// Copyright 2017 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// THIS FILE IS AUTOMATICALLY GENERATED BY MIXGEN.

syntax = "proto3";


// The `authorization` template defines parameters for performing policy
// enforcement within Istio. It is primarily concerned with enabling Mixer
// 
// Example config:
// 
// ```yaml
// apiVersion: "config.istio.io/v1alpha2"
// kind: instance
// metadata:
//   name: authinfo
//   namespace: istio-system
// spec:
//   compiledTemplate: authorization
//   params:
//     subject:
//       user: source.principal | request.auth.principal | ""
//       groups: request.auth.claims["groups"] | ""
//       properties:
//         iss: request.auth.claims["iss"]
//     action:
//       namespace: destination.namespace | "default"
//       service: destination.service.host | ""
//       path: request.path | "/"
//       method: request.method | "post"
//       properties:
//         version: destination.labels[version] | ""
// ```
//
// The `authorization` template defines parameters for performing policy
// enforcement within Istio. It is primarily concerned with enabling Mixer
// adapters to make decisions about who is allowed to do what.
// In this template, the "who" is defined in a Subject message. The "what" is
// defined in an Action message. During a Mixer Check call, these values
// will be populated based on configuration from request attributes and
// passed to individual authorization adapters to adjudicate.
package authorization;


import "gogoproto/gogo.proto";
import "mixer/adapter/model/v1beta1/extensions.proto";
import "google/protobuf/any.proto";
import "mixer/adapter/model/v1beta1/check.proto";
import "policy/v1beta1/value_type.proto";
import "policy/v1beta1/type.proto";

option (istio.mixer.adapter.model.v1beta1.template_variety) = TEMPLATE_VARIETY_CHECK;
option (istio.mixer.adapter.model.v1beta1.template_name) = "authorization";

option (gogoproto.goproto_getters_all) = false;
option (gogoproto.equal_all) = false;
option (gogoproto.gostring_all) = false;

// HandleAuthorizationService is implemented by backends that wants to handle request-time 'authorization' instances.
service HandleAuthorizationService {
    // HandleAuthorization is called by Mixer at request-time to deliver 'authorization' instances to the backend.
    rpc HandleAuthorization(HandleAuthorizationRequest) returns (istio.mixer.adapter.model.v1beta1.CheckResult);
    
}

// Request message for HandleAuthorization method.
message HandleAuthorizationRequest {

    // 'authorization' instance.
    InstanceMsg instance = 1;

    // Adapter specific handler configuration.
    //
    // Note: Backends can also implement [InfrastructureBackend][https://istio.io/docs/reference/config/mixer/istio.mixer.adapter.model.v1beta1.html#InfrastructureBackend]
    // service and therefore opt to receive handler configuration during session creation through [InfrastructureBackend.CreateSession][TODO: Link to this fragment]
    // call. In that case, adapter_config will have type_url as 'google.protobuf.Any.type_url' and would contain string
    // value of session_id (returned from InfrastructureBackend.CreateSession).
    google.protobuf.Any adapter_config = 2;

    // Id to dedupe identical requests from Mixer.
    string dedup_id = 3;
}





// Contains instance payload for 'authorization' template. This is passed to infrastructure backends during request-time
// through HandleAuthorizationService.HandleAuthorization.
message InstanceMsg {

    // Name of the instance as specified in configuration.
    string name = 72295727;
    
    // A subject contains a list of attributes that identify
// the caller identity.
    SubjectMsg subject = 1;
    
    // An action defines "how a resource is accessed".
    ActionMsg action = 2;
    
}

// A subject contains a list of attributes that identify
// the caller identity.
message SubjectMsg {
    
    // The user name/ID that the subject represents.
    string user = 1;
    
    // Groups the subject belongs to depending on the authentication mechanism,
// "groups" are normally populated from JWT claim or client certificate.
// The operator can define how it is populated when creating an instance of
// the template.
    string groups = 2;
    
    // Additional attributes about the subject.
    map<string, istio.policy.v1beta1.Value> properties = 3;
    
}

// An action defines "how a resource is accessed".
message ActionMsg {
    
    // Namespace the target action is taking place in.
    string namespace = 1;
    
    // The Service the action is being taken on.
    string service = 2;
    
    // What action is being taken.
    string method = 3;
    
    // HTTP REST path within the service
    string path = 4;
    
    // Additional data about the action for use in policy.
    map<string, istio.policy.v1beta1.Value> properties = 5;
    
}

// Contains inferred type information about specific instance of 'authorization' template. This is passed to
// infrastructure backends during configuration-time through [InfrastructureBackend.CreateSession][TODO: Link to this fragment].
message Type {
    
    // A subject contains a list of attributes that identify
// the caller identity.
    SubjectType subject = 1;
    
    // An action defines "how a resource is accessed".
    ActionType action = 2;
    
}

// A subject contains a list of attributes that identify
// the caller identity.
message SubjectType {
    
    // Additional attributes about the subject.
    map<string, istio.policy.v1beta1.ValueType> properties = 3;
    
}

// An action defines "how a resource is accessed".
message ActionType {
    
    // Additional data about the action for use in policy.
    map<string, istio.policy.v1beta1.ValueType> properties = 5;
    
}


// Represents instance configuration schema for 'authorization' template.
message InstanceParam {
    
    // A subject contains a list of attributes that identify
// the caller identity.
    SubjectInstanceParam subject = 1;
    
    // An action defines "how a resource is accessed".
    ActionInstanceParam action = 2;
    
}

// A subject contains a list of attributes that identify
// the caller identity.
message SubjectInstanceParam {
    
    // The user name/ID that the subject represents.
    string user = 1;
    
    // Groups the subject belongs to depending on the authentication mechanism,
// "groups" are normally populated from JWT claim or client certificate.
// The operator can define how it is populated when creating an instance of
// the template.
    string groups = 2;
    
    // Additional attributes about the subject.
    map<string, string> properties = 3;
    
}

// An action defines "how a resource is accessed".
message ActionInstanceParam {
    
    // Namespace the target action is taking place in.
    string namespace = 1;
    
    // The Service the action is being taken on.
    string service = 2;
    
    // What action is being taken.
    string method = 3;
    
    // HTTP REST path within the service
    string path = 4;
    
    // Additional data about the action for use in policy.
    map<string, string> properties = 5;
    
}

