From 3c819e561a5d5db4b7adf8b213671fa0c84a5e36 Mon Sep 17 00:00:00 2001 From: Fabiennne Date: Mon, 23 Mar 2020 10:50:40 +0100 Subject: [PATCH] feat: add proto files --- go.sum | 1 + pkg/admin/api/grpc/generate.go | 1 - pkg/admin/api/proto/admin.proto | 141 +- pkg/admin/api/proto/org.proto | 137 -- pkg/auth/api/grpc/generate.go | 5 + pkg/auth/api/proto/auth.proto | 1169 +++++++++++ pkg/management/api/grpc/generate.go | 6 + pkg/management/api/proto/management.proto | 2164 +++++++++++++++++++++ 8 files changed, 3480 insertions(+), 144 deletions(-) delete mode 100644 pkg/admin/api/proto/org.proto create mode 100644 pkg/auth/api/grpc/generate.go create mode 100644 pkg/auth/api/proto/auth.proto create mode 100644 pkg/management/api/grpc/generate.go create mode 100644 pkg/management/api/proto/management.proto diff --git a/go.sum b/go.sum index 177ae9d7e..ebd09e2dd 100644 --- a/go.sum +++ b/go.sum @@ -298,6 +298,7 @@ github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OK github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc= github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0= +github.com/sethvargo/go-password v0.1.3 h1:18KkbGDkw8SuzeohAbWqBLNSfRQblVwEHOLbPa0PvWM= github.com/sethvargo/go-password v0.1.3/go.mod h1:2tyaaoHK/AlXwh5WWQDYjqQbHcq4cjPj5qb/ciYvu/Q= github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4= github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc= diff --git a/pkg/admin/api/grpc/generate.go b/pkg/admin/api/grpc/generate.go index 8887324db..7632f53f8 100644 --- a/pkg/admin/api/grpc/generate.go +++ b/pkg/admin/api/grpc/generate.go @@ -1,6 +1,5 @@ package grpc -//go:generate protoc -I$GOPATH/src -I../proto -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate --go_out=plugins=grpc:$GOPATH/src ../proto/org.proto //go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/citadel/utils/protoc/protoc-gen-authoption --go_out=plugins=grpc:${GOPATH}/src --grpc-gateway_out=logtostderr=true:${GOPATH}/src --swagger_out=logtostderr=true:. --authoption_out=. ../proto/admin.proto //go:generate mockgen -package api -destination ./mock/admin.proto.mock.go github.com/caos/citadel/admin/api/grpc AdminServiceClient diff --git a/pkg/admin/api/proto/admin.proto b/pkg/admin/api/proto/admin.proto index bc852af12..f187dc913 100644 --- a/pkg/admin/api/proto/admin.proto +++ b/pkg/admin/api/proto/admin.proto @@ -3,10 +3,10 @@ syntax = "proto3"; import "google/api/annotations.proto"; import "google/protobuf/empty.proto"; +import "google/protobuf/timestamp.proto"; import "google/protobuf/struct.proto"; import "protoc-gen-swagger/options/annotations.proto"; import "authoption/options.proto"; -import "github.com/caos/zitadel/pkg/admin/api/proto/org.proto"; package zitadel.admin.api.v1; @@ -56,7 +56,7 @@ service AdminService { } //ORG - rpc IsOrgUnique(zitadel.admin.v1.UniqueOrgRequest) returns (zitadel.admin.v1.UniqueOrgResponse) { + rpc IsOrgUnique(UniqueOrgRequest) returns (UniqueOrgResponse) { option (google.api.http) = { get: "/orgs/_isunique" }; @@ -66,7 +66,7 @@ service AdminService { }; } - rpc GetOrgByID(zitadel.admin.v1.OrgID) returns (zitadel.admin.v1.Org) { + rpc GetOrgByID(OrgID) returns (Org) { option (google.api.http) = { get: "/orgs/{id}" }; @@ -76,7 +76,7 @@ service AdminService { }; } - rpc SearchOrgs(zitadel.admin.v1.OrgSearchRequest) returns (zitadel.admin.v1.OrgSearchResponse) { + rpc SearchOrgs(OrgSearchRequest) returns (OrgSearchResponse) { option (google.api.http) = { post: "/orgs/_search" body: "*" @@ -87,7 +87,7 @@ service AdminService { }; } - rpc SetUpOrg(zitadel.admin.v1.OrgSetUpRequest) returns (zitadel.admin.v1.OrgSetUpResponse) { + rpc SetUpOrg(OrgSetUpRequest) returns (OrgSetUpResponse) { option (google.api.http) = { post: "/orgs/_setup" body: "*" @@ -97,4 +97,133 @@ service AdminService { permission: "iam.write" }; } -} \ No newline at end of file +} + +message OrgID { + string id = 1; +} + +message UniqueOrgRequest { + string name = 1 [(validate.rules).string.min_len = 1]; + string domain = 2 [(validate.rules).string.min_len = 1]; +} + +message UniqueOrgResponse { + bool is_unique = 1; +} + +message Org { + string id = 1; + OrgState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + string name = 5; + string domain = 6; +} + +enum OrgState { + ORGSTATE_UNSPECIFIED = 0; + ORGSTATE_ACTIVE = 1; + ORGSTATE_INACTIVE = 2; +} + +message OrgSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + OrgSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}];; + bool asc = 4; + repeated OrgSearchQuery queries = 5; +} + +message OrgSearchQuery { + OrgSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; + OrgSearchMethod method = 2; + string value = 3; +} + +enum OrgSearchKey { + ORGSEARCHKEY_UNSPECIFIED = 0; + ORGSEARCHKEY_ORG_NAME = 1; + ORGSEARCHKEY_DOMAIN = 2; + ORGSEARCHKEY_STATE = 3; +} + +message OrgSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Org result = 4; +} + +enum OrgSearchMethod { + ORGSEARCHMETHOD_EQUALS = 0; + ORGSEARCHMETHOD_STARTS_WITH = 1; + ORGSEARCHMETHOD_CONTAINS = 2; +} + +message OrgSetUpRequest { + CreateOrgRequest org = 1; + RegisterUserRequest user = 2; +} + +message OrgSetUpResponse { + Org org = 1; + User user = 2; +} + +message RegisterUserRequest { + string email = 1 [(validate.rules).string.email = true]; + string first_name = 2 [(validate.rules).string.min_len = 1]; + string last_name = 3 [(validate.rules).string.min_len = 1]; + string nick_name = 4; + string display_name = 5; + string preferred_language = 6; + Gender gender = 7; + string password = 8 [(validate.rules).string.min_len = 1]; + string org_id = 9 [(validate.rules).string.min_len = 1]; +} + +message User { + string id = 1; + UserState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + string user_name = 5; + string first_name = 6; + string last_name = 7; + string nick_name = 8; + string display_name = 9; + string preferred_language = 10; + Gender gender = 11; + string email = 12; + bool isEmailVerified = 13; + string phone = 14; + bool isPhoneVerified = 15; + string country = 16; + string locality = 17; + string postal_code = 18; + string region = 19; + string street_address = 20; +} + +enum UserState { + USERSTATE_UNSPECIFIED = 0; + USERSTATE_ACTIVE = 1; + USERSTATE_INACTIVE = 2; + USERSTATE_DELETED = 3; + USERSTATE_LOCKED = 4; + USERSTATE_SUSPEND = 5; + USERSTATE_INITIAL= 6; +} + +enum Gender { + GENDER_UNSPECIFIED = 0; + GENDER_FEMALE = 1; + GENDER_MALE = 2; + GENDER_DIVERSE = 3; +} + +message CreateOrgRequest { + string name = 1 [(validate.rules).string.min_len = 1]; + string domain = 2 [(validate.rules).string.min_len = 1]; +} diff --git a/pkg/admin/api/proto/org.proto b/pkg/admin/api/proto/org.proto deleted file mode 100644 index c8a54f441..000000000 --- a/pkg/admin/api/proto/org.proto +++ /dev/null @@ -1,137 +0,0 @@ -syntax = "proto3"; - -import "google/protobuf/timestamp.proto"; -import "validate/validate.proto"; - -package zitadel.admin.v1; - -option go_package = "github.com/caos/zitadel/pkg/admin/api/grpc"; - -message OrgID { - string id = 1; -} - -message UniqueOrgRequest { - string name = 1 [(validate.rules).string.min_len = 1]; - string domain = 2 [(validate.rules).string.min_len = 1]; -} - -message UniqueOrgResponse { - bool is_unique = 1; -} - -message Org { - string id = 1; - OrgState state = 2; - google.protobuf.Timestamp creation_date = 3; - google.protobuf.Timestamp change_date = 4; - string name = 5; - string domain = 6; -} - -enum OrgState { - ORGSTATE_UNSPECIFIED = 0; - ORGSTATE_ACTIVE = 1; - ORGSTATE_INACTIVE = 2; -} - -message OrgSearchRequest { - uint64 offset = 1; - uint64 limit = 2; - OrgSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}];; - bool asc = 4; - repeated OrgSearchQuery queries = 5; -} - -message OrgSearchQuery { - OrgSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; - OrgSearchMethod method = 2; - string value = 3; -} - -enum OrgSearchKey { - ORGSEARCHKEY_UNSPECIFIED = 0; - ORGSEARCHKEY_ORG_NAME = 1; - ORGSEARCHKEY_DOMAIN = 2; - ORGSEARCHKEY_STATE = 3; -} - -message OrgSearchResponse { - uint64 offset = 1; - uint64 limit = 2; - uint64 total_result = 3; - repeated Org result = 4; -} - -enum OrgSearchMethod { - ORGSEARCHMETHOD_EQUALS = 0; - ORGSEARCHMETHOD_STARTS_WITH = 1; - ORGSEARCHMETHOD_CONTAINS = 2; -} - -message OrgSetUpRequest { - CreateOrgRequest org = 1; - RegisterUserRequest user = 2; -} - -message OrgSetUpResponse { - Org org = 1; - User user = 2; -} - -message RegisterUserRequest { - string email = 1 [(validate.rules).string.email = true]; - string first_name = 2 [(validate.rules).string.min_len = 1]; - string last_name = 3 [(validate.rules).string.min_len = 1]; - string nick_name = 4; - string display_name = 5; - string preferred_language = 6; - Gender gender = 7; - string password = 8 [(validate.rules).string.min_len = 1]; - string org_id = 9 [(validate.rules).string.min_len = 1]; -} - -message User { - string id = 1; - UserState state = 2; - google.protobuf.Timestamp creation_date = 3; - google.protobuf.Timestamp change_date = 4; - string user_name = 5; - string first_name = 6; - string last_name = 7; - string nick_name = 8; - string display_name = 9; - string preferred_language = 10; - Gender gender = 11; - string email = 12; - bool isEmailVerified = 13; - string phone = 14; - bool isPhoneVerified = 15; - string country = 16; - string locality = 17; - string postal_code = 18; - string region = 19; - string street_address = 20; -} - -enum UserState { - USERSTATE_UNSPPECIFIED = 0; - USERSTATE_ACTIVE = 1; - USERSTATE_INACTIVE = 2; - USERSTATE_DELETED = 3; - USERSTATE_LOCKED = 4; - USERSTATE_SUSPEND = 5; - USERSTATE_INITIAL= 6; -} - -enum Gender { - GENDER_UNSPECIFIED = 0; - GENDER_FEMALE = 1; - GENDER_MALE = 2; - GENDER_DIVERSE = 3; -} - -message CreateOrgRequest { - string name = 1 [(validate.rules).string.min_len = 1]; - string domain = 2 [(validate.rules).string.min_len = 1]; -} diff --git a/pkg/auth/api/grpc/generate.go b/pkg/auth/api/grpc/generate.go new file mode 100644 index 000000000..37b24a85e --- /dev/null +++ b/pkg/auth/api/grpc/generate.go @@ -0,0 +1,5 @@ +package grpc + +//go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/citadel/utils/protoc/protoc-gen-authoption --go_out=plugins=grpc:$GOPATH/src --grpc-gateway_out=logtostderr=true:$GOPATH/src --swagger_out=logtostderr=true:. --authoption_out=. ../proto/auth.proto +//go:generate mockgen -package api -destination ./mock/auth.proto.mock.go github.com/caos/citadel/auth/api/grpc AuthServiceClient +//go:generate ../../../console/etc/generate-grpc.sh diff --git a/pkg/auth/api/proto/auth.proto b/pkg/auth/api/proto/auth.proto new file mode 100644 index 000000000..225403aaa --- /dev/null +++ b/pkg/auth/api/proto/auth.proto @@ -0,0 +1,1169 @@ +syntax = "proto3"; + +import "google/api/annotations.proto"; +import "google/protobuf/empty.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/timestamp.proto"; +import "protoc-gen-swagger/options/annotations.proto"; +import "authoption/options.proto"; + +package zitadel.auth.api.v1; + +option go_package = "github.com/caos/citadel/auth/api/grpc"; + +option (grpc.gateway.protoc_gen_swagger.options.openapiv2_swagger) = { + info: { + title: "Auth API"; + version: "0.1"; + contact:{ + url: "https://github.com/caos/citadel/auth" + }; + }; + + schemes: HTTPS; + + consumes: "application/json"; + consumes: "application/grpc"; + + produces: "application/json"; + produces: "application/grpc"; +}; + +service AuthService { + // Readiness + rpc Healthz(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + get: "/healthz" + }; + } + + rpc Ready(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + get: "/ready" + }; + } + + rpc Validate(google.protobuf.Empty) returns (google.protobuf.Struct) { + option (google.api.http) = { + get: "/validate" + }; + } + + // Authorization + rpc GetUserAgent(UserAgentID) returns (UserAgent) { + option (google.api.http) = { + get: "/useragents/{id}" + }; + } + + rpc CreateUserAgent(UserAgentCreation) returns (UserAgent) { + option (google.api.http) = { + post: "/useragents" + body: "*" + }; + } + + rpc RevokeUserAgent(UserAgentID) returns (UserAgent) { + option (google.api.http) = { + put: "/useragents/{id}" + body: "*" + }; + } + + rpc CreateAuthSession(AuthSessionCreation) returns (AuthSessionResponse) { + option (google.api.http) = { + post: "/useragents/{agent_id}/authsessions" + body: "*" + }; + } + + rpc GetAuthSession(AuthSessionID) returns (AuthSessionResponse) { + option (google.api.http) = { + get: "/useragents/{agent_id}/authsessions/{id}" + }; + } + + rpc GetAuthSessionByTokenID(TokenID) returns (AuthSessionView) { + option (google.api.http) = { + get: "/tokens/{id}/authsession" + }; + } + + rpc SelectUser(SelectUserRequest) returns (AuthSessionResponse) { + option (google.api.http) = { + put: "/useragents/{agent_id}/authsessions/{auth_session_id}/_selectuser" + body: "*" + }; + } + + rpc VerifyUser(VerifyUserRequest) returns (AuthSessionResponse) { + option (google.api.http) = { + put: "/useragents/{agent_id}/authsessions/{auth_session_id}/_verifyuser" + body: "*" + }; + } + + rpc VerifyPassword(VerifyPasswordRequest) returns (AuthSessionResponse) { + option (google.api.http) = { + put: "/useragents/{agent_id}/authsessions/{auth_session_id}/_verifypassword" + body: "*" + }; + } + + rpc VerifyMfa(VerifyMfaRequest) returns (AuthSessionResponse) { + option (google.api.http) = { + put: "/useragents/{agent_id}/authsessions/{auth_session_id}/_verifymfa" + body: "*" + }; + } + + rpc GetUserAgentSessions(UserAgentID) returns (UserSessions) { + option (google.api.http) = { + get: "/useragents/{id}/usersessions" + }; + } + + rpc GetUserSession(UserSessionID) returns (UserSession) { + option (google.api.http) = { + get: "/useragents/{agent_id}/usersessions/{id}" + }; + } + + rpc GetMyUserSessions(google.protobuf.Empty) returns (UserSessionViews) { + option (google.api.http) = { + get: "/me/usersessions" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc TerminateUserSession(UserSessionID) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/useragents/{agent_id}/usersessions/{id}" + }; + } + + rpc CreateToken(CreateTokenRequest) returns (Token) { + option (google.api.http) = { + post: "/useragents/{agent_id}/authsessions/{auth_session_id}/tokens" + body: "*" + }; + } + + //User + rpc IsUserUnique(UniqueUserRequest) returns (UniqueUserResponse) { + option (google.api.http) = { + get: "/users/_isunique" + }; + } + + rpc RegisterUser(RegisterUserRequest) returns (User) { + option (google.api.http) = { + post: "/users/_register" + body: "*" + }; + } + + rpc RegisterUserWithExternal(RegisterUserExternalIDPRequest) returns (User) { + option (google.api.http) = { + post: "/users/_externalregister" + body: "*" + }; + } + + rpc GetMyUserProfile(google.protobuf.Empty) returns (UserProfile) { + option (google.api.http) = { + get: "/users/me/profile" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc UpdateMyUserProfile(UpdateUserProfileRequest) returns (UserProfile) { + option (google.api.http) = { + put: "/users/me/profile" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc GetMyUserEmail(google.protobuf.Empty) returns (UserEmail) { + option (google.api.http) = { + get: "/users/me/email" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc ChangeMyUserEmail(UpdateUserEmailRequest) returns (UserEmail) { + option (google.api.http) = { + put: "/users/me/email" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc VerifyMyUserEmail(VerifyMyUserEmailRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/me/email/_verify" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc VerifyUserEmail(VerifyUserEmailRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/email/_verify" + body: "*" + }; + + } + + rpc ResendMyEmailVerificationMail(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/me/email/_resendverification" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc ResendEmailVerificationMail(UserID) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/email/_resendverification" + body: "*" + }; + + } + + rpc GetMyUserPhone(google.protobuf.Empty) returns (UserPhone) { + option (google.api.http) = { + get: "/users/me/phone" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc ChangeMyUserPhone(UpdateUserPhoneRequest) returns (UserPhone) { + option (google.api.http) = { + put: "/users/me/phone" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc VerifyMyUserPhone(VerifyUserPhoneRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/me/phone/_verify" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc ResendMyPhoneVerificationCode(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/me/phone/_resendverification" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc GetMyUserAddress(google.protobuf.Empty) returns (UserAddress) { + option (google.api.http) = { + get: "/users/me/address" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc UpdateMyUserAddress(UpdateUserAddressRequest) returns (UserAddress) { + option (google.api.http) = { + put: "/users/me/address" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc GetMyMfas(google.protobuf.Empty) returns (MultiFactors) { + option (google.api.http) = { + get: "/users/me/mfas" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + //Password + + rpc SetMyPassword(PasswordRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + put: "/users/me/passwords" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc RequestPasswordReset(ResetPasswordRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/passwords/_requestpwreset" + body: "*" + }; + } + + rpc PasswordReset(ResetPassword) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/passwords/_resetpw" + body: "*" + }; + } + + rpc ChangeMyPassword(PasswordChange) returns (google.protobuf.Empty) { + option (google.api.http) = { + put: "/users/me/passwords/_change" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + // MFA + rpc AddMfaOTP(google.protobuf.Empty) returns (MfaOtpResponse) { + option (google.api.http) = { + post: "/users/me/mfa/otp" + body: "*" + }; + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc VerifyMfaOTP(VerifyMfaOtp) returns (MfaOtpResponse) { + option (google.api.http) = { + put: "/users/me/mfa/otp/_verify" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc RemoveMfaOTP(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/users/me/mfa/otp" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc SkipMfaInit(SkipMfaInitRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{user_id}/mfa/_skipinit" + body: "*" + }; + } + + + //TODO: Remove func only for tests + rpc GetUserByID(UserID) returns (User) { + option (google.api.http) = { + get: "/users/{id}" + }; + } + + //Application + rpc GetApplicationByID(ApplicationID) returns (Application) { + option (google.api.http) = { + get: "/applications/{id}" + }; + } + + rpc SearchApplications(ApplicationSearchRequest) returns (ApplicationSearchResponse) { + option (google.api.http) = { + post: "/applications/_search" + body: "*" + }; + } + + rpc AuthorizeApplication(ApplicationAuthorizeRequest) returns (Application) { + option (google.api.http) = { + post: "/applications/_authorize" + body: "*" + }; + } + + //Grant + rpc SearchGrant(GrantSearchRequest) returns (GrantSearchResponse) { + option (google.api.http) = { + post: "/grants/_search" + body: "*" + }; + } + + rpc SearchMyProjectOrgs(MyProjectOrgSearchRequest) returns (MyProjectOrgSearchResponse) { + option (google.api.http) = { + post: "/global/projectorgs/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + rpc IsIamAdmin(google.protobuf.Empty) returns (IsAdminResponse) { + option (google.api.http) = { + get: "/global/_isiamadmin" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } + + //Permission + rpc GetMyCitadelPermissions(google.protobuf.Empty) returns (MyPermissions) { + option (google.api.http) = { + get: "/permissions/zitadel/me" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "authenticated" + }; + } +} + + +message SessionRequest { + string user_id = 1; + BrowserInformation browser_info = 2; +} + +message UserAgent { + string id = 1; + BrowserInformation browser_info = 2; + UserAgentState state = 3; +} + + +enum UserAgentState { + USERAGENTSTATE_UNSPECIFIED = 0; + USERAGENTSTATE_ACTIVE = 1; + USERAGENTSTATE_TERMINATED = 2; +} + +message UserAgentID { + string id = 1; +} + +message UserAgentCreation { + BrowserInformation browser_info = 1 [(validate.rules).message.required = true]; +} + +message UserAgents { + repeated UserAgent sessions = 1; +} + +message AuthSessionCreation { + string agent_id = 1 [(validate.rules).string.min_len = 1]; + AuthSessionType type = 2; + BrowserInformation browser_info = 3 [(validate.rules).message.required = true]; + string client_id = 4 [(validate.rules).string.min_len = 1]; + string redirect_uri = 5 [(validate.rules).string.min_len = 1]; + string state = 6; + Prompt prompt = 7; + repeated string auth_context_class_reference = 8; + repeated string ui_locales = 9; + string login_hint = 10; + uint32 max_age = 11; + oneof type_info { + AuthRequestOIDC oidc = 12; + } + string preselected_user_id = 13; +} + +message AuthSessionResponse { + string agent_id = 1; + string id = 2; + AuthSessionType type = 3; + string client_id = 4; + string redirect_uri = 5; + string state = 6; + Prompt prompt = 7; + repeated string auth_context_class_reference = 8; + repeated string ui_locales = 9; + string login_hint = 10; + uint32 max_age = 11; + oneof type_info { + AuthRequestOIDC oidc = 12; + } + repeated NextStep possible_steps = 13; + repeated string project_client_ids = 14; + UserSession user_session = 15; +} + +message AuthSessionView { + string agent_id = 1; + string auth_session_id = 2; + AuthSessionType type = 3; + string client_id = 4; + string user_session_id = 5; + repeated string project_client_ids = 6; + string token_id = 7; + google.protobuf.Timestamp token_expiration = 8; + string user_id = 9; +} + +message TokenID { + string id = 1; +} + +message UserSessionID { + string id = 1; + string agent_id = 2; +} + +message UserSessions { + repeated UserSession user_sessions = 1; +} + +message UserSession { + string id = 1; + string agent_id = 2; + UserSessionState auth_state = 3; + AuthUser user = 4; + bool password_verified = 5; + MfaType mfa = 6; + bool mfa_verified = 7; + google.protobuf.Timestamp auth_time = 8; +} + +message UserSessionViews { + repeated UserSessionView user_sessions = 1; +} +message UserSessionView { + string id = 1; + string agent_id = 2; + UserSessionState auth_state = 3; + string user_id = 4; + string user_name = 5; +} + +message AuthUser { + string user_id = 1; + string user_name = 2; +} + +enum UserSessionState { + USERSESSIONSTATE_UNSPECIFIED = 0; + USERSESSIONSTATE_ACTIVE = 1; + USERSESSIONSTATE_TERMINATED = 2; +} + +message AuthSessionID { + string id = 1; + string agent_id = 2; + BrowserInformation browser_info = 3; +} + +message SelectUserRequest { + string agent_id = 1; + string auth_session_id = 2; + string user_session_id = 3; + BrowserInformation browser_info = 4 [(validate.rules).message.required = true]; +} + +message VerifyUserRequest { + string agent_id = 1 [(validate.rules).string.min_len = 1]; + string auth_session_id = 2 [(validate.rules).string.min_len = 1]; + string user_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + BrowserInformation browser_info = 4 [(validate.rules).message.required = true]; +} + +message VerifyPasswordRequest { + string agent_id = 1 [(validate.rules).string.min_len = 1]; + string auth_session_id = 2 [(validate.rules).string.min_len = 1]; + string password = 3 [(validate.rules).string = {min_len: 1, max_len: 72}]; + BrowserInformation browser_info = 4 [(validate.rules).message.required = true]; +} + +message VerifyMfaRequest { + string agent_id = 1 [(validate.rules).string.min_len = 1]; + string auth_session_id = 2 [(validate.rules).string.min_len = 1]; + BrowserInformation browser_info = 3; + oneof mfa { + AuthSessionMultiFactorOTP otp = 4; + } +} + +message AuthSessionMultiFactorOTP { + string code = 1 [(validate.rules).string = {max_len: 200}]; +} + +message NextStep { + NextStepType type = 1; + oneof data { + LoginData login = 2; + PasswordData password = 3; + MfaVerifyData mfa_verify = 4; + MfaPromptData mfa_prompt = 5; + ChooseUserData choose_user = 6; + } +} + +enum NextStepType { + NEXTSTEP_UNSPECIFIED = 0; + NEXTSTEP_LOGIN = 1; + NEXTSTEP_PASSWORD = 2; + NEXTSTEP_CHANGE_PASSWORD = 3; + NEXTSTEP_MFA_PROMPT = 4; //TODO: ? + NEXTSTEP_MFA_INIT_CHOICE = 5; //TODO: ? + NEXTSTEP_MFA_INIT_CREATE = 6; + NEXTSTEP_MFA_INIT_VERIFY = 7; + NEXTSTEP_MFA_INIT_DONE = 8; + NEXTSTEP_MFA_VERIFY = 9; + NEXTSTEP_MFA_VERIFY_ASYNC = 10; + NEXTSTEP_VERIFY_EMAIL = 11; + NEXTSTEP_REDIRECT_TO_CALLBACK = 12; + NEXTSTEP_INIT_PASSWORD = 13; + NEXTSTEP_CHOOSE_USER = 14; +} + +message LoginData { + string err_msg = 1; +} + +message PasswordData { + string err_msg = 1; + uint32 failure_count = 2; +} + +message MfaVerifyData { + string err_msg = 1; + uint32 failure_count = 2; + repeated MfaType mfa_providers = 3; +} + +message MfaPromptData { + bool required = 1; + repeated MfaType mfa_providers = 2; +} + +message ChooseUserData { + repeated ChooseUser users = 1; +} + +message ChooseUser { + string user_session_id = 1; + string user_id = 2; + string user_name = 3; + UserSessionState user_session_state = 4; +} + +message SkipMfaInitRequest { + string user_id = 1; +} + +enum AuthSessionType { + AUTHSESSIONTYPE_UNSPECIFIED = 0; //TODO: necessary? + AUTHSESSIONTYPE_OIDC = 1; + AUTHSESSIONTYPE_SAML = 2; +} + +message BrowserInformation { + string user_agent = 1; + IP remote_ip = 2 [(validate.rules).message.required = true]; + string accept_language = 3; +} + +message IP { + string V4 = 1; + string V6 = 2; +} + +enum Prompt { + PROMPT_UNSPECIFIED = 0; + PROMPT_NONE = 1; + PROMPT_LOGIN = 2; + PROMPT_CONSENT = 3; + PROMPT_SELECT_ACCOUNT = 4; +} + +message AuthRequestOIDC { + repeated string scope = 1; + OIDCResponseType response_type = 2; + string nonce = 3; + CodeChallenge code_challenge = 4; +} + +enum OIDCResponseType { + OIDCRESPONSETYPE_CODE = 0; + OIDCRESPONSETYPE_ID_TOKEN = 1; + OIDCRESPONSETYPE_ID_TOKEN_TOKEN = 2; +} + +message CodeChallenge { + string challenge = 1; + CodeChallengeMethod method = 2; +} + +enum CodeChallengeMethod { + CODECHALLENGEMETHOD_PLAIN = 0; + CODECHALLENGEMETHOD_S256 = 1; +} + +message UserID { + string id = 1; +} + +message UniqueUserRequest { + string user_name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string email = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message UniqueUserResponse { + bool is_unique = 1; +} + + +message RegisterUserRequest { + string email = 1 [(validate.rules).string = {min_len: 1, max_len: 200, email: true}]; + string first_name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string last_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string nick_name = 4 [(validate.rules).string = {max_len: 200}]; + string display_name = 5 [(validate.rules).string = {max_len: 200}]; + string preferred_language = 6 [(validate.rules).string = {max_len: 200}]; + Gender gender = 7; + string password = 8 [(validate.rules).string = {min_len: 1, max_len: 72}]; + string org_id = 9 [(validate.rules).string.min_len = 1]; +} + +message RegisterUserExternalIDPRequest { + string email = 1 [(validate.rules).string = {min_len: 1, max_len: 200, email: true}]; + string first_name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string last_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string nick_name = 4 [(validate.rules).string = {max_len: 200}]; + string display_name = 5 [(validate.rules).string = {max_len: 200}]; + string preferred_language = 6 [(validate.rules).string = {max_len: 200}]; + Gender gender = 7; + IDPProvider idp_provider = 8; + string org_id = 9 [(validate.rules).string.min_len = 1]; +} + +message IDPProvider { + string provider = 8; + string externalIdpID = 9; +} + +message User { + string id = 1; + UserState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp activation_date = 4; + google.protobuf.Timestamp change_date = 5; + google.protobuf.Timestamp last_login = 6; + google.protobuf.Timestamp password_changed = 7; + string user_name = 8; + string first_name = 9; + string last_name = 10; + string nick_name = 11; + string display_name = 12; + string preferred_language = 13; + Gender gender = 14; + string email = 15; + bool is_email_verified = 16; + string phone = 17; + bool is_phone_verified = 18; + string country = 19; + string locality = 20; + string postal_code = 21; + string region = 22; + string street_address = 23; + bool password_change_required = 24; +} + +enum UserState { + USERSTATE_UNSPECIEFIED = 0; + USERSTATE_ACTIVE = 1; + USERSTATE_INACTIVE = 2; + USERSTATE_DELETED = 3; + USERSTATE_LOCKED = 4; + USERSTATE_SUSPEND = 5; + USERSTATE_INITIAL= 6; +} + +enum Gender { + GENDER_UNSPECIFIED = 0; + GENDER_FEMALE = 1; + GENDER_MALE = 2; + GENDER_DIVERSE = 3; +} + +message UserProfile { + string id = 1; + string user_name = 2; + string first_name = 3; + string last_name = 4; + string nick_name = 5; + string display_name = 6; + string preferred_language = 7; + Gender gender = 8; +} + +message UpdateUserProfileRequest { + string first_name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string last_name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string nick_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string display_name = 4 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string preferred_language = 5 [(validate.rules).string = {min_len: 1, max_len: 200}]; + Gender gender = 6; +} + +message UserEmail { + string id = 1; + string email = 2; + bool isEmailVerified = 3; +} + +message VerifyMyUserEmailRequest { + string code = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message VerifyUserEmailRequest { + string id = 1; + string code = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message UpdateUserEmailRequest { + string email = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message UserPhone { + string id = 1; + string phone = 2; + bool is_phone_verified = 3; +} + +message UpdateUserPhoneRequest { + string phone = 1 [(validate.rules).string = {min_len: 1, max_len: 20}]; +} + +message VerifyUserPhoneRequest { + string code = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message UserAddress { + string id = 1; + string country = 2; + string locality = 3; + string postal_code = 4; + string region = 5; + string street_address = 6; +} + +message UpdateUserAddressRequest { + string country = 1 [(validate.rules).string = {max_len: 200}]; + string locality = 2 [(validate.rules).string = {max_len: 200}]; + string postal_code = 3 [(validate.rules).string = {max_len: 200}]; + string region = 4 [(validate.rules).string = {max_len: 200}]; + string street_address = 5 [(validate.rules).string = {max_len: 200}]; +} + +message PasswordID{ + string id = 1; +} + +message PasswordRequest { + string password = 1 [(validate.rules).string = {min_len: 1, max_len: 72}]; +} + +message ResetPasswordRequest { + string user_name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; + NotificationType type = 2; +} + +message ResetPassword { + string id = 1 [(validate.rules).string.min_len = 1]; + string code = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string new_password = 3 [(validate.rules).string = {min_len: 1, max_len: 72}]; +} + +message SetPasswordNotificationRequest { + string id = 1; + NotificationType type = 2; +} + +enum NotificationType { + NOTIFICATIONTYPE_EMAIL = 0; + NOTIFICATIONTYPE_SMS = 1; +} + +message PasswordChange { + string old_password = 1 [(validate.rules).string = {min_len: 1, max_len: 72}]; + string new_password = 2 [(validate.rules).string = {min_len: 1, max_len: 72}]; +} + +enum MfaType { + MFATYPE_UNSPECIFIED = 0; + MFATYPE_SMS = 1; + MFATYPE_OTP = 2; +} + +message VerifyMfaOtp { + string code = 1; +} + +message MultiFactors { + repeated MultiFactor mfas = 1; +} + +message MultiFactor { + MfaType type = 1; + MFAState state = 2; +} + +message MfaOtpResponse { + string user_id = 1; + string url = 2; + string secret = 3; + MFAState state = 4; +} + +enum MFAState { + MFASTATE_UNSPECIFIED = 0; + MFASTATE_NOT_READY = 1; + MFASTATE_READY = 2; + MFASTATE_REMOVED = 3; +} + +message ApplicationID { + string id = 1; +} + +message Application { + string id = 1; + AppState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + string name = 5; + oneof app_config { + OIDCConfig oidc_config = 8; + } +} + + +enum AppState { + APPSTATE_UNSPECIFIED = 0; + APPSTATE_ACTIVE = 1; + APPSTATE_INACTIVE = 2; + APPSTATE_DELETED = 3; +} + + +message OIDCConfig { + repeated string redirect_uris = 1; + repeated OIDCResponseType response_types = 2; + repeated OIDCGrantType grant_types = 3; + OIDCApplicationType application_type = 4; + string client_secret = 5; + string client_id = 6; + OIDCAuthMethodType auth_method_type = 7; + repeated string post_logout_redirect_uris = 8; +} + +enum OIDCGrantType { + OIDCGRANTTYPE_AUTHORIZATION_CODE = 0; + OIDCGRANTTYPE_GRANT_TYPE_NONE = 1; + OIDCGRANTTYPE_REFRESH_TOKEN = 2; +} + +enum OIDCApplicationType { + OIDCAPPLICATIONTYPE_WEB = 0; + OIDCAPPLICATIONTYPE_USER_AGENT = 1; + OIDCAPPLICATIONTYPE_NATIVE = 2; +} + +enum OIDCAuthMethodType { + OIDCAUTHMETHODTYPE_BASIC = 0; + OIDCAUTHMETHODTYPE_POST = 1; + OIDCAUTHMETHODTYPE_NONE = 2; +} + +message ApplicationSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + ApplicationSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}];; + bool asc = 4; + repeated ApplicationSearchQuery queries = 5; +} + +message ApplicationSearchQuery { + ApplicationSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; + SearchMethod method = 2; + string value = 3; +} + +enum ApplicationSearchKey { + APPLICATIONSEARCHKEY_UNSPECIFIED = 0; + APPLICATIONSEARCHKEY_APP_TYPE = 1; + APPLICATIONSEARCHKEY_STATE = 2; + APPLICATIONSEARCHKEY_CLIENT_ID = 3; + APPLICATIONSEARCHKEY_APP_NAME = 4; + APPLICATIONSEARCHKEY_PROJECT_ID = 5; +} + +message ApplicationSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Application result = 4; +} + +enum SearchMethod { + SEARCHMETHOD_EQUALS = 0; + SEARCHMETHOD_STARTS_WITH = 1; + SEARCHMETHOD_CONTAINS = 2; +} + +message ApplicationAuthorizeRequest { + oneof auth { + OIDCClientAuth oidc_client_auth = 1; + } +} + +message OIDCClientAuth { + string client_id = 1; + string client_secret = 2; +} + + +message GrantSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + GrantSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}];; + bool asc = 4; + repeated GrantSearchQuery queries = 5; +} + +message GrantSearchQuery { + GrantSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; + SearchMethod method = 2; + string value = 3; +} + +enum GrantSearchKey { + GRANTSEARCHKEY_UNSPECIFIED = 0; + GRANTSEARCHKEY_ORG_ID = 1; + GRANTSEARCHKEY_PROJECT_ID = 2; + GRANTSEARCHKEY_USER_ID = 3; +} + +message GrantSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Grant result = 4; +} + +message Grant { + string OrgId = 1; + string ProjectId = 2; + string UserId = 3; + repeated string Roles = 4; + string OrgName = 5; +} + +message MyProjectOrgSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + bool asc = 4; + repeated MyProjectOrgSearchQuery queries = 5; +} + +message MyProjectOrgSearchQuery { + MyProjectOrgSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; + SearchMethod method = 2; + string value = 3; +} + +enum MyProjectOrgSearchKey { + MYPROJECTORGSEARCHKEY_UNSPECIFIED = 0; + MYPROJECTORGSEARCHKEY_ORG_NAME = 1; +} + +message MyProjectOrgSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Org result = 4; +} + +message IsAdminResponse { + bool is_admin = 1; +} + +message Org { + string id = 1; + string name = 2; +} + +message CreateTokenRequest { + string agent_id = 1 [(validate.rules).string.min_len = 1]; + string auth_session_id = 2 [(validate.rules).string.min_len = 1]; +} + +message Token { + string id = 1; + google.protobuf.Timestamp expiration = 8; +} + +message MyPermissions { + repeated string permissions = 1; +} + + +message VerifyUserInitRequest { + string id = 1; + string code = 2; + string password = 3; +} diff --git a/pkg/management/api/grpc/generate.go b/pkg/management/api/grpc/generate.go new file mode 100644 index 000000000..9db2fd358 --- /dev/null +++ b/pkg/management/api/grpc/generate.go @@ -0,0 +1,6 @@ +package grpc + +//go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/citadel/utils/protoc/protoc-gen-authoption --go_out=plugins=grpc:$GOPATH/src --grpc-gateway_out=logtostderr=true:$GOPATH/src --swagger_out=logtostderr=true:. --authoption_out=. ../proto/management.proto +//go:generate mockgen -package api -destination ./mock/management.proto.mock.go github.com/caos/citadel/management/api/grpc ManagementServiceClient + +//go:generate ../../../console/etc/generate-grpc.sh diff --git a/pkg/management/api/proto/management.proto b/pkg/management/api/proto/management.proto new file mode 100644 index 000000000..0b7ed3da7 --- /dev/null +++ b/pkg/management/api/proto/management.proto @@ -0,0 +1,2164 @@ +syntax = "proto3"; + +import "google/api/annotations.proto"; +import "google/protobuf/empty.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/timestamp.proto"; +import "protoc-gen-swagger/options/annotations.proto"; +import "validate/validate.proto"; +import "google/protobuf/descriptor.proto"; +import "authoption/options.proto"; + +package caos.citadel.management.api.v1; + +option go_package = "github.com/caos/citadel/management/api/grpc"; + +option (grpc.gateway.protoc_gen_swagger.options.openapiv2_swagger) = { + info: { + title: "Management API"; +version: "0.1"; +contact:{ +url: "https://github.com/caos/citadel/management" +}; +}; + +schemes: HTTPS; + +consumes: "application/json"; +consumes: "application/grpc"; + +produces: "application/json"; +produces: "application/grpc"; +}; + +service ManagementService { + //READINESS + rpc Healthz(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + get: "/healthz" + }; + } + + rpc Ready(google.protobuf.Empty) returns (google.protobuf.Empty) { + option (google.api.http) = { + get: "/ready" + }; + } + + rpc Validate(google.protobuf.Empty) returns (google.protobuf.Struct) { + option (google.api.http) = { + get: "/validate" + }; + } + + //USER + rpc GetUserByID(UserID) returns (User) { + option (google.api.http) = { + get: "/users/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc GetUserByEmailGlobal(UserEmailID) returns (User) { + option (google.api.http) = { + get: "/global/users/email/{email}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc SearchUsers(UserSearchRequest) returns (UserSearchResponse) { + option (google.api.http) = { + post: "/users/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc IsUserUnique(UniqueUserRequest) returns (UniqueUserResponse) { + option (google.api.http) = { + get: "/users/_isunique" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc CreateUser(CreateUserRequest) returns (User) { + option (google.api.http) = { + post: "/users" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc DeactivateUser(UserID) returns (User) { + option (google.api.http) = { + put: "/users/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc ReactivateUser(UserID) returns (User) { + option (google.api.http) = { + put: "/users/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc LockUser(UserID) returns (User) { + option (google.api.http) = { + put: "/users/{id}/_lock" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc UnlockUser(UserID) returns (User) { + option (google.api.http) = { + put: "/users/{id}/_unlock" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc DeleteUser(UserID) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/users/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.delete" + }; + } + + rpc UserChanges(ChangeRequest) returns (Changes) { + option (google.api.http) = { + get: "/users/{id}/changes" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc ApplicationChanges(ChangeRequest) returns (Changes) { + option (google.api.http) = { + get: "/applications/{id}/changes" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.read" + }; + } + + rpc OrgChanges(ChangeRequest) returns (Changes) { + option (google.api.http) = { + get: "/orgs/{id}/changes" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.read" + }; + } + + rpc ProjectChanges(ChangeRequest) returns (Changes) { + option (google.api.http) = { + get: "/projects/{id}/changes" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.read" + }; + } + + //USER_PROFILE + rpc GetUserProfile(UserID) returns (UserProfile) { + option (google.api.http) = { + get: "/users/{id}/profile" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc UpdateUserProfile(UpdateUserProfileRequest) returns (UserProfile) { + option (google.api.http) = { + put: "/users/{id}/profile" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + //USER_EMAIL + rpc GetUserEmail(UserID) returns (UserEmail) { + option (google.api.http) = { + get: "/users/{id}/email" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc ChangeUserEmail(UpdateUserEmailRequest) returns (UserEmail) { + option (google.api.http) = { + put: "/users/{id}/email" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc ResendEmailVerificationMail(UserID) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/email/_resendverification" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + //USER_PHONE + rpc GetUserPhone(UserID) returns (UserPhone) { + option (google.api.http) = { + get: "/users/{id}/phone" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc ChangeUserPhone(UpdateUserPhoneRequest) returns (UserPhone) { + option (google.api.http) = { + put: "/users/{id}/phone" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + rpc ResendPhoneVerificationCode(UserID) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/phone/_resendverification" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + //USER_ADDRESS + rpc GetUserAddress(UserID) returns (UserAddress) { + option (google.api.http) = { + get: "/users/{id}/address" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + rpc UpdateUserAddress(UpdateUserAddressRequest) returns (UserAddress) { + option (google.api.http) = { + put: "/users/{id}/address" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + //MFA + rpc GetUserMfas(UserID) returns (MultiFactors) { + option (google.api.http) = { + get: "/users/{id}/mfas" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.read" + }; + } + + //PASSWORD + // Sends an Notification (Email/SMS) with a password reset Link + rpc SendSetPasswordNotification(SetPasswordNotificationRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/_sendsetpwnotify" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + // A Manager is only allowed to set an initial password, on the next login the user has to change his password + rpc SetInitialPassword(PasswordRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/users/{id}/_setinitialpw" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.write" + }; + } + + + //PASSWORD_COMPLEXITY_POLICY + rpc GetPasswordComplexityPolicy(google.protobuf.Empty) returns (PasswordComplexityPolicy) { + option (google.api.http) = { + get: "/policies/passwords/complexity" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.read" + }; + } + + rpc CreatePasswordComplexityPolicy(PasswordComplexityPolicyCreate) returns (PasswordComplexityPolicy) { + option (google.api.http) = { + post: "/policies/passwords/complexity" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc UpdatePasswordComplexityPolicy(PasswordComplexityPolicyUpdate) returns (PasswordComplexityPolicy) { + option (google.api.http) = { + put: "/policies/passwords/complexity/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc DeletePasswordComplexityPolicy(PasswordComplexityPolicyID) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/policies/passwords/complexity/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.delete" + }; + } + + //PASSWORD_AGE_POLICY + rpc GetPasswordAgePolicy(google.protobuf.Empty) returns (PasswordAgePolicy) { + option (google.api.http) = { + get: "/policies/passwords/age" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.read" + }; + } + + rpc CreatePasswordAgePolicy(PasswordAgePolicyCreate) returns (PasswordAgePolicy) { + option (google.api.http) = { + post: "/policies/passwords/age" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc UpdatePasswordAgePolicy(PasswordAgePolicyUpdate) returns (PasswordAgePolicy) { + option (google.api.http) = { + put: "/policies/passwords/age/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc DeletePasswordAgePolicy(PasswordAgePolicyID) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/policies/passwords/age/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.delete" + }; + } + + //PASSWORD_LOCKOUT_POLICY + rpc GetPasswordLockoutPolicy(google.protobuf.Empty) returns (PasswordLockoutPolicy) { + option (google.api.http) = { + get: "/policies/passwords/lockout" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.read" + }; + } + + rpc CreatePasswordLockoutPolicy(PasswordLockoutPolicyCreate) returns (PasswordLockoutPolicy) { + option (google.api.http) = { + post: "/policies/passwords/lockout" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc UpdatePasswordLockoutPolicy(PasswordLockoutPolicyUpdate) returns (PasswordLockoutPolicy) { + option (google.api.http) = { + put: "/policies/passwords/lockout/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.write" + }; + } + + rpc DeletePasswordLockoutPolicy(PasswordLockoutPolicyID) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/policies/passwords/lockout/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "policy.delete" + }; + } + + //ORG + rpc GetOrgByID(OrgID) returns (Org) { + option (google.api.http) = { + get: "/orgs/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.read" + }; + } + + rpc GetOrgByDomainGlobal(OrgDomain) returns (Org) { + option (google.api.http) = { + get: "/global/orgs/domain/{domain}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.read" + }; + } + + rpc DeactivateOrg(OrgID) returns (Org) { + option (google.api.http) = { + put: "/orgs/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.write" + }; + } + + rpc ReactivateOrg(OrgID) returns (Org) { + option (google.api.http) = { + put: "/orgs/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.write" + }; + } + + //ORG_MEMBERS + rpc GetOrgMemberRoles(google.protobuf.Empty) returns (OrgMemberRoles) { + option (google.api.http) = { + get: "/orgs/members/roles" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.member.read" + }; + } + + rpc AddOrgMember(AddOrgMemberRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/orgs/{org_id}/members" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.member.write" + }; + } + + rpc ChangeOrgMember(ChangeOrgMemberRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + put: "/orgs/{org_id}/members/{user_id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.member.write" + }; + } + + rpc RemoveOrgMember(RemoveOrgMemberRequest) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/orgs/{org_id}/members/{user_id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.member.delete" + }; + } + + rpc SearchOrgMembers(OrgMemberSearchRequest) returns (OrgMemberSearchResponse) { + option (google.api.http) = { + post: "/orgs/{org_id}/members/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "org.member.read" + }; + } + + //PROJECTS + rpc SearchProjects(ProjectSearchRequest) returns (ProjectSearchResponse) { + option (google.api.http) = { + post: "/projects/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.read" + }; + } + + rpc ProjectByID(ProjectID) returns (Project) { + option (google.api.http) = { + get: "/projects/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.read" + check_field_name: "Id" + }; + } + + rpc CreateProject(ProjectCreateRequest) returns (Project) { + option (google.api.http) = { + post: "/projects" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.write" + }; + } + + rpc UpdateProject(ProjectUpdateRequest) returns (Project) { + option (google.api.http) = { + put: "/projects/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.write" + check_field_name: "Id" + }; + } + + rpc DeactivateProject(ProjectID) returns (Project) { + option (google.api.http) = { + put: "/projects/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.write" + check_field_name: "Id" + }; + } + + rpc ReactivateProject(ProjectID) returns (Project) { + option (google.api.http) = { + put: "/projects/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.write" + check_field_name: "Id" + }; + } + + //GRANTED_PROJECT_GRANTS + rpc GetGrantedProjectGrantByID(GrantedGrantID) returns (ProjectGrant) { + option (google.api.http) = { + get: "/grants/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.read" + }; + } + + //PROJECT_MEMBERS + rpc GetProjectMemberRoles(google.protobuf.Empty) returns (ProjectMemberRoles) { + option (google.api.http) = { + get: "/projects/members/roles" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.member.read" + }; + } + + rpc SearchProjectMembers(ProjectMemberSearchRequest) returns (ProjectMemberSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/members/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.member.read" + check_field_name: "ProjectId" + }; + } + + rpc AddProjectMember(ProjectMemberAdd) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/projects/{id}/members" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.member.write" + check_field_name: "Id" + }; + } + + rpc ChangeProjectMember(ProjectMemberChange) returns (google.protobuf.Empty) { + option (google.api.http) = { + put: "/projects/{id}/members/{user_id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.member.write" + check_field_name: "Id" + }; + } + + rpc RemoveProjectMember(ProjectMemberRemove) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/projects/{id}/members/{user_id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.member.delete" + check_field_name: "Id" + }; + } + + //PROJECT_ROLES + rpc SearchProjectRoles(ProjectRoleSearchRequest) returns (ProjectRoleSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/roles/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.role.read" + check_field_name: "ProjectId" + }; + } + + rpc AddProjectRole(ProjectRoleAdd) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/projects/{id}/roles" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.role.write" + check_field_name: "Id" + }; + } + + rpc RemoveProjectRole(ProjectRoleRemove) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/projects/{id}/roles/{name}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.role.delete" + check_field_name: "Id" + }; + } + + //APPLICATIONS + rpc SearchApplications(ApplicationSearchRequest) returns (ApplicationSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/applications/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.read" + check_field_name: "ProjectId" + }; + } + + rpc ApplicationByID(ApplicationID) returns (Application) { + option (google.api.http) = { + get: "/projects/{project_id}/applications/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.read" + check_field_name: "ProjectId" + }; + } + + rpc CreateOIDCApplication(OIDCApplicationCreate) returns (Application) { + option (google.api.http) = { + post: "/projects/{project_id}/oidcapplications" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + rpc UpdateApplication(ApplicationUpdate) returns (Application) { + option (google.api.http) = { + put: "/projects/{project_id}/applications/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + rpc DeactivateApplication(ApplicationID) returns (Application) { + option (google.api.http) = { + put: "/projects/{project_id}/applications/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + rpc ReactivateApplication(ApplicationID) returns (Application) { + option (google.api.http) = { + put: "/projects/{project_id}/applications/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + rpc UpdateApplicationOIDCConfig(OIDCConfigUpdate) returns (OIDCConfig) { + option (google.api.http) = { + put: "/projects/{project_id}/applications/{application_id}/oidcconfig" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + rpc RegenerateOIDCClientSecret(ApplicationID) returns (ClientSecret) { + option (google.api.http) = { + put: "/projects/{project_id}/applications/{id}/oidcconfig/_changeclientsecret" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.app.write" + check_field_name: "ProjectId" + }; + } + + //PROJECT_GRANT + rpc SearchProjectGrants(ProjectGrantSearchRequest) returns (ProjectGrantSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/grants/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.read" + check_field_name: "ProjectId" + }; + } + + rpc ProjectGrantByID(ProjectGrantID) returns (ProjectGrant) { + option (google.api.http) = { + get: "/projects/{project_id}/grants/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.read" + }; + } + + rpc CreateProjectGrant(ProjectGrantCreate) returns (ProjectGrant) { + option (google.api.http) = { + post: "/projects/{project_id}/grants" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.write" + }; + } + + rpc UpdateProjectGrant(ProjectGrantUpdate) returns (ProjectGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/grants/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.write" + }; + } + + rpc DeactivateProjectGrant(ProjectGrantID) returns (ProjectGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/grants/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.write" + }; + } + + rpc ReactivateProjectGrant(ProjectGrantID) returns (ProjectGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/grants/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.write" + }; + } + + + //PROJECT_GRANT_MEMBER + rpc GetProjectGrantMemberRoles(google.protobuf.Empty) returns (ProjectGrantMemberRoles) { + option (google.api.http) = { + get: "/projects/grants/members/roles" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.member.read" + }; + } + rpc SearchProjectGrantMembers(ProjectGrantMemberSearchRequest) returns (ProjectGrantMemberSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/grants/{grant_id}/members/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.member.read" + }; + } + + rpc AddProjectGrantMember(ProjectGrantMemberAdd) returns (google.protobuf.Empty) { + option (google.api.http) = { + post: "/projects/{project_id}/grants/{grant_id}/members" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.member.write" + }; + } + + rpc ChangeProjectGrantMember(ProjectGrantMemberChange) returns (google.protobuf.Empty) { + option (google.api.http) = { + put: "/projects/{project_id}/grants/{grant_id}/members/{user_id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.member.write" + }; + } + + rpc RemoveProjectGrantMember(ProjectGrantMemberRemove) returns (google.protobuf.Empty) { + option (google.api.http) = { + delete: "/projects/{project_id}/grants/{grant_id}/members/{user_id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.member.delete" + }; + } + + + //USER_GRANT + rpc SearchUserGrants(UserGrantSearchRequest) returns (UserGrantSearchResponse) { + option (google.api.http) = { + post: "/users/grants/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.read" + }; + } + + rpc UserGrantByID(UserGrantID) returns (UserGrant) { + option (google.api.http) = { + get: "/users/{user_id}/grants/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.read" + }; + } + + rpc CreateUserGrant(UserGrantCreate) returns (UserGrant) { + option (google.api.http) = { + post: "/users/{user_id}/grants" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.write" + }; + } + + rpc UpdateUserGrant(UserGrantUpdate) returns (UserGrant) { + option (google.api.http) = { + put: "/users/{user_id}/grants/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.write" + }; + } + + rpc DeactivateUserGrant(UserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/users/{user_id}/grants/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.write" + }; + } + + rpc ReactivateUserGrant(UserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/users/{user_id}/grants/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "user.grant.write" + }; + } + + //PROJECT_USER_GRANT + rpc SearchProjectUserGrants(ProjectUserGrantSearchRequest) returns (UserGrantSearchResponse) { + option (google.api.http) = { + post: "/projects/{project_id}/users/grants/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.read" + check_field_name: "ProjectId" + }; + } + + rpc ProjectUserGrantByID(ProjectUserGrantID) returns (UserGrant) { + option (google.api.http) = { + get: "/projects/{project_id}/users/{user_id}/grants/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.read" + check_field_name: "ProjectId" + }; + } + + rpc CreateProjectUserGrant(UserGrantCreate) returns (UserGrant) { + option (google.api.http) = { + post: "/projects/{project_id}/users/{user_id}/grants" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.write" + check_field_name: "ProjectId" + }; + } + + rpc UpdateProjectUserGrant(ProjectUserGrantUpdate) returns (UserGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/users/{user_id}/grants/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.write" + check_field_name: "ProjectId" + }; + } + + rpc DeactivateProjectUserGrant(ProjectUserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/users/{user_id}/grants/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.write" + check_field_name: "ProjectId" + }; + } + + rpc ReactivateProjectUserGrant(ProjectUserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/projects/{project_id}/users/{user_id}/grants/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.user.grant.write" + check_field_name: "ProjectId" + }; + } + //PROJECT_GRANT_USER_GRANT + rpc SearchProjectGrantUserGrants(ProjectGrantUserGrantSearchRequest) returns (UserGrantSearchResponse) { + option (google.api.http) = { + post: "/projectgrants/{project_grant_id}/users/grants/_search" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.read" + check_field_name: "ProjectGrantId" + }; + } + + rpc ProjectGrantUserGrantByID(ProjectGrantUserGrantID) returns (UserGrant) { + option (google.api.http) = { + get: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.read" + check_field_name: "ProjectGrantId" + }; + } + + rpc CreateProjectGrantUserGrant(ProjectGrantUserGrantCreate) returns (UserGrant) { + option (google.api.http) = { + post: "/projectgrants/{project_grant_id}/users/{user_id}/grants" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.write" + check_field_name: "ProjectGrantId" + }; + } + + rpc UpdateProjectGrantUserGrant(ProjectGrantUserGrantUpdate) returns (UserGrant) { + option (google.api.http) = { + put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.write" + check_field_name: "ProjectGrantId" + }; + } + + rpc DeactivateProjectGrantUserGrant(ProjectGrantUserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}/_deactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.write" + check_field_name: "ProjectGrantId" + }; + } + + rpc ReactivateProjectGrantUserGrant(ProjectGrantUserGrantID) returns (UserGrant) { + option (google.api.http) = { + put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}/_reactivate" + body: "*" + }; + + option (caos.citadel.utils.v1.auth_option) = { + permission: "project.grant.user.grant.write" + check_field_name: "ProjectGrantId" + }; + } + //Grant + rpc SearchAuthGrant(AuthGrantSearchRequest) returns (AuthGrantSearchResponse) { + option (google.api.http) = { + post: "/authgrants/_search" + body: "*" + }; + } +} + +message ChangeRequest { + string id = 1; + uint64 limit= 2; + uint64 sequence_offset = 3; +} + +message Changes { + repeated Change changes = 1; + uint64 offset = 2; + uint64 limit = 3; +} + +message Change { + google.protobuf.Timestamp change_date = 1; + string event_type = 2; + uint64 sequence = 3; + string modifier = 4; + google.protobuf.Struct data = 5; +} + +message ApplicationID { + string id = 1; + string project_id = 2; +} + +message ProjectID { + string id = 1; +} + +message UserID { + string id = 1; +} + +message UserEmailID { + string email = 1; +} + +message UniqueUserRequest { + string user_name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string email = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message UniqueUserResponse { + bool is_unique = 1; +} + +message CreateUserRequest { + string user_name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string first_name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string last_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string nick_name = 4 [(validate.rules).string = {max_len: 200}]; + string display_name = 5[(validate.rules).string = {max_len: 200}]; + string preferred_language = 6[(validate.rules).string = {max_len: 200}]; + Gender gender = 7; + string email = 8 [(validate.rules).string = {min_len: 1, max_len: 200, email: true}]; + bool is_email_verified = 9; + string phone = 11 [(validate.rules).string = {max_len: 20}]; + bool is_phone_verified = 12; + string country = 13 [(validate.rules).string = {max_len: 200}]; + string locality = 14 [(validate.rules).string = {max_len: 200}]; + string postal_code = 15 [(validate.rules).string = {max_len: 200}]; + string region = 16 [(validate.rules).string = {max_len: 200}]; + string street_address = 17 [(validate.rules).string = {max_len: 200}]; + string password = 18 [(validate.rules).string = {max_len: 72}]; +} + +message User { + string id = 1; + UserState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + google.protobuf.Timestamp last_login = 5; + google.protobuf.Timestamp password_changed = 6; + string user_name = 7; + string first_name = 8; + string last_name = 9; + string display_name = 10; + string nick_name = 11; + string preferred_language = 12; + Gender gender = 13; + string email = 14; + bool is_email_verified = 15; + string phone = 16; + bool is_phone_verified = 17; + string country = 18; + string locality = 19; + string postal_code = 20; + string region = 21; + string street_address = 22; +} + +enum UserState { + USERSTATE_UNSPECIFIED = 0; + USERSTATE_ACTIVE = 1; + USERSTATE_INACTIVE = 2; + USERSTATE_DELETED = 3; + USERSTATE_LOCKED = 4; + USERSTATE_SUSPEND = 5; + USERSTATE_INITIAL= 6; +} + +enum Gender { + GENDER_UNSPECIFIED = 0; + GENDER_FEMALE = 1; + GENDER_MALE = 2; + GENDER_DIVERSE = 3; +} + +message UserSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + UserSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}];; + bool asc = 4; + repeated UserSearchQuery queries = 5; +} + +message UserSearchQuery { + UserSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];; + SearchMethod method = 2; + string value = 3; +} + +enum UserSearchKey { + USERSEARCHKEY_UNSPECIFIED = 0; + USERSEARCHKEY_USER_NAME = 1; + USERSEARCHKEY_FIRST_NAME = 2; + USERSEARCHKEY_LAST_NAME = 3; + USERSEARCHKEY_NICK_NAME = 4; + USERSEARCHKEY_DISPLAY_NAME = 5; + USERSEARCHKEY_EMAIL = 6; + USERSEARCHKEY_STATE = 7; +} + +message UserSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated User result = 4; +} + +enum SearchMethod { + SEARCHMETHOD_EQUALS = 0; + SEARCHMETHOD_STARTS_WITH = 1; + SEARCHMETHOD_CONTAINS = 2; +} + + +message UserProfile { + string id = 1; + UserState state = 2; + string first_name = 3; + string last_name = 4; + string nick_name = 5; + string display_name = 6; + string preferred_language = 7; + Gender gender = 8; + string user_name = 9; +} + +message UpdateUserProfileRequest { + string id = 1; + string first_name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string last_name = 3 [(validate.rules).string = {min_len: 1, max_len: 200}]; + string nick_name = 4 [(validate.rules).string = {max_len: 200}]; + string display_name = 5 [(validate.rules).string = {max_len: 200}]; + string preferred_language = 6 [(validate.rules).string = {max_len: 200}]; + Gender gender = 7; +} + +message UserEmail { + string id = 1; + string email = 2; + bool is_email_verified = 3; +} + +message UpdateUserEmailRequest { + string id = 1; + string email = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + bool is_email_verified = 3; +} + +message UserPhone { + string id = 1; + string phone = 2; + bool is_phone_verified = 3; +} + +message UpdateUserPhoneRequest { + string id = 1; + string phone = 2 [(validate.rules).string = {min_len: 1, max_len: 20}]; + bool is_phone_verified = 3; +} + +message UserAddress { + string id = 1; + string country = 2; + string locality = 3; + string postal_code = 4; + string region = 5; + string street_address = 6; +} + +message UpdateUserAddressRequest { + string id = 1; + string country = 2 [(validate.rules).string = {max_len: 200}]; + string locality = 3 [(validate.rules).string = {max_len: 200}]; + string postal_code = 4 [(validate.rules).string = {max_len: 200}]; + string region = 5 [(validate.rules).string = {max_len: 200}]; + string street_address = 6 [(validate.rules).string = {max_len: 200}]; +} + +message MultiFactors { + repeated MultiFactor mfas = 1; +} + +message MultiFactor { + MfaType type = 1; + MFAState state = 2; +} + +enum MfaType { + MFATYPE_UNSPECIFIED = 0; + MFATYPE_SMS = 1; + MFATYPE_OTP = 2; +} + +enum MFAState { + MFASTATE_UNSPECIFIED = 0; + MFASTATE_NOT_READY = 1; + MFASTATE_READY = 2; + MFASTATE_REMOVED = 3; +} + +message PasswordID{ + string id = 1; +} + +message PasswordRequest { + string id = 1; + string password = 2 [(validate.rules).string = {min_len: 1, max_len: 72}]; +} + +message ResetPasswordRequest { + string id = 1; +} + +message SetPasswordNotificationRequest { + string id = 1; + NotificationType type = 2; +} + +enum NotificationType { + NOTIFICATIONTYPE_EMAIL = 0; + NOTIFICATIONTYPE_SMS = 1; +} + +message PasswordComplexityPolicyID { + string id = 1; +} + +message PasswordComplexityPolicy { + string id = 1; + string description = 2; + PolicyState state = 3; + google.protobuf.Timestamp creation_date = 4; + google.protobuf.Timestamp change_date = 5; + uint64 min_length = 6; + bool has_lowercase = 7; + bool has_uppercase = 8; + bool has_number = 9; + bool has_symbol = 10; +} + +message PasswordComplexityPolicyCreate { + string description = 1 [(validate.rules).string = {max_len: 500}]; + uint64 min_length = 2; + bool has_lowercase = 3; + bool has_uppercase = 4; + bool has_number = 5; + bool has_symbol = 6; +} + +message PasswordComplexityPolicyUpdate { + string id = 1; + string description = 2 [(validate.rules).string = {max_len: 500}]; + uint64 min_length = 3; + bool has_lowercase = 4; + bool has_uppercase = 5; + bool has_number = 6; + bool has_symbol = 7; +} + +message PasswordAgePolicyID { + string id = 1; +} + +message PasswordAgePolicy { + string id = 1; + string description = 2; + PolicyState state = 3; + google.protobuf.Timestamp creation_date = 4; + google.protobuf.Timestamp change_date = 5; + uint64 max_age_days = 6; + uint64 expire_warn_days = 7; +} + +message PasswordAgePolicyCreate { + string description = 1 [(validate.rules).string = {max_len: 500}]; + uint64 max_age_days = 2; + uint64 expire_warn_days = 3; +} + +message PasswordAgePolicyUpdate { + string id = 1; + string description = 2 [(validate.rules).string = {max_len: 500}]; + uint64 max_age_days = 3; + uint64 expire_warn_days = 4; +} + +message PasswordLockoutPolicyID { + string id = 1; +} + +message PasswordLockoutPolicy { + string id = 1; + string description = 2; + PolicyState state = 3; + google.protobuf.Timestamp creation_date = 4; + google.protobuf.Timestamp change_date = 5; + uint64 max_attempts = 6; + bool show_lock_out_failures = 7; +} + +message PasswordLockoutPolicyCreate { + string description = 1 [(validate.rules).string = {max_len: 500}]; + uint64 max_attempts = 2; + bool show_lock_out_failures = 3; +} + +message PasswordLockoutPolicyUpdate { + string id = 1; + string description = 2 [(validate.rules).string = {max_len: 500}]; + uint64 max_attempts = 3; + bool show_lock_out_failures = 4; +} + +enum PolicyState { + POLICYSTATE_UNSPECIFIED = 0; + POLICYSTATE_ACTIVE = 1; + POLICYSTATE_INACTIVE = 2; + POLICYSTATE_DELETED = 3; +} + +message OrgID { + string id = 1; +} + +message OrgDomain { + string domain = 1; +} + +message Org { + string id = 1; + OrgState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + string name = 5; + string domain = 6; +} + +enum OrgState { + ORGSTATE_UNSPECIFIED = 0; + ORGSTATE_ACTIVE = 1; + ORGSTATE_INACTIVE = 2; +} + +message OrgMemberRoles { + repeated string roles = 1; +} + +message OrgMember { + string user_id = 1; + string user_name = 2; + string email = 3; + string first_name = 4; + string last_name = 5; + repeated string roles = 6; + google.protobuf.Timestamp change_date = 7; + google.protobuf.Timestamp creation_date = 8; +} + +message AddOrgMemberRequest { + string org_id = 1; + string user_id = 2; + repeated string roles = 3; +} + +message ChangeOrgMemberRequest { + string org_id = 1; + string user_id = 2; + repeated string roles = 3; +} + +message RemoveOrgMemberRequest { + string org_id = 1; + string user_id = 2; +} + +message OrgMemberSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated OrgMember result = 4; +} + +message OrgMemberSearchRequest { + string org_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated OrgMemberSearchQuery queries = 4; +} + +message OrgMemberSearchQuery { + OrgMemberSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum OrgMemberSearchKey { + ORGMEMBERSEARCHKEY_UNSPECIFIED = 0; + ORGMEMBERSEARCHKEY_FIRST_NAME = 1; + ORGMEMBERSEARCHKEY_LAST_NAME = 2; + ORGMEMBERSEARCHKEY_EMAIL = 3; + ORGMEMBERSEARCHKEY_USER_ID = 4; +} + +message ProjectCreateRequest { + string name = 1 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message ProjectUpdateRequest { + string id = 1; + string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + +message Projects { + repeated Project projects = 1; +} + +message Project { + string id = 1; + string name = 2; + ProjectState state = 3; + google.protobuf.Timestamp change_date = 4; + google.protobuf.Timestamp creation_date = 5; + ProjectType type = 6; + string resource_owner = 7; + string org_id = 8; + string org_name = 9; + string org_domain = 10; + string grant_id = 11; +} + +enum ProjectState { + PROJECTSTATE_UNSPECIFIED = 0; + PROJECTSTATE_ACTIVE = 1; + PROJECTSSTATE_INACTIVE = 2; +} + +enum ProjectType { + PROJECTTYPE_UNKNOWN = 0; + PROJECTTYPE_SELF = 1; + PROJECTTYPE_GRANTED = 2; +} + +message ProjectSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Project result = 4; +} + +message ProjectSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + repeated ProjectSearchQuery queries = 3; +} + +message ProjectSearchQuery { + ProjectSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum ProjectSearchKey { + PROJECTSEARCHKEY_UNSPECIFIED = 0; + PROJECTSEARCHKEY_PROJECT_NAME = 1; +} + +message ProjectMemberRoles { + repeated string roles = 1; +} + +message ProjectMember { + string user_id = 1; + string user_name = 2; + string email = 3; + string first_name = 4; + string last_name = 5; + repeated string roles = 6; + google.protobuf.Timestamp change_date = 7; + google.protobuf.Timestamp creation_date = 8; +} + +message ProjectMemberAdd { + string id = 1; + string user_id = 2; + repeated string roles = 3; +} + +message ProjectMemberChange { + string id = 1; + string user_id = 2; + repeated string roles = 3; +} + +message ProjectMemberRemove { + string id = 1; + string user_id = 2; +} + +message ProjectRoleAdd { + string id = 1; + string name = 2; + string display_name = 3; + string group = 4; +} + +message ProjectRole { + string project_id = 1; + string name = 2; + string display_name = 3; + google.protobuf.Timestamp creation_date = 4; + string group = 5; +} + +message ProjectRoleRemove { + string id = 1; + string name = 2; +} + +message ProjectRoleSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated ProjectRole result = 4; +} + +message ProjectRoleSearchRequest { + string project_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated ProjectRoleSearchQuery queries = 4; +} + +message ProjectRoleSearchQuery { + ProjectRoleSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum ProjectRoleSearchKey { + PROJECTROLESEARCHKEY_UNSPECIFIED = 0; + PROJECTROLESEARCHKEY_NAME = 1; + PROJECTROLESEARCHKEY_DISPLAY_NAME = 2; +} + +message ProjectMemberSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated ProjectMember result = 4; +} + +message ProjectMemberSearchRequest { + string project_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated ProjectMemberSearchQuery queries = 4; +} + +message ProjectMemberSearchQuery { + ProjectMemberSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum ProjectMemberSearchKey { + PROJECTMEMBERSEARCHKEY_UNSPECIFIED = 0; + PROJECTMEMBERSEARCHKEY_FIRST_NAME = 1; + PROJECTMEMBERSEARCHKEY_LAST_NAME = 2; + PROJECTMEMBERSEARCHKEY_EMAIL = 3; + PROJECTMEMBERSEARCHKEY_USER_ID = 4; +} + +enum AppState { + APPSTATE_UNSPECIFIED = 0; + APPSTATE_ACTIVE = 1; + APPSTATE_INACTIVE = 2; +} + +message Application { + string id = 1; + AppState state = 2; + google.protobuf.Timestamp creation_date = 3; + google.protobuf.Timestamp change_date = 4; + string name = 5; + oneof app_config { + OIDCConfig oidc_config = 8; + } +} + +message ApplicationUpdate { + string project_id = 1; + string id = 2; + string name = 5 [(validate.rules).string = {min_len: 1, max_len: 200}]; +} + + +message OIDCConfig { + repeated string redirect_uris = 1; + repeated OIDCResponseType response_types = 2; + repeated OIDCGrantType grant_types = 3; + OIDCApplicationType application_type = 4; + string client_id = 5; + string client_secret = 6; + OIDCAuthMethodType auth_method_type = 7; + repeated string post_logout_redirect_uris = 8; +} + +message OIDCApplicationCreate { + string project_id = 1; + string name = 2 [(validate.rules).string = {min_len: 1, max_len: 200}]; + repeated string redirect_uris = 3; + repeated OIDCResponseType response_types = 4; + repeated OIDCGrantType grant_types = 5; + OIDCApplicationType application_type = 6; + OIDCAuthMethodType auth_method_type = 7; + repeated string post_logout_redirect_uris = 8; +} + +message OIDCConfigUpdate { + string project_id = 1; + string application_id = 2; + repeated string redirect_uris = 3; + repeated OIDCResponseType response_types = 4; + repeated OIDCGrantType grant_types = 5; + OIDCApplicationType application_type = 6; + OIDCAuthMethodType auth_method_type = 7; + repeated string post_logout_redirect_uris = 8; +} + +enum OIDCResponseType { + OIDCRESPONSETYPE_CODE = 0; + OIDCRESPONSETYPE_ID_TOKEN = 1; + OIDCRESPONSETYPE_TOKEN_ID_TOKEN = 2; +} + +enum OIDCGrantType { + OIDCGRANTTYPE_AUTHORIZATION_CODE = 0; + OIDCGRANTTYPE_IMPLICIT = 1; + OIDCGRANTTYPE_REFRESH_TOKEN = 2; +} + +enum OIDCApplicationType { + OIDCAPPLICATIONTYPE_WEB = 0; + OIDCAPPLICATIONTYPE_USER_AGENT = 1; + OIDCAPPLICATIONTYPE_NATIVE = 2; +} + +enum OIDCAuthMethodType { + OIDCAUTHMETHODTYPE_BASIC = 0; + OIDCAUTHMETHODTYPE_POST = 1; + OIDCAUTHMETHODTYPE_NONE = 2; +} + +message ClientSecret { + string client_secret = 1; +} + +message ApplicationSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated Application result = 4; +} + +message ApplicationSearchRequest { + string project_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated ApplicationSearchQuery queries = 4; +} + +message ApplicationSearchQuery { + ApplicationSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum ApplicationSearchKey { + APPLICATIONSERACHKEY_UNSPECIFIED = 0; + APPLICATIONSEARCHKEY_APP_NAME = 1; +} + +message ProjectGrant { + string id = 1; + string project_id = 2; + string granted_org_id = 3; + string granted_org_name = 4; + string granted_org_domain = 5; + repeated string role_names = 6; + ProjectGrantState state = 7; + google.protobuf.Timestamp creation_date = 8; + google.protobuf.Timestamp change_date = 9; + string project_name = 10; +} + +message ProjectGrantCreate { + string project_id = 1; + string granted_org_id = 2; + repeated string role_names = 3; +} + +message ProjectGrantUpdate { + string project_id = 1; + string id = 2; + repeated string role_names = 3; +} + +message ProjectGrantID { + string project_id = 1; + string id = 2; +} + +message GrantedGrantID { + string id = 1; +} + +enum ProjectGrantState { + PROJECTGRANTSTATE_UNSPECIFIED = 0; + PROJECTGRANTSTATE_ACTIVE = 1; + PROJECTGRANTSTATE_INACTIVE = 2; +} + +message ProjectGrantSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated ProjectGrant result = 4; +} + +message ProjectGrantSearchRequest { + string project_id = 1; + uint64 offset = 2; + uint64 limit = 3; +} + +message ProjectGrantMemberRoles { + repeated string roles = 1; +} + +message ProjectGrantMember { + string user_id = 1; + string user_name = 2; + string email = 3; + string first_name = 4; + string last_name = 5; + repeated string roles = 6; + google.protobuf.Timestamp change_date = 7; + google.protobuf.Timestamp creation_date = 8; +} + +message ProjectGrantMemberAdd { + string project_id = 1; + string grant_id = 2; + string user_id = 3; + repeated string roles = 4; +} + +message ProjectGrantMemberChange { + string project_id = 1; + string grant_id = 2; + string user_id = 3; + repeated string roles = 4; +} + +message ProjectGrantMemberRemove { + string project_id = 1; + string grant_id = 2; + string user_id = 3; +} + +message ProjectGrantMemberSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated ProjectGrantMember result = 4; +} + +message ProjectGrantMemberSearchRequest { + string project_id = 1; + string grant_id = 2; + uint64 offset = 3; + uint64 limit = 4; + repeated ProjectGrantMemberSearchQuery queries = 5; +} + +message ProjectGrantMemberSearchQuery { + ProjectGrantMemberSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2; + string value = 3; +} + +enum ProjectGrantMemberSearchKey { + PROJECTGRANTMEMBERSEARCHKEY_UNSPECIFIED = 0; + PROJECTGRANTMEMBERSEARCHKEY_FIRST_NAME = 1; + PROJECTGRANTMEMBERSEARCHKEY_LAST_NAME = 2; + PROJECTGRANTMEMBERSEARCHKEY_EMAIL = 3; + PROJECTGRANTMEMBERSEARCHKEY_USER_ID = 4; +} + +message UserGrant { + string id = 1; + string user_id = 2; + string org_id = 3; + string project_id = 4; + repeated string role_names = 5; + UserGrantState state = 6; + google.protobuf.Timestamp creation_date = 7; + google.protobuf.Timestamp change_date = 8; + string user_name = 9; + string first_name = 10; + string last_name = 11; + string email = 12; + string org_name = 13; + string org_domain = 14; + string project_name = 15; +} + +message UserGrantCreate { + string user_id = 1; + string org_id = 2; + string project_id = 3; + repeated string role_names = 4; +} + +message UserGrantUpdate { + string user_id = 1; + string id = 2; + repeated string role_names = 3; +} + +message UserGrantID { + string user_id = 1; + string id = 2; +} + +message ProjectUserGrantID { + string project_id = 1; + string user_id = 2; + string id = 3; +} + +message ProjectUserGrantUpdate { + string project_id = 1; + string user_id = 2; + string id = 3; + repeated string role_names = 4; +} + +message ProjectGrantUserGrantID { + string project_grant_id = 1; + string user_id = 2; + string id = 3; +} + +message ProjectGrantUserGrantCreate { + string user_id = 1; + string org_id = 2; + string project_grant_id = 3; + string project_id = 4 [(validate.rules).string.min_len = 1]; + repeated string role_names = 5; +} + +message ProjectGrantUserGrantUpdate { + string project_grant_id = 1; + string user_id = 2; + string id = 3; + repeated string role_names = 4; +} + +enum UserGrantState { + USERGRANTSTATE_UNSPECIFIED = 0; + USERGRANTSTATE_ACTIVE = 1; + USERGRANTSTATE_INACTIVE = 2; +} + + +message UserGrantSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated UserGrant result = 4; +} + +message UserGrantSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + repeated UserGrantSearchQuery queries = 3; +} +message UserGrantSearchQuery { + UserGrantSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2 [(validate.rules).enum = {in: [0]}]; + string value = 3; +} + +enum UserGrantSearchKey { + USERGRANTSEARCHKEY_UNSPECIFIED = 0; + USERGRANTSEARCHKEY_PROJECT_ID = 1; + USERGRANTSEARCHKEY_USER_ID = 2; + USERGRANTSEARCHKEY_ORG_ID = 3; +} + +message ProjectUserGrantSearchRequest { + string project_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated UserGrantSearchQuery queries = 4; +} + +message ProjectGrantUserGrantSearchRequest { + string project_grant_id = 1; + uint64 offset = 2; + uint64 limit = 3; + repeated UserGrantSearchQuery queries = 4; +} + +message AuthGrantSearchRequest { + uint64 offset = 1; + uint64 limit = 2; + AuthGrantSearchKey sorting_column = 3 [(validate.rules).enum = {not_in: [0]}]; + bool asc = 4; + repeated AuthGrantSearchQuery queries = 5; +} + +message AuthGrantSearchQuery { + AuthGrantSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}]; + SearchMethod method = 2 [(validate.rules).enum = {in: [0]}]; + string value = 3; +} + +enum AuthGrantSearchKey { + AUTHGRANTSEARCHKEY_UNSPECIFIED = 0; + AUTHGRANTSEARCHKEY_ORG_ID = 1; + AUTHGRANTSEARCHKEY_PROJECT_ID = 2; + AUTHGRANTSEARCHKEY_USER_ID = 3; +} + +message AuthGrantSearchResponse { + uint64 offset = 1; + uint64 limit = 2; + uint64 total_result = 3; + repeated AuthGrant result = 4; +} + +message AuthGrant { + string orgId = 1; + string projectId = 2; + string userId = 3; + repeated string roles = 4; +}