@structured-id/ui-core 1.2.0 → 2.0.0

package/src/generated/sid/v1/authz/forward_auth.client.ts

@@ -0,0 +1,97 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/authz/forward_auth.proto" (package "sid.v1.authz", syntax proto3)
+// tslint:disable
+import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
+import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import { ForwardAuthService } from "./forward_auth";
+import { stackIntercept } from "@protobuf-ts/runtime-rpc";
+import type { HttpBody } from "../../../google/api/httpbody";
+import type { VerifyRequest } from "./forward_auth";
+import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
+import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
+/**
+ * @generated from protobuf service sid.v1.authz.ForwardAuthService
+ */
+export interface IForwardAuthServiceClient {
+    /**
+     * Decide whether the original request may reach `application`.
+     *
+     * The reverse proxy sub-requests `/auth/verify/{application}` with the
+     * original request's method, so the rule binds every method. The
+     * application comes from the address the proxy is configured with, never
+     * from anything the client sends; it names a protected application of the
+     * route configuration, which pins the registered resource (exact issuer
+     * and resource indicator) its access tokens must be issued for.
+     *
+     * Request metadata, as the proxy forwards the original request:
+     * `authorization` (`Bearer`, RFC 6750 §2.1, or `DPoP`, RFC 9449 §7.1),
+     * `dpop` (the proof, RFC 9449 §4), `x-original-uri` or `x-forwarded-uri`
+     * (path and query), `x-original-method` or `x-forwarded-method`.
+     *
+     * The decision is the HTTP answer the proxy acts on, carried in the
+     * `x-http-code` response metadata with an empty body:
+     * - 200: allowed; response metadata carries the identity headers of the
+     *   route (`x-forwarded-user` = the token's recipient-scoped `sub`,
+     *   `x-auth-request-*` for disclosed claims), which the proxy copies to
+     *   the upstream request after removing any client-supplied copies;
+     * - 401: no acceptable access token for this application, with
+     *   `www-authenticate` (a DPoP challenge when a sender constraint failed,
+     *   RFC 9449 §7.1) and, when a login URL is configured, `location`;
+     * - 403: authenticated but not allowed, or the application's resource is
+     *   not registered or not active.
+     * An application not in the route configuration is NOT_FOUND (ErrorInfo
+     * reason FORWARD_AUTH_APPLICATION_NOT_FOUND, ResourceInfo naming it); a
+     * registry or revocation check that cannot be answered is UNAVAILABLE. The
+     * proxy denies on both.
+     *
+     * @generated from protobuf rpc: Verify
+     */
+    verify(input: VerifyRequest, options?: RpcOptions): UnaryCall<VerifyRequest, HttpBody>;
+}
+/**
+ * @generated from protobuf service sid.v1.authz.ForwardAuthService
+ */
+export class ForwardAuthServiceClient implements IForwardAuthServiceClient, ServiceInfo {
+    typeName = ForwardAuthService.typeName;
+    methods = ForwardAuthService.methods;
+    options = ForwardAuthService.options;
+    constructor(private readonly _transport: RpcTransport) {
+    }
+    /**
+     * Decide whether the original request may reach `application`.
+     *
+     * The reverse proxy sub-requests `/auth/verify/{application}` with the
+     * original request's method, so the rule binds every method. The
+     * application comes from the address the proxy is configured with, never
+     * from anything the client sends; it names a protected application of the
+     * route configuration, which pins the registered resource (exact issuer
+     * and resource indicator) its access tokens must be issued for.
+     *
+     * Request metadata, as the proxy forwards the original request:
+     * `authorization` (`Bearer`, RFC 6750 §2.1, or `DPoP`, RFC 9449 §7.1),
+     * `dpop` (the proof, RFC 9449 §4), `x-original-uri` or `x-forwarded-uri`
+     * (path and query), `x-original-method` or `x-forwarded-method`.
+     *
+     * The decision is the HTTP answer the proxy acts on, carried in the
+     * `x-http-code` response metadata with an empty body:
+     * - 200: allowed; response metadata carries the identity headers of the
+     *   route (`x-forwarded-user` = the token's recipient-scoped `sub`,
+     *   `x-auth-request-*` for disclosed claims), which the proxy copies to
+     *   the upstream request after removing any client-supplied copies;
+     * - 401: no acceptable access token for this application, with
+     *   `www-authenticate` (a DPoP challenge when a sender constraint failed,
+     *   RFC 9449 §7.1) and, when a login URL is configured, `location`;
+     * - 403: authenticated but not allowed, or the application's resource is
+     *   not registered or not active.
+     * An application not in the route configuration is NOT_FOUND (ErrorInfo
+     * reason FORWARD_AUTH_APPLICATION_NOT_FOUND, ResourceInfo naming it); a
+     * registry or revocation check that cannot be answered is UNAVAILABLE. The
+     * proxy denies on both.
+     *
+     * @generated from protobuf rpc: Verify
+     */
+    verify(input: VerifyRequest, options?: RpcOptions): UnaryCall<VerifyRequest, HttpBody> {
+        const method = this.methods[0], opt = this._transport.mergeOptions(options);
+        return stackIntercept<VerifyRequest, HttpBody>("unary", this._transport, method, opt, input);
+    }
+}

package/src/generated/sid/v1/authz/forward_auth.ts

@@ -0,0 +1,79 @@
+// @generated by protobuf-ts 2.11.1 with parameter client_generic,generate_dependencies
+// @generated from protobuf file "sid/v1/authz/forward_auth.proto" (package "sid.v1.authz", syntax proto3)
+// tslint:disable
+import { HttpBody } from "../../../google/api/httpbody";
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+/**
+ * @generated from protobuf message sid.v1.authz.VerifyRequest
+ */
+export interface VerifyRequest {
+    /**
+     * Name of the protected application in the route configuration: letters,
+     * digits, '-' and '_'. Set by the reverse proxy's configured address.
+     *
+     * @generated from protobuf field: string application = 1
+     */
+    application: string;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class VerifyRequest$Type extends MessageType<VerifyRequest> {
+    constructor() {
+        super("sid.v1.authz.VerifyRequest", [
+            { no: 1, name: "application", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<VerifyRequest>): VerifyRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.application = "";
+        if (value !== undefined)
+            reflectionMergePartial<VerifyRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: VerifyRequest): VerifyRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string application */ 1:
+                    message.application = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: VerifyRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string application = 1; */
+        if (message.application !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.application);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.VerifyRequest
+ */
+export const VerifyRequest = new VerifyRequest$Type();
+/**
+ * @generated ServiceType for protobuf service sid.v1.authz.ForwardAuthService
+ */
+export const ForwardAuthService = new ServiceType("sid.v1.authz.ForwardAuthService", [
+    { name: "Verify", options: { "google.api.http": { custom: { kind: "*", path: "/auth/verify/{application}" } } }, I: VerifyRequest, O: HttpBody }
+]);

package/src/generated/sid/v1/authz/governance.client.ts

@@ -16,7 +16,7 @@ import type { AccessRequestMessage } from "./governance";
 import type { UnaryCall } from "@protobuf-ts/runtime-rpc";
 import type { RpcOptions } from "@protobuf-ts/runtime-rpc";
 // ────────────────────────────────────────────────────────────────────────────
-// GovernanceService — CE access lifecycle (4 RPCs)
+// GovernanceService: access lifecycle (4 RPCs)
 // SoD checks + role assignment listing → AuthzService (authz.proto)
 // ────────────────────────────────────────────────────────────────────────────
 
@@ -50,7 +50,7 @@ export interface IGovernanceServiceClient {
     grantTemporaryRole(input: GrantTemporaryRoleRequest, options?: RpcOptions): UnaryCall<GrantTemporaryRoleRequest, GrantTemporaryRoleResponse>;
 }
 // ────────────────────────────────────────────────────────────────────────────
-// GovernanceService — CE access lifecycle (4 RPCs)
+// GovernanceService: access lifecycle (4 RPCs)
 // SoD checks + role assignment listing → AuthzService (authz.proto)
 // ────────────────────────────────────────────────────────────────────────────
 

package/src/generated/sid/v1/authz/governance.ts

@@ -24,21 +24,39 @@ import { Duration } from "../../../google/protobuf/duration";
  */
 export interface AccessRequestMessage {
     /**
+     * Profile asking for the role (UUID). The caller itself, or anyone when an
+     * administrator files the request on its behalf.
+     *
      * @generated from protobuf field: string requester_profile_id = 1
      */
     requesterProfileId: string;
     /**
+     * Key of the requested role within `project_id`. A role the project does
+     * not define is NOT_FOUND; nothing is stored.
+     *
      * @generated from protobuf field: string requested_role = 2
      */
     requestedRole: string;
     /**
+     * Why the requester needs the role, shown to the approver.
+     *
      * @generated from protobuf field: string justification = 3
      */
     justification: string;
     /**
+     * How long the role is wanted; absent = permanent. On approval the
+     * assignment expires after it.
+     *
      * @generated from protobuf field: optional google.protobuf.Duration requested_duration = 4
      */
-    requestedDuration?: Duration; // null = permanent
+    requestedDuration?: Duration;
+    /**
+     * Project (UUID) whose role is requested: roles are defined per project.
+     * An unknown project is NOT_FOUND.
+     *
+     * @generated from protobuf field: string project_id = 5
+     */
+    projectId: string;
 }
 /**
  * @generated from protobuf message sid.v1.authz.AccessRequestResponse
@@ -125,17 +143,26 @@ export interface AccessRequestDetail {
  */
 export interface DecideRequestRequest {
     /**
+     * Access request (UUID) being decided.
+     *
      * @generated from protobuf field: string request_id = 1
      */
     requestId: string;
     /**
+     * Approve (grant the role) or deny. An approval and the role assignment it
+     * makes are recorded together: when the role can no longer be assigned
+     * (it was deleted) the call fails FAILED_PRECONDITION and the request
+     * stays pending.
+     *
      * @generated from protobuf field: bool approved = 2
      */
     approved: boolean;
     /**
+     * Reviewer's comment, recorded on the request.
+     *
      * @generated from protobuf field: string reason = 3
      */
-    reason: string; // Required for deny, optional for approve
+    reason: string;
 }
 /**
  * @generated from protobuf message sid.v1.authz.DecideRequestResponse
@@ -159,21 +186,35 @@ export interface DecideRequestResponse {
  */
 export interface GrantTemporaryRoleRequest {
     /**
+     * Profile receiving the role (UUID); an unknown profile is NOT_FOUND.
+     *
      * @generated from protobuf field: string profile_id = 1
      */
     profileId: string;
     /**
+     * Key of the role within `project_id`; an unknown role is NOT_FOUND.
+     *
      * @generated from protobuf field: string role = 2
      */
     role: string;
     /**
+     * When the assignment is revoked automatically; must be in the future.
+     *
      * @generated from protobuf field: google.protobuf.Timestamp expires_at = 3
      */
     expiresAt?: Timestamp;
     /**
+     * Why the role is granted, recorded in the audit trail.
+     *
      * @generated from protobuf field: string justification = 4
      */
     justification: string;
+    /**
+     * Project (UUID) whose role is granted: roles are defined per project.
+     *
+     * @generated from protobuf field: string project_id = 5
+     */
+    projectId: string;
 }
 /**
  * @generated from protobuf message sid.v1.authz.GrantTemporaryRoleResponse
@@ -232,7 +273,8 @@ class AccessRequestMessage$Type extends MessageType<AccessRequestMessage> {
             { no: 1, name: "requester_profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "requested_role", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "justification", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "requested_duration", kind: "message", T: () => Duration }
+            { no: 4, name: "requested_duration", kind: "message", T: () => Duration },
+            { no: 5, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<AccessRequestMessage>): AccessRequestMessage {
@@ -240,6 +282,7 @@ class AccessRequestMessage$Type extends MessageType<AccessRequestMessage> {
         message.requesterProfileId = "";
         message.requestedRole = "";
         message.justification = "";
+        message.projectId = "";
         if (value !== undefined)
             reflectionMergePartial<AccessRequestMessage>(this, message, value);
         return message;
@@ -261,6 +304,9 @@ class AccessRequestMessage$Type extends MessageType<AccessRequestMessage> {
                 case /* optional google.protobuf.Duration requested_duration */ 4:
                     message.requestedDuration = Duration.internalBinaryRead(reader, reader.uint32(), options, message.requestedDuration);
                     break;
+                case /* string project_id */ 5:
+                    message.projectId = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -285,6 +331,9 @@ class AccessRequestMessage$Type extends MessageType<AccessRequestMessage> {
         /* optional google.protobuf.Duration requested_duration = 4; */
         if (message.requestedDuration)
             Duration.internalBinaryWrite(message.requestedDuration, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        /* string project_id = 5; */
+        if (message.projectId !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.projectId);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -690,7 +739,8 @@ class GrantTemporaryRoleRequest$Type extends MessageType<GrantTemporaryRoleReque
             { no: 1, name: "profile_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "role", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "expires_at", kind: "message", T: () => Timestamp },
-            { no: 4, name: "justification", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 4, name: "justification", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<GrantTemporaryRoleRequest>): GrantTemporaryRoleRequest {
@@ -698,6 +748,7 @@ class GrantTemporaryRoleRequest$Type extends MessageType<GrantTemporaryRoleReque
         message.profileId = "";
         message.role = "";
         message.justification = "";
+        message.projectId = "";
         if (value !== undefined)
             reflectionMergePartial<GrantTemporaryRoleRequest>(this, message, value);
         return message;
@@ -719,6 +770,9 @@ class GrantTemporaryRoleRequest$Type extends MessageType<GrantTemporaryRoleReque
                 case /* string justification */ 4:
                     message.justification = reader.string();
                     break;
+                case /* string project_id */ 5:
+                    message.projectId = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -743,6 +797,9 @@ class GrantTemporaryRoleRequest$Type extends MessageType<GrantTemporaryRoleReque
         /* string justification = 4; */
         if (message.justification !== "")
             writer.tag(4, WireType.LengthDelimited).string(message.justification);
+        /* string project_id = 5; */
+        if (message.projectId !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.projectId);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);