuf.Struct attributes = 4 [(custom_options.v1.subtype) = "default"];
|
|
OidcChangeStateAttributes oidc_change_state_attributes = 5 [(custom_options.v1.subtype) = "oidc", (google.api.field_visibility).restriction = "INTERNAL"];
|
|
}
|
|
}
|
|
|
|
message ChangeStateResponse {
|
|
resources.authmethods.v1.AuthMethod item = 1;
|
|
}
|
|
|
|
// The layout of the struct for "attributes" field in AuthenticateRequest for a password type. This message isn't directly referenced anywhere but is used here to define the expected field names and
|
|
// types.
|
|
message PasswordLoginAttributes {
|
|
string login_name = 1 [json_name = "login_name"];
|
|
string password = 2;
|
|
}
|
|
|
|
// The layout of the struct for "attributes" field in AuthenticateRequest for a oidc type's start command. This message isn't directly referenced anywhere but is used here to define the expected field
|
|
// names and types.
|
|
message OidcStartAttributes {
|
|
// An object which will be marshaled as JSON and roundtripped in the token command call.
|
|
google.protobuf.Struct roundtrip_payload = 1 [json_name = "roundtrip_payload"];
|
|
// Cached marshaled payload. This is not ingressed from the client; anything found will be thrown out.
|
|
string cached_roundtrip_payload = 2;
|
|
}
|
|
|
|
// The layout of the struct for "attributes" field in AuthenticateRequest for a
|
|
// oidc type's token command. This message isn't directly referenced anywhere
|
|
// but is used here to define the expected field names and types.
|
|
message OidcTokenAttributes {
|
|
// The token id for the request. This is the token id that was returned from
|
|
// the oidc type's start command
|
|
string token_id = 1;
|
|
}
|
|
|
|
message AuthenticateRequest {
|
|
// The ID of the Auth Method in the system that should be used for authentication.
|
|
string auth_method_id = 1 [json_name = "auth_method_id"]; // @gotags: `class:"public"`
|
|
// This can be "cookie" or "token". If not provided, "token" will be used. "cookie" activates a split-cookie method where the token is split partially between http-only and regular cookies in order
|
|
// to keep it safe from rogue JS in the browser. Deprecated, use "type" instead.
|
|
string token_type = 2 [json_name = "token_type", deprecated = true]; // @gotags: `class:"public"`
|
|
// This can be "cookie" or "token". If not provided, "token" will be used. "cookie" activates a split-cookie method where the token is split partially between http-only and regular cookies in order
|
|
// to keep it safe from rogue JS in the browser.
|
|
string type = 6 [json_name = "type"]; // @gotags: `class:"public"`
|
|
// Attributes are passed to the Auth Method; the valid keys and values depend on the type of Auth Method as well as the command.
|
|
google.protobuf.Struct attributes = 4 [json_name = "attributes"];
|
|
// The command to perform.
|
|
string command = 5 [json_name = "command"]; // @gotags: `class:"public"`
|
|
|
|
// Deprecated fields
|
|
reserved "credentials";
|
|
reserved 3;
|
|
}
|
|
|
|
message AuthenticateResponse {
|
|
reserved 1, 2; // Old item and token_type
|
|
reserved "item", "token_type";
|
|
// The type of the token returned. Either "cookie" or "token".
|
|
string type = 3; // @gotags: `class:"public"`
|
|
// Valid keys and values depend on the type of Auth Method as well as the command.
|
|
google.protobuf.Struct attributes = 4 [json_name = "attributes"];
|
|
// The command that was performed.
|
|
string command = 5 [json_name = "command"]; // @gotags: `class:"public"`
|
|
}
|