@fi-ts/api 0.0.1 → 0.0.3

package/fits/api/v1/token_pb.d.ts

@@ -1,6 +1,6 @@
 import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
-import type { AdminRole, Labels, Meta, ProjectRole, TenantRole, UpdateLabels, UpdateMeta } from "./common_pb";
-import type { Duration, Timestamp } from "@bufbuild/protobuf/wkt";
+import type { AdminRole, Meta, ProjectRole, TenantRole } from "./common_pb.js";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
 import type { Message } from "@bufbuild/protobuf";
 /**
  * Describes the file fits/api/v1/token.proto.
@@ -50,9 +50,9 @@ export type Token = Message<"fits.api.v1.Token"> & {
     /**
      * Permissions is a list of service methods this token can be used for
      *
-     * @generated from field: repeated fits.api.v1.MethodPermission permissions = 5;
+     * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 5;
      */
-    permissions: MethodPermission[];
+    permissions: PermissionsByVisibility[];
     /**
      * Expires gives the date in the future after which this token can not be used anymore
      *
@@ -80,7 +80,7 @@ export type Token = Message<"fits.api.v1.Token"> & {
         [key: string]: ProjectRole;
     };
     /**
-     * TenantRoles associates a tenant id with the corresponding role of the token owner
+     * TenantRoles associates a tenant id with the corresponding role of the token owner.
      *
      * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 10;
      */
@@ -93,6 +93,24 @@ export type Token = Message<"fits.api.v1.Token"> & {
      * @generated from field: optional fits.api.v1.AdminRole admin_role = 11;
      */
     adminRole?: AdminRole | undefined;
+    /**
+     * RawRoles are the raw roles transmitted by the OIDC provider.
+     *
+     * @generated from field: repeated string raw_roles = 12;
+     */
+    rawRoles: string[];
+    /**
+     * Name is the display name of the user the token was issued for.
+     *
+     * @generated from field: string name = 13;
+     */
+    name: string;
+    /**
+     * Email is the email address of the user the token was issued for.
+     *
+     * @generated from field: string email = 14;
+     */
+    email: string;
 };
 /**
  * Describes the message fits.api.v1.Token.
@@ -100,116 +118,199 @@ export type Token = Message<"fits.api.v1.Token"> & {
  */
 export declare const TokenSchema: GenMessage<Token>;
 /**
- * TokenServiceCreateRequest is the request payload to create a token
+ * MethodPermission is a mapping from a subject/project to a service method
  *
- * @generated from message fits.api.v1.TokenServiceCreateRequest
+ * @generated from message fits.api.v1.MethodPermission
  */
-export type TokenServiceCreateRequest = Message<"fits.api.v1.TokenServiceCreateRequest"> & {
+export type MethodPermission = Message<"fits.api.v1.MethodPermission"> & {
     /**
-     * Description of the token
+     * Subject maybe either the project or the tenant
+     * for which the methods should be allowed
      *
-     * @generated from field: string description = 1;
-     */
-    description: string;
-    /**
-     * Permissions is a list of service methods this token can be used for
+     * asterisk (*) can be specified to match any subject
+     * empty string ("") can be specified for requests that do not require a subject, e.g. partition list
+     * otherwise either a projectid or a tenant login should be specified
      *
-     * @generated from field: repeated fits.api.v1.MethodPermission permissions = 2;
+     * @generated from field: string subject = 1;
      */
-    permissions: MethodPermission[];
+    subject: string;
     /**
-     * Expires gives the duration since now, after which this token can not be used anymore
+     * Methods which should be accessible
      *
-     * @generated from field: google.protobuf.Duration expires = 3;
+     * @generated from field: repeated string methods = 2;
      */
-    expires?: Duration | undefined;
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.MethodPermission.
+ * Use `create(MethodPermissionSchema)` to create a new message.
+ */
+export declare const MethodPermissionSchema: GenMessage<MethodPermission>;
+/**
+ * PermissionsByVisibility contains method permissions by visibility.
+ *
+ * @generated from message fits.api.v1.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"fits.api.v1.PermissionsByVisibility"> & {
+    /**
+     * Visibility defines the visibility of the requested method permissions.
+     *
+     * @generated from oneof fits.api.v1.PermissionsByVisibility.visibility
+     */
+    visibility: {
+        /**
+         * PublicPermissions carries public method permissions.
+         *
+         * @generated from field: fits.api.v1.PublicPermissions public = 1;
+         */
+        value: PublicPermissions;
+        case: "public";
+    } | {
+        /**
+         * SelfPermissions carries self method permissions.
+         *
+         * @generated from field: fits.api.v1.SelfPermissions self = 2;
+         */
+        value: SelfPermissions;
+        case: "self";
+    } | {
+        /**
+         * ProjectPermissions carries project method permissions.
+         *
+         * @generated from field: fits.api.v1.ProjectPermissions project = 3;
+         */
+        value: ProjectPermissions;
+        case: "project";
+    } | {
+        /**
+         * TenantPermissions carries tenant method permissions.
+         *
+         * @generated from field: fits.api.v1.TenantPermissions tenant = 4;
+         */
+        value: TenantPermissions;
+        case: "tenant";
+    } | {
+        /**
+         * AdminPermissions carries admin method permissions.
+         *
+         * @generated from field: fits.api.v1.AdminPermissions admin = 5;
+         */
+        value: AdminPermissions;
+        case: "admin";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export declare const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility>;
+/**
+ * PublicPermissions carries public method permissions.
+ *
+ * @generated from message fits.api.v1.PublicPermissions
+ */
+export type PublicPermissions = Message<"fits.api.v1.PublicPermissions"> & {
     /**
-     * ProjectRoles associates a project id with the corresponding role of the token owner
+     * Methods which should be accessible.
      *
-     * @generated from field: map<string, fits.api.v1.ProjectRole> project_roles = 4;
+     * @generated from field: repeated string methods = 1;
      */
-    projectRoles: {
-        [key: string]: ProjectRole;
-    };
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export declare const PublicPermissionsSchema: GenMessage<PublicPermissions>;
+/**
+ * SelfPermissions carries self method permissions.
+ *
+ * @generated from message fits.api.v1.SelfPermissions
+ */
+export type SelfPermissions = Message<"fits.api.v1.SelfPermissions"> & {
     /**
-     * TenantRoles_associates a tenant id with the corresponding role of the token owner
+     * Methods which should be accessible.
      *
-     * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 5;
+     * @generated from field: repeated string methods = 1;
      */
-    tenantRoles: {
-        [key: string]: TenantRole;
-    };
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export declare const SelfPermissionsSchema: GenMessage<SelfPermissions>;
+/**
+ * ProjectPermissions carries project method permissions.
+ *
+ * @generated from message fits.api.v1.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"fits.api.v1.ProjectPermissions"> & {
     /**
-     * AdminRole defines the admin role of the token owner
+     * Project scope for the permissions.
+     * Asterisk (*) can be specified to match any subject.
      *
-     * @generated from field: optional fits.api.v1.AdminRole admin_role = 6;
+     * @generated from field: string project = 1;
      */
-    adminRole?: AdminRole | undefined;
+    project: string;
     /**
-     * Labels on this token
+     * Methods which should be accessible.
      *
-     * @generated from field: fits.api.v1.Labels labels = 7;
+     * @generated from field: repeated string methods = 2;
      */
-    labels?: Labels | undefined;
+    methods: string[];
 };
 /**
- * Describes the message fits.api.v1.TokenServiceCreateRequest.
- * Use `create(TokenServiceCreateRequestSchema)` to create a new message.
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
  */
-export declare const TokenServiceCreateRequestSchema: GenMessage<TokenServiceCreateRequest>;
+export declare const ProjectPermissionsSchema: GenMessage<ProjectPermissions>;
 /**
- * MethodPermission is a mapping from a subject/project to a service method
+ * TenantPermissions carries tenant method permissions.
  *
- * @generated from message fits.api.v1.MethodPermission
+ * @generated from message fits.api.v1.TenantPermissions
  */
-export type MethodPermission = Message<"fits.api.v1.MethodPermission"> & {
+export type TenantPermissions = Message<"fits.api.v1.TenantPermissions"> & {
     /**
-     * Subject maybe either the project or the tenant
-     * for which the methods should be allowed
+     * Login of the tenant.
+     * Asterisk (*) can be specified to match any subject.
      *
-     * asterisk (*) can be specified to match any subject
-     * empty string ("") can be specified for requests that do not require a subject, e.g. partition list
-     * otherwise either a projectid or a tenant login should be specified
-     *
-     * @generated from field: string subject = 1;
+     * @generated from field: string login = 1;
      */
-    subject: string;
+    login: string;
     /**
-     * Methods which should be accessible
+     * Methods which should be accessible.
      *
      * @generated from field: repeated string methods = 2;
      */
     methods: string[];
 };
 /**
- * Describes the message fits.api.v1.MethodPermission.
- * Use `create(MethodPermissionSchema)` to create a new message.
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
  */
-export declare const MethodPermissionSchema: GenMessage<MethodPermission>;
+export declare const TenantPermissionsSchema: GenMessage<TenantPermissions>;
 /**
- * TokenServiceCreateResponse is the response payload of a token create request
+ * AdminPermissions carries admin method permissions.
  *
- * @generated from message fits.api.v1.TokenServiceCreateResponse
+ * @generated from message fits.api.v1.AdminPermissions
  */
-export type TokenServiceCreateResponse = Message<"fits.api.v1.TokenServiceCreateResponse"> & {
+export type AdminPermissions = Message<"fits.api.v1.AdminPermissions"> & {
     /**
-     * Token which was created
+     * Methods which should be accessible.
      *
-     * @generated from field: fits.api.v1.Token token = 1;
+     * @generated from field: repeated string methods = 1;
      */
-    token?: Token | undefined;
-    /**
-     * Secret is the body if the jwt token, should be used in api requests as bearer token
-     *
-     * @generated from field: string secret = 2;
-     */
-    secret: string;
+    methods: string[];
 };
 /**
- * Describes the message fits.api.v1.TokenServiceCreateResponse.
- * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
  */
-export declare const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse>;
+export declare const AdminPermissionsSchema: GenMessage<AdminPermissions>;
 /**
  * TokenServiceListRequest is the request payload to list tokens
  *
@@ -268,89 +369,6 @@ export type TokenServiceRevokeResponse = Message<"fits.api.v1.TokenServiceRevoke
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
 export declare const TokenServiceRevokeResponseSchema: GenMessage<TokenServiceRevokeResponse>;
-/**
- * TokenServiceUpdateRequest is the request payload of a token update request
- *
- * @generated from message fits.api.v1.TokenServiceUpdateRequest
- */
-export type TokenServiceUpdateRequest = Message<"fits.api.v1.TokenServiceUpdateRequest"> & {
-    /**
-     * Uuid of the token to update
-     *
-     * @generated from field: string uuid = 1;
-     */
-    uuid: string;
-    /**
-     * UpdateMeta contains the timestamp and strategy to be used in this update request
-     * TokenUpdate is not guarded with optlock in the backend
-     *
-     * @generated from field: fits.api.v1.UpdateMeta update_meta = 2;
-     */
-    updateMeta?: UpdateMeta | undefined;
-    /**
-     * Description is a user given description of this token.
-     *
-     * @generated from field: optional string description = 3;
-     */
-    description?: string | undefined;
-    /**
-     * Permissions is a list of service methods this token can be used for
-     *
-     * @generated from field: repeated fits.api.v1.MethodPermission permissions = 4;
-     */
-    permissions: MethodPermission[];
-    /**
-     * ProjectRoles associates a project id with the corresponding role of the token owner
-     *
-     * @generated from field: map<string, fits.api.v1.ProjectRole> project_roles = 5;
-     */
-    projectRoles: {
-        [key: string]: ProjectRole;
-    };
-    /**
-     * TenantRoles associates a tenant id with the corresponding role of the token owner
-     *
-     * @generated from field: map<string, fits.api.v1.TenantRole> tenant_roles = 6;
-     */
-    tenantRoles: {
-        [key: string]: TenantRole;
-    };
-    /**
-     * AdminRole defines the admin role of the token owner
-     *
-     * @generated from field: optional fits.api.v1.AdminRole admin_role = 7;
-     */
-    adminRole?: AdminRole | undefined;
-    /**
-     * Labels on this token
-     *
-     * @generated from field: fits.api.v1.UpdateLabels labels = 8;
-     */
-    labels?: UpdateLabels | undefined;
-};
-/**
- * Describes the message fits.api.v1.TokenServiceUpdateRequest.
- * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
- */
-export declare const TokenServiceUpdateRequestSchema: GenMessage<TokenServiceUpdateRequest>;
-/**
- * TokenServiceUpdateResponse is the response payload of a token update request
- *
- * @generated from message fits.api.v1.TokenServiceUpdateResponse
- */
-export type TokenServiceUpdateResponse = Message<"fits.api.v1.TokenServiceUpdateResponse"> & {
-    /**
-     * Token is the updated token
-     *
-     * @generated from field: fits.api.v1.Token token = 1;
-     */
-    token?: Token | undefined;
-};
-/**
- * Describes the message fits.api.v1.TokenServiceUpdateResponse.
- * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
- */
-export declare const TokenServiceUpdateResponseSchema: GenMessage<TokenServiceUpdateResponse>;
 /**
  * TokenServiceGetRequest is the request payload of a token get request
  *
@@ -387,43 +405,6 @@ export type TokenServiceGetResponse = Message<"fits.api.v1.TokenServiceGetRespon
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
 export declare const TokenServiceGetResponseSchema: GenMessage<TokenServiceGetResponse>;
-/**
- * TokenServiceRefreshRequest is the request payload of a token refresh request
- * Permissions, Roles and Expiration duration and all other properties are inherited from the calling token.
- * The expiration duration will be calculated from the existing token (exp - iat)
- *
- * @generated from message fits.api.v1.TokenServiceRefreshRequest
- */
-export type TokenServiceRefreshRequest = Message<"fits.api.v1.TokenServiceRefreshRequest"> & {};
-/**
- * Describes the message fits.api.v1.TokenServiceRefreshRequest.
- * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
- */
-export declare const TokenServiceRefreshRequestSchema: GenMessage<TokenServiceRefreshRequest>;
-/**
- * TokenServiceRefreshResponse is the response payload of a token refresh request
- *
- * @generated from message fits.api.v1.TokenServiceRefreshResponse
- */
-export type TokenServiceRefreshResponse = Message<"fits.api.v1.TokenServiceRefreshResponse"> & {
-    /**
-     * Token which was refreshed
-     *
-     * @generated from field: fits.api.v1.Token token = 1;
-     */
-    token?: Token | undefined;
-    /**
-     * Secret is the body if the jwt token, should be used in api requests as bearer token
-     *
-     * @generated from field: string secret = 2;
-     */
-    secret: string;
-};
-/**
- * Describes the message fits.api.v1.TokenServiceRefreshResponse.
- * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
- */
-export declare const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse>;
 /**
  * TokenType specifies different use cases of tokens
  *
@@ -469,26 +450,6 @@ export declare const TokenService: GenService<{
         input: typeof TokenServiceGetRequestSchema;
         output: typeof TokenServiceGetResponseSchema;
     };
-    /**
-     * Creates a token to authenticate against the platform, the secret will be only visible in the response.
-     *
-     * @generated from rpc fits.api.v1.TokenService.Create
-     */
-    create: {
-        methodKind: "unary";
-        input: typeof TokenServiceCreateRequestSchema;
-        output: typeof TokenServiceCreateResponseSchema;
-    };
-    /**
-     * Updates a token.
-     *
-     * @generated from rpc fits.api.v1.TokenService.Update
-     */
-    update: {
-        methodKind: "unary";
-        input: typeof TokenServiceUpdateRequestSchema;
-        output: typeof TokenServiceUpdateResponseSchema;
-    };
     /**
      * Returns the list of all user tokens.
      *
@@ -509,14 +470,4 @@ export declare const TokenService: GenService<{
         input: typeof TokenServiceRevokeRequestSchema;
         output: typeof TokenServiceRevokeResponseSchema;
     };
-    /**
-     * Refreshes a token, this will create a new token with the exact same permissions as the calling token contains.
-     *
-     * @generated from rpc fits.api.v1.TokenService.Refresh
-     */
-    refresh: {
-        methodKind: "unary";
-        input: typeof TokenServiceRefreshRequestSchema;
-        output: typeof TokenServiceRefreshResponseSchema;
-    };
 }>;

package/fits/api/v1/token_pb.js

@@ -1,85 +1,85 @@
-// @generated by protoc-gen-es v2.14.1 with parameter "target=ts"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file fits/api/v1/token.proto (package fits.api.v1, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
-import { file_fits_api_v1_common } from "./common_pb";
-import { file_fits_api_v1_predefined_rules } from "./predefined_rules_pb";
-import { file_google_protobuf_duration, file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
+import { file_buf_validate_validate } from "../../../buf/validate/validate_pb.js";
+import { file_fits_api_v1_common } from "./common_pb.js";
+import { file_fits_api_v1_predefined_rules } from "./predefined_rules_pb.js";
+import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file fits/api/v1/token.proto.
  */
-export const file_fits_api_v1_token = /*@__PURE__*/ fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEizQYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEj0KC3Blcm1pc3Npb25zGAUgAygLMh0uZml0cy5hcGkudjEuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNAoKdG9rZW5fdHlwZRgIIAEoDjIWLmZpdHMuYXBpLnYxLlRva2VuVHlwZUIIukgFggECEAESOwoNcHJvamVjdF9yb2xlcxgJIAMoCzIkLmZpdHMuYXBpLnYxLlRva2VuLlByb2plY3RSb2xlc0VudHJ5EjkKDHRlbmFudF9yb2xlcxgKIAMoCzIjLmZpdHMuYXBpLnYxLlRva2VuLlRlbmFudFJvbGVzRW50cnkSOQoKYWRtaW5fcm9sZRgLIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4ATqfAbpImwEamAEKG3Rva2VuLnBlcm1pc3Npb25zLnVzZXJ0b2tlbhIpdG9rZW4gdHlwZSB1c2VyIG11c3Qgbm90IGhhdmUgcGVybWlzc2lvbnMaTih0aGlzLnRva2VuX3R5cGUgPT0gMiAmJiB0aGlzLnBlcm1pc3Npb25zLnNpemUoKSA9PSAwKSB8fCB0aGlzLnRva2VuX3R5cGUgIT0gMkINCgtfYWRtaW5fcm9sZSKgBQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIgCgtkZXNjcmlwdGlvbhgBIAEoCUILukgIcgbIs66xAgESPAoLcGVybWlzc2lvbnMYAiADKAsyHS5maXRzLmFwaS52MS5NZXRob2RQZXJtaXNzaW9uQgi6SAWSAQIQZBI+CgdleHBpcmVzGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQhK6SA+qAQwaBQiB54QPMgMI2AQSawoNcHJvamVjdF9yb2xlcxgEIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgFIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAYgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgAiAEBEiMKBmxhYmVscxgHIAEoCzITLmZpdHMuYXBpLnYxLkxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUINCgtfYWRtaW5fcm9sZSJJChBNZXRob2RQZXJtaXNzaW9uEhkKB3N1YmplY3QYASABKAlCCLpIBXIDGIACEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJPChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuEg4KBnNlY3JldBgCIAEoCSIZChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdCI+ChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USIgoGdG9rZW5zGAEgAygLMhIuZml0cy5hcGkudjEuVG9rZW4iMwoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSK/BQoZVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARI0Cgt1cGRhdGVfbWV0YRgCIAEoCzIXLmZpdHMuYXBpLnYxLlVwZGF0ZU1ldGFCBrpIA8gBABIlCgtkZXNjcmlwdGlvbhgDIAEoCUILukgIcgbIs66xAgFIAIgBARIyCgtwZXJtaXNzaW9ucxgEIAMoCzIdLmZpdHMuYXBpLnYxLk1ldGhvZFBlcm1pc3Npb24SawoNcHJvamVjdF9yb2xlcxgFIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgGIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAcgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgBiAEBEikKBmxhYmVscxgIIAEoCzIZLmZpdHMuYXBpLnYxLlVwZGF0ZUxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGUiPwoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIjwKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiUAobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjLgBAoMVG9rZW5TZXJ2aWNlEloKA0dldBIjLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUdldFJlcXVlc3QaJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESYwoGQ3JlYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJjCgZVcGRhdGUSJi5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0GicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJmCgdSZWZyZXNoEicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaKC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQpYBCg9jb20uZml0cy5hcGkudjFCClRva2VuUHJvdG9QAVopZ2l0aHViLmNvbS9maS10cy9hcGkvZ28vZml0cy9hcGkvdjE7YXBpdjGiAgNGQViqAgtGaXRzLkFwaS5WMcoCC0ZpdHNcQXBpXFYx4gIXRml0c1xBcGlcVjFcR1BCTWV0YWRhdGHqAg1GaXRzOjpBcGk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
+export const file_fits_api_v1_token = /*@__PURE__*/ fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEiyQcKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEkQKC3Blcm1pc3Npb25zGAUgAygLMiQuZml0cy5hcGkudjEuUGVybWlzc2lvbnNCeVZpc2liaWxpdHlCCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKCnRva2VuX3R5cGUYCCABKA4yFi5maXRzLmFwaS52MS5Ub2tlblR5cGVCCLpIBYIBAhABEjsKDXByb2plY3Rfcm9sZXMYCSADKAsyJC5maXRzLmFwaS52MS5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeRJUCgx0ZW5hbnRfcm9sZXMYCiADKAsyIy5maXRzLmFwaS52MS5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEjkKCmFkbWluX3JvbGUYCyABKA4yFi5maXRzLmFwaS52MS5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESJwoJcmF3X3JvbGVzGAwgAygJQhS6SBGSAQ7QpLOxAgHYpLOxAgEYARIWCgRuYW1lGA0gASgJQgi6SAVyAxiAAhIXCgVlbWFpbBgOIAEoCUIIukgFcgMYgAIaTQoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEicKBXZhbHVlGAIgASgOMhguZml0cy5hcGkudjEuUHJvamVjdFJvbGU6AjgBGksKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgOMhcuZml0cy5hcGkudjEuVGVuYW50Um9sZToCOAE6nwG6SJsBGpgBCht0b2tlbi5wZXJtaXNzaW9ucy51c2VydG9rZW4SKXRva2VuIHR5cGUgdXNlciBtdXN0IG5vdCBoYXZlIHBlcm1pc3Npb25zGk4odGhpcy50b2tlbl90eXBlID09IDIgJiYgdGhpcy5wZXJtaXNzaW9ucy5zaXplKCkgPT0gMCkgfHwgdGhpcy50b2tlbl90eXBlICE9IDJCDQoLX2FkbWluX3JvbGUiSQoQTWV0aG9kUGVybWlzc2lvbhIZCgdzdWJqZWN0GAEgASgJQgi6SAVyAxiAAhIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMinQIKF1Blcm1pc3Npb25zQnlWaXNpYmlsaXR5EjAKBnB1YmxpYxgBIAEoCzIeLmZpdHMuYXBpLnYxLlB1YmxpY1Blcm1pc3Npb25zSAASLAoEc2VsZhgCIAEoCzIcLmZpdHMuYXBpLnYxLlNlbGZQZXJtaXNzaW9uc0gAEjIKB3Byb2plY3QYAyABKAsyHy5maXRzLmFwaS52MS5Qcm9qZWN0UGVybWlzc2lvbnNIABIwCgZ0ZW5hbnQYBCABKAsyHi5maXRzLmFwaS52MS5UZW5hbnRQZXJtaXNzaW9uc0gAEi4KBWFkbWluGAUgASgLMh0uZml0cy5hcGkudjEuQWRtaW5QZXJtaXNzaW9uc0gAQgwKCnZpc2liaWxpdHkiLwoRUHVibGljUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgBIAMoCUIJukgGkgEDEPQDIi0KD1NlbGZQZXJtaXNzaW9ucxIaCgdtZXRob2RzGAEgAygJQgm6SAaSAQMQ9AMiTgoSUHJvamVjdFBlcm1pc3Npb25zEhwKB3Byb2plY3QYASABKAlCC7pICHIGmLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJLChFUZW5hbnRQZXJtaXNzaW9ucxIaCgVsb2dpbhgBIAEoCUILukgIcgaQtK6xAgESGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIi4KEEFkbWluUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgBIAMoCUIJukgGkgEDEPQDIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0Ij4KGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIiCgZ0b2tlbnMYASADKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIjAKFlRva2VuU2VydmljZUdldFJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiPAoXVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbipQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIyrgIKDFRva2VuU2VydmljZRJaCgNHZXQSIy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GiQuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYAUKWAQoPY29tLmZpdHMuYXBpLnYxQgpUb2tlblByb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_timestamp]);
 /**
  * Describes the message fits.api.v1.Token.
  * Use `create(TokenSchema)` to create a new message.
  */
 export const TokenSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 0);
-/**
- * Describes the message fits.api.v1.TokenServiceCreateRequest.
- * Use `create(TokenServiceCreateRequestSchema)` to create a new message.
- */
-export const TokenServiceCreateRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 1);
 /**
  * Describes the message fits.api.v1.MethodPermission.
  * Use `create(MethodPermissionSchema)` to create a new message.
  */
-export const MethodPermissionSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 2);
+export const MethodPermissionSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 1);
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 2);
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 3);
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 4);
+/**
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 5);
 /**
- * Describes the message fits.api.v1.TokenServiceCreateResponse.
- * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
  */
-export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 3);
+export const TenantPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 6);
+/**
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 7);
 /**
  * Describes the message fits.api.v1.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
  */
-export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 4);
+export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 8);
 /**
  * Describes the message fits.api.v1.TokenServiceListResponse.
  * Use `create(TokenServiceListResponseSchema)` to create a new message.
  */
-export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 5);
+export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 9);
 /**
  * Describes the message fits.api.v1.TokenServiceRevokeRequest.
  * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
  */
-export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 6);
+export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 10);
 /**
  * Describes the message fits.api.v1.TokenServiceRevokeResponse.
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
-export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 7);
-/**
- * Describes the message fits.api.v1.TokenServiceUpdateRequest.
- * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
- */
-export const TokenServiceUpdateRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 8);
-/**
- * Describes the message fits.api.v1.TokenServiceUpdateResponse.
- * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
- */
-export const TokenServiceUpdateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 9);
+export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 11);
 /**
  * Describes the message fits.api.v1.TokenServiceGetRequest.
  * Use `create(TokenServiceGetRequestSchema)` to create a new message.
  */
-export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 10);
+export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 12);
 /**
  * Describes the message fits.api.v1.TokenServiceGetResponse.
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
-export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 11);
-/**
- * Describes the message fits.api.v1.TokenServiceRefreshRequest.
- * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
- */
-export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 12);
-/**
- * Describes the message fits.api.v1.TokenServiceRefreshResponse.
- * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
- */
-export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 13);
+export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 13);
 /**
  * TokenType specifies different use cases of tokens
  *