|
| 1 | +// Public API for resolving the identity associated with an authenticated request. |
| 2 | + |
| 3 | +edition = "2023"; |
| 4 | + |
| 5 | +package authentication.v1alpha1; |
| 6 | + |
| 7 | +import "buf/validate/validate.proto"; |
| 8 | +import "tilebox/v1/id.proto"; |
| 9 | + |
| 10 | +option features.field_presence = IMPLICIT; |
| 11 | + |
| 12 | +// User is the Tilebox user associated with an authenticated request. |
| 13 | +message User { |
| 14 | + // The user's Tilebox ID. |
| 15 | + tilebox.v1.ID id = 1 [(buf.validate.field).required = true]; |
| 16 | + // The user's display name. |
| 17 | + string name = 2; |
| 18 | + // The user's email address. |
| 19 | + string email = 3; |
| 20 | +} |
| 21 | + |
| 22 | +// Organization is the Tilebox organization associated with an authenticated request. |
| 23 | +message Organization { |
| 24 | + // The organization's Tilebox ID. |
| 25 | + tilebox.v1.ID id = 1 [(buf.validate.field).required = true]; |
| 26 | + // The organization's display name. |
| 27 | + string name = 2; |
| 28 | + // The organization's unique slug. |
| 29 | + string slug = 3; |
| 30 | +} |
| 31 | + |
| 32 | +// APIKey identifies an API key without exposing its secret. |
| 33 | +message APIKey { |
| 34 | + // The API key's Tilebox ID. |
| 35 | + tilebox.v1.ID id = 1 [(buf.validate.field).required = true]; |
| 36 | + // The non-secret identifier embedded in the API key. |
| 37 | + string identifier = 2; |
| 38 | + // The API key's user-provided description. |
| 39 | + string description = 3; |
| 40 | +} |
| 41 | + |
| 42 | +// GetAuthenticationStatusRequest requests the identity associated with the calling credential. |
| 43 | +message GetAuthenticationStatusRequest {} |
| 44 | + |
| 45 | +// AuthenticationStatus describes the identity associated with the calling credential. |
| 46 | +message AuthenticationStatus { |
| 47 | + // The authenticated user. |
| 48 | + User user = 1 [(buf.validate.field).required = true]; |
| 49 | + // The organization the request acts within. |
| 50 | + Organization organization = 2 [(buf.validate.field).required = true]; |
| 51 | + // The API key used to authenticate the request. Unset for JWT or session authentication. |
| 52 | + APIKey api_key = 3; |
| 53 | +} |
| 54 | + |
| 55 | +// AuthenticationService exposes information about the effective authentication of a request. |
| 56 | +service AuthenticationService { |
| 57 | + // GetAuthenticationStatus resolves the calling credential to its effective user and organization. |
| 58 | + // Requests without valid authentication fail with UNAUTHENTICATED. |
| 59 | + rpc GetAuthenticationStatus(GetAuthenticationStatusRequest) returns (AuthenticationStatus) {} |
| 60 | +} |
0 commit comments