oidc.platform.proto

syntax = "proto3";

option go_package = "chainguard.dev/sdk/proto/platform/oidc/v1";
option java_multiple_files = true;
option java_package = "dev.chainguard.sdk.platform.oidc.v1";
option java_outer_classname = "PlatformOIDCProto";

package chainguard.platform.oidc;

import "google/api/annotations.proto";
import "google/api/resource.proto";

service SecurityTokenService {

  rpc Exchange(ExchangeRequest) returns (RawToken) {
    option (google.api.http) = {
      post: "/sts/exchange"
      additional_bindings {
        get: "/sts/exchange"
      }
    };
  }

  rpc ExchangeRefreshToken(ExchangeRefreshTokenRequest) returns (TokenPair) {
    option (google.api.http) = {
      post: "/sts/exchange_refresh_token"
    };
  }
}

message ExchangeRefreshTokenRequest {
  repeated string aud = 1;
  string scope = 2;

  // List of capabilities to request for the token.
  repeated string cap = 3 [(google.api.resource_reference) = {
    type: "chainguard.capabilities/Capability"
  }];
}

message ExchangeRequest {
  repeated string aud = 1;
  string scope = 2;

  // `cluster` field was deprecated and removed.
  reserved 3;
  reserved "cluster";

  string identity = 4;

  // List of capabilities to request for the token.
  repeated string cap = 5 [(google.api.resource_reference) = {
    type: "chainguard.capabilities/Capability"
  }];

  // `include_upstream_token` field was deprecated and removed.
  reserved 6;
  reserved "include_upstream_token";

  // Empty or the UIDP of the custom identity provider.
  string identity_provider = 7;
}

message RawToken {
  string token = 1;
  string refresh_token = 2;
}

// ExchangeRefreshToken returns a pair of token, in order to allow
// refresh token to also be rotated.
message TokenPair {
  RawToken token = 1;
  RawToken refresh_token = 2;
}