@fi-ts/api 0.0.0-pr.12.167eda91

package/fits/api/v1/token_pb.ts

@@ -0,0 +1,782 @@
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts"
+// @generated from file fits/api/v1/token.proto (package fits.api.v1, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
+import type { AdminRole, Labels, Meta, ProjectRole, TenantRole, UpdateLabels, UpdateMeta } from "./common_pb";
+import { file_fits_api_v1_common } from "./common_pb";
+import { file_fits_api_v1_predefined_rules } from "./predefined_rules_pb";
+import type { Duration, Timestamp } from "@bufbuild/protobuf/wkt";
+import { file_google_protobuf_duration, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import type { Message } from "@bufbuild/protobuf";
+
+/**
+ * Describes the file fits/api/v1/token.proto.
+ */
+export const file_fits_api_v1_token: GenFile = /*@__PURE__*/
+  fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEi7wYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkQKC3Blcm1pc3Npb25zGAUgAygLMiQuZml0cy5hcGkudjEuUGVybWlzc2lvbnNCeVZpc2liaWxpdHlCCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKCnRva2VuX3R5cGUYCCABKA4yFi5maXRzLmFwaS52MS5Ub2tlblR5cGVCCLpIBYIBAhABEjsKDXByb2plY3Rfcm9sZXMYCSADKAsyJC5maXRzLmFwaS52MS5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeRJUCgx0ZW5hbnRfcm9sZXMYCiADKAsyIy5maXRzLmFwaS52MS5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEjkKCmFkbWluX3JvbGUYCyABKA4yFi5maXRzLmFwaS52MS5BZG1pblJvbGVCCLpIBYIBAhABSACIAQEaTQoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEicKBXZhbHVlGAIgASgOMhguZml0cy5hcGkudjEuUHJvamVjdFJvbGU6AjgBGksKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgOMhcuZml0cy5hcGkudjEuVGVuYW50Um9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGUiqgUKGVRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QSIAoLZGVzY3JpcHRpb24YASABKAlCC7pICHIGyLOusQIBEkMKC3Blcm1pc3Npb25zGAIgAygLMiQuZml0cy5hcGkudjEuUGVybWlzc2lvbnNCeVZpc2liaWxpdHlCCLpIBZIBAhBkEj4KB2V4cGlyZXMYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CErpID6oBDBoFCIHnhA8yAwjYBBJxCg1wcm9qZWN0X3JvbGVzGAQgAygLMjguZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIgukgdmgEawJW4sQIByJW4sQIBIgVyA7ABASoFggECEAESaAoMdGVuYW50X3JvbGVzGAUgAygLMjcuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEjkKCmFkbWluX3JvbGUYBiABKA4yFi5maXRzLmFwaS52MS5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESIwoGbGFiZWxzGAcgASgLMhMuZml0cy5hcGkudjEuTGFiZWxzGk0KEVByb2plY3RSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRInCgV2YWx1ZRgCIAEoDjIYLmZpdHMuYXBpLnYxLlByb2plY3RSb2xlOgI4ARpLChBUZW5hbnRSb2xlc0VudHJ5EgsKA2tleRgBIAEoCRImCgV2YWx1ZRgCIAEoDjIXLmZpdHMuYXBpLnYxLlRlbmFudFJvbGU6AjgBQg0KC19hZG1pbl9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIp0CChdQZXJtaXNzaW9uc0J5VmlzaWJpbGl0eRIwCgZwdWJsaWMYASABKAsyHi5maXRzLmFwaS52MS5QdWJsaWNQZXJtaXNzaW9uc0gAEiwKBHNlbGYYAiABKAsyHC5maXRzLmFwaS52MS5TZWxmUGVybWlzc2lvbnNIABIyCgdwcm9qZWN0GAMgASgLMh8uZml0cy5hcGkudjEuUHJvamVjdFBlcm1pc3Npb25zSAASMAoGdGVuYW50GAQgASgLMh4uZml0cy5hcGkudjEuVGVuYW50UGVybWlzc2lvbnNIABIuCgVhZG1pbhgFIAEoCzIdLmZpdHMuYXBpLnYxLkFkbWluUGVybWlzc2lvbnNIAEIMCgp2aXNpYmlsaXR5Ii8KEVB1YmxpY1Blcm1pc3Npb25zEhoKB21ldGhvZHMYASADKAlCCbpIBpIBAxD0AyItCg9TZWxmUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgBIAMoCUIJukgGkgEDEPQDIk4KElByb2plY3RQZXJtaXNzaW9ucxIcCgdwcm9qZWN0GAEgASgJQgu6SAhyBpi0rrECARIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiSwoRVGVuYW50UGVybWlzc2lvbnMSGgoFbG9naW4YASABKAlCC7pICHIGkLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyIuChBBZG1pblBlcm1pc3Npb25zEhoKB21ldGhvZHMYASADKAlCCbpIBpIBAxD0AyJPChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuEg4KBnNlY3JldBgCIAEoCSIZChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdCI+ChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USIgoGdG9rZW5zGAEgAygLMhIuZml0cy5hcGkudjEuVG9rZW4iMwoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSLJBQoZVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARI0Cgt1cGRhdGVfbWV0YRgCIAEoCzIXLmZpdHMuYXBpLnYxLlVwZGF0ZU1ldGFCBrpIA8gBABIlCgtkZXNjcmlwdGlvbhgDIAEoCUILukgIcgbIs66xAgFIAIgBARI5CgtwZXJtaXNzaW9ucxgEIAMoCzIkLmZpdHMuYXBpLnYxLlBlcm1pc3Npb25zQnlWaXNpYmlsaXR5EnEKDXByb2plY3Rfcm9sZXMYBSADKAsyOC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5QiC6SB2aARrAlbixAgHIlbixAgEiBXIDsAEBKgWCAQIQARJoCgx0ZW5hbnRfcm9sZXMYBiADKAsyNy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESOQoKYWRtaW5fcm9sZRgHIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAYgBARIpCgZsYWJlbHMYCCABKAsyGS5maXRzLmFwaS52MS5VcGRhdGVMYWJlbHMaTQoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEicKBXZhbHVlGAIgASgOMhguZml0cy5hcGkudjEuUHJvamVjdFJvbGU6AjgBGksKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgOMhcuZml0cy5hcGkudjEuVGVuYW50Um9sZToCOAFCDgoMX2Rlc2NyaXB0aW9uQg0KC19hZG1pbl9yb2xlIj8KGlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iMAoWVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASI8ChdUb2tlblNlcnZpY2VHZXRSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuIhwKGlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0IlAKG1Rva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuEg4KBnNlY3JldBgCIAEoCSpQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIy4AQKDFRva2VuU2VydmljZRJaCgNHZXQSIy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GiQuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEmMKBkNyZWF0ZRImLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaJy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZSII2PMYAuDzGAESYwoGVXBkYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgjY8xgC4PMYARJdCgRMaXN0EiQuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QaJS5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCNjzGALg8xgBEmMKBlJldm9rZRImLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlcXVlc3QaJy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSII2PMYAuDzGAESZgoHUmVmcmVzaBInLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0GiguZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgjY8xgC4PMYAUKWAQoPY29tLmZpdHMuYXBpLnYxQgpUb2tlblByb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
+
+/**
+ * Token generates a jwt authentication token to access the api
+ *
+ * There are two different types of tokens, api- and user- tokens
+ *
+ * A user token is used to authenticate end user requests for example from a cli.
+ * The configured roles in a user token are expanded in the api server
+ * based on the memberships in other projects and tenants based on the role granted there.
+ * User tokens will never contain permissions.
+ * Permissions are always derived from the tenant and project roles and memberships.
+ *
+ * The api token should be used to authenticate services.
+ * In contrast to a user token, the api token permissions and roles apply as configured during the token create process.
+ *
+ * @generated from message fits.api.v1.Token
+ */
+export type Token = Message<"fits.api.v1.Token"> & {
+  /**
+   * Uuid of the jwt token, used to reference it by revoke
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+
+  /**
+   * User who created this token
+   *
+   * @generated from field: string user = 2;
+   */
+  user: string;
+
+  /**
+   * Meta for this token
+   *
+   * @generated from field: fits.api.v1.Meta meta = 3;
+   */
+  meta?: Meta | undefined;
+
+  /**
+   * Description is a user given description of this token.
+   *
+   * @generated from field: string description = 4;
+   */
+  description: string;
+
+  /**
+   * Permissions is a list of service methods this token can be used for
+   *
+   * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 5;
+   */
+  permissions: PermissionsByVisibility[];
+
+  /**
+   * Expires gives the date in the future after which this token can not be used anymore
+   *
+   * @generated from field: google.protobuf.Timestamp expires = 6;
+   */
+  expires?: Timestamp | undefined;
+
+  /**
+   * IssuedAt gives the date when this token was created
+   *
+   * @generated from field: google.protobuf.Timestamp issued_at = 7;
+   */
+  issuedAt?: Timestamp | undefined;
+
+  /**
+   * TokenType describes the type of this token
+   *
+   * @generated from field: fits.api.v1.TokenType token_type = 8;
+   */
+  tokenType: TokenType;
+
+  /**
+   * ProjectRoles associates a project id with the corresponding role of the token owner
+   *
+   * @generated from field: map<string, fits.api.v1.ProjectRole> project_roles = 9;
+   */
+  projectRoles: { [key: string]: ProjectRole };
+
+  /**
+   * TenantRoles associates a tenant id with the corresponding role of the token owner.
+   *
+   * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 10;
+   */
+  tenantRoles: { [key: string]: TenantRole };
+
+  /**
+   * AdminRole defines the admin role of the token owner
+   *
+   * @generated from field: optional fits.api.v1.AdminRole admin_role = 11;
+   */
+  adminRole?: AdminRole | undefined;
+};
+
+/**
+ * Describes the message fits.api.v1.Token.
+ * Use `create(TokenSchema)` to create a new message.
+ */
+export const TokenSchema: GenMessage<Token> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 0);
+
+/**
+ * TokenServiceCreateRequest is the request payload to create a token
+ *
+ * @generated from message fits.api.v1.TokenServiceCreateRequest
+ */
+export type TokenServiceCreateRequest = Message<"fits.api.v1.TokenServiceCreateRequest"> & {
+  /**
+   * Description of the token
+   *
+   * @generated from field: string description = 1;
+   */
+  description: string;
+
+  /**
+   * Permissions is a list of service methods this token can be used for.
+   *
+   * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 2;
+   */
+  permissions: PermissionsByVisibility[];
+
+  /**
+   * Expires gives the duration since now, after which this token can not be used anymore
+   *
+   * @generated from field: google.protobuf.Duration expires = 3;
+   */
+  expires?: Duration | undefined;
+
+  /**
+   * ProjectRoles associates a project id with the corresponding role of the token owner
+   *
+   * @generated from field: map<string, fits.api.v1.ProjectRole> project_roles = 4;
+   */
+  projectRoles: { [key: string]: ProjectRole };
+
+  /**
+   * TenantRoles associates a tenant id with the corresponding role of the token owner.
+   *
+   * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 5;
+   */
+  tenantRoles: { [key: string]: TenantRole };
+
+  /**
+   * AdminRole defines the admin role of the token owner
+   *
+   * @generated from field: optional fits.api.v1.AdminRole admin_role = 6;
+   */
+  adminRole?: AdminRole | undefined;
+
+  /**
+   * Labels on this token
+   *
+   * @generated from field: fits.api.v1.Labels labels = 7;
+   */
+  labels?: Labels | undefined;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceCreateRequest.
+ * Use `create(TokenServiceCreateRequestSchema)` to create a new message.
+ */
+export const TokenServiceCreateRequestSchema: GenMessage<TokenServiceCreateRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 1);
+
+/**
+ * MethodPermission is a mapping from a subject/project to a service method
+ *
+ * @generated from message fits.api.v1.MethodPermission
+ */
+export type MethodPermission = Message<"fits.api.v1.MethodPermission"> & {
+  /**
+   * Subject maybe either the project or the tenant
+   * for which the methods should be allowed
+   *
+   * asterisk (*) can be specified to match any subject
+   * empty string ("") can be specified for requests that do not require a subject, e.g. partition list
+   * otherwise either a projectid or a tenant login should be specified
+   *
+   * @generated from field: string subject = 1;
+   */
+  subject: string;
+
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.MethodPermission.
+ * Use `create(MethodPermissionSchema)` to create a new message.
+ */
+export const MethodPermissionSchema: GenMessage<MethodPermission> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 2);
+
+/**
+ * PermissionsByVisibility contains method permissions by visibility.
+ *
+ * @generated from message fits.api.v1.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"fits.api.v1.PermissionsByVisibility"> & {
+  /**
+   * Visibility defines the visibility of the requested method permissions.
+   *
+   * @generated from oneof fits.api.v1.PermissionsByVisibility.visibility
+   */
+  visibility: {
+    /**
+     * PublicPermissions carries public method permissions.
+     *
+     * @generated from field: fits.api.v1.PublicPermissions public = 1;
+     */
+    value: PublicPermissions;
+    case: "public";
+  } | {
+    /**
+     * SelfPermissions carries self method permissions.
+     *
+     * @generated from field: fits.api.v1.SelfPermissions self = 2;
+     */
+    value: SelfPermissions;
+    case: "self";
+  } | {
+    /**
+     * ProjectPermissions carries project method permissions.
+     *
+     * @generated from field: fits.api.v1.ProjectPermissions project = 3;
+     */
+    value: ProjectPermissions;
+    case: "project";
+  } | {
+    /**
+     * TenantPermissions carries tenant method permissions.
+     *
+     * @generated from field: fits.api.v1.TenantPermissions tenant = 4;
+     */
+    value: TenantPermissions;
+    case: "tenant";
+  } | {
+    /**
+     * AdminPermissions carries admin method permissions.
+     *
+     * @generated from field: fits.api.v1.AdminPermissions admin = 5;
+     */
+    value: AdminPermissions;
+    case: "admin";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 3);
+
+/**
+ * PublicPermissions carries public method permissions.
+ *
+ * @generated from message fits.api.v1.PublicPermissions
+ */
+export type PublicPermissions = Message<"fits.api.v1.PublicPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 1;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema: GenMessage<PublicPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 4);
+
+/**
+ * SelfPermissions carries self method permissions.
+ *
+ * @generated from message fits.api.v1.SelfPermissions
+ */
+export type SelfPermissions = Message<"fits.api.v1.SelfPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 1;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema: GenMessage<SelfPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 5);
+
+/**
+ * ProjectPermissions carries project method permissions.
+ *
+ * @generated from message fits.api.v1.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"fits.api.v1.ProjectPermissions"> & {
+  /**
+   * Project scope for the permissions.
+   * Asterisk (*) can be specified to match any subject.
+   *
+   * @generated from field: string project = 1;
+   */
+  project: string;
+
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema: GenMessage<ProjectPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 6);
+
+/**
+ * TenantPermissions carries tenant method permissions.
+ *
+ * @generated from message fits.api.v1.TenantPermissions
+ */
+export type TenantPermissions = Message<"fits.api.v1.TenantPermissions"> & {
+  /**
+   * Login of the tenant.
+   * Asterisk (*) can be specified to match any subject.
+   *
+   * @generated from field: string login = 1;
+   */
+  login: string;
+
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export const TenantPermissionsSchema: GenMessage<TenantPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 7);
+
+/**
+ * AdminPermissions carries admin method permissions.
+ *
+ * @generated from message fits.api.v1.AdminPermissions
+ */
+export type AdminPermissions = Message<"fits.api.v1.AdminPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 1;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema: GenMessage<AdminPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 8);
+
+/**
+ * TokenServiceCreateResponse is the response payload of a token create request
+ *
+ * @generated from message fits.api.v1.TokenServiceCreateResponse
+ */
+export type TokenServiceCreateResponse = Message<"fits.api.v1.TokenServiceCreateResponse"> & {
+  /**
+   * Token which was created
+   *
+   * @generated from field: fits.api.v1.Token token = 1;
+   */
+  token?: Token | undefined;
+
+  /**
+   * Secret is the body if the jwt token, should be used in api requests as bearer token
+   *
+   * @generated from field: string secret = 2;
+   */
+  secret: string;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceCreateResponse.
+ * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
+ */
+export const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 9);
+
+/**
+ * TokenServiceListRequest is the request payload to list tokens
+ *
+ * @generated from message fits.api.v1.TokenServiceListRequest
+ */
+export type TokenServiceListRequest = Message<"fits.api.v1.TokenServiceListRequest"> & {
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceListRequest.
+ * Use `create(TokenServiceListRequestSchema)` to create a new message.
+ */
+export const TokenServiceListRequestSchema: GenMessage<TokenServiceListRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 10);
+
+/**
+ * TokenServiceListResponse is the response payload of a token list request
+ *
+ * @generated from message fits.api.v1.TokenServiceListResponse
+ */
+export type TokenServiceListResponse = Message<"fits.api.v1.TokenServiceListResponse"> & {
+  /**
+   * Tokens is a list of tokens without the secrets
+   *
+   * @generated from field: repeated fits.api.v1.Token tokens = 1;
+   */
+  tokens: Token[];
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceListResponse.
+ * Use `create(TokenServiceListResponseSchema)` to create a new message.
+ */
+export const TokenServiceListResponseSchema: GenMessage<TokenServiceListResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 11);
+
+/**
+ * TokenServiceRevokeRequest is the request payload of a token revoke request
+ *
+ * @generated from message fits.api.v1.TokenServiceRevokeRequest
+ */
+export type TokenServiceRevokeRequest = Message<"fits.api.v1.TokenServiceRevokeRequest"> & {
+  /**
+   * Uuid of the token to revoke
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceRevokeRequest.
+ * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
+ */
+export const TokenServiceRevokeRequestSchema: GenMessage<TokenServiceRevokeRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 12);
+
+/**
+ * TokenServiceRevokeResponse is the response payload of a token revoke request
+ *
+ * @generated from message fits.api.v1.TokenServiceRevokeResponse
+ */
+export type TokenServiceRevokeResponse = Message<"fits.api.v1.TokenServiceRevokeResponse"> & {
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceRevokeResponse.
+ * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
+ */
+export const TokenServiceRevokeResponseSchema: GenMessage<TokenServiceRevokeResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 13);
+
+/**
+ * TokenServiceUpdateRequest is the request payload of a token update request
+ *
+ * @generated from message fits.api.v1.TokenServiceUpdateRequest
+ */
+export type TokenServiceUpdateRequest = Message<"fits.api.v1.TokenServiceUpdateRequest"> & {
+  /**
+   * Uuid of the token to update
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+
+  /**
+   * UpdateMeta contains the timestamp and strategy to be used in this update request
+   * TokenUpdate is not guarded with optlock in the backend
+   *
+   * @generated from field: fits.api.v1.UpdateMeta update_meta = 2;
+   */
+  updateMeta?: UpdateMeta | undefined;
+
+  /**
+   * Description is a user given description of this token.
+   *
+   * @generated from field: optional string description = 3;
+   */
+  description?: string | undefined;
+
+  /**
+   * Permissions is a list of service methods this token can be used for.
+   *
+   * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 4;
+   */
+  permissions: PermissionsByVisibility[];
+
+  /**
+   * ProjectRoles associates a project id with the corresponding role of the token owner
+   *
+   * @generated from field: map<string, fits.api.v1.ProjectRole> project_roles = 5;
+   */
+  projectRoles: { [key: string]: ProjectRole };
+
+  /**
+   * TenantRoles associates a tenant id with the corresponding role of the token owner.
+   *
+   * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 6;
+   */
+  tenantRoles: { [key: string]: TenantRole };
+
+  /**
+   * AdminRole defines the admin role of the token owner
+   *
+   * @generated from field: optional fits.api.v1.AdminRole admin_role = 7;
+   */
+  adminRole?: AdminRole | undefined;
+
+  /**
+   * Labels on this token
+   *
+   * @generated from field: fits.api.v1.UpdateLabels labels = 8;
+   */
+  labels?: UpdateLabels | undefined;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceUpdateRequest.
+ * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
+ */
+export const TokenServiceUpdateRequestSchema: GenMessage<TokenServiceUpdateRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 14);
+
+/**
+ * TokenServiceUpdateResponse is the response payload of a token update request
+ *
+ * @generated from message fits.api.v1.TokenServiceUpdateResponse
+ */
+export type TokenServiceUpdateResponse = Message<"fits.api.v1.TokenServiceUpdateResponse"> & {
+  /**
+   * Token is the updated token
+   *
+   * @generated from field: fits.api.v1.Token token = 1;
+   */
+  token?: Token | undefined;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceUpdateResponse.
+ * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
+ */
+export const TokenServiceUpdateResponseSchema: GenMessage<TokenServiceUpdateResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 15);
+
+/**
+ * TokenServiceGetRequest is the request payload of a token get request
+ *
+ * @generated from message fits.api.v1.TokenServiceGetRequest
+ */
+export type TokenServiceGetRequest = Message<"fits.api.v1.TokenServiceGetRequest"> & {
+  /**
+   * Uuid of the token to get
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceGetRequest.
+ * Use `create(TokenServiceGetRequestSchema)` to create a new message.
+ */
+export const TokenServiceGetRequestSchema: GenMessage<TokenServiceGetRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 16);
+
+/**
+ * TokenServiceGetResponse is the response payload of a token get request
+ *
+ * @generated from message fits.api.v1.TokenServiceGetResponse
+ */
+export type TokenServiceGetResponse = Message<"fits.api.v1.TokenServiceGetResponse"> & {
+  /**
+   * Token is the token
+   *
+   * @generated from field: fits.api.v1.Token token = 1;
+   */
+  token?: Token | undefined;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceGetResponse.
+ * Use `create(TokenServiceGetResponseSchema)` to create a new message.
+ */
+export const TokenServiceGetResponseSchema: GenMessage<TokenServiceGetResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 17);
+
+/**
+ * TokenServiceRefreshRequest is the request payload of a token refresh request
+ * Permissions, Roles and Expiration duration and all other properties are inherited from the calling token.
+ * The expiration duration will be calculated from the existing token (exp - iat)
+ *
+ * @generated from message fits.api.v1.TokenServiceRefreshRequest
+ */
+export type TokenServiceRefreshRequest = Message<"fits.api.v1.TokenServiceRefreshRequest"> & {
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceRefreshRequest.
+ * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
+ */
+export const TokenServiceRefreshRequestSchema: GenMessage<TokenServiceRefreshRequest> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 18);
+
+/**
+ * TokenServiceRefreshResponse is the response payload of a token refresh request
+ *
+ * @generated from message fits.api.v1.TokenServiceRefreshResponse
+ */
+export type TokenServiceRefreshResponse = Message<"fits.api.v1.TokenServiceRefreshResponse"> & {
+  /**
+   * Token which was refreshed
+   *
+   * @generated from field: fits.api.v1.Token token = 1;
+   */
+  token?: Token | undefined;
+
+  /**
+   * Secret is the body if the jwt token, should be used in api requests as bearer token
+   *
+   * @generated from field: string secret = 2;
+   */
+  secret: string;
+};
+
+/**
+ * Describes the message fits.api.v1.TokenServiceRefreshResponse.
+ * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
+ */
+export const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 19);
+
+/**
+ * TokenType specifies different use cases of tokens
+ *
+ * @generated from enum fits.api.v1.TokenType
+ */
+export enum TokenType {
+  /**
+   * TOKEN_TYPE_UNSPECIFIED is not specified
+   *
+   * @generated from enum value: TOKEN_TYPE_UNSPECIFIED = 0;
+   */
+  UNSPECIFIED = 0,
+
+  /**
+   * TOKEN_TYPE_API is a token for api usage
+   *
+   * @generated from enum value: TOKEN_TYPE_API = 1;
+   */
+  API = 1,
+
+  /**
+   * TOKEN_TYPE_USER is a token to access the api with cli, a web application or other user induced actions.
+   *
+   * @generated from enum value: TOKEN_TYPE_USER = 2;
+   */
+  USER = 2,
+}
+
+/**
+ * Describes the enum fits.api.v1.TokenType.
+ */
+export const TokenTypeSchema: GenEnum<TokenType> = /*@__PURE__*/
+  enumDesc(file_fits_api_v1_token, 0);
+
+/**
+ * TokenService provides token management operations.
+ *
+ * @generated from service fits.api.v1.TokenService
+ */
+export const TokenService: GenService<{
+  /**
+   * Returns the token with the specified UUID.
+   *
+   * @generated from rpc fits.api.v1.TokenService.Get
+   */
+  get: {
+    methodKind: "unary";
+    input: typeof TokenServiceGetRequestSchema;
+    output: typeof TokenServiceGetResponseSchema;
+  },
+  /**
+   * Creates a token to authenticate against the platform, the secret will be only visible in the response.
+   *
+   * @generated from rpc fits.api.v1.TokenService.Create
+   */
+  create: {
+    methodKind: "unary";
+    input: typeof TokenServiceCreateRequestSchema;
+    output: typeof TokenServiceCreateResponseSchema;
+  },
+  /**
+   * Updates a token.
+   *
+   * @generated from rpc fits.api.v1.TokenService.Update
+   */
+  update: {
+    methodKind: "unary";
+    input: typeof TokenServiceUpdateRequestSchema;
+    output: typeof TokenServiceUpdateResponseSchema;
+  },
+  /**
+   * Returns the list of all user tokens.
+   *
+   * @generated from rpc fits.api.v1.TokenService.List
+   */
+  list: {
+    methodKind: "unary";
+    input: typeof TokenServiceListRequestSchema;
+    output: typeof TokenServiceListResponseSchema;
+  },
+  /**
+   * Revokes a token, no further usage is possible afterwards.
+   *
+   * @generated from rpc fits.api.v1.TokenService.Revoke
+   */
+  revoke: {
+    methodKind: "unary";
+    input: typeof TokenServiceRevokeRequestSchema;
+    output: typeof TokenServiceRevokeResponseSchema;
+  },
+  /**
+   * Refreshes a token, this will create a new token with the exact same permissions as the calling token contains.
+   *
+   * @generated from rpc fits.api.v1.TokenService.Refresh
+   */
+  refresh: {
+    methodKind: "unary";
+    input: typeof TokenServiceRefreshRequestSchema;
+    output: typeof TokenServiceRefreshResponseSchema;
+  },
+}> = /*@__PURE__*/
+  serviceDesc(file_fits_api_v1_token, 0);
+