syntax = "proto3";

package envoy.extensions.grpc_service.call_credentials.sts_service.v3;

import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.grpc_service.call_credentials.sts_service.v3";
option java_outer_classname = "StsServiceCredentialsProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/sts_service/v3;sts_servicev3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: gRPC STS Credentials]

// Security token service configuration that allows Google gRPC to
// fetch security token from an OAuth 2.0 authorization server.
// See https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-16 and
// https://github.com/grpc/grpc/pull/19587.
// [#not-implemented-hide:]
// [#next-free-field: 10]
message StsServiceCredentials {
  // URI of the token exchange service that handles token exchange requests.
  // [#comment:TODO(asraa): Add URI validation when implemented. Tracked by
  // https://github.com/bufbuild/protoc-gen-validate/issues/303]
  string token_exchange_service_uri = 1;

  // Location of the target service or resource where the client
  // intends to use the requested security token.
  string resource = 2;

  // Logical name of the target service where the client intends to
  // use the requested security token.
  string audience = 3;

  // The desired scope of the requested security token in the
  // context of the service or resource where the token will be used.
  string scope = 4;

  // Type of the requested security token.
  string requested_token_type = 5;

  // The path of subject token, a security token that represents the
  // identity of the party on behalf of whom the request is being made.
  string subject_token_path = 6 [(validate.rules).string = {min_len: 1}];

  // Type of the subject token.
  string subject_token_type = 7 [(validate.rules).string = {min_len: 1}];

  // The path of actor token, a security token that represents the identity
  // of the acting party. The acting party is authorized to use the
  // requested security token and act on behalf of the subject.
  string actor_token_path = 8;

  // Type of the actor token.
  string actor_token_type = 9;
}
