From d22227ed2f236d31a14b93e23bc03217106f7687 Mon Sep 17 00:00:00 2001 From: "agent-kanban[bot]" <295243365+agent-kanban[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:26:44 -0400 Subject: [PATCH] feat: add delegated agent OAuth provider (#539) * feat: add delegated agent oauth provider Agent-Profile: https://agent-kanban.dev/agents/e0a1ce35687e48ef * test(auth): cover delegated OAuth configuration * fix(auth): route OAuth metadata through worker * fix(auth): advertise canonical OAuth issuer * test: cover agent oauth provider integration Agent-Profile: https://agent-kanban.dev/agents/e0a1ce35687e48ef * test(auth): cover managed OAuth consent flow --------- Co-authored-by: Ravi Shah Co-authored-by: saltbo --- cmd/internal/openapi/client.gen.go | 5844 ++++++++++++++++- docs/design/agent-authentication.md | 27 +- docs/roadmap/v2.9.md | 10 +- migrations/0081_spotty_boomerang.sql | 96 + migrations/meta/0081_snapshot.json | 5598 ++++++++++++++++ migrations/meta/_journal.json | 7 + package.json | 1 + pnpm-lock.yaml | 22 + server/adapters/repos/agent-oauth.test.ts | 318 + server/adapters/repos/agent-oauth.ts | 233 + server/app.ts | 103 +- server/auth.integration.test.ts | 137 +- server/auth.ts | 22 + server/auth/agent-oauth-provider.test.ts | 143 + server/auth/agent-oauth-provider.ts | 83 + server/composition.ts | 2 + server/db/auth-schema.test.ts | 79 +- server/db/auth-schema.ts | 122 + .../agent-oauth-grants.integration.test.ts | 159 + server/http/agent-oauth-grants.ts | 65 + server/http/auth/auth.cf-test.ts | 47 + server/middleware/audit-actor.test.ts | 18 + server/middleware/audit-actor.ts | 3 + server/middleware/auth.ts | 27 + server/middleware/platform.ts | 18 + server/openapi.test.ts | 56 + server/test/setup.ts | 79 + server/usecases/agent-oauth-grants.test.ts | 59 + server/usecases/agent-oauth-grants.ts | 25 + server/usecases/deps.ts | 2 + server/usecases/ports.ts | 1 + server/usecases/ports/agent-oauth.ts | 31 + shared/agent-oauth.ts | 10 + wrangler.toml | 2 +- 34 files changed, 13422 insertions(+), 27 deletions(-) create mode 100644 migrations/0081_spotty_boomerang.sql create mode 100644 migrations/meta/0081_snapshot.json create mode 100644 server/adapters/repos/agent-oauth.test.ts create mode 100644 server/adapters/repos/agent-oauth.ts create mode 100644 server/auth/agent-oauth-provider.test.ts create mode 100644 server/auth/agent-oauth-provider.ts create mode 100644 server/http/agent-oauth-grants.integration.test.ts create mode 100644 server/http/agent-oauth-grants.ts create mode 100644 server/usecases/agent-oauth-grants.test.ts create mode 100644 server/usecases/agent-oauth-grants.ts create mode 100644 server/usecases/ports/agent-oauth.ts create mode 100644 shared/agent-oauth.ts diff --git a/cmd/internal/openapi/client.gen.go b/cmd/internal/openapi/client.gen.go index bb068bac..c88abada 100644 --- a/cmd/internal/openapi/client.gen.go +++ b/cmd/internal/openapi/client.gen.go @@ -2029,6 +2029,60 @@ func (e WebDavVerificationStatus) Valid() bool { } } +// Defines values for ListAgentOAuthGrants200JSONResponseBodyItemsScopes. +const ( + ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksCancel ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "download-tasks:cancel" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksCreate ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "download-tasks:create" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksRead ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "download-tasks:read" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesImagesUpload ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "images:upload" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsCreate ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "objects:create" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsDelete ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "objects:delete" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsPurge ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "objects:purge" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsRead ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "objects:read" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsUpdate ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "objects:update" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesQuotaRead ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "quota:read" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesCreate ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "shares:create" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesDelete ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "shares:delete" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesRead ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "shares:read" + ListAgentOAuthGrants200JSONResponseBodyItemsScopesStorageUsageRead ListAgentOAuthGrants200JSONResponseBodyItemsScopes = "storage-usage:read" +) + +// Valid indicates whether the value is a known member of the ListAgentOAuthGrants200JSONResponseBodyItemsScopes enum. +func (e ListAgentOAuthGrants200JSONResponseBodyItemsScopes) Valid() bool { + switch e { + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksCancel: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksCreate: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesDownloadTasksRead: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesImagesUpload: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsCreate: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsDelete: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsPurge: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsRead: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesObjectsUpdate: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesQuotaRead: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesCreate: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesDelete: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesSharesRead: + return true + case ListAgentOAuthGrants200JSONResponseBodyItemsScopesStorageUsageRead: + return true + default: + return false + } +} + // Defines values for ChangeEmail200JSONResponseBodyMessage. const ( ChangeEmail200JSONResponseBodyMessageEmailUpdated ChangeEmail200JSONResponseBodyMessage = "Email updated" @@ -2149,6 +2203,102 @@ func (e PostApiAuthDeviceToken400JSONResponseBodyError) Valid() bool { } } +// Defines values for PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes. +const ( + PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesAuthorizationCode PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes = "authorization_code" + PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesClientCredentials PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes = "client_credentials" + PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesRefreshToken PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes = "refresh_token" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes enum. +func (e PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes) Valid() bool { + switch e { + case PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesAuthorizationCode: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesClientCredentials: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypesRefreshToken: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes. +const ( + PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypesCode PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes = "code" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes enum. +func (e PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes) Valid() bool { + switch e { + case PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypesCode: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod. +const ( + PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodClientSecretBasic PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod = "client_secret_basic" + PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodClientSecretPost PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod = "client_secret_post" + PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodNone PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod = "none" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod enum. +func (e PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod) Valid() bool { + switch e { + case PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodClientSecretBasic: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodClientSecretPost: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethodNone: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2CreateClient200JSONResponseBodyType. +const ( + PostApiAuthOauth2CreateClient200JSONResponseBodyTypeNative PostApiAuthOauth2CreateClient200JSONResponseBodyType = "native" + PostApiAuthOauth2CreateClient200JSONResponseBodyTypeUserAgentBased PostApiAuthOauth2CreateClient200JSONResponseBodyType = "user-agent-based" + PostApiAuthOauth2CreateClient200JSONResponseBodyTypeWeb PostApiAuthOauth2CreateClient200JSONResponseBodyType = "web" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2CreateClient200JSONResponseBodyType enum. +func (e PostApiAuthOauth2CreateClient200JSONResponseBodyType) Valid() bool { + switch e { + case PostApiAuthOauth2CreateClient200JSONResponseBodyTypeNative: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyTypeUserAgentBased: + return true + case PostApiAuthOauth2CreateClient200JSONResponseBodyTypeWeb: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint. +const ( + PostApiAuthOauth2IntrospectJSONBodyTokenTypeHintAccessToken PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint = "access_token" + PostApiAuthOauth2IntrospectJSONBodyTokenTypeHintRefreshToken PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint = "refresh_token" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint enum. +func (e PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint) Valid() bool { + switch e { + case PostApiAuthOauth2IntrospectJSONBodyTokenTypeHintAccessToken: + return true + case PostApiAuthOauth2IntrospectJSONBodyTokenTypeHintRefreshToken: + return true + default: + return false + } +} + // Defines values for PostApiAuthOauth2Link200JSONResponseBodyRedirect. const ( PostApiAuthOauth2Link200JSONResponseBodyRedirectTrue PostApiAuthOauth2Link200JSONResponseBodyRedirect = true @@ -2164,6 +2314,138 @@ func (e PostApiAuthOauth2Link200JSONResponseBodyRedirect) Valid() bool { } } +// Defines values for PostApiAuthOauth2Register200JSONResponseBodyGrantTypes. +const ( + PostApiAuthOauth2Register200JSONResponseBodyGrantTypesAuthorizationCode PostApiAuthOauth2Register200JSONResponseBodyGrantTypes = "authorization_code" + PostApiAuthOauth2Register200JSONResponseBodyGrantTypesClientCredentials PostApiAuthOauth2Register200JSONResponseBodyGrantTypes = "client_credentials" + PostApiAuthOauth2Register200JSONResponseBodyGrantTypesRefreshToken PostApiAuthOauth2Register200JSONResponseBodyGrantTypes = "refresh_token" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2Register200JSONResponseBodyGrantTypes enum. +func (e PostApiAuthOauth2Register200JSONResponseBodyGrantTypes) Valid() bool { + switch e { + case PostApiAuthOauth2Register200JSONResponseBodyGrantTypesAuthorizationCode: + return true + case PostApiAuthOauth2Register200JSONResponseBodyGrantTypesClientCredentials: + return true + case PostApiAuthOauth2Register200JSONResponseBodyGrantTypesRefreshToken: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2Register200JSONResponseBodyResponseTypes. +const ( + PostApiAuthOauth2Register200JSONResponseBodyResponseTypesCode PostApiAuthOauth2Register200JSONResponseBodyResponseTypes = "code" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2Register200JSONResponseBodyResponseTypes enum. +func (e PostApiAuthOauth2Register200JSONResponseBodyResponseTypes) Valid() bool { + switch e { + case PostApiAuthOauth2Register200JSONResponseBodyResponseTypesCode: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod. +const ( + PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodClientSecretBasic PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod = "client_secret_basic" + PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodClientSecretPost PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod = "client_secret_post" + PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodNone PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod = "none" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod enum. +func (e PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod) Valid() bool { + switch e { + case PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodClientSecretBasic: + return true + case PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodClientSecretPost: + return true + case PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethodNone: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2Register200JSONResponseBodyType. +const ( + PostApiAuthOauth2Register200JSONResponseBodyTypeNative PostApiAuthOauth2Register200JSONResponseBodyType = "native" + PostApiAuthOauth2Register200JSONResponseBodyTypeUserAgentBased PostApiAuthOauth2Register200JSONResponseBodyType = "user-agent-based" + PostApiAuthOauth2Register200JSONResponseBodyTypeWeb PostApiAuthOauth2Register200JSONResponseBodyType = "web" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2Register200JSONResponseBodyType enum. +func (e PostApiAuthOauth2Register200JSONResponseBodyType) Valid() bool { + switch e { + case PostApiAuthOauth2Register200JSONResponseBodyTypeNative: + return true + case PostApiAuthOauth2Register200JSONResponseBodyTypeUserAgentBased: + return true + case PostApiAuthOauth2Register200JSONResponseBodyTypeWeb: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2RevokeJSONBodyTokenTypeHint. +const ( + PostApiAuthOauth2RevokeJSONBodyTokenTypeHintAccessToken PostApiAuthOauth2RevokeJSONBodyTokenTypeHint = "access_token" + PostApiAuthOauth2RevokeJSONBodyTokenTypeHintRefreshToken PostApiAuthOauth2RevokeJSONBodyTokenTypeHint = "refresh_token" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2RevokeJSONBodyTokenTypeHint enum. +func (e PostApiAuthOauth2RevokeJSONBodyTokenTypeHint) Valid() bool { + switch e { + case PostApiAuthOauth2RevokeJSONBodyTokenTypeHintAccessToken: + return true + case PostApiAuthOauth2RevokeJSONBodyTokenTypeHintRefreshToken: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2TokenJSONBodyGrantType. +const ( + AuthorizationCode PostApiAuthOauth2TokenJSONBodyGrantType = "authorization_code" + ClientCredentials PostApiAuthOauth2TokenJSONBodyGrantType = "client_credentials" + RefreshToken PostApiAuthOauth2TokenJSONBodyGrantType = "refresh_token" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2TokenJSONBodyGrantType enum. +func (e PostApiAuthOauth2TokenJSONBodyGrantType) Valid() bool { + switch e { + case AuthorizationCode: + return true + case ClientCredentials: + return true + case RefreshToken: + return true + default: + return false + } +} + +// Defines values for PostApiAuthOauth2Token200JSONResponseBodyTokenType. +const ( + Bearer PostApiAuthOauth2Token200JSONResponseBodyTokenType = "Bearer" +) + +// Valid indicates whether the value is a known member of the PostApiAuthOauth2Token200JSONResponseBodyTokenType enum. +func (e PostApiAuthOauth2Token200JSONResponseBodyTokenType) Valid() bool { + switch e { + case Bearer: + return true + default: + return false + } +} + // Defines values for SignInEmail200JSONResponseBodyRedirect. const ( False SignInEmail200JSONResponseBodyRedirect = false @@ -3378,37 +3660,37 @@ func (e RotateWorkspaceAgentApiKeyJSONBodyScopes) Valid() bool { // Defines values for RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes. const ( - ObjectsCreate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:create" - ObjectsDelete RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:delete" - ObjectsRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:read" - ObjectsUpdate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:update" - QuotaRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "quota:read" - SharesCreate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:create" - SharesDelete RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:delete" - SharesRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:read" - StorageUsageRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "storage-usage:read" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsCreate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:create" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsDelete RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:delete" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:read" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsUpdate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "objects:update" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesQuotaRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "quota:read" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesCreate RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:create" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesDelete RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:delete" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "shares:read" + RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesStorageUsageRead RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes = "storage-usage:read" ) // Valid indicates whether the value is a known member of the RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes enum. func (e RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopes) Valid() bool { switch e { - case ObjectsCreate: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsCreate: return true - case ObjectsDelete: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsDelete: return true - case ObjectsRead: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsRead: return true - case ObjectsUpdate: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesObjectsUpdate: return true - case QuotaRead: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesQuotaRead: return true - case SharesCreate: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesCreate: return true - case SharesDelete: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesDelete: return true - case SharesRead: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesSharesRead: return true - case StorageUsageRead: + case RotateWorkspaceAgentApiKey201JSONResponseBodyItemScopesStorageUsageRead: return true default: return false @@ -5707,6 +5989,9 @@ type User struct { // WebDavVerificationStatus defines model for WebDavVerificationStatus. type WebDavVerificationStatus string +// ListAgentOAuthGrants200JSONResponseBodyItemsScopes defines parameters for ListAgentOAuthGrants. +type ListAgentOAuthGrants200JSONResponseBodyItemsScopes string + // BanUserJSONBody defines parameters for BanUser. type BanUserJSONBody struct { // BanExpiresIn The number of seconds until the ban expires @@ -6055,6 +6340,39 @@ type LinkSocialAccountJSONBody struct { Scopes *[]interface{} `json:"scopes,omitempty"` } +// GetApiAuthOauth2AuthorizeParams defines parameters for GetApiAuthOauth2Authorize. +type GetApiAuthOauth2AuthorizeParams struct { + // ResponseType OAuth2 response type (e.g., 'code') + ResponseType *string `form:"response_type,omitempty" json:"response_type,omitempty"` + + // ClientId OAuth2 client ID + ClientId string `form:"client_id" json:"client_id"` + + // RedirectUri OAuth2 redirect URI + RedirectUri *string `form:"redirect_uri,omitempty" json:"redirect_uri,omitempty"` + + // Scope OAuth2 scopes (space-separated) + Scope *string `form:"scope,omitempty" json:"scope,omitempty"` + + // State OAuth2 state parameter + State *string `form:"state,omitempty" json:"state,omitempty"` + + // RequestUri Pushed Authorization Request URI referencing stored parameters + RequestUri *string `form:"request_uri,omitempty" json:"request_uri,omitempty"` + + // CodeChallenge PKCE code challenge + CodeChallenge *string `form:"code_challenge,omitempty" json:"code_challenge,omitempty"` + + // CodeChallengeMethod PKCE code challenge method + CodeChallengeMethod *string `form:"code_challenge_method,omitempty" json:"code_challenge_method,omitempty"` + + // Nonce OpenID Connect nonce + Nonce *string `form:"nonce,omitempty" json:"nonce,omitempty"` + + // Prompt OAuth2 prompt parameter + Prompt *string `form:"prompt,omitempty" json:"prompt,omitempty"` +} + // GetApiAuthOauth2CallbackProviderIdParams defines parameters for GetApiAuthOauth2CallbackProviderId. type GetApiAuthOauth2CallbackProviderIdParams struct { Code *string `form:"code,omitempty" json:"code,omitempty"` @@ -6064,6 +6382,108 @@ type GetApiAuthOauth2CallbackProviderIdParams struct { Iss *string `form:"iss,omitempty" json:"iss,omitempty"` } +// PostApiAuthOauth2ClientRotateSecretJSONBody defines parameters for PostApiAuthOauth2ClientRotateSecret. +type PostApiAuthOauth2ClientRotateSecretJSONBody struct { + ClientId string `json:"client_id"` +} + +// PostApiAuthOauth2ConsentJSONBody defines parameters for PostApiAuthOauth2Consent. +type PostApiAuthOauth2ConsentJSONBody struct { + // Accept Accept or deny user consent for a set of scopes + Accept bool `json:"accept"` + OauthQuery *string `json:"oauth_query,omitempty"` + Scope *string `json:"scope,omitempty"` +} + +// PostApiAuthOauth2ContinueJSONBody defines parameters for PostApiAuthOauth2Continue. +type PostApiAuthOauth2ContinueJSONBody struct { + Created *bool `json:"created,omitempty"` + OauthQuery *string `json:"oauth_query,omitempty"` + PostLogin *bool `json:"postLogin,omitempty"` + Selected *bool `json:"selected,omitempty"` +} + +// PostApiAuthOauth2CreateClientJSONBody defines parameters for PostApiAuthOauth2CreateClient. +type PostApiAuthOauth2CreateClientJSONBody struct { + ClientName *string `json:"client_name,omitempty"` + ClientUri *string `json:"client_uri,omitempty"` + Contacts *[]interface{} `json:"contacts,omitempty"` + GrantTypes *[]interface{} `json:"grant_types,omitempty"` + LogoUri *string `json:"logo_uri,omitempty"` + PolicyUri *string `json:"policy_uri,omitempty"` + PostLogoutRedirectUris *[]interface{} `json:"post_logout_redirect_uris,omitempty"` + RedirectUris []interface{} `json:"redirect_uris"` + ResponseTypes *[]interface{} `json:"response_types,omitempty"` + Scope *string `json:"scope,omitempty"` + SoftwareId *string `json:"software_id,omitempty"` + SoftwareStatement *string `json:"software_statement,omitempty"` + SoftwareVersion *string `json:"software_version,omitempty"` + TokenEndpointAuthMethod *string `json:"token_endpoint_auth_method,omitempty"` + TosUri *string `json:"tos_uri,omitempty"` + Type *string `json:"type,omitempty"` +} + +// PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes defines parameters for PostApiAuthOauth2CreateClient. +type PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes string + +// PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes defines parameters for PostApiAuthOauth2CreateClient. +type PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes string + +// PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod defines parameters for PostApiAuthOauth2CreateClient. +type PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod string + +// PostApiAuthOauth2CreateClient200JSONResponseBodyType defines parameters for PostApiAuthOauth2CreateClient. +type PostApiAuthOauth2CreateClient200JSONResponseBodyType string + +// PostApiAuthOauth2DeleteClientJSONBody defines parameters for PostApiAuthOauth2DeleteClient. +type PostApiAuthOauth2DeleteClientJSONBody struct { + ClientId string `json:"client_id"` +} + +// PostApiAuthOauth2DeleteConsentJSONBody defines parameters for PostApiAuthOauth2DeleteConsent. +type PostApiAuthOauth2DeleteConsentJSONBody struct { + Id string `json:"id"` +} + +// GetApiAuthOauth2EndSessionParams defines parameters for GetApiAuthOauth2EndSession. +type GetApiAuthOauth2EndSessionParams struct { + IdTokenHint *string `form:"id_token_hint,omitempty" json:"id_token_hint,omitempty"` + ClientId *string `form:"client_id,omitempty" json:"client_id,omitempty"` + PostLogoutRedirectUri *string `form:"post_logout_redirect_uri,omitempty" json:"post_logout_redirect_uri,omitempty"` + State *string `form:"state,omitempty" json:"state,omitempty"` +} + +// GetApiAuthOauth2GetClientParams defines parameters for GetApiAuthOauth2GetClient. +type GetApiAuthOauth2GetClientParams struct { + ClientId *string `form:"client_id,omitempty" json:"client_id,omitempty"` +} + +// GetApiAuthOauth2GetConsentParams defines parameters for GetApiAuthOauth2GetConsent. +type GetApiAuthOauth2GetConsentParams struct { + Id *string `form:"id,omitempty" json:"id,omitempty"` +} + +// PostApiAuthOauth2IntrospectJSONBody defines parameters for PostApiAuthOauth2Introspect. +type PostApiAuthOauth2IntrospectJSONBody struct { + // ClientId OAuth2 client ID + ClientId *string `json:"client_id,omitempty"` + + // ClientSecret OAuth2 client secret + ClientSecret *string `json:"client_secret,omitempty"` + + // Resource Introspects a token for a specific resource. + Resource *string `json:"resource,omitempty"` + + // Token The token to introspect (access or refresh token) + Token string `json:"token"` + + // TokenTypeHint Hint about the type of the token submitted for introspection + TokenTypeHint *PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint `json:"token_type_hint,omitempty"` +} + +// PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint defines parameters for PostApiAuthOauth2Introspect. +type PostApiAuthOauth2IntrospectJSONBodyTokenTypeHint string + // PostApiAuthOauth2LinkJSONBody defines parameters for PostApiAuthOauth2Link. type PostApiAuthOauth2LinkJSONBody struct { CallbackURL string `json:"callbackURL"` @@ -6079,6 +6499,141 @@ type PostApiAuthOauth2LinkJSONBody struct { // PostApiAuthOauth2Link200JSONResponseBodyRedirect defines parameters for PostApiAuthOauth2Link. type PostApiAuthOauth2Link200JSONResponseBodyRedirect bool +// GetApiAuthOauth2PublicClientParams defines parameters for GetApiAuthOauth2PublicClient. +type GetApiAuthOauth2PublicClientParams struct { + ClientId *string `form:"client_id,omitempty" json:"client_id,omitempty"` +} + +// PostApiAuthOauth2PublicClientPreloginJSONBody defines parameters for PostApiAuthOauth2PublicClientPrelogin. +type PostApiAuthOauth2PublicClientPreloginJSONBody struct { + ClientId string `json:"client_id"` + OauthQuery *string `json:"oauth_query,omitempty"` +} + +// PostApiAuthOauth2RegisterJSONBody defines parameters for PostApiAuthOauth2Register. +type PostApiAuthOauth2RegisterJSONBody struct { + ClientName *string `json:"client_name,omitempty"` + ClientUri *string `json:"client_uri,omitempty"` + Contacts *[]interface{} `json:"contacts,omitempty"` + GrantTypes *[]interface{} `json:"grant_types,omitempty"` + LogoUri *string `json:"logo_uri,omitempty"` + PolicyUri *string `json:"policy_uri,omitempty"` + PostLogoutRedirectUris *[]interface{} `json:"post_logout_redirect_uris,omitempty"` + RedirectUris []interface{} `json:"redirect_uris"` + ResponseTypes *[]interface{} `json:"response_types,omitempty"` + Scope *string `json:"scope,omitempty"` + SkipConsent *string `json:"skip_consent,omitempty"` + SoftwareId *string `json:"software_id,omitempty"` + SoftwareStatement *string `json:"software_statement,omitempty"` + SoftwareVersion *string `json:"software_version,omitempty"` + SubjectType *string `json:"subject_type,omitempty"` + TokenEndpointAuthMethod *string `json:"token_endpoint_auth_method,omitempty"` + TosUri *string `json:"tos_uri,omitempty"` + Type *string `json:"type,omitempty"` +} + +// PostApiAuthOauth2Register200JSONResponseBodyGrantTypes defines parameters for PostApiAuthOauth2Register. +type PostApiAuthOauth2Register200JSONResponseBodyGrantTypes string + +// PostApiAuthOauth2Register200JSONResponseBodyResponseTypes defines parameters for PostApiAuthOauth2Register. +type PostApiAuthOauth2Register200JSONResponseBodyResponseTypes string + +// PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod defines parameters for PostApiAuthOauth2Register. +type PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod string + +// PostApiAuthOauth2Register200JSONResponseBodyType defines parameters for PostApiAuthOauth2Register. +type PostApiAuthOauth2Register200JSONResponseBodyType string + +// PostApiAuthOauth2RevokeJSONBody defines parameters for PostApiAuthOauth2Revoke. +type PostApiAuthOauth2RevokeJSONBody struct { + // ClientId OAuth2 client ID + ClientId *string `json:"client_id,omitempty"` + + // ClientSecret OAuth2 client secret + ClientSecret *string `json:"client_secret,omitempty"` + + // Token The token to revoke (access or refresh token) + Token string `json:"token"` + + // TokenTypeHint Hint about the type of the token submitted for revocation + TokenTypeHint *PostApiAuthOauth2RevokeJSONBodyTokenTypeHint `json:"token_type_hint,omitempty"` +} + +// PostApiAuthOauth2RevokeJSONBodyTokenTypeHint defines parameters for PostApiAuthOauth2Revoke. +type PostApiAuthOauth2RevokeJSONBodyTokenTypeHint string + +// PostApiAuthOauth2TokenJSONBody defines parameters for PostApiAuthOauth2Token. +type PostApiAuthOauth2TokenJSONBody struct { + // ClientId OAuth2 client ID + ClientId *string `json:"client_id,omitempty"` + + // ClientSecret OAuth2 client secret + ClientSecret *string `json:"client_secret,omitempty"` + + // Code Authorization code (for authorization_code grant) + Code *string `json:"code,omitempty"` + + // CodeVerifier PKCE code verifier (for authorization_code grant) + CodeVerifier *string `json:"code_verifier,omitempty"` + + // GrantType OAuth2 grant type + GrantType PostApiAuthOauth2TokenJSONBodyGrantType `json:"grant_type"` + + // RedirectUri Redirect URI (for authorization_code grant) + RedirectUri *string `json:"redirect_uri,omitempty"` + + // RefreshToken Refresh token (for refresh_token grant) + RefreshToken *string `json:"refresh_token,omitempty"` + + // Resource Requested token resource (ie audience) to obtain a JWT formatted access token + Resource *string `json:"resource,omitempty"` + + // Scope Requested scopes (for client_credentials grant) + Scope *string `json:"scope,omitempty"` +} + +// PostApiAuthOauth2TokenJSONBodyGrantType defines parameters for PostApiAuthOauth2Token. +type PostApiAuthOauth2TokenJSONBodyGrantType string + +// PostApiAuthOauth2Token200JSONResponseBodyTokenType defines parameters for PostApiAuthOauth2Token. +type PostApiAuthOauth2Token200JSONResponseBodyTokenType string + +// PostApiAuthOauth2UpdateClientJSONBody defines parameters for PostApiAuthOauth2UpdateClient. +type PostApiAuthOauth2UpdateClientJSONBody struct { + ClientId string `json:"client_id"` + Update struct { + ClientName *string `json:"client_name,omitempty"` + ClientUri *string `json:"client_uri,omitempty"` + Contacts *[]interface{} `json:"contacts,omitempty"` + GrantTypes *[]interface{} `json:"grant_types,omitempty"` + LogoUri *string `json:"logo_uri,omitempty"` + PolicyUri *string `json:"policy_uri,omitempty"` + PostLogoutRedirectUris *[]interface{} `json:"post_logout_redirect_uris,omitempty"` + RedirectUris *[]interface{} `json:"redirect_uris,omitempty"` + ResponseTypes *[]interface{} `json:"response_types,omitempty"` + Scope *string `json:"scope,omitempty"` + SoftwareId *string `json:"software_id,omitempty"` + SoftwareStatement *string `json:"software_statement,omitempty"` + SoftwareVersion *string `json:"software_version,omitempty"` + TosUri *string `json:"tos_uri,omitempty"` + Type *string `json:"type,omitempty"` + } `json:"update"` +} + +// PostApiAuthOauth2UpdateConsentJSONBody defines parameters for PostApiAuthOauth2UpdateConsent. +type PostApiAuthOauth2UpdateConsentJSONBody struct { + Id string `json:"id"` + Update struct { + Scopes []interface{} `json:"scopes"` + } `json:"update"` +} + +// GetApiAuthOauth2UserinfoParams defines parameters for GetApiAuthOauth2Userinfo. +type GetApiAuthOauth2UserinfoParams struct { + // Authorization Bearer access token + Authorization *string `json:"Authorization,omitempty"` +} + // PostApiAuthOrganizationAcceptInvitationJSONBody defines parameters for PostApiAuthOrganizationAcceptInvitation. type PostApiAuthOrganizationAcceptInvitationJSONBody struct { // InvitationId The ID of the invitation to accept @@ -7324,9 +7879,48 @@ type PostApiAuthIsUsernameAvailableJSONRequestBody PostApiAuthIsUsernameAvailabl // LinkSocialAccountJSONRequestBody defines body for LinkSocialAccount for application/json ContentType. type LinkSocialAccountJSONRequestBody LinkSocialAccountJSONBody +// PostApiAuthOauth2ClientRotateSecretJSONRequestBody defines body for PostApiAuthOauth2ClientRotateSecret for application/json ContentType. +type PostApiAuthOauth2ClientRotateSecretJSONRequestBody PostApiAuthOauth2ClientRotateSecretJSONBody + +// PostApiAuthOauth2ConsentJSONRequestBody defines body for PostApiAuthOauth2Consent for application/json ContentType. +type PostApiAuthOauth2ConsentJSONRequestBody PostApiAuthOauth2ConsentJSONBody + +// PostApiAuthOauth2ContinueJSONRequestBody defines body for PostApiAuthOauth2Continue for application/json ContentType. +type PostApiAuthOauth2ContinueJSONRequestBody PostApiAuthOauth2ContinueJSONBody + +// PostApiAuthOauth2CreateClientJSONRequestBody defines body for PostApiAuthOauth2CreateClient for application/json ContentType. +type PostApiAuthOauth2CreateClientJSONRequestBody PostApiAuthOauth2CreateClientJSONBody + +// PostApiAuthOauth2DeleteClientJSONRequestBody defines body for PostApiAuthOauth2DeleteClient for application/json ContentType. +type PostApiAuthOauth2DeleteClientJSONRequestBody PostApiAuthOauth2DeleteClientJSONBody + +// PostApiAuthOauth2DeleteConsentJSONRequestBody defines body for PostApiAuthOauth2DeleteConsent for application/json ContentType. +type PostApiAuthOauth2DeleteConsentJSONRequestBody PostApiAuthOauth2DeleteConsentJSONBody + +// PostApiAuthOauth2IntrospectJSONRequestBody defines body for PostApiAuthOauth2Introspect for application/json ContentType. +type PostApiAuthOauth2IntrospectJSONRequestBody PostApiAuthOauth2IntrospectJSONBody + // PostApiAuthOauth2LinkJSONRequestBody defines body for PostApiAuthOauth2Link for application/json ContentType. type PostApiAuthOauth2LinkJSONRequestBody PostApiAuthOauth2LinkJSONBody +// PostApiAuthOauth2PublicClientPreloginJSONRequestBody defines body for PostApiAuthOauth2PublicClientPrelogin for application/json ContentType. +type PostApiAuthOauth2PublicClientPreloginJSONRequestBody PostApiAuthOauth2PublicClientPreloginJSONBody + +// PostApiAuthOauth2RegisterJSONRequestBody defines body for PostApiAuthOauth2Register for application/json ContentType. +type PostApiAuthOauth2RegisterJSONRequestBody PostApiAuthOauth2RegisterJSONBody + +// PostApiAuthOauth2RevokeJSONRequestBody defines body for PostApiAuthOauth2Revoke for application/json ContentType. +type PostApiAuthOauth2RevokeJSONRequestBody PostApiAuthOauth2RevokeJSONBody + +// PostApiAuthOauth2TokenJSONRequestBody defines body for PostApiAuthOauth2Token for application/json ContentType. +type PostApiAuthOauth2TokenJSONRequestBody PostApiAuthOauth2TokenJSONBody + +// PostApiAuthOauth2UpdateClientJSONRequestBody defines body for PostApiAuthOauth2UpdateClient for application/json ContentType. +type PostApiAuthOauth2UpdateClientJSONRequestBody PostApiAuthOauth2UpdateClientJSONBody + +// PostApiAuthOauth2UpdateConsentJSONRequestBody defines body for PostApiAuthOauth2UpdateConsent for application/json ContentType. +type PostApiAuthOauth2UpdateConsentJSONRequestBody PostApiAuthOauth2UpdateConsentJSONBody + // PostApiAuthOrganizationAcceptInvitationJSONRequestBody defines body for PostApiAuthOrganizationAcceptInvitation for application/json ContentType. type PostApiAuthOrganizationAcceptInvitationJSONRequestBody PostApiAuthOrganizationAcceptInvitationJSONBody @@ -8248,6 +8842,12 @@ func WithRequestEditorFn(fn RequestEditorFn) ClientOption { // The interface specification for the client above. type ClientInterface interface { + // ListAgentOAuthGrants request + ListAgentOAuthGrants(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) + + // RevokeAgentOAuthGrant request + RevokeAgentOAuthGrant(ctx context.Context, grantId string, reqEditors ...RequestEditorFn) (*http.Response, error) + // GetApiAuthAccountInfo request GetApiAuthAccountInfo(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) @@ -8422,14 +9022,103 @@ type ClientInterface interface { // ListUserSessions request ListUserSessions(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) + // GetApiAuthOauth2Authorize request + GetApiAuthOauth2Authorize(ctx context.Context, params *GetApiAuthOauth2AuthorizeParams, reqEditors ...RequestEditorFn) (*http.Response, error) + // GetApiAuthOauth2CallbackProviderId request GetApiAuthOauth2CallbackProviderId(ctx context.Context, providerId string, params *GetApiAuthOauth2CallbackProviderIdParams, reqEditors ...RequestEditorFn) (*http.Response, error) + // PostApiAuthOauth2ClientRotateSecretWithBody request with any body + PostApiAuthOauth2ClientRotateSecretWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2ClientRotateSecret(ctx context.Context, body PostApiAuthOauth2ClientRotateSecretJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2ConsentWithBody request with any body + PostApiAuthOauth2ConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Consent(ctx context.Context, body PostApiAuthOauth2ConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2ContinueWithBody request with any body + PostApiAuthOauth2ContinueWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Continue(ctx context.Context, body PostApiAuthOauth2ContinueJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2CreateClientWithBody request with any body + PostApiAuthOauth2CreateClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2CreateClient(ctx context.Context, body PostApiAuthOauth2CreateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2DeleteClientWithBody request with any body + PostApiAuthOauth2DeleteClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2DeleteClient(ctx context.Context, body PostApiAuthOauth2DeleteClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2DeleteConsentWithBody request with any body + PostApiAuthOauth2DeleteConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2DeleteConsent(ctx context.Context, body PostApiAuthOauth2DeleteConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2EndSession request + GetApiAuthOauth2EndSession(ctx context.Context, params *GetApiAuthOauth2EndSessionParams, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2GetClient request + GetApiAuthOauth2GetClient(ctx context.Context, params *GetApiAuthOauth2GetClientParams, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2GetClients request + GetApiAuthOauth2GetClients(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2GetConsent request + GetApiAuthOauth2GetConsent(ctx context.Context, params *GetApiAuthOauth2GetConsentParams, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2GetConsents request + GetApiAuthOauth2GetConsents(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2IntrospectWithBody request with any body + PostApiAuthOauth2IntrospectWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Introspect(ctx context.Context, body PostApiAuthOauth2IntrospectJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + // PostApiAuthOauth2LinkWithBody request with any body PostApiAuthOauth2LinkWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) PostApiAuthOauth2Link(ctx context.Context, body PostApiAuthOauth2LinkJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + // GetApiAuthOauth2PublicClient request + GetApiAuthOauth2PublicClient(ctx context.Context, params *GetApiAuthOauth2PublicClientParams, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2PublicClientPreloginWithBody request with any body + PostApiAuthOauth2PublicClientPreloginWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2PublicClientPrelogin(ctx context.Context, body PostApiAuthOauth2PublicClientPreloginJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2RegisterWithBody request with any body + PostApiAuthOauth2RegisterWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Register(ctx context.Context, body PostApiAuthOauth2RegisterJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2RevokeWithBody request with any body + PostApiAuthOauth2RevokeWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Revoke(ctx context.Context, body PostApiAuthOauth2RevokeJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2TokenWithBody request with any body + PostApiAuthOauth2TokenWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2Token(ctx context.Context, body PostApiAuthOauth2TokenJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2UpdateClientWithBody request with any body + PostApiAuthOauth2UpdateClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2UpdateClient(ctx context.Context, body PostApiAuthOauth2UpdateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // PostApiAuthOauth2UpdateConsentWithBody request with any body + PostApiAuthOauth2UpdateConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) + + PostApiAuthOauth2UpdateConsent(ctx context.Context, body PostApiAuthOauth2UpdateConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) + + // GetApiAuthOauth2Userinfo request + GetApiAuthOauth2Userinfo(ctx context.Context, params *GetApiAuthOauth2UserinfoParams, reqEditors ...RequestEditorFn) (*http.Response, error) + // GetApiAuthOk request GetApiAuthOk(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) @@ -9184,6 +9873,30 @@ type ClientInterface interface { RotateWorkspaceAgentApiKey(ctx context.Context, orgId string, keyId string, body RotateWorkspaceAgentApiKeyJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) } +func (c *Client) ListAgentOAuthGrants(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewListAgentOAuthGrantsRequest(c.Server) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) RevokeAgentOAuthGrant(ctx context.Context, grantId string, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewRevokeAgentOAuthGrantRequest(c.Server, grantId) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + func (c *Client) GetApiAuthAccountInfo(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) { req, err := NewGetApiAuthAccountInfoRequest(c.Server) if err != nil { @@ -9988,6 +10701,18 @@ func (c *Client) ListUserSessions(ctx context.Context, reqEditors ...RequestEdit return c.Client.Do(req) } +func (c *Client) GetApiAuthOauth2Authorize(ctx context.Context, params *GetApiAuthOauth2AuthorizeParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2AuthorizeRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + func (c *Client) GetApiAuthOauth2CallbackProviderId(ctx context.Context, providerId string, params *GetApiAuthOauth2CallbackProviderIdParams, reqEditors ...RequestEditorFn) (*http.Response, error) { req, err := NewGetApiAuthOauth2CallbackProviderIdRequest(c.Server, providerId, params) if err != nil { @@ -10000,6 +10725,234 @@ func (c *Client) GetApiAuthOauth2CallbackProviderId(ctx context.Context, provide return c.Client.Do(req) } +func (c *Client) PostApiAuthOauth2ClientRotateSecretWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ClientRotateSecretRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2ClientRotateSecret(ctx context.Context, body PostApiAuthOauth2ClientRotateSecretJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ClientRotateSecretRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2ConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ConsentRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Consent(ctx context.Context, body PostApiAuthOauth2ConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ConsentRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2ContinueWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ContinueRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Continue(ctx context.Context, body PostApiAuthOauth2ContinueJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2ContinueRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2CreateClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2CreateClientRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2CreateClient(ctx context.Context, body PostApiAuthOauth2CreateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2CreateClientRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2DeleteClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2DeleteClientRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2DeleteClient(ctx context.Context, body PostApiAuthOauth2DeleteClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2DeleteClientRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2DeleteConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2DeleteConsentRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2DeleteConsent(ctx context.Context, body PostApiAuthOauth2DeleteConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2DeleteConsentRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2EndSession(ctx context.Context, params *GetApiAuthOauth2EndSessionParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2EndSessionRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2GetClient(ctx context.Context, params *GetApiAuthOauth2GetClientParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2GetClientRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2GetClients(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2GetClientsRequest(c.Server) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2GetConsent(ctx context.Context, params *GetApiAuthOauth2GetConsentParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2GetConsentRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2GetConsents(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2GetConsentsRequest(c.Server) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2IntrospectWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2IntrospectRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Introspect(ctx context.Context, body PostApiAuthOauth2IntrospectJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2IntrospectRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + func (c *Client) PostApiAuthOauth2LinkWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { req, err := NewPostApiAuthOauth2LinkRequestWithBody(c.Server, contentType, body) if err != nil { @@ -10024,6 +10977,174 @@ func (c *Client) PostApiAuthOauth2Link(ctx context.Context, body PostApiAuthOaut return c.Client.Do(req) } +func (c *Client) GetApiAuthOauth2PublicClient(ctx context.Context, params *GetApiAuthOauth2PublicClientParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2PublicClientRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2PublicClientPreloginWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2PublicClientPreloginRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2PublicClientPrelogin(ctx context.Context, body PostApiAuthOauth2PublicClientPreloginJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2PublicClientPreloginRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2RegisterWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2RegisterRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Register(ctx context.Context, body PostApiAuthOauth2RegisterJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2RegisterRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2RevokeWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2RevokeRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Revoke(ctx context.Context, body PostApiAuthOauth2RevokeJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2RevokeRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2TokenWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2TokenRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2Token(ctx context.Context, body PostApiAuthOauth2TokenJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2TokenRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2UpdateClientWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2UpdateClientRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2UpdateClient(ctx context.Context, body PostApiAuthOauth2UpdateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2UpdateClientRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2UpdateConsentWithBody(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2UpdateConsentRequestWithBody(c.Server, contentType, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) PostApiAuthOauth2UpdateConsent(ctx context.Context, body PostApiAuthOauth2UpdateConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewPostApiAuthOauth2UpdateConsentRequest(c.Server, body) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + +func (c *Client) GetApiAuthOauth2Userinfo(ctx context.Context, params *GetApiAuthOauth2UserinfoParams, reqEditors ...RequestEditorFn) (*http.Response, error) { + req, err := NewGetApiAuthOauth2UserinfoRequest(c.Server, params) + if err != nil { + return nil, err + } + req = req.WithContext(ctx) + if err := c.applyEditors(ctx, req, reqEditors); err != nil { + return nil, err + } + return c.Client.Do(req) +} + func (c *Client) GetApiAuthOk(ctx context.Context, reqEditors ...RequestEditorFn) (*http.Response, error) { req, err := NewGetApiAuthOkRequest(c.Server) if err != nil { @@ -13372,6 +14493,67 @@ func (c *Client) RotateWorkspaceAgentApiKey(ctx context.Context, orgId string, k return c.Client.Do(req) } +// NewListAgentOAuthGrantsRequest generates requests for ListAgentOAuthGrants +func NewListAgentOAuthGrantsRequest(server string) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/agent-oauth-grants") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewRevokeAgentOAuthGrantRequest generates requests for RevokeAgentOAuthGrant +func NewRevokeAgentOAuthGrantRequest(server string, grantId string) (*http.Request, error) { + var err error + + var pathParam0 string + + pathParam0, err = runtime.StyleParamWithOptions("simple", false, "grantId", grantId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationPath, Type: "string", Format: ""}) + if err != nil { + return nil, err + } + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/agent-oauth-grants/%s", pathParam0) + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodDelete, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + // NewGetApiAuthAccountInfoRequest generates requests for GetApiAuthAccountInfo func NewGetApiAuthAccountInfoRequest(server string) (*http.Request, error) { var err error @@ -15084,6 +16266,164 @@ func NewListUserSessionsRequest(server string) (*http.Request, error) { return req, nil } +// NewGetApiAuthOauth2AuthorizeRequest generates requests for GetApiAuthOauth2Authorize +func NewGetApiAuthOauth2AuthorizeRequest(server string, params *GetApiAuthOauth2AuthorizeParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/authorize") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + if params != nil { + // queryValues collects non-styled parameters (passthrough, JSON) + // that are safe to round-trip through url.Values.Encode(). + queryValues := queryURL.Query() + // rawQueryFragments collects pre-encoded query fragments from + // styled parameters, preserving literal commas as delimiters + // per the OpenAPI spec (e.g. "color=blue,black,brown"). + var rawQueryFragments []string + + if params.ResponseType != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "response_type", *params.ResponseType, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + if params.RedirectUri != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "redirect_uri", *params.RedirectUri, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: "uri"}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.Scope != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "scope", *params.Scope, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.State != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "state", *params.State, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.RequestUri != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "request_uri", *params.RequestUri, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.CodeChallenge != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge", *params.CodeChallenge, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.CodeChallengeMethod != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "code_challenge_method", *params.CodeChallengeMethod, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.Nonce != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "nonce", *params.Nonce, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.Prompt != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "prompt", *params.Prompt, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if encoded := queryValues.Encode(); encoded != "" { + rawQueryFragments = append(rawQueryFragments, encoded) + } + queryURL.RawQuery = strings.Join(rawQueryFragments, "&") + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + // NewGetApiAuthOauth2CallbackProviderIdRequest generates requests for GetApiAuthOauth2CallbackProviderId func NewGetApiAuthOauth2CallbackProviderIdRequest(server string, providerId string, params *GetApiAuthOauth2CallbackProviderIdParams) (*http.Request, error) { var err error @@ -15193,6 +16533,538 @@ func NewGetApiAuthOauth2CallbackProviderIdRequest(server string, providerId stri return req, nil } +// NewPostApiAuthOauth2ClientRotateSecretRequest calls the generic PostApiAuthOauth2ClientRotateSecret builder with application/json body +func NewPostApiAuthOauth2ClientRotateSecretRequest(server string, body PostApiAuthOauth2ClientRotateSecretJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2ClientRotateSecretRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2ClientRotateSecretRequestWithBody generates requests for PostApiAuthOauth2ClientRotateSecret with any type of body +func NewPostApiAuthOauth2ClientRotateSecretRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/client/rotate-secret") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2ConsentRequest calls the generic PostApiAuthOauth2Consent builder with application/json body +func NewPostApiAuthOauth2ConsentRequest(server string, body PostApiAuthOauth2ConsentJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2ConsentRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2ConsentRequestWithBody generates requests for PostApiAuthOauth2Consent with any type of body +func NewPostApiAuthOauth2ConsentRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/consent") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2ContinueRequest calls the generic PostApiAuthOauth2Continue builder with application/json body +func NewPostApiAuthOauth2ContinueRequest(server string, body PostApiAuthOauth2ContinueJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2ContinueRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2ContinueRequestWithBody generates requests for PostApiAuthOauth2Continue with any type of body +func NewPostApiAuthOauth2ContinueRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/continue") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2CreateClientRequest calls the generic PostApiAuthOauth2CreateClient builder with application/json body +func NewPostApiAuthOauth2CreateClientRequest(server string, body PostApiAuthOauth2CreateClientJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2CreateClientRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2CreateClientRequestWithBody generates requests for PostApiAuthOauth2CreateClient with any type of body +func NewPostApiAuthOauth2CreateClientRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/create-client") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2DeleteClientRequest calls the generic PostApiAuthOauth2DeleteClient builder with application/json body +func NewPostApiAuthOauth2DeleteClientRequest(server string, body PostApiAuthOauth2DeleteClientJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2DeleteClientRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2DeleteClientRequestWithBody generates requests for PostApiAuthOauth2DeleteClient with any type of body +func NewPostApiAuthOauth2DeleteClientRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/delete-client") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2DeleteConsentRequest calls the generic PostApiAuthOauth2DeleteConsent builder with application/json body +func NewPostApiAuthOauth2DeleteConsentRequest(server string, body PostApiAuthOauth2DeleteConsentJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2DeleteConsentRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2DeleteConsentRequestWithBody generates requests for PostApiAuthOauth2DeleteConsent with any type of body +func NewPostApiAuthOauth2DeleteConsentRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/delete-consent") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewGetApiAuthOauth2EndSessionRequest generates requests for GetApiAuthOauth2EndSession +func NewGetApiAuthOauth2EndSessionRequest(server string, params *GetApiAuthOauth2EndSessionParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/end-session") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + if params != nil { + // queryValues collects non-styled parameters (passthrough, JSON) + // that are safe to round-trip through url.Values.Encode(). + queryValues := queryURL.Query() + // rawQueryFragments collects pre-encoded query fragments from + // styled parameters, preserving literal commas as delimiters + // per the OpenAPI spec (e.g. "color=blue,black,brown"). + var rawQueryFragments []string + + if params.IdTokenHint != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "id_token_hint", *params.IdTokenHint, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.ClientId != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", *params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.PostLogoutRedirectUri != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "post_logout_redirect_uri", *params.PostLogoutRedirectUri, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if params.State != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "state", *params.State, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if encoded := queryValues.Encode(); encoded != "" { + rawQueryFragments = append(rawQueryFragments, encoded) + } + queryURL.RawQuery = strings.Join(rawQueryFragments, "&") + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewGetApiAuthOauth2GetClientRequest generates requests for GetApiAuthOauth2GetClient +func NewGetApiAuthOauth2GetClientRequest(server string, params *GetApiAuthOauth2GetClientParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/get-client") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + if params != nil { + // queryValues collects non-styled parameters (passthrough, JSON) + // that are safe to round-trip through url.Values.Encode(). + queryValues := queryURL.Query() + // rawQueryFragments collects pre-encoded query fragments from + // styled parameters, preserving literal commas as delimiters + // per the OpenAPI spec (e.g. "color=blue,black,brown"). + var rawQueryFragments []string + + if params.ClientId != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", *params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if encoded := queryValues.Encode(); encoded != "" { + rawQueryFragments = append(rawQueryFragments, encoded) + } + queryURL.RawQuery = strings.Join(rawQueryFragments, "&") + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewGetApiAuthOauth2GetClientsRequest generates requests for GetApiAuthOauth2GetClients +func NewGetApiAuthOauth2GetClientsRequest(server string) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/get-clients") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewGetApiAuthOauth2GetConsentRequest generates requests for GetApiAuthOauth2GetConsent +func NewGetApiAuthOauth2GetConsentRequest(server string, params *GetApiAuthOauth2GetConsentParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/get-consent") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + if params != nil { + // queryValues collects non-styled parameters (passthrough, JSON) + // that are safe to round-trip through url.Values.Encode(). + queryValues := queryURL.Query() + // rawQueryFragments collects pre-encoded query fragments from + // styled parameters, preserving literal commas as delimiters + // per the OpenAPI spec (e.g. "color=blue,black,brown"). + var rawQueryFragments []string + + if params.Id != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "id", *params.Id, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if encoded := queryValues.Encode(); encoded != "" { + rawQueryFragments = append(rawQueryFragments, encoded) + } + queryURL.RawQuery = strings.Join(rawQueryFragments, "&") + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewGetApiAuthOauth2GetConsentsRequest generates requests for GetApiAuthOauth2GetConsents +func NewGetApiAuthOauth2GetConsentsRequest(server string) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/get-consents") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewPostApiAuthOauth2IntrospectRequest calls the generic PostApiAuthOauth2Introspect builder with application/json body +func NewPostApiAuthOauth2IntrospectRequest(server string, body PostApiAuthOauth2IntrospectJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2IntrospectRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2IntrospectRequestWithBody generates requests for PostApiAuthOauth2Introspect with any type of body +func NewPostApiAuthOauth2IntrospectRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/introspect") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + // NewPostApiAuthOauth2LinkRequest calls the generic PostApiAuthOauth2Link builder with application/json body func NewPostApiAuthOauth2LinkRequest(server string, body PostApiAuthOauth2LinkJSONRequestBody) (*http.Request, error) { var bodyReader io.Reader @@ -15233,6 +17105,342 @@ func NewPostApiAuthOauth2LinkRequestWithBody(server string, contentType string, return req, nil } +// NewGetApiAuthOauth2PublicClientRequest generates requests for GetApiAuthOauth2PublicClient +func NewGetApiAuthOauth2PublicClientRequest(server string, params *GetApiAuthOauth2PublicClientParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/public-client") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + if params != nil { + // queryValues collects non-styled parameters (passthrough, JSON) + // that are safe to round-trip through url.Values.Encode(). + queryValues := queryURL.Query() + // rawQueryFragments collects pre-encoded query fragments from + // styled parameters, preserving literal commas as delimiters + // per the OpenAPI spec (e.g. "color=blue,black,brown"). + var rawQueryFragments []string + + if params.ClientId != nil { + + if queryFrag, err := runtime.StyleParamWithOptions("form", true, "client_id", *params.ClientId, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationQuery, Type: "string", Format: ""}); err != nil { + return nil, err + } else { + for _, qp := range strings.Split(queryFrag, "&") { + rawQueryFragments = append(rawQueryFragments, qp) + } + } + + } + + if encoded := queryValues.Encode(); encoded != "" { + rawQueryFragments = append(rawQueryFragments, encoded) + } + queryURL.RawQuery = strings.Join(rawQueryFragments, "&") + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + return req, nil +} + +// NewPostApiAuthOauth2PublicClientPreloginRequest calls the generic PostApiAuthOauth2PublicClientPrelogin builder with application/json body +func NewPostApiAuthOauth2PublicClientPreloginRequest(server string, body PostApiAuthOauth2PublicClientPreloginJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2PublicClientPreloginRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2PublicClientPreloginRequestWithBody generates requests for PostApiAuthOauth2PublicClientPrelogin with any type of body +func NewPostApiAuthOauth2PublicClientPreloginRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/public-client-prelogin") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2RegisterRequest calls the generic PostApiAuthOauth2Register builder with application/json body +func NewPostApiAuthOauth2RegisterRequest(server string, body PostApiAuthOauth2RegisterJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2RegisterRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2RegisterRequestWithBody generates requests for PostApiAuthOauth2Register with any type of body +func NewPostApiAuthOauth2RegisterRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/register") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2RevokeRequest calls the generic PostApiAuthOauth2Revoke builder with application/json body +func NewPostApiAuthOauth2RevokeRequest(server string, body PostApiAuthOauth2RevokeJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2RevokeRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2RevokeRequestWithBody generates requests for PostApiAuthOauth2Revoke with any type of body +func NewPostApiAuthOauth2RevokeRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/revoke") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2TokenRequest calls the generic PostApiAuthOauth2Token builder with application/json body +func NewPostApiAuthOauth2TokenRequest(server string, body PostApiAuthOauth2TokenJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2TokenRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2TokenRequestWithBody generates requests for PostApiAuthOauth2Token with any type of body +func NewPostApiAuthOauth2TokenRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/token") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2UpdateClientRequest calls the generic PostApiAuthOauth2UpdateClient builder with application/json body +func NewPostApiAuthOauth2UpdateClientRequest(server string, body PostApiAuthOauth2UpdateClientJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2UpdateClientRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2UpdateClientRequestWithBody generates requests for PostApiAuthOauth2UpdateClient with any type of body +func NewPostApiAuthOauth2UpdateClientRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/update-client") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewPostApiAuthOauth2UpdateConsentRequest calls the generic PostApiAuthOauth2UpdateConsent builder with application/json body +func NewPostApiAuthOauth2UpdateConsentRequest(server string, body PostApiAuthOauth2UpdateConsentJSONRequestBody) (*http.Request, error) { + var bodyReader io.Reader + buf, err := json.Marshal(body) + if err != nil { + return nil, err + } + bodyReader = bytes.NewReader(buf) + return NewPostApiAuthOauth2UpdateConsentRequestWithBody(server, "application/json", bodyReader) +} + +// NewPostApiAuthOauth2UpdateConsentRequestWithBody generates requests for PostApiAuthOauth2UpdateConsent with any type of body +func NewPostApiAuthOauth2UpdateConsentRequestWithBody(server string, contentType string, body io.Reader) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/update-consent") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodPost, queryURL.String(), body) + if err != nil { + return nil, err + } + + req.Header.Add("Content-Type", contentType) + + return req, nil +} + +// NewGetApiAuthOauth2UserinfoRequest generates requests for GetApiAuthOauth2Userinfo +func NewGetApiAuthOauth2UserinfoRequest(server string, params *GetApiAuthOauth2UserinfoParams) (*http.Request, error) { + var err error + + serverURL, err := url.Parse(server) + if err != nil { + return nil, err + } + + operationPath := fmt.Sprintf("/api/auth/oauth2/userinfo") + if operationPath[0] == '/' { + operationPath = "." + operationPath + } + + queryURL, err := serverURL.Parse(operationPath) + if err != nil { + return nil, err + } + + req, err := http.NewRequest(http.MethodGet, queryURL.String(), nil) + if err != nil { + return nil, err + } + + if params != nil { + + if params.Authorization != nil { + var headerParam0 string + + headerParam0, err = runtime.StyleParamWithOptions("simple", false, "Authorization", *params.Authorization, runtime.StyleParamOptions{ParamLocation: runtime.ParamLocationHeader, Type: "string", Format: ""}) + if err != nil { + return nil, err + } + + req.Header.Set("Authorization", headerParam0) + } + + } + + return req, nil +} + // NewGetApiAuthOkRequest generates requests for GetApiAuthOk func NewGetApiAuthOkRequest(server string) (*http.Request, error) { var err error @@ -23673,6 +25881,12 @@ func WithBaseURL(baseURL string) ClientOption { // ClientWithResponsesInterface is the interface specification for the client with responses above. type ClientWithResponsesInterface interface { + // ListAgentOAuthGrantsWithResponse request + ListAgentOAuthGrantsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*ListAgentOAuthGrantsResponse, error) + + // RevokeAgentOAuthGrantWithResponse request + RevokeAgentOAuthGrantWithResponse(ctx context.Context, grantId string, reqEditors ...RequestEditorFn) (*RevokeAgentOAuthGrantResponse, error) + // GetApiAuthAccountInfoWithResponse request GetApiAuthAccountInfoWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthAccountInfoResponse, error) @@ -23847,14 +26061,103 @@ type ClientWithResponsesInterface interface { // ListUserSessionsWithResponse request ListUserSessionsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*ListUserSessionsResponse, error) + // GetApiAuthOauth2AuthorizeWithResponse request + GetApiAuthOauth2AuthorizeWithResponse(ctx context.Context, params *GetApiAuthOauth2AuthorizeParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2AuthorizeResponse, error) + // GetApiAuthOauth2CallbackProviderIdWithResponse request GetApiAuthOauth2CallbackProviderIdWithResponse(ctx context.Context, providerId string, params *GetApiAuthOauth2CallbackProviderIdParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2CallbackProviderIdResponse, error) + // PostApiAuthOauth2ClientRotateSecretWithBodyWithResponse request with any body + PostApiAuthOauth2ClientRotateSecretWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ClientRotateSecretResponse, error) + + PostApiAuthOauth2ClientRotateSecretWithResponse(ctx context.Context, body PostApiAuthOauth2ClientRotateSecretJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ClientRotateSecretResponse, error) + + // PostApiAuthOauth2ConsentWithBodyWithResponse request with any body + PostApiAuthOauth2ConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ConsentResponse, error) + + PostApiAuthOauth2ConsentWithResponse(ctx context.Context, body PostApiAuthOauth2ConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ConsentResponse, error) + + // PostApiAuthOauth2ContinueWithBodyWithResponse request with any body + PostApiAuthOauth2ContinueWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ContinueResponse, error) + + PostApiAuthOauth2ContinueWithResponse(ctx context.Context, body PostApiAuthOauth2ContinueJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ContinueResponse, error) + + // PostApiAuthOauth2CreateClientWithBodyWithResponse request with any body + PostApiAuthOauth2CreateClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2CreateClientResponse, error) + + PostApiAuthOauth2CreateClientWithResponse(ctx context.Context, body PostApiAuthOauth2CreateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2CreateClientResponse, error) + + // PostApiAuthOauth2DeleteClientWithBodyWithResponse request with any body + PostApiAuthOauth2DeleteClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteClientResponse, error) + + PostApiAuthOauth2DeleteClientWithResponse(ctx context.Context, body PostApiAuthOauth2DeleteClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteClientResponse, error) + + // PostApiAuthOauth2DeleteConsentWithBodyWithResponse request with any body + PostApiAuthOauth2DeleteConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteConsentResponse, error) + + PostApiAuthOauth2DeleteConsentWithResponse(ctx context.Context, body PostApiAuthOauth2DeleteConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteConsentResponse, error) + + // GetApiAuthOauth2EndSessionWithResponse request + GetApiAuthOauth2EndSessionWithResponse(ctx context.Context, params *GetApiAuthOauth2EndSessionParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2EndSessionResponse, error) + + // GetApiAuthOauth2GetClientWithResponse request + GetApiAuthOauth2GetClientWithResponse(ctx context.Context, params *GetApiAuthOauth2GetClientParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetClientResponse, error) + + // GetApiAuthOauth2GetClientsWithResponse request + GetApiAuthOauth2GetClientsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetClientsResponse, error) + + // GetApiAuthOauth2GetConsentWithResponse request + GetApiAuthOauth2GetConsentWithResponse(ctx context.Context, params *GetApiAuthOauth2GetConsentParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetConsentResponse, error) + + // GetApiAuthOauth2GetConsentsWithResponse request + GetApiAuthOauth2GetConsentsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetConsentsResponse, error) + + // PostApiAuthOauth2IntrospectWithBodyWithResponse request with any body + PostApiAuthOauth2IntrospectWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2IntrospectResponse, error) + + PostApiAuthOauth2IntrospectWithResponse(ctx context.Context, body PostApiAuthOauth2IntrospectJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2IntrospectResponse, error) + // PostApiAuthOauth2LinkWithBodyWithResponse request with any body PostApiAuthOauth2LinkWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2LinkResponse, error) PostApiAuthOauth2LinkWithResponse(ctx context.Context, body PostApiAuthOauth2LinkJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2LinkResponse, error) + // GetApiAuthOauth2PublicClientWithResponse request + GetApiAuthOauth2PublicClientWithResponse(ctx context.Context, params *GetApiAuthOauth2PublicClientParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2PublicClientResponse, error) + + // PostApiAuthOauth2PublicClientPreloginWithBodyWithResponse request with any body + PostApiAuthOauth2PublicClientPreloginWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2PublicClientPreloginResponse, error) + + PostApiAuthOauth2PublicClientPreloginWithResponse(ctx context.Context, body PostApiAuthOauth2PublicClientPreloginJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2PublicClientPreloginResponse, error) + + // PostApiAuthOauth2RegisterWithBodyWithResponse request with any body + PostApiAuthOauth2RegisterWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RegisterResponse, error) + + PostApiAuthOauth2RegisterWithResponse(ctx context.Context, body PostApiAuthOauth2RegisterJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RegisterResponse, error) + + // PostApiAuthOauth2RevokeWithBodyWithResponse request with any body + PostApiAuthOauth2RevokeWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RevokeResponse, error) + + PostApiAuthOauth2RevokeWithResponse(ctx context.Context, body PostApiAuthOauth2RevokeJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RevokeResponse, error) + + // PostApiAuthOauth2TokenWithBodyWithResponse request with any body + PostApiAuthOauth2TokenWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2TokenResponse, error) + + PostApiAuthOauth2TokenWithResponse(ctx context.Context, body PostApiAuthOauth2TokenJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2TokenResponse, error) + + // PostApiAuthOauth2UpdateClientWithBodyWithResponse request with any body + PostApiAuthOauth2UpdateClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateClientResponse, error) + + PostApiAuthOauth2UpdateClientWithResponse(ctx context.Context, body PostApiAuthOauth2UpdateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateClientResponse, error) + + // PostApiAuthOauth2UpdateConsentWithBodyWithResponse request with any body + PostApiAuthOauth2UpdateConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateConsentResponse, error) + + PostApiAuthOauth2UpdateConsentWithResponse(ctx context.Context, body PostApiAuthOauth2UpdateConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateConsentResponse, error) + + // GetApiAuthOauth2UserinfoWithResponse request + GetApiAuthOauth2UserinfoWithResponse(ctx context.Context, params *GetApiAuthOauth2UserinfoParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2UserinfoResponse, error) + // GetApiAuthOkWithResponse request GetApiAuthOkWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOkResponse, error) @@ -24609,6 +26912,76 @@ type ClientWithResponsesInterface interface { RotateWorkspaceAgentApiKeyWithResponse(ctx context.Context, orgId string, keyId string, body RotateWorkspaceAgentApiKeyJSONRequestBody, reqEditors ...RequestEditorFn) (*RotateWorkspaceAgentApiKeyResponse, error) } +type ListAgentOAuthGrantsResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + Items []struct { + ClientId string `json:"clientId"` + CreatedAt string `json:"createdAt"` + Id string `json:"id"` + OrgId string `json:"orgId"` + Scopes []ListAgentOAuthGrants200JSONResponseBodyItemsScopes `json:"scopes"` + UpdatedAt string `json:"updatedAt"` + UserId string `json:"userId"` + } `json:"items"` + } +} + +// Status returns HTTPResponse.Status +func (r ListAgentOAuthGrantsResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r ListAgentOAuthGrantsResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r ListAgentOAuthGrantsResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type RevokeAgentOAuthGrantResponse struct { + Body []byte + HTTPResponse *http.Response + JSON404 *Error +} + +// Status returns HTTPResponse.Status +func (r RevokeAgentOAuthGrantResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r RevokeAgentOAuthGrantResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r RevokeAgentOAuthGrantResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + type GetApiAuthAccountInfoResponse struct { Body []byte HTTPResponse *http.Response @@ -26925,6 +29298,55 @@ func (r ListUserSessionsResponse) ContentType() string { return "" } +type GetApiAuthOauth2AuthorizeResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + State *string `json:"state,omitempty"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2AuthorizeResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2AuthorizeResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2AuthorizeResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + type GetApiAuthOauth2CallbackProviderIdResponse struct { Body []byte HTTPResponse *http.Response @@ -26975,6 +29397,694 @@ func (r GetApiAuthOauth2CallbackProviderIdResponse) ContentType() string { return "" } +type PostApiAuthOauth2ClientRotateSecretResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2ClientRotateSecretResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2ClientRotateSecretResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2ClientRotateSecretResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2ConsentResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // RedirectUri The URI to redirect to, either with an authorization code or an error + RedirectUri string `json:"redirect_uri"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2ConsentResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2ConsentResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2ConsentResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2ContinueResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // RedirectUri The URI to redirect to, either with an authorization code or an error + RedirectUri string `json:"redirect_uri"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2ContinueResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2ContinueResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2ContinueResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2CreateClientResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // ClientId Unique identifier for the client + ClientId string `json:"client_id"` + + // ClientIdIssuedAt Creation timestamp of this client + ClientIdIssuedAt *float32 `json:"client_id_issued_at,omitempty"` + + // ClientName Name of the OAuth2 application + ClientName *string `json:"client_name,omitempty"` + + // ClientSecret Secret key for the client + ClientSecret *string `json:"client_secret,omitempty"` + + // ClientSecretExpiresAt Time the client secret will expire. If 0, the client secret will never expire. + ClientSecretExpiresAt *float32 `json:"client_secret_expires_at,omitempty"` + + // ClientUri URI of the OAuth2 application + ClientUri *string `json:"client_uri,omitempty"` + + // Contacts List representing ways to contact people responsible for this client, typically email addresses + Contacts *[]string `json:"contacts,omitempty"` + + // Disabled Whether the client is disabled + Disabled *bool `json:"disabled,omitempty"` + + // GrantTypes Requested authentication method for the token endpoint + GrantTypes *[]PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes `json:"grant_types,omitempty"` + + // LogoUri Icon URI for the application + LogoUri *string `json:"logo_uri,omitempty"` + + // Metadata Additional metadata for the application + Metadata *map[string]interface{} `json:"metadata,omitempty"` + + // PolicyUri Client's policy uri + PolicyUri *string `json:"policy_uri,omitempty"` + + // Public Whether the client is public as determined by the type + Public *bool `json:"public,omitempty"` + + // RedirectUris List of allowed redirect uris + RedirectUris *[]string `json:"redirect_uris,omitempty"` + + // ResponseTypes Requested authentication method for the token endpoint + ResponseTypes *[]PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes `json:"response_types,omitempty"` + + // Scope Space-separated scopes allowed by the client + Scope *string `json:"scope,omitempty"` + + // SoftwareId Unique identifier assigned by the developer to help in the dynamic registration process + SoftwareId *string `json:"software_id,omitempty"` + + // SoftwareStatement JWT containing metadata values about the client software as claims + SoftwareStatement *string `json:"software_statement,omitempty"` + + // SoftwareVersion Version identifier for the software_id + SoftwareVersion *string `json:"software_version,omitempty"` + + // TokenEndpointAuthMethod Response types the client may use + TokenEndpointAuthMethod *PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod `json:"token_endpoint_auth_method,omitempty"` + + // TosUri Client's terms of service uri + TosUri *string `json:"tos_uri,omitempty"` + + // Type Type of the client + Type *PostApiAuthOauth2CreateClient200JSONResponseBodyType `json:"type,omitempty"` + + // UserId ID of the user who registered the client, null if registered anonymously + UserId *string `json:"user_id,omitempty"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2CreateClientResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2CreateClientResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2CreateClientResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2DeleteClientResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2DeleteClientResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2DeleteClientResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2DeleteClientResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2DeleteConsentResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2DeleteConsentResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2DeleteConsentResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2DeleteConsentResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2EndSessionResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // Message Success message + Message *string `json:"message,omitempty"` + + // RedirectUri URI to redirect to after logout (if post_logout_redirect_uri was provided) + RedirectUri *string `json:"redirect_uri,omitempty"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2EndSessionResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2EndSessionResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2EndSessionResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2GetClientResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2GetClientResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2GetClientResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2GetClientResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2GetClientsResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2GetClientsResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2GetClientsResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2GetClientsResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2GetConsentResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2GetConsentResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2GetConsentResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2GetConsentResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2GetConsentsResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2GetConsentsResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2GetConsentsResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2GetConsentsResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2IntrospectResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // Active Whether the token is active + Active bool `json:"active"` + + // Aud Audience of the token + Aud *string `json:"aud,omitempty"` + + // ClientId Client ID associated with the token + ClientId *string `json:"client_id,omitempty"` + + // Exp Expiration time of the token (seconds since epoch) + Exp *float32 `json:"exp,omitempty"` + + // Iat Issued at time (seconds since epoch) + Iat *float32 `json:"iat,omitempty"` + + // Iss Issuer of the token + Iss *string `json:"iss,omitempty"` + + // Jti JWT ID + Jti *string `json:"jti,omitempty"` + + // Nbf Not before time (seconds since epoch) + Nbf *float32 `json:"nbf,omitempty"` + + // Scope Scopes associated with the token + Scope *string `json:"scope,omitempty"` + + // Sub Subject of the token + Sub *string `json:"sub,omitempty"` + + // TokenType Type of the token + TokenType *string `json:"token_type,omitempty"` + + // Username Username associated with the token + Username *string `json:"username,omitempty"` + } + JSON400 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2IntrospectResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2IntrospectResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2IntrospectResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + type PostApiAuthOauth2LinkResponse struct { Body []byte HTTPResponse *http.Response @@ -27029,6 +30139,500 @@ func (r PostApiAuthOauth2LinkResponse) ContentType() string { return "" } +type GetApiAuthOauth2PublicClientResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2PublicClientResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2PublicClientResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2PublicClientResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2PublicClientPreloginResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2PublicClientPreloginResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2PublicClientPreloginResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2PublicClientPreloginResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2RegisterResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // ClientId Unique identifier for the client + ClientId string `json:"client_id"` + + // ClientIdIssuedAt Creation timestamp of this client + ClientIdIssuedAt *float32 `json:"client_id_issued_at,omitempty"` + + // ClientName Name of the OAuth2 application + ClientName *string `json:"client_name,omitempty"` + + // ClientSecret Secret key for the client + ClientSecret *string `json:"client_secret,omitempty"` + + // ClientSecretExpiresAt Time the client secret will expire. If 0, the client secret will never expire. + ClientSecretExpiresAt *float32 `json:"client_secret_expires_at,omitempty"` + + // ClientUri Name of the OAuth2 application + ClientUri *string `json:"client_uri,omitempty"` + + // Contacts List representing ways to contact people responsible for this client, typically email addresses + Contacts *[]string `json:"contacts,omitempty"` + + // Disabled Whether the client is disabled + Disabled *bool `json:"disabled,omitempty"` + + // GrantTypes Requested authentication method for the token endpoint + GrantTypes *[]PostApiAuthOauth2Register200JSONResponseBodyGrantTypes `json:"grant_types,omitempty"` + + // LogoUri Icon URL for the application + LogoUri *string `json:"logo_uri,omitempty"` + + // PolicyUri Client's policy uri + PolicyUri *string `json:"policy_uri,omitempty"` + + // PostLogoutRedirectUris List of allowed logout redirect uris + PostLogoutRedirectUris *[]string `json:"post_logout_redirect_uris,omitempty"` + + // Public Whether the client is public as determined by the type + Public *bool `json:"public,omitempty"` + + // RedirectUris List of allowed redirect uris + RedirectUris *[]string `json:"redirect_uris,omitempty"` + + // ResponseTypes Requested authentication method for the token endpoint + ResponseTypes *[]PostApiAuthOauth2Register200JSONResponseBodyResponseTypes `json:"response_types,omitempty"` + + // Scope Space-separated scopes allowed by the client + Scope *string `json:"scope,omitempty"` + + // SoftwareId Unique identifier assigned by the developer to help in the dynamic registration process + SoftwareId *string `json:"software_id,omitempty"` + + // SoftwareStatement JWT containing metadata values about the client software as claims + SoftwareStatement *string `json:"software_statement,omitempty"` + + // SoftwareVersion Version identifier for the software_id + SoftwareVersion *string `json:"software_version,omitempty"` + + // TokenEndpointAuthMethod Requested authentication method for the token endpoint + TokenEndpointAuthMethod *PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod `json:"token_endpoint_auth_method,omitempty"` + + // TosUri Client's terms of service uri + TosUri *string `json:"tos_uri,omitempty"` + + // Type Type of the client + Type *PostApiAuthOauth2Register200JSONResponseBodyType `json:"type,omitempty"` + + // UserId ID of the user who registered the client, null if registered anonymously + UserId *string `json:"user_id,omitempty"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2RegisterResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2RegisterResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2RegisterResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2RevokeResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *map[string]interface{} + JSON400 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2RevokeResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2RevokeResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2RevokeResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2TokenResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // AccessToken The access token issued by the authorization server + AccessToken string `json:"access_token"` + + // ExpiresIn Lifetime in seconds of the access token + ExpiresIn float32 `json:"expires_in"` + + // IdToken ID Token (if OpenID Connect) + IdToken *string `json:"id_token,omitempty"` + + // RefreshToken Refresh token, if issued + RefreshToken *string `json:"refresh_token,omitempty"` + + // Scope Scopes granted by the access token + Scope *string `json:"scope,omitempty"` + + // TokenType The type of the token issued + TokenType PostApiAuthOauth2Token200JSONResponseBodyTokenType `json:"token_type"` + } + JSON400 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2TokenResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2TokenResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2TokenResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2UpdateClientResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2UpdateClientResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2UpdateClientResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2UpdateClientResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type PostApiAuthOauth2UpdateConsentResponse struct { + Body []byte + HTTPResponse *http.Response + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Message string `json:"message"` + } + JSON403 *struct { + Message *string `json:"message,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r PostApiAuthOauth2UpdateConsentResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r PostApiAuthOauth2UpdateConsentResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r PostApiAuthOauth2UpdateConsentResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + +type GetApiAuthOauth2UserinfoResponse struct { + Body []byte + HTTPResponse *http.Response + JSON200 *struct { + // Email User's email address, included if 'email' scope is granted + Email *openapi_types.Email `json:"email,omitempty"` + + // EmailVerified Whether the email is verified, included if 'email' scope is granted + EmailVerified *bool `json:"email_verified,omitempty"` + + // FamilyName User's family name, included if 'profile' scope is granted + FamilyName *string `json:"family_name,omitempty"` + + // GivenName User's given name, included if 'profile' scope is granted + GivenName *string `json:"given_name,omitempty"` + + // Name User's full name, included if 'profile' scope is granted + Name *string `json:"name,omitempty"` + + // Picture User's profile picture URL, included if 'profile' scope is granted + Picture *string `json:"picture,omitempty"` + + // Sub Subject identifier (user ID) + Sub string `json:"sub"` + } + JSON400 *struct { + Message string `json:"message"` + } + JSON401 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + } + JSON403 *struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + } + JSON404 *struct { + Message *string `json:"message,omitempty"` + } + JSON429 *struct { + Message *string `json:"message,omitempty"` + } + JSON500 *struct { + Message *string `json:"message,omitempty"` + } +} + +// Status returns HTTPResponse.Status +func (r GetApiAuthOauth2UserinfoResponse) Status() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Status + } + return http.StatusText(0) +} + +// StatusCode returns HTTPResponse.StatusCode +func (r GetApiAuthOauth2UserinfoResponse) StatusCode() int { + if r.HTTPResponse != nil { + return r.HTTPResponse.StatusCode + } + return 0 +} + +// ContentType is a convenience method to retrieve the Content-Type value from the HTTP response headers +func (r GetApiAuthOauth2UserinfoResponse) ContentType() string { + if r.HTTPResponse != nil { + return r.HTTPResponse.Header.Get("Content-Type") + } + return "" +} + type GetApiAuthOkResponse struct { Body []byte HTTPResponse *http.Response @@ -34167,6 +37771,24 @@ func (r RotateWorkspaceAgentApiKeyResponse) ContentType() string { return "" } +// ListAgentOAuthGrantsWithResponse request returning *ListAgentOAuthGrantsResponse +func (c *ClientWithResponses) ListAgentOAuthGrantsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*ListAgentOAuthGrantsResponse, error) { + rsp, err := c.ListAgentOAuthGrants(ctx, reqEditors...) + if err != nil { + return nil, err + } + return ParseListAgentOAuthGrantsResponse(rsp) +} + +// RevokeAgentOAuthGrantWithResponse request returning *RevokeAgentOAuthGrantResponse +func (c *ClientWithResponses) RevokeAgentOAuthGrantWithResponse(ctx context.Context, grantId string, reqEditors ...RequestEditorFn) (*RevokeAgentOAuthGrantResponse, error) { + rsp, err := c.RevokeAgentOAuthGrant(ctx, grantId, reqEditors...) + if err != nil { + return nil, err + } + return ParseRevokeAgentOAuthGrantResponse(rsp) +} + // GetApiAuthAccountInfoWithResponse request returning *GetApiAuthAccountInfoResponse func (c *ClientWithResponses) GetApiAuthAccountInfoWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthAccountInfoResponse, error) { rsp, err := c.GetApiAuthAccountInfo(ctx, reqEditors...) @@ -34743,6 +38365,15 @@ func (c *ClientWithResponses) ListUserSessionsWithResponse(ctx context.Context, return ParseListUserSessionsResponse(rsp) } +// GetApiAuthOauth2AuthorizeWithResponse request returning *GetApiAuthOauth2AuthorizeResponse +func (c *ClientWithResponses) GetApiAuthOauth2AuthorizeWithResponse(ctx context.Context, params *GetApiAuthOauth2AuthorizeParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2AuthorizeResponse, error) { + rsp, err := c.GetApiAuthOauth2Authorize(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2AuthorizeResponse(rsp) +} + // GetApiAuthOauth2CallbackProviderIdWithResponse request returning *GetApiAuthOauth2CallbackProviderIdResponse func (c *ClientWithResponses) GetApiAuthOauth2CallbackProviderIdWithResponse(ctx context.Context, providerId string, params *GetApiAuthOauth2CallbackProviderIdParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2CallbackProviderIdResponse, error) { rsp, err := c.GetApiAuthOauth2CallbackProviderId(ctx, providerId, params, reqEditors...) @@ -34752,6 +38383,170 @@ func (c *ClientWithResponses) GetApiAuthOauth2CallbackProviderIdWithResponse(ctx return ParseGetApiAuthOauth2CallbackProviderIdResponse(rsp) } +// PostApiAuthOauth2ClientRotateSecretWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2ClientRotateSecretResponse +func (c *ClientWithResponses) PostApiAuthOauth2ClientRotateSecretWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ClientRotateSecretResponse, error) { + rsp, err := c.PostApiAuthOauth2ClientRotateSecretWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ClientRotateSecretResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2ClientRotateSecretWithResponse(ctx context.Context, body PostApiAuthOauth2ClientRotateSecretJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ClientRotateSecretResponse, error) { + rsp, err := c.PostApiAuthOauth2ClientRotateSecret(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ClientRotateSecretResponse(rsp) +} + +// PostApiAuthOauth2ConsentWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2ConsentResponse +func (c *ClientWithResponses) PostApiAuthOauth2ConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2ConsentWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ConsentResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2ConsentWithResponse(ctx context.Context, body PostApiAuthOauth2ConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2Consent(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ConsentResponse(rsp) +} + +// PostApiAuthOauth2ContinueWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2ContinueResponse +func (c *ClientWithResponses) PostApiAuthOauth2ContinueWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ContinueResponse, error) { + rsp, err := c.PostApiAuthOauth2ContinueWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ContinueResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2ContinueWithResponse(ctx context.Context, body PostApiAuthOauth2ContinueJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2ContinueResponse, error) { + rsp, err := c.PostApiAuthOauth2Continue(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2ContinueResponse(rsp) +} + +// PostApiAuthOauth2CreateClientWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2CreateClientResponse +func (c *ClientWithResponses) PostApiAuthOauth2CreateClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2CreateClientResponse, error) { + rsp, err := c.PostApiAuthOauth2CreateClientWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2CreateClientResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2CreateClientWithResponse(ctx context.Context, body PostApiAuthOauth2CreateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2CreateClientResponse, error) { + rsp, err := c.PostApiAuthOauth2CreateClient(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2CreateClientResponse(rsp) +} + +// PostApiAuthOauth2DeleteClientWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2DeleteClientResponse +func (c *ClientWithResponses) PostApiAuthOauth2DeleteClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteClientResponse, error) { + rsp, err := c.PostApiAuthOauth2DeleteClientWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2DeleteClientResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2DeleteClientWithResponse(ctx context.Context, body PostApiAuthOauth2DeleteClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteClientResponse, error) { + rsp, err := c.PostApiAuthOauth2DeleteClient(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2DeleteClientResponse(rsp) +} + +// PostApiAuthOauth2DeleteConsentWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2DeleteConsentResponse +func (c *ClientWithResponses) PostApiAuthOauth2DeleteConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2DeleteConsentWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2DeleteConsentResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2DeleteConsentWithResponse(ctx context.Context, body PostApiAuthOauth2DeleteConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2DeleteConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2DeleteConsent(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2DeleteConsentResponse(rsp) +} + +// GetApiAuthOauth2EndSessionWithResponse request returning *GetApiAuthOauth2EndSessionResponse +func (c *ClientWithResponses) GetApiAuthOauth2EndSessionWithResponse(ctx context.Context, params *GetApiAuthOauth2EndSessionParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2EndSessionResponse, error) { + rsp, err := c.GetApiAuthOauth2EndSession(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2EndSessionResponse(rsp) +} + +// GetApiAuthOauth2GetClientWithResponse request returning *GetApiAuthOauth2GetClientResponse +func (c *ClientWithResponses) GetApiAuthOauth2GetClientWithResponse(ctx context.Context, params *GetApiAuthOauth2GetClientParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetClientResponse, error) { + rsp, err := c.GetApiAuthOauth2GetClient(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2GetClientResponse(rsp) +} + +// GetApiAuthOauth2GetClientsWithResponse request returning *GetApiAuthOauth2GetClientsResponse +func (c *ClientWithResponses) GetApiAuthOauth2GetClientsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetClientsResponse, error) { + rsp, err := c.GetApiAuthOauth2GetClients(ctx, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2GetClientsResponse(rsp) +} + +// GetApiAuthOauth2GetConsentWithResponse request returning *GetApiAuthOauth2GetConsentResponse +func (c *ClientWithResponses) GetApiAuthOauth2GetConsentWithResponse(ctx context.Context, params *GetApiAuthOauth2GetConsentParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetConsentResponse, error) { + rsp, err := c.GetApiAuthOauth2GetConsent(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2GetConsentResponse(rsp) +} + +// GetApiAuthOauth2GetConsentsWithResponse request returning *GetApiAuthOauth2GetConsentsResponse +func (c *ClientWithResponses) GetApiAuthOauth2GetConsentsWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2GetConsentsResponse, error) { + rsp, err := c.GetApiAuthOauth2GetConsents(ctx, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2GetConsentsResponse(rsp) +} + +// PostApiAuthOauth2IntrospectWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2IntrospectResponse +func (c *ClientWithResponses) PostApiAuthOauth2IntrospectWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2IntrospectResponse, error) { + rsp, err := c.PostApiAuthOauth2IntrospectWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2IntrospectResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2IntrospectWithResponse(ctx context.Context, body PostApiAuthOauth2IntrospectJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2IntrospectResponse, error) { + rsp, err := c.PostApiAuthOauth2Introspect(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2IntrospectResponse(rsp) +} + // PostApiAuthOauth2LinkWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2LinkResponse func (c *ClientWithResponses) PostApiAuthOauth2LinkWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2LinkResponse, error) { rsp, err := c.PostApiAuthOauth2LinkWithBody(ctx, contentType, body, reqEditors...) @@ -34769,6 +38564,126 @@ func (c *ClientWithResponses) PostApiAuthOauth2LinkWithResponse(ctx context.Cont return ParsePostApiAuthOauth2LinkResponse(rsp) } +// GetApiAuthOauth2PublicClientWithResponse request returning *GetApiAuthOauth2PublicClientResponse +func (c *ClientWithResponses) GetApiAuthOauth2PublicClientWithResponse(ctx context.Context, params *GetApiAuthOauth2PublicClientParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2PublicClientResponse, error) { + rsp, err := c.GetApiAuthOauth2PublicClient(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2PublicClientResponse(rsp) +} + +// PostApiAuthOauth2PublicClientPreloginWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2PublicClientPreloginResponse +func (c *ClientWithResponses) PostApiAuthOauth2PublicClientPreloginWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2PublicClientPreloginResponse, error) { + rsp, err := c.PostApiAuthOauth2PublicClientPreloginWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2PublicClientPreloginResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2PublicClientPreloginWithResponse(ctx context.Context, body PostApiAuthOauth2PublicClientPreloginJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2PublicClientPreloginResponse, error) { + rsp, err := c.PostApiAuthOauth2PublicClientPrelogin(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2PublicClientPreloginResponse(rsp) +} + +// PostApiAuthOauth2RegisterWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2RegisterResponse +func (c *ClientWithResponses) PostApiAuthOauth2RegisterWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RegisterResponse, error) { + rsp, err := c.PostApiAuthOauth2RegisterWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2RegisterResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2RegisterWithResponse(ctx context.Context, body PostApiAuthOauth2RegisterJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RegisterResponse, error) { + rsp, err := c.PostApiAuthOauth2Register(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2RegisterResponse(rsp) +} + +// PostApiAuthOauth2RevokeWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2RevokeResponse +func (c *ClientWithResponses) PostApiAuthOauth2RevokeWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RevokeResponse, error) { + rsp, err := c.PostApiAuthOauth2RevokeWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2RevokeResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2RevokeWithResponse(ctx context.Context, body PostApiAuthOauth2RevokeJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2RevokeResponse, error) { + rsp, err := c.PostApiAuthOauth2Revoke(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2RevokeResponse(rsp) +} + +// PostApiAuthOauth2TokenWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2TokenResponse +func (c *ClientWithResponses) PostApiAuthOauth2TokenWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2TokenResponse, error) { + rsp, err := c.PostApiAuthOauth2TokenWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2TokenResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2TokenWithResponse(ctx context.Context, body PostApiAuthOauth2TokenJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2TokenResponse, error) { + rsp, err := c.PostApiAuthOauth2Token(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2TokenResponse(rsp) +} + +// PostApiAuthOauth2UpdateClientWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2UpdateClientResponse +func (c *ClientWithResponses) PostApiAuthOauth2UpdateClientWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateClientResponse, error) { + rsp, err := c.PostApiAuthOauth2UpdateClientWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2UpdateClientResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2UpdateClientWithResponse(ctx context.Context, body PostApiAuthOauth2UpdateClientJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateClientResponse, error) { + rsp, err := c.PostApiAuthOauth2UpdateClient(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2UpdateClientResponse(rsp) +} + +// PostApiAuthOauth2UpdateConsentWithBodyWithResponse request with arbitrary body returning *PostApiAuthOauth2UpdateConsentResponse +func (c *ClientWithResponses) PostApiAuthOauth2UpdateConsentWithBodyWithResponse(ctx context.Context, contentType string, body io.Reader, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2UpdateConsentWithBody(ctx, contentType, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2UpdateConsentResponse(rsp) +} + +func (c *ClientWithResponses) PostApiAuthOauth2UpdateConsentWithResponse(ctx context.Context, body PostApiAuthOauth2UpdateConsentJSONRequestBody, reqEditors ...RequestEditorFn) (*PostApiAuthOauth2UpdateConsentResponse, error) { + rsp, err := c.PostApiAuthOauth2UpdateConsent(ctx, body, reqEditors...) + if err != nil { + return nil, err + } + return ParsePostApiAuthOauth2UpdateConsentResponse(rsp) +} + +// GetApiAuthOauth2UserinfoWithResponse request returning *GetApiAuthOauth2UserinfoResponse +func (c *ClientWithResponses) GetApiAuthOauth2UserinfoWithResponse(ctx context.Context, params *GetApiAuthOauth2UserinfoParams, reqEditors ...RequestEditorFn) (*GetApiAuthOauth2UserinfoResponse, error) { + rsp, err := c.GetApiAuthOauth2Userinfo(ctx, params, reqEditors...) + if err != nil { + return nil, err + } + return ParseGetApiAuthOauth2UserinfoResponse(rsp) +} + // GetApiAuthOkWithResponse request returning *GetApiAuthOkResponse func (c *ClientWithResponses) GetApiAuthOkWithResponse(ctx context.Context, reqEditors ...RequestEditorFn) (*GetApiAuthOkResponse, error) { rsp, err := c.GetApiAuthOk(ctx, reqEditors...) @@ -37196,6 +41111,68 @@ func (c *ClientWithResponses) RotateWorkspaceAgentApiKeyWithResponse(ctx context return ParseRotateWorkspaceAgentApiKeyResponse(rsp) } +// ParseListAgentOAuthGrantsResponse parses an HTTP response from a ListAgentOAuthGrantsWithResponse call +func ParseListAgentOAuthGrantsResponse(rsp *http.Response) (*ListAgentOAuthGrantsResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &ListAgentOAuthGrantsResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + Items []struct { + ClientId string `json:"clientId"` + CreatedAt string `json:"createdAt"` + Id string `json:"id"` + OrgId string `json:"orgId"` + Scopes []ListAgentOAuthGrants200JSONResponseBodyItemsScopes `json:"scopes"` + UpdatedAt string `json:"updatedAt"` + UserId string `json:"userId"` + } `json:"items"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + } + + return response, nil +} + +// ParseRevokeAgentOAuthGrantResponse parses an HTTP response from a RevokeAgentOAuthGrantWithResponse call +func ParseRevokeAgentOAuthGrantResponse(rsp *http.Response) (*RevokeAgentOAuthGrantResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &RevokeAgentOAuthGrantResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest Error + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + } + + return response, nil +} + // ParseGetApiAuthAccountInfoResponse parses an HTTP response from a GetApiAuthAccountInfoWithResponse call func ParseGetApiAuthAccountInfoResponse(rsp *http.Response) (*GetApiAuthAccountInfoResponse, error) { bodyBytes, err := io.ReadAll(rsp.Body) @@ -40756,6 +44733,81 @@ func ParseListUserSessionsResponse(rsp *http.Response) (*ListUserSessionsRespons return response, nil } +// ParseGetApiAuthOauth2AuthorizeResponse parses an HTTP response from a GetApiAuthOauth2AuthorizeWithResponse call +func ParseGetApiAuthOauth2AuthorizeResponse(rsp *http.Response) (*GetApiAuthOauth2AuthorizeResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2AuthorizeResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + State *string `json:"state,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + // ParseGetApiAuthOauth2CallbackProviderIdResponse parses an HTTP response from a GetApiAuthOauth2CallbackProviderIdWithResponse call func ParseGetApiAuthOauth2CallbackProviderIdResponse(rsp *http.Response) (*GetApiAuthOauth2CallbackProviderIdResponse, error) { bodyBytes, err := io.ReadAll(rsp.Body) @@ -40838,6 +44890,1036 @@ func ParseGetApiAuthOauth2CallbackProviderIdResponse(rsp *http.Response) (*GetAp return response, nil } +// ParsePostApiAuthOauth2ClientRotateSecretResponse parses an HTTP response from a PostApiAuthOauth2ClientRotateSecretWithResponse call +func ParsePostApiAuthOauth2ClientRotateSecretResponse(rsp *http.Response) (*PostApiAuthOauth2ClientRotateSecretResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2ClientRotateSecretResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2ConsentResponse parses an HTTP response from a PostApiAuthOauth2ConsentWithResponse call +func ParsePostApiAuthOauth2ConsentResponse(rsp *http.Response) (*PostApiAuthOauth2ConsentResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2ConsentResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // RedirectUri The URI to redirect to, either with an authorization code or an error + RedirectUri string `json:"redirect_uri"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2ContinueResponse parses an HTTP response from a PostApiAuthOauth2ContinueWithResponse call +func ParsePostApiAuthOauth2ContinueResponse(rsp *http.Response) (*PostApiAuthOauth2ContinueResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2ContinueResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // RedirectUri The URI to redirect to, either with an authorization code or an error + RedirectUri string `json:"redirect_uri"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2CreateClientResponse parses an HTTP response from a PostApiAuthOauth2CreateClientWithResponse call +func ParsePostApiAuthOauth2CreateClientResponse(rsp *http.Response) (*PostApiAuthOauth2CreateClientResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2CreateClientResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // ClientId Unique identifier for the client + ClientId string `json:"client_id"` + + // ClientIdIssuedAt Creation timestamp of this client + ClientIdIssuedAt *float32 `json:"client_id_issued_at,omitempty"` + + // ClientName Name of the OAuth2 application + ClientName *string `json:"client_name,omitempty"` + + // ClientSecret Secret key for the client + ClientSecret *string `json:"client_secret,omitempty"` + + // ClientSecretExpiresAt Time the client secret will expire. If 0, the client secret will never expire. + ClientSecretExpiresAt *float32 `json:"client_secret_expires_at,omitempty"` + + // ClientUri URI of the OAuth2 application + ClientUri *string `json:"client_uri,omitempty"` + + // Contacts List representing ways to contact people responsible for this client, typically email addresses + Contacts *[]string `json:"contacts,omitempty"` + + // Disabled Whether the client is disabled + Disabled *bool `json:"disabled,omitempty"` + + // GrantTypes Requested authentication method for the token endpoint + GrantTypes *[]PostApiAuthOauth2CreateClient200JSONResponseBodyGrantTypes `json:"grant_types,omitempty"` + + // LogoUri Icon URI for the application + LogoUri *string `json:"logo_uri,omitempty"` + + // Metadata Additional metadata for the application + Metadata *map[string]interface{} `json:"metadata,omitempty"` + + // PolicyUri Client's policy uri + PolicyUri *string `json:"policy_uri,omitempty"` + + // Public Whether the client is public as determined by the type + Public *bool `json:"public,omitempty"` + + // RedirectUris List of allowed redirect uris + RedirectUris *[]string `json:"redirect_uris,omitempty"` + + // ResponseTypes Requested authentication method for the token endpoint + ResponseTypes *[]PostApiAuthOauth2CreateClient200JSONResponseBodyResponseTypes `json:"response_types,omitempty"` + + // Scope Space-separated scopes allowed by the client + Scope *string `json:"scope,omitempty"` + + // SoftwareId Unique identifier assigned by the developer to help in the dynamic registration process + SoftwareId *string `json:"software_id,omitempty"` + + // SoftwareStatement JWT containing metadata values about the client software as claims + SoftwareStatement *string `json:"software_statement,omitempty"` + + // SoftwareVersion Version identifier for the software_id + SoftwareVersion *string `json:"software_version,omitempty"` + + // TokenEndpointAuthMethod Response types the client may use + TokenEndpointAuthMethod *PostApiAuthOauth2CreateClient200JSONResponseBodyTokenEndpointAuthMethod `json:"token_endpoint_auth_method,omitempty"` + + // TosUri Client's terms of service uri + TosUri *string `json:"tos_uri,omitempty"` + + // Type Type of the client + Type *PostApiAuthOauth2CreateClient200JSONResponseBodyType `json:"type,omitempty"` + + // UserId ID of the user who registered the client, null if registered anonymously + UserId *string `json:"user_id,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2DeleteClientResponse parses an HTTP response from a PostApiAuthOauth2DeleteClientWithResponse call +func ParsePostApiAuthOauth2DeleteClientResponse(rsp *http.Response) (*PostApiAuthOauth2DeleteClientResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2DeleteClientResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2DeleteConsentResponse parses an HTTP response from a PostApiAuthOauth2DeleteConsentWithResponse call +func ParsePostApiAuthOauth2DeleteConsentResponse(rsp *http.Response) (*PostApiAuthOauth2DeleteConsentResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2DeleteConsentResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2EndSessionResponse parses an HTTP response from a GetApiAuthOauth2EndSessionWithResponse call +func ParseGetApiAuthOauth2EndSessionResponse(rsp *http.Response) (*GetApiAuthOauth2EndSessionResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2EndSessionResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // Message Success message + Message *string `json:"message,omitempty"` + + // RedirectUri URI to redirect to after logout (if post_logout_redirect_uri was provided) + RedirectUri *string `json:"redirect_uri,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2GetClientResponse parses an HTTP response from a GetApiAuthOauth2GetClientWithResponse call +func ParseGetApiAuthOauth2GetClientResponse(rsp *http.Response) (*GetApiAuthOauth2GetClientResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2GetClientResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2GetClientsResponse parses an HTTP response from a GetApiAuthOauth2GetClientsWithResponse call +func ParseGetApiAuthOauth2GetClientsResponse(rsp *http.Response) (*GetApiAuthOauth2GetClientsResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2GetClientsResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2GetConsentResponse parses an HTTP response from a GetApiAuthOauth2GetConsentWithResponse call +func ParseGetApiAuthOauth2GetConsentResponse(rsp *http.Response) (*GetApiAuthOauth2GetConsentResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2GetConsentResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2GetConsentsResponse parses an HTTP response from a GetApiAuthOauth2GetConsentsWithResponse call +func ParseGetApiAuthOauth2GetConsentsResponse(rsp *http.Response) (*GetApiAuthOauth2GetConsentsResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2GetConsentsResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2IntrospectResponse parses an HTTP response from a PostApiAuthOauth2IntrospectWithResponse call +func ParsePostApiAuthOauth2IntrospectResponse(rsp *http.Response) (*PostApiAuthOauth2IntrospectResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2IntrospectResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // Active Whether the token is active + Active bool `json:"active"` + + // Aud Audience of the token + Aud *string `json:"aud,omitempty"` + + // ClientId Client ID associated with the token + ClientId *string `json:"client_id,omitempty"` + + // Exp Expiration time of the token (seconds since epoch) + Exp *float32 `json:"exp,omitempty"` + + // Iat Issued at time (seconds since epoch) + Iat *float32 `json:"iat,omitempty"` + + // Iss Issuer of the token + Iss *string `json:"iss,omitempty"` + + // Jti JWT ID + Jti *string `json:"jti,omitempty"` + + // Nbf Not before time (seconds since epoch) + Nbf *float32 `json:"nbf,omitempty"` + + // Scope Scopes associated with the token + Scope *string `json:"scope,omitempty"` + + // Sub Subject of the token + Sub *string `json:"sub,omitempty"` + + // TokenType Type of the token + TokenType *string `json:"token_type,omitempty"` + + // Username Username associated with the token + Username *string `json:"username,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + // ParsePostApiAuthOauth2LinkResponse parses an HTTP response from a PostApiAuthOauth2LinkWithResponse call func ParsePostApiAuthOauth2LinkResponse(rsp *http.Response) (*PostApiAuthOauth2LinkResponse, error) { bodyBytes, err := io.ReadAll(rsp.Body) @@ -40924,6 +46006,732 @@ func ParsePostApiAuthOauth2LinkResponse(rsp *http.Response) (*PostApiAuthOauth2L return response, nil } +// ParseGetApiAuthOauth2PublicClientResponse parses an HTTP response from a GetApiAuthOauth2PublicClientWithResponse call +func ParseGetApiAuthOauth2PublicClientResponse(rsp *http.Response) (*GetApiAuthOauth2PublicClientResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2PublicClientResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2PublicClientPreloginResponse parses an HTTP response from a PostApiAuthOauth2PublicClientPreloginWithResponse call +func ParsePostApiAuthOauth2PublicClientPreloginResponse(rsp *http.Response) (*PostApiAuthOauth2PublicClientPreloginResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2PublicClientPreloginResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2RegisterResponse parses an HTTP response from a PostApiAuthOauth2RegisterWithResponse call +func ParsePostApiAuthOauth2RegisterResponse(rsp *http.Response) (*PostApiAuthOauth2RegisterResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2RegisterResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // ClientId Unique identifier for the client + ClientId string `json:"client_id"` + + // ClientIdIssuedAt Creation timestamp of this client + ClientIdIssuedAt *float32 `json:"client_id_issued_at,omitempty"` + + // ClientName Name of the OAuth2 application + ClientName *string `json:"client_name,omitempty"` + + // ClientSecret Secret key for the client + ClientSecret *string `json:"client_secret,omitempty"` + + // ClientSecretExpiresAt Time the client secret will expire. If 0, the client secret will never expire. + ClientSecretExpiresAt *float32 `json:"client_secret_expires_at,omitempty"` + + // ClientUri Name of the OAuth2 application + ClientUri *string `json:"client_uri,omitempty"` + + // Contacts List representing ways to contact people responsible for this client, typically email addresses + Contacts *[]string `json:"contacts,omitempty"` + + // Disabled Whether the client is disabled + Disabled *bool `json:"disabled,omitempty"` + + // GrantTypes Requested authentication method for the token endpoint + GrantTypes *[]PostApiAuthOauth2Register200JSONResponseBodyGrantTypes `json:"grant_types,omitempty"` + + // LogoUri Icon URL for the application + LogoUri *string `json:"logo_uri,omitempty"` + + // PolicyUri Client's policy uri + PolicyUri *string `json:"policy_uri,omitempty"` + + // PostLogoutRedirectUris List of allowed logout redirect uris + PostLogoutRedirectUris *[]string `json:"post_logout_redirect_uris,omitempty"` + + // Public Whether the client is public as determined by the type + Public *bool `json:"public,omitempty"` + + // RedirectUris List of allowed redirect uris + RedirectUris *[]string `json:"redirect_uris,omitempty"` + + // ResponseTypes Requested authentication method for the token endpoint + ResponseTypes *[]PostApiAuthOauth2Register200JSONResponseBodyResponseTypes `json:"response_types,omitempty"` + + // Scope Space-separated scopes allowed by the client + Scope *string `json:"scope,omitempty"` + + // SoftwareId Unique identifier assigned by the developer to help in the dynamic registration process + SoftwareId *string `json:"software_id,omitempty"` + + // SoftwareStatement JWT containing metadata values about the client software as claims + SoftwareStatement *string `json:"software_statement,omitempty"` + + // SoftwareVersion Version identifier for the software_id + SoftwareVersion *string `json:"software_version,omitempty"` + + // TokenEndpointAuthMethod Requested authentication method for the token endpoint + TokenEndpointAuthMethod *PostApiAuthOauth2Register200JSONResponseBodyTokenEndpointAuthMethod `json:"token_endpoint_auth_method,omitempty"` + + // TosUri Client's terms of service uri + TosUri *string `json:"tos_uri,omitempty"` + + // Type Type of the client + Type *PostApiAuthOauth2Register200JSONResponseBodyType `json:"type,omitempty"` + + // UserId ID of the user who registered the client, null if registered anonymously + UserId *string `json:"user_id,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2RevokeResponse parses an HTTP response from a PostApiAuthOauth2RevokeWithResponse call +func ParsePostApiAuthOauth2RevokeResponse(rsp *http.Response) (*PostApiAuthOauth2RevokeResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2RevokeResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest map[string]interface{} + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2TokenResponse parses an HTTP response from a PostApiAuthOauth2TokenWithResponse call +func ParsePostApiAuthOauth2TokenResponse(rsp *http.Response) (*PostApiAuthOauth2TokenResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2TokenResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // AccessToken The access token issued by the authorization server + AccessToken string `json:"access_token"` + + // ExpiresIn Lifetime in seconds of the access token + ExpiresIn float32 `json:"expires_in"` + + // IdToken ID Token (if OpenID Connect) + IdToken *string `json:"id_token,omitempty"` + + // RefreshToken Refresh token, if issued + RefreshToken *string `json:"refresh_token,omitempty"` + + // Scope Scopes granted by the access token + Scope *string `json:"scope,omitempty"` + + // TokenType The type of the token issued + TokenType PostApiAuthOauth2Token200JSONResponseBodyTokenType `json:"token_type"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + ErrorUri *string `json:"error_uri,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2UpdateClientResponse parses an HTTP response from a PostApiAuthOauth2UpdateClientWithResponse call +func ParsePostApiAuthOauth2UpdateClientResponse(rsp *http.Response) (*PostApiAuthOauth2UpdateClientResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2UpdateClientResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParsePostApiAuthOauth2UpdateConsentResponse parses an HTTP response from a PostApiAuthOauth2UpdateConsentWithResponse call +func ParsePostApiAuthOauth2UpdateConsentResponse(rsp *http.Response) (*PostApiAuthOauth2UpdateConsentResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &PostApiAuthOauth2UpdateConsentResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + +// ParseGetApiAuthOauth2UserinfoResponse parses an HTTP response from a GetApiAuthOauth2UserinfoWithResponse call +func ParseGetApiAuthOauth2UserinfoResponse(rsp *http.Response) (*GetApiAuthOauth2UserinfoResponse, error) { + bodyBytes, err := io.ReadAll(rsp.Body) + defer func() { _ = rsp.Body.Close() }() + if err != nil { + return nil, err + } + + response := &GetApiAuthOauth2UserinfoResponse{ + Body: bodyBytes, + HTTPResponse: rsp, + } + + switch { + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 200: + var dest struct { + // Email User's email address, included if 'email' scope is granted + Email *openapi_types.Email `json:"email,omitempty"` + + // EmailVerified Whether the email is verified, included if 'email' scope is granted + EmailVerified *bool `json:"email_verified,omitempty"` + + // FamilyName User's family name, included if 'profile' scope is granted + FamilyName *string `json:"family_name,omitempty"` + + // GivenName User's given name, included if 'profile' scope is granted + GivenName *string `json:"given_name,omitempty"` + + // Name User's full name, included if 'profile' scope is granted + Name *string `json:"name,omitempty"` + + // Picture User's profile picture URL, included if 'profile' scope is granted + Picture *string `json:"picture,omitempty"` + + // Sub Subject identifier (user ID) + Sub string `json:"sub"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON200 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 400: + var dest struct { + Message string `json:"message"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON400 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 401: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON401 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 403: + var dest struct { + Error string `json:"error"` + ErrorDescription *string `json:"error_description,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON403 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 404: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON404 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 429: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON429 = &dest + + case strings.Contains(rsp.Header.Get("Content-Type"), "json") && rsp.StatusCode == 500: + var dest struct { + Message *string `json:"message,omitempty"` + } + if err := json.Unmarshal(bodyBytes, &dest); err != nil { + return nil, err + } + response.JSON500 = &dest + + } + + return response, nil +} + // ParseGetApiAuthOkResponse parses an HTTP response from a GetApiAuthOkWithResponse call func ParseGetApiAuthOkResponse(rsp *http.Response) (*GetApiAuthOkResponse, error) { bodyBytes, err := io.ReadAll(rsp.Body) diff --git a/docs/design/agent-authentication.md b/docs/design/agent-authentication.md index 431c17db..933565de 100644 --- a/docs/design/agent-authentication.md +++ b/docs/design/agent-authentication.md @@ -48,6 +48,11 @@ Restish v2 natively supports authorization code + PKCE. It caches OAuth tokens separately from HTTP responses, refreshes them, retries once after a `401`, and supports explicit logout. +Restish v2.3 uses port `8484` and path `/callback` by default for browser +authorization-code callbacks. Restish sends `localhost` in the authorization +request; ZPan also registers the equivalent `127.0.0.1` loopback callback for +clients and tooling that distinguish loopback hostnames. + ## 3. Why API Keys Still Exist CI and unattended services are different: no human is present to complete @@ -118,16 +123,30 @@ Properties: - system-managed and not editable/deletable - public client; no client secret - authorization code grant with PKCE -- loopback redirect URI such as `http://localhost:8484/callback` +- loopback redirect URIs `http://localhost:8484/callback` and + `http://127.0.0.1:8484/callback` - refresh-token support through `offline_access` - Agent scopes only Dynamic client registration is not required in v2.9. One first-party client is enough for the versioned ZPan Skill and Restish integration. -The authorization server publishes discovery metadata. Clients must discover -authorization, token, revocation, and user-info or introspection endpoints -rather than hard-code them. +The authorization server publishes discovery metadata. Better Auth OAuth +Provider 1.6.x mounts the runtime endpoints below the Better Auth base path: + +| Endpoint | Path | +|----------|------| +| Authorization | `/api/auth/oauth2/authorize` | +| Token and refresh | `/api/auth/oauth2/token` | +| Revocation | `/api/auth/oauth2/revoke` | +| Introspection | `/api/auth/oauth2/introspect` | +| UserInfo | `/api/auth/oauth2/userinfo` | +| Consent | `/api/auth/oauth2/consent` | +| Continue login flow | `/api/auth/oauth2/continue` | + +Because Better Auth is mounted at `/api/auth`, ZPan forwards the required +well-known authorization-server and OIDC metadata at root locations and also +publishes protected-resource metadata for `/api`. ## 6. Workspace Grant diff --git a/docs/roadmap/v2.9.md b/docs/roadmap/v2.9.md index c9fd4378..cd30851a 100644 --- a/docs/roadmap/v2.9.md +++ b/docs/roadmap/v2.9.md @@ -195,10 +195,18 @@ contents continue to move through presigned URLs, never through an MCP result. Create a system-managed public native client, for example `zpan-agent`, with: - authorization code + PKCE -- loopback callback such as `http://localhost:8484/callback` +- Restish v2.3 loopback callbacks `http://localhost:8484/callback` and + `http://127.0.0.1:8484/callback` - refresh-token support through `offline_access` - only Agent API scopes +Better Auth OAuth Provider 1.6.x serves the flow below the auth base path: +`/api/auth/oauth2/authorize`, `/api/auth/oauth2/token`, +`/api/auth/oauth2/revoke`, `/api/auth/oauth2/introspect`, and +`/api/auth/oauth2/userinfo`. ZPan additionally forwards required root +well-known metadata for the `/api/auth` issuer and publishes protected-resource +metadata for `/api`. + The default Restish profile uses authorization code + PKCE. After `restish api connect`, the first safe Agent API request opens browser consent; Restish caches and refreshes the resulting tokens. `--rsh-no-browser` may be diff --git a/migrations/0081_spotty_boomerang.sql b/migrations/0081_spotty_boomerang.sql new file mode 100644 index 00000000..af90bb7f --- /dev/null +++ b/migrations/0081_spotty_boomerang.sql @@ -0,0 +1,96 @@ +CREATE TABLE `oauthAccessToken` ( + `id` text PRIMARY KEY NOT NULL, + `token` text NOT NULL, + `client_id` text NOT NULL, + `session_id` text, + `user_id` text, + `reference_id` text, + `refresh_id` text, + `expires_at` integer NOT NULL, + `created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + `scopes` text NOT NULL, + FOREIGN KEY (`client_id`) REFERENCES `oauthClient`(`client_id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`session_id`) REFERENCES `session`(`id`) ON UPDATE no action ON DELETE set null, + FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`refresh_id`) REFERENCES `oauthRefreshToken`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE UNIQUE INDEX `oauthAccessToken_token_unique` ON `oauthAccessToken` (`token`);--> statement-breakpoint +CREATE INDEX `oauthAccessToken_client_id_idx` ON `oauthAccessToken` (`client_id`);--> statement-breakpoint +CREATE INDEX `oauthAccessToken_session_id_idx` ON `oauthAccessToken` (`session_id`);--> statement-breakpoint +CREATE INDEX `oauthAccessToken_user_id_idx` ON `oauthAccessToken` (`user_id`);--> statement-breakpoint +CREATE INDEX `oauthAccessToken_refresh_id_idx` ON `oauthAccessToken` (`refresh_id`);--> statement-breakpoint +CREATE INDEX `oauthAccessToken_token_idx` ON `oauthAccessToken` (`token`);--> statement-breakpoint +CREATE TABLE `oauthClient` ( + `id` text PRIMARY KEY NOT NULL, + `client_id` text NOT NULL, + `client_secret` text, + `disabled` integer DEFAULT false, + `skip_consent` integer, + `enable_end_session` integer, + `subject_type` text, + `scopes` text, + `user_id` text, + `created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + `updated_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + `name` text, + `uri` text, + `icon` text, + `contacts` text, + `tos` text, + `policy` text, + `software_id` text, + `software_version` text, + `software_statement` text, + `redirect_uris` text NOT NULL, + `post_logout_redirect_uris` text, + `token_endpoint_auth_method` text, + `grant_types` text, + `response_types` text, + `public` integer, + `type` text, + `require_pkce` integer, + `reference_id` text, + `metadata` text, + FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE UNIQUE INDEX `oauthClient_client_id_unique` ON `oauthClient` (`client_id`);--> statement-breakpoint +CREATE INDEX `oauthClient_client_id_idx` ON `oauthClient` (`client_id`);--> statement-breakpoint +CREATE INDEX `oauthClient_user_id_idx` ON `oauthClient` (`user_id`);--> statement-breakpoint +CREATE TABLE `oauthConsent` ( + `id` text PRIMARY KEY NOT NULL, + `client_id` text NOT NULL, + `user_id` text, + `reference_id` text, + `scopes` text NOT NULL, + `created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + `updated_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + FOREIGN KEY (`client_id`) REFERENCES `oauthClient`(`client_id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE INDEX `oauthConsent_client_id_idx` ON `oauthConsent` (`client_id`);--> statement-breakpoint +CREATE INDEX `oauthConsent_user_id_idx` ON `oauthConsent` (`user_id`);--> statement-breakpoint +CREATE TABLE `oauthRefreshToken` ( + `id` text PRIMARY KEY NOT NULL, + `token` text NOT NULL, + `client_id` text NOT NULL, + `session_id` text, + `user_id` text NOT NULL, + `reference_id` text, + `expires_at` integer NOT NULL, + `created_at` integer DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) NOT NULL, + `revoked` integer, + `auth_time` integer, + `scopes` text NOT NULL, + FOREIGN KEY (`client_id`) REFERENCES `oauthClient`(`client_id`) ON UPDATE no action ON DELETE cascade, + FOREIGN KEY (`session_id`) REFERENCES `session`(`id`) ON UPDATE no action ON DELETE set null, + FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON UPDATE no action ON DELETE cascade +); +--> statement-breakpoint +CREATE UNIQUE INDEX `oauthRefreshToken_token_unique` ON `oauthRefreshToken` (`token`);--> statement-breakpoint +CREATE INDEX `oauthRefreshToken_client_id_idx` ON `oauthRefreshToken` (`client_id`);--> statement-breakpoint +CREATE INDEX `oauthRefreshToken_session_id_idx` ON `oauthRefreshToken` (`session_id`);--> statement-breakpoint +CREATE INDEX `oauthRefreshToken_user_id_idx` ON `oauthRefreshToken` (`user_id`);--> statement-breakpoint +CREATE INDEX `oauthRefreshToken_token_idx` ON `oauthRefreshToken` (`token`); \ No newline at end of file diff --git a/migrations/meta/0081_snapshot.json b/migrations/meta/0081_snapshot.json new file mode 100644 index 00000000..2e476a46 --- /dev/null +++ b/migrations/meta/0081_snapshot.json @@ -0,0 +1,5598 @@ +{ + "version": "6", + "dialect": "sqlite", + "id": "813569e8-2a9a-4e8b-a4ec-610fced8b2e1", + "prevId": "a92fd738-4537-484c-8463-178ec6d07b19", + "tables": { + "announcements": { + "name": "announcements", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "body": { + "name": "body", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'draft'" + }, + "priority": { + "name": "priority", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "published_at": { + "name": "published_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_by": { + "name": "created_by", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "announcements_status_priority_idx": { + "name": "announcements_status_priority_idx", + "columns": [ + "status", + "priority" + ], + "isUnique": false + }, + "announcements_published_idx": { + "name": "announcements_published_idx", + "columns": [ + "published_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "audit_events": { + "name": "audit_events", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "action": { + "name": "action", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "target_type": { + "name": "target_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "target_id": { + "name": "target_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "target_name": { + "name": "target_name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "actor_type": { + "name": "actor_type", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "actor_ref": { + "name": "actor_ref", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "audit_events_org_created_idx": { + "name": "audit_events_org_created_idx", + "columns": [ + "org_id", + "created_at" + ], + "isUnique": false + }, + "audit_events_user_created_idx": { + "name": "audit_events_user_created_idx", + "columns": [ + "user_id", + "created_at" + ], + "isUnique": false + }, + "audit_events_action_created_idx": { + "name": "audit_events_action_created_idx", + "columns": [ + "action", + "created_at" + ], + "isUnique": false + }, + "audit_events_target_created_idx": { + "name": "audit_events_target_created_idx", + "columns": [ + "target_type", + "target_id", + "created_at" + ], + "isUnique": false + }, + "audit_events_created_idx": { + "name": "audit_events_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "background_jobs": { + "name": "background_jobs", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "type": { + "name": "type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "target_folder": { + "name": "target_folder", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "target_path": { + "name": "target_path", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "input_bytes": { + "name": "input_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "output_bytes": { + "name": "output_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "processed_bytes": { + "name": "processed_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "file_count": { + "name": "file_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "current_filename": { + "name": "current_filename", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "error_message": { + "name": "error_message", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "result_metadata": { + "name": "result_metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "retryable": { + "name": "retryable", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "cancelable": { + "name": "cancelable", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "retried_from_job_id": { + "name": "retried_from_job_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "started_at": { + "name": "started_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "finished_at": { + "name": "finished_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "background_jobs_org_created_idx": { + "name": "background_jobs_org_created_idx", + "columns": [ + "org_id", + "created_at" + ], + "isUnique": false + }, + "background_jobs_org_status_idx": { + "name": "background_jobs_org_status_idx", + "columns": [ + "org_id", + "status" + ], + "isUnique": false + }, + "background_jobs_org_type_idx": { + "name": "background_jobs_org_type_idx", + "columns": [ + "org_id", + "type" + ], + "isUnique": false + }, + "background_jobs_created_idx": { + "name": "background_jobs_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + }, + "background_jobs_org_page_idx": { + "name": "background_jobs_org_page_idx", + "columns": [ + "org_id", + "created_at", + "id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "cloud_traffic_reports": { + "name": "cloud_traffic_reports", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "period": { + "name": "period", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source": { + "name": "source", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source_id": { + "name": "source_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "event_id": { + "name": "event_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "bytes": { + "name": "bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_id": { + "name": "storage_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "unit_bytes": { + "name": "unit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "credits_per_unit": { + "name": "credits_per_unit", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "error": { + "name": "error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "attempt_count": { + "name": "attempt_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "next_retry_at": { + "name": "next_retry_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "issued_at": { + "name": "issued_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "cloud_traffic_reports_event_uniq": { + "name": "cloud_traffic_reports_event_uniq", + "columns": [ + "event_id" + ], + "isUnique": true + }, + "cloud_traffic_reports_org_period_idx": { + "name": "cloud_traffic_reports_org_period_idx", + "columns": [ + "org_id", + "period" + ], + "isUnique": false + }, + "cloud_traffic_reports_status_idx": { + "name": "cloud_traffic_reports_status_idx", + "columns": [ + "status" + ], + "isUnique": false + }, + "cloud_traffic_reports_retry_idx": { + "name": "cloud_traffic_reports_retry_idx", + "columns": [ + "status", + "next_retry_at", + "created_at" + ], + "isUnique": false + }, + "cloud_traffic_reports_issued_idx": { + "name": "cloud_traffic_reports_issued_idx", + "columns": [ + "issued_at" + ], + "isUnique": false + }, + "cloud_traffic_reports_updated_idx": { + "name": "cloud_traffic_reports_updated_idx", + "columns": [ + "updated_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "download_tasks": { + "name": "download_tasks", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_by_user_id": { + "name": "created_by_user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source_type": { + "name": "source_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source_uri": { + "name": "source_uri", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "display_name": { + "name": "display_name", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "target_folder": { + "name": "target_folder", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "category": { + "name": "category", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "tags": { + "name": "tags", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'[]'" + }, + "assigned_downloader_id": { + "name": "assigned_downloader_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "attempt": { + "name": "attempt", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "billing_authorized_bytes": { + "name": "billing_authorized_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "billing_charged_bytes": { + "name": "billing_charged_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "billing_charged_credits": { + "name": "billing_charged_credits", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "billing_status": { + "name": "billing_status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'none'" + }, + "error_code": { + "name": "error_code", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "error_message": { + "name": "error_message", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "result_object_id": { + "name": "result_object_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "runtime": { + "name": "runtime", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "events": { + "name": "events", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'[]'" + }, + "resolve_started_at": { + "name": "resolve_started_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "resolve_completed_at": { + "name": "resolve_completed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "download_completed_at": { + "name": "download_completed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "ingest_started_at": { + "name": "ingest_started_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "ingest_completed_at": { + "name": "ingest_completed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "seeding_started_at": { + "name": "seeding_started_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "seeding_stopped_at": { + "name": "seeding_stopped_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "assigned_at": { + "name": "assigned_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "started_at": { + "name": "started_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "finished_at": { + "name": "finished_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "deleted_at": { + "name": "deleted_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "download_tasks_org_created_idx": { + "name": "download_tasks_org_created_idx", + "columns": [ + "org_id", + "created_at" + ], + "isUnique": false + }, + "download_tasks_org_status_idx": { + "name": "download_tasks_org_status_idx", + "columns": [ + "org_id", + "status" + ], + "isUnique": false + }, + "download_tasks_org_category_idx": { + "name": "download_tasks_org_category_idx", + "columns": [ + "org_id", + "category" + ], + "isUnique": false + }, + "download_tasks_org_tags_idx": { + "name": "download_tasks_org_tags_idx", + "columns": [ + "org_id", + "tags" + ], + "isUnique": false + }, + "download_tasks_downloader_idx": { + "name": "download_tasks_downloader_idx", + "columns": [ + "assigned_downloader_id", + "status" + ], + "isUnique": false + }, + "download_tasks_created_idx": { + "name": "download_tasks_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + }, + "download_tasks_finished_idx": { + "name": "download_tasks_finished_idx", + "columns": [ + "finished_at" + ], + "isUnique": false + }, + "download_tasks_org_deleted_created_idx": { + "name": "download_tasks_org_deleted_created_idx", + "columns": [ + "org_id", + "deleted_at", + "created_at" + ], + "isUnique": false + }, + "download_tasks_org_page_idx": { + "name": "download_tasks_org_page_idx", + "columns": [ + "org_id", + "deleted_at", + "created_at", + "id" + ], + "isUnique": false + }, + "download_tasks_downloader_page_idx": { + "name": "download_tasks_downloader_page_idx", + "columns": [ + "assigned_downloader_id", + "deleted_at", + "created_at", + "id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "downloaders": { + "name": "downloaders", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token_hash": { + "name": "token_hash", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token_jti": { + "name": "token_jti", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'offline'" + }, + "enabled": { + "name": "enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "version": { + "name": "version", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "hostname": { + "name": "hostname", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "platform": { + "name": "platform", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "arch": { + "name": "arch", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "engine": { + "name": "engine", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'http'" + }, + "capabilities": { + "name": "capabilities", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'[]'" + }, + "max_concurrent_tasks": { + "name": "max_concurrent_tasks", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "current_tasks": { + "name": "current_tasks", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "download_bps": { + "name": "download_bps", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "upload_bps": { + "name": "upload_bps", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "free_disk_bytes": { + "name": "free_disk_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "remote_download_credit_billing_enabled": { + "name": "remote_download_credit_billing_enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "remote_download_credit_unit_bytes": { + "name": "remote_download_credit_unit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 104857600 + }, + "remote_download_credit_per_unit": { + "name": "remote_download_credit_per_unit", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "last_heartbeat_at": { + "name": "last_heartbeat_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_by": { + "name": "created_by", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "downloaders_token_jti_unique": { + "name": "downloaders_token_jti_unique", + "columns": [ + "token_jti" + ], + "isUnique": true + }, + "downloaders_status_idx": { + "name": "downloaders_status_idx", + "columns": [ + "status" + ], + "isUnique": false + }, + "downloaders_enabled_idx": { + "name": "downloaders_enabled_idx", + "columns": [ + "enabled" + ], + "isUnique": false + }, + "downloaders_created_idx": { + "name": "downloaders_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "image_hosting_configs": { + "name": "image_hosting_configs", + "columns": { + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "custom_domain": { + "name": "custom_domain", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "domain_provider": { + "name": "domain_provider", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "provider_hostname_id": { + "name": "provider_hostname_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "domain_status": { + "name": "domain_status", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "domain_error": { + "name": "domain_error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "verification_token": { + "name": "verification_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "domain_last_checked_at": { + "name": "domain_last_checked_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "domain_verified_at": { + "name": "domain_verified_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "referer_allowlist": { + "name": "referer_allowlist", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "image_hosting_configs_custom_domain_unique": { + "name": "image_hosting_configs_custom_domain_unique", + "columns": [ + "custom_domain" + ], + "isUnique": true + } + }, + "foreignKeys": { + "image_hosting_configs_org_id_organization_id_fk": { + "name": "image_hosting_configs_org_id_organization_id_fk", + "tableFrom": "image_hosting_configs", + "tableTo": "organization", + "columnsFrom": [ + "org_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "image_hostings": { + "name": "image_hostings", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "path": { + "name": "path", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_id": { + "name": "storage_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_key": { + "name": "storage_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "size": { + "name": "size", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "mime": { + "name": "mime", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "width": { + "name": "width", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "height": { + "name": "height", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'draft'" + }, + "purged_at": { + "name": "purged_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "access_count": { + "name": "access_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "last_accessed_at": { + "name": "last_accessed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "image_hostings_token_unique": { + "name": "image_hostings_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "image_hostings_org_path_uniq": { + "name": "image_hostings_org_path_uniq", + "columns": [ + "org_id", + "path" + ], + "isUnique": true, + "where": "\"image_hostings\".\"purged_at\" IS NULL" + }, + "image_hostings_org_created_idx": { + "name": "image_hostings_org_created_idx", + "columns": [ + "org_id", + "created_at" + ], + "isUnique": false + }, + "image_hostings_page_idx": { + "name": "image_hostings_page_idx", + "columns": [ + "org_id", + "status", + "purged_at", + "created_at", + "id" + ], + "isUnique": false + }, + "image_hostings_token_idx": { + "name": "image_hostings_token_idx", + "columns": [ + "token" + ], + "isUnique": false + } + }, + "foreignKeys": { + "image_hostings_org_id_organization_id_fk": { + "name": "image_hostings_org_id_organization_id_fk", + "tableFrom": "image_hostings", + "tableTo": "organization", + "columnsFrom": [ + "org_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "image_hostings_storage_id_storages_id_fk": { + "name": "image_hostings_storage_id_storages_id_fk", + "tableFrom": "image_hostings", + "tableTo": "storages", + "columnsFrom": [ + "storage_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "no action", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "invite_codes": { + "name": "invite_codes", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "code": { + "name": "code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_by": { + "name": "created_by", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "used_by": { + "name": "used_by", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "used_at": { + "name": "used_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "invite_codes_code_unique": { + "name": "invite_codes_code_unique", + "columns": [ + "code" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "license_bindings": { + "name": "license_bindings", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "cloud_binding_id": { + "name": "cloud_binding_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "cloud_store_id": { + "name": "cloud_store_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "instance_id": { + "name": "instance_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "cloud_account_id": { + "name": "cloud_account_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "cloud_account_email": { + "name": "cloud_account_email", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "refresh_token": { + "name": "refresh_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "cached_certificate": { + "name": "cached_certificate", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "cached_certificate_expires_at": { + "name": "cached_certificate_expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "bound_at": { + "name": "bound_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "disconnected_at": { + "name": "disconnected_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_refresh_at": { + "name": "last_refresh_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_refresh_error": { + "name": "last_refresh_error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "license_bindings_active_uniq": { + "name": "license_bindings_active_uniq", + "columns": [ + "status" + ], + "isUnique": true, + "where": "status = 'active'" + }, + "license_bindings_cloud_binding_idx": { + "name": "license_bindings_cloud_binding_idx", + "columns": [ + "cloud_binding_id" + ], + "isUnique": false + }, + "license_bindings_instance_idx": { + "name": "license_bindings_instance_idx", + "columns": [ + "instance_id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "matters": { + "name": "matters", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "alias": { + "name": "alias", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "type": { + "name": "type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "size": { + "name": "size", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": 0 + }, + "dirtype": { + "name": "dirtype", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": 0 + }, + "parent": { + "name": "parent", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "object": { + "name": "object", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "storage_id": { + "name": "storage_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'draft'" + }, + "trashed_at": { + "name": "trashed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "purged_at": { + "name": "purged_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "matters_alias_unique": { + "name": "matters_alias_unique", + "columns": [ + "alias" + ], + "isUnique": true + }, + "matters_status_dir_created_idx": { + "name": "matters_status_dir_created_idx", + "columns": [ + "status", + "dirtype", + "created_at" + ], + "isUnique": false + }, + "matters_webdav_path_idx": { + "name": "matters_webdav_path_idx", + "columns": [ + "org_id", + "parent", + "name", + "status", + "trashed_at", + "purged_at" + ], + "isUnique": false + }, + "matters_webdav_children_idx": { + "name": "matters_webdav_children_idx", + "columns": [ + "org_id", + "parent", + "status", + "trashed_at", + "purged_at", + "\"dirtype\" desc", + "name" + ], + "isUnique": false + }, + "matters_list_page_idx": { + "name": "matters_list_page_idx", + "columns": [ + "org_id", + "parent", + "status", + "trashed_at", + "purged_at", + "\"dirtype\" desc", + "created_at", + "id" + ], + "isUnique": false + }, + "matters_trash_page_idx": { + "name": "matters_trash_page_idx", + "columns": [ + "org_id", + "status", + "purged_at", + "trashed_at", + "created_at", + "id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "notifications": { + "name": "notifications", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "type": { + "name": "type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "title": { + "name": "title", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "body": { + "name": "body", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "ref_type": { + "name": "ref_type", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "ref_id": { + "name": "ref_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "read_at": { + "name": "read_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "notifications_user_created_idx": { + "name": "notifications_user_created_idx", + "columns": [ + "user_id", + "created_at" + ], + "isUnique": false + }, + "notifications_user_read_idx": { + "name": "notifications_user_read_idx", + "columns": [ + "user_id", + "read_at" + ], + "isUnique": false + }, + "notifications_user_page_idx": { + "name": "notifications_user_page_idx", + "columns": [ + "user_id", + "read_at", + "created_at", + "id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "object_upload_sessions": { + "name": "object_upload_sessions", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "object_id": { + "name": "object_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_id": { + "name": "storage_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_key": { + "name": "storage_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "upload_id": { + "name": "upload_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "part_size": { + "name": "part_size", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "on_conflict": { + "name": "on_conflict", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'fail'" + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_by": { + "name": "created_by", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "object_upload_sessions_object_idx": { + "name": "object_upload_sessions_object_idx", + "columns": [ + "org_id", + "object_id" + ], + "isUnique": false + }, + "object_upload_sessions_expires_idx": { + "name": "object_upload_sessions_expires_idx", + "columns": [ + "expires_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "org_quota_entitlements": { + "name": "org_quota_entitlements", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_type": { + "name": "resource_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "entitlement_type": { + "name": "entitlement_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'grant'" + }, + "source": { + "name": "source", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "source_id": { + "name": "source_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "bytes": { + "name": "bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "starts_at": { + "name": "starts_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "org_quota_entitlements_org_resource_idx": { + "name": "org_quota_entitlements_org_resource_idx", + "columns": [ + "org_id", + "resource_type", + "status" + ], + "isUnique": false + }, + "org_quota_entitlements_org_type_idx": { + "name": "org_quota_entitlements_org_type_idx", + "columns": [ + "org_id", + "resource_type", + "entitlement_type", + "status" + ], + "isUnique": false + }, + "org_quota_entitlements_active_plan_uniq": { + "name": "org_quota_entitlements_active_plan_uniq", + "columns": [ + "org_id", + "resource_type", + "entitlement_type" + ], + "isUnique": true, + "where": "status = 'active' AND entitlement_type = 'plan' AND source <> 'free_plan'" + }, + "org_quota_entitlements_source_resource_uniq": { + "name": "org_quota_entitlements_source_resource_uniq", + "columns": [ + "source", + "source_id", + "resource_type" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "org_quotas": { + "name": "org_quotas", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "quota": { + "name": "quota", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "used": { + "name": "used", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "traffic_quota": { + "name": "traffic_quota", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "traffic_used": { + "name": "traffic_used", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "traffic_period": { + "name": "traffic_period", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'1970-01'" + } + }, + "indexes": { + "org_quotas_org_uniq": { + "name": "org_quotas_org_uniq", + "columns": [ + "org_id" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "remote_download_usage_reports": { + "name": "remote_download_usage_reports", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "downloader_id": { + "name": "downloader_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "task_id": { + "name": "task_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "event_id": { + "name": "event_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "unit_index": { + "name": "unit_index", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "unit_bytes": { + "name": "unit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "credits_per_unit": { + "name": "credits_per_unit", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "error": { + "name": "error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "remote_download_usage_reports_event_id_unique": { + "name": "remote_download_usage_reports_event_id_unique", + "columns": [ + "event_id" + ], + "isUnique": true + }, + "remote_download_usage_task_unit_uniq": { + "name": "remote_download_usage_task_unit_uniq", + "columns": [ + "task_id", + "unit_index" + ], + "isUnique": true + }, + "remote_download_usage_org_idx": { + "name": "remote_download_usage_org_idx", + "columns": [ + "org_id" + ], + "isUnique": false + }, + "remote_download_usage_status_idx": { + "name": "remote_download_usage_status_idx", + "columns": [ + "status" + ], + "isUnique": false + }, + "remote_download_usage_created_idx": { + "name": "remote_download_usage_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "resource_changes": { + "name": "resource_changes", + "columns": { + "sequence": { + "name": "sequence", + "type": "integer", + "primaryKey": true, + "notNull": true, + "autoincrement": true + }, + "scope_type": { + "name": "scope_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "scope_id": { + "name": "scope_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_type": { + "name": "resource_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_id": { + "name": "resource_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "change_type": { + "name": "change_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "action": { + "name": "action", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "occurred_at": { + "name": "occurred_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "resource_changes_scope_sequence_idx": { + "name": "resource_changes_scope_sequence_idx", + "columns": [ + "scope_type", + "scope_id", + "sequence" + ], + "isUnique": false + }, + "resource_changes_resource_sequence_idx": { + "name": "resource_changes_resource_sequence_idx", + "columns": [ + "resource_type", + "resource_id", + "sequence" + ], + "isUnique": false + }, + "resource_changes_occurred_idx": { + "name": "resource_changes_occurred_idx", + "columns": [ + "occurred_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "share_recipients": { + "name": "share_recipients", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "share_id": { + "name": "share_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "recipient_user_id": { + "name": "recipient_user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "recipient_email": { + "name": "recipient_email", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "share_recipients_share_id_idx": { + "name": "share_recipients_share_id_idx", + "columns": [ + "share_id" + ], + "isUnique": false + }, + "share_recipients_user_id_idx": { + "name": "share_recipients_user_id_idx", + "columns": [ + "recipient_user_id" + ], + "isUnique": false + }, + "share_recipients_email_idx": { + "name": "share_recipients_email_idx", + "columns": [ + "recipient_email" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "shares": { + "name": "shares", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "kind": { + "name": "kind", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "matter_id": { + "name": "matter_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "creator_id": { + "name": "creator_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "password_hash": { + "name": "password_hash", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "download_limit": { + "name": "download_limit", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "views": { + "name": "views", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "downloads": { + "name": "downloads", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'active'" + }, + "private": { + "name": "private", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "shares_token_unique": { + "name": "shares_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "shares_creator_status_created_idx": { + "name": "shares_creator_status_created_idx", + "columns": [ + "creator_id", + "status", + "created_at", + "id" + ], + "isUnique": false + }, + "shares_creator_private_created_idx": { + "name": "shares_creator_private_created_idx", + "columns": [ + "creator_id", + "private", + "created_at" + ], + "isUnique": false + }, + "shares_created_idx": { + "name": "shares_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "site_invitations": { + "name": "site_invitations", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "invited_by": { + "name": "invited_by", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "accepted_by": { + "name": "accepted_by", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "accepted_at": { + "name": "accepted_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "revoked_by": { + "name": "revoked_by", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "revoked_at": { + "name": "revoked_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "site_invitations_token_unique": { + "name": "site_invitations_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "site_invitations_email_idx": { + "name": "site_invitations_email_idx", + "columns": [ + "email" + ], + "isUnique": false + }, + "site_invitations_created_idx": { + "name": "site_invitations_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + }, + "site_invitations_expires_idx": { + "name": "site_invitations_expires_idx", + "columns": [ + "expires_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "stats_rollups_hourly": { + "name": "stats_rollups_hourly", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "bucket_start": { + "name": "bucket_start", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "metric_key": { + "name": "metric_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "dimension_key": { + "name": "dimension_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "dimension_value": { + "name": "dimension_value", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "count": { + "name": "count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "bytes": { + "name": "bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "unique_count": { + "name": "unique_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "stats_rollups_hourly_bucket_metric_dim_uniq": { + "name": "stats_rollups_hourly_bucket_metric_dim_uniq", + "columns": [ + "bucket_start", + "org_id", + "metric_key", + "dimension_key", + "dimension_value" + ], + "isUnique": true + }, + "stats_rollups_hourly_metric_bucket_idx": { + "name": "stats_rollups_hourly_metric_bucket_idx", + "columns": [ + "metric_key", + "bucket_start" + ], + "isUnique": false + }, + "stats_rollups_hourly_dimension_bucket_idx": { + "name": "stats_rollups_hourly_dimension_bucket_idx", + "columns": [ + "metric_key", + "dimension_key", + "bucket_start" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "storage_usage_breakdowns": { + "name": "storage_usage_breakdowns", + "columns": { + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "category": { + "name": "category", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "bytes": { + "name": "bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "file_count": { + "name": "file_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "storage_usage_breakdowns_org_category_uniq": { + "name": "storage_usage_breakdowns_org_category_uniq", + "columns": [ + "org_id", + "category" + ], + "isUnique": true + }, + "storage_usage_breakdowns_org_idx": { + "name": "storage_usage_breakdowns_org_idx", + "columns": [ + "org_id" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "storage_usage_ledger": { + "name": "storage_usage_ledger", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "event_key": { + "name": "event_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "storage_id": { + "name": "storage_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_type": { + "name": "resource_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_id": { + "name": "resource_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "delta_bytes": { + "name": "delta_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "reason": { + "name": "reason", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "occurred_at": { + "name": "occurred_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "storage_usage_ledger_event_key_unique": { + "name": "storage_usage_ledger_event_key_unique", + "columns": [ + "event_key" + ], + "isUnique": true + }, + "storage_usage_ledger_occurred_idx": { + "name": "storage_usage_ledger_occurred_idx", + "columns": [ + "occurred_at" + ], + "isUnique": false + }, + "storage_usage_ledger_org_occurred_idx": { + "name": "storage_usage_ledger_org_occurred_idx", + "columns": [ + "org_id", + "occurred_at" + ], + "isUnique": false + }, + "storage_usage_ledger_storage_occurred_idx": { + "name": "storage_usage_ledger_storage_occurred_idx", + "columns": [ + "storage_id", + "occurred_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "storages": { + "name": "storages", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "provider": { + "name": "provider", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "bucket": { + "name": "bucket", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "endpoint": { + "name": "endpoint", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "region": { + "name": "region", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'auto'" + }, + "access_key": { + "name": "access_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "secret_key": { + "name": "secret_key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "file_path": { + "name": "file_path", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "custom_host": { + "name": "custom_host", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": "''" + }, + "capacity": { + "name": "capacity", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "egress_credit_billing_enabled": { + "name": "egress_credit_billing_enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "egress_credit_unit_bytes": { + "name": "egress_credit_unit_bytes", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 104857600 + }, + "egress_credit_per_unit": { + "name": "egress_credit_per_unit", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 1 + }, + "force_path_style": { + "name": "force_path_style", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "used": { + "name": "used", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "enabled": { + "name": "enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'unknown'" + }, + "status_reason": { + "name": "status_reason", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status_checked_at": { + "name": "status_checked_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "system_options": { + "name": "system_options", + "columns": { + "key": { + "name": "key", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "value": { + "name": "value", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + } + }, + "indexes": {}, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "team_invite_links": { + "name": "team_invite_links", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'member'" + }, + "inviter_id": { + "name": "inviter_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "team_invite_links_token_unique": { + "name": "team_invite_links_token_unique", + "columns": [ + "token" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "webdav_dead_properties": { + "name": "webdav_dead_properties", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_path": { + "name": "resource_path", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "namespace": { + "name": "namespace", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "value": { + "name": "value", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "webdav_dead_properties_resource_prop_uniq": { + "name": "webdav_dead_properties_resource_prop_uniq", + "columns": [ + "org_id", + "resource_path", + "namespace", + "name" + ], + "isUnique": true + }, + "webdav_dead_properties_resource_idx": { + "name": "webdav_dead_properties_resource_idx", + "columns": [ + "org_id", + "resource_path" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "webdav_locks": { + "name": "webdav_locks", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "org_id": { + "name": "org_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "resource_path": { + "name": "resource_path", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "owner": { + "name": "owner", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "''" + }, + "depth": { + "name": "depth", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'infinity'" + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "webdav_locks_token_unique": { + "name": "webdav_locks_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "webdav_locks_resource_idx": { + "name": "webdav_locks_resource_idx", + "columns": [ + "org_id", + "resource_path" + ], + "isUnique": false + }, + "webdav_locks_expires_idx": { + "name": "webdav_locks_expires_idx", + "columns": [ + "expires_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "webhook_events": { + "name": "webhook_events", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "source": { + "name": "source", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'cloud'" + }, + "event_id": { + "name": "event_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "event_type": { + "name": "event_type", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'order.quota_changed'" + }, + "payload_hash": { + "name": "payload_hash", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "raw_payload": { + "name": "raw_payload", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "error": { + "name": "error", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "processed_at": { + "name": "processed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "webhook_events_source_event_uniq": { + "name": "webhook_events_source_event_uniq", + "columns": [ + "source", + "event_id" + ], + "isUnique": true + }, + "webhook_events_source_created_idx": { + "name": "webhook_events_source_created_idx", + "columns": [ + "source", + "created_at" + ], + "isUnique": false + }, + "webhook_events_status_idx": { + "name": "webhook_events_status_idx", + "columns": [ + "status" + ], + "isUnique": false + }, + "webhook_events_processed_idx": { + "name": "webhook_events_processed_idx", + "columns": [ + "processed_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "account": { + "name": "account", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "account_id": { + "name": "account_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "provider_id": { + "name": "provider_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "access_token": { + "name": "access_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refresh_token": { + "name": "refresh_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "id_token": { + "name": "id_token", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "access_token_expires_at": { + "name": "access_token_expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refresh_token_expires_at": { + "name": "refresh_token_expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scope": { + "name": "scope", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "password": { + "name": "password", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "account_userId_idx": { + "name": "account_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "account_user_id_user_id_fk": { + "name": "account_user_id_user_id_fk", + "tableFrom": "account", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "apikey": { + "name": "apikey", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "config_id": { + "name": "config_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'default'" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "start": { + "name": "start", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "reference_id": { + "name": "reference_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "prefix": { + "name": "prefix", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "key": { + "name": "key", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "refill_interval": { + "name": "refill_interval", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refill_amount": { + "name": "refill_amount", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_refill_at": { + "name": "last_refill_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "enabled": { + "name": "enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "rate_limit_enabled": { + "name": "rate_limit_enabled", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": true + }, + "rate_limit_time_window": { + "name": "rate_limit_time_window", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "rate_limit_max": { + "name": "rate_limit_max", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "request_count": { + "name": "request_count", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": 0 + }, + "remaining": { + "name": "remaining", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_request": { + "name": "last_request", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "permissions": { + "name": "permissions", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "apikey_config_id_idx": { + "name": "apikey_config_id_idx", + "columns": [ + "config_id" + ], + "isUnique": false + }, + "apikey_reference_id_idx": { + "name": "apikey_reference_id_idx", + "columns": [ + "reference_id" + ], + "isUnique": false + }, + "apikey_key_idx": { + "name": "apikey_key_idx", + "columns": [ + "key" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "deviceCode": { + "name": "deviceCode", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "device_code": { + "name": "device_code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_code": { + "name": "user_code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scope": { + "name": "scope", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "last_polled_at": { + "name": "last_polled_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "polling_interval": { + "name": "polling_interval", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "deviceCode_device_code_idx": { + "name": "deviceCode_device_code_idx", + "columns": [ + "device_code" + ], + "isUnique": false + }, + "deviceCode_user_code_idx": { + "name": "deviceCode_user_code_idx", + "columns": [ + "user_code" + ], + "isUnique": false + }, + "deviceCode_status_idx": { + "name": "deviceCode_status_idx", + "columns": [ + "status" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "downloader_bootstrap_credentials": { + "name": "downloader_bootstrap_credentials", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token_hash": { + "name": "token_hash", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "device_code": { + "name": "device_code", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "scope": { + "name": "scope", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "consumed_at": { + "name": "consumed_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "downloader_bootstrap_credentials_token_hash_unique": { + "name": "downloader_bootstrap_credentials_token_hash_unique", + "columns": [ + "token_hash" + ], + "isUnique": true + }, + "downloader_bootstrap_token_hash_idx": { + "name": "downloader_bootstrap_token_hash_idx", + "columns": [ + "token_hash" + ], + "isUnique": false + }, + "downloader_bootstrap_user_idx": { + "name": "downloader_bootstrap_user_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "downloader_bootstrap_consumed_idx": { + "name": "downloader_bootstrap_consumed_idx", + "columns": [ + "consumed_at" + ], + "isUnique": false + } + }, + "foreignKeys": { + "downloader_bootstrap_credentials_user_id_user_id_fk": { + "name": "downloader_bootstrap_credentials_user_id_user_id_fk", + "tableFrom": "downloader_bootstrap_credentials", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "invitation": { + "name": "invitation", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "status": { + "name": "status", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'pending'" + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "inviter_id": { + "name": "inviter_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "invitation_organizationId_idx": { + "name": "invitation_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "invitation_email_idx": { + "name": "invitation_email_idx", + "columns": [ + "email" + ], + "isUnique": false + } + }, + "foreignKeys": { + "invitation_organization_id_organization_id_fk": { + "name": "invitation_organization_id_organization_id_fk", + "tableFrom": "invitation", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "invitation_inviter_id_user_id_fk": { + "name": "invitation_inviter_id_user_id_fk", + "tableFrom": "invitation", + "tableTo": "user", + "columnsFrom": [ + "inviter_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "member": { + "name": "member", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "organization_id": { + "name": "organization_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "'member'" + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "member_organizationId_idx": { + "name": "member_organizationId_idx", + "columns": [ + "organization_id" + ], + "isUnique": false + }, + "member_userId_idx": { + "name": "member_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "member_organization_id_organization_id_fk": { + "name": "member_organization_id_organization_id_fk", + "tableFrom": "member", + "tableTo": "organization", + "columnsFrom": [ + "organization_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "member_user_id_user_id_fk": { + "name": "member_user_id_user_id_fk", + "tableFrom": "member", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "oauthAccessToken": { + "name": "oauthAccessToken", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "session_id": { + "name": "session_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "reference_id": { + "name": "reference_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "refresh_id": { + "name": "refresh_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "scopes": { + "name": "scopes", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "oauthAccessToken_token_unique": { + "name": "oauthAccessToken_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "oauthAccessToken_client_id_idx": { + "name": "oauthAccessToken_client_id_idx", + "columns": [ + "client_id" + ], + "isUnique": false + }, + "oauthAccessToken_session_id_idx": { + "name": "oauthAccessToken_session_id_idx", + "columns": [ + "session_id" + ], + "isUnique": false + }, + "oauthAccessToken_user_id_idx": { + "name": "oauthAccessToken_user_id_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "oauthAccessToken_refresh_id_idx": { + "name": "oauthAccessToken_refresh_id_idx", + "columns": [ + "refresh_id" + ], + "isUnique": false + }, + "oauthAccessToken_token_idx": { + "name": "oauthAccessToken_token_idx", + "columns": [ + "token" + ], + "isUnique": false + } + }, + "foreignKeys": { + "oauthAccessToken_client_id_oauthClient_client_id_fk": { + "name": "oauthAccessToken_client_id_oauthClient_client_id_fk", + "tableFrom": "oauthAccessToken", + "tableTo": "oauthClient", + "columnsFrom": [ + "client_id" + ], + "columnsTo": [ + "client_id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauthAccessToken_session_id_session_id_fk": { + "name": "oauthAccessToken_session_id_session_id_fk", + "tableFrom": "oauthAccessToken", + "tableTo": "session", + "columnsFrom": [ + "session_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "oauthAccessToken_user_id_user_id_fk": { + "name": "oauthAccessToken_user_id_user_id_fk", + "tableFrom": "oauthAccessToken", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauthAccessToken_refresh_id_oauthRefreshToken_id_fk": { + "name": "oauthAccessToken_refresh_id_oauthRefreshToken_id_fk", + "tableFrom": "oauthAccessToken", + "tableTo": "oauthRefreshToken", + "columnsFrom": [ + "refresh_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "oauthClient": { + "name": "oauthClient", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "client_secret": { + "name": "client_secret", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "disabled": { + "name": "disabled", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": false + }, + "skip_consent": { + "name": "skip_consent", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "enable_end_session": { + "name": "enable_end_session", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "subject_type": { + "name": "subject_type", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scopes": { + "name": "scopes", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "uri": { + "name": "uri", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "icon": { + "name": "icon", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "contacts": { + "name": "contacts", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "tos": { + "name": "tos", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "policy": { + "name": "policy", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "software_id": { + "name": "software_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "software_version": { + "name": "software_version", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "software_statement": { + "name": "software_statement", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "redirect_uris": { + "name": "redirect_uris", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "post_logout_redirect_uris": { + "name": "post_logout_redirect_uris", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "token_endpoint_auth_method": { + "name": "token_endpoint_auth_method", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "grant_types": { + "name": "grant_types", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "response_types": { + "name": "response_types", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "public": { + "name": "public", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "type": { + "name": "type", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "require_pkce": { + "name": "require_pkce", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "reference_id": { + "name": "reference_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "oauthClient_client_id_unique": { + "name": "oauthClient_client_id_unique", + "columns": [ + "client_id" + ], + "isUnique": true + }, + "oauthClient_client_id_idx": { + "name": "oauthClient_client_id_idx", + "columns": [ + "client_id" + ], + "isUnique": false + }, + "oauthClient_user_id_idx": { + "name": "oauthClient_user_id_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "oauthClient_user_id_user_id_fk": { + "name": "oauthClient_user_id_user_id_fk", + "tableFrom": "oauthClient", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "oauthConsent": { + "name": "oauthConsent", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "reference_id": { + "name": "reference_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scopes": { + "name": "scopes", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "oauthConsent_client_id_idx": { + "name": "oauthConsent_client_id_idx", + "columns": [ + "client_id" + ], + "isUnique": false + }, + "oauthConsent_user_id_idx": { + "name": "oauthConsent_user_id_idx", + "columns": [ + "user_id" + ], + "isUnique": false + } + }, + "foreignKeys": { + "oauthConsent_client_id_oauthClient_client_id_fk": { + "name": "oauthConsent_client_id_oauthClient_client_id_fk", + "tableFrom": "oauthConsent", + "tableTo": "oauthClient", + "columnsFrom": [ + "client_id" + ], + "columnsTo": [ + "client_id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauthConsent_user_id_user_id_fk": { + "name": "oauthConsent_user_id_user_id_fk", + "tableFrom": "oauthConsent", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "oauthRefreshToken": { + "name": "oauthRefreshToken", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "client_id": { + "name": "client_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "session_id": { + "name": "session_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "reference_id": { + "name": "reference_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "revoked": { + "name": "revoked", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "auth_time": { + "name": "auth_time", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "scopes": { + "name": "scopes", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + } + }, + "indexes": { + "oauthRefreshToken_token_unique": { + "name": "oauthRefreshToken_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "oauthRefreshToken_client_id_idx": { + "name": "oauthRefreshToken_client_id_idx", + "columns": [ + "client_id" + ], + "isUnique": false + }, + "oauthRefreshToken_session_id_idx": { + "name": "oauthRefreshToken_session_id_idx", + "columns": [ + "session_id" + ], + "isUnique": false + }, + "oauthRefreshToken_user_id_idx": { + "name": "oauthRefreshToken_user_id_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "oauthRefreshToken_token_idx": { + "name": "oauthRefreshToken_token_idx", + "columns": [ + "token" + ], + "isUnique": false + } + }, + "foreignKeys": { + "oauthRefreshToken_client_id_oauthClient_client_id_fk": { + "name": "oauthRefreshToken_client_id_oauthClient_client_id_fk", + "tableFrom": "oauthRefreshToken", + "tableTo": "oauthClient", + "columnsFrom": [ + "client_id" + ], + "columnsTo": [ + "client_id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + }, + "oauthRefreshToken_session_id_session_id_fk": { + "name": "oauthRefreshToken_session_id_session_id_fk", + "tableFrom": "oauthRefreshToken", + "tableTo": "session", + "columnsFrom": [ + "session_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "set null", + "onUpdate": "no action" + }, + "oauthRefreshToken_user_id_user_id_fk": { + "name": "oauthRefreshToken_user_id_user_id_fk", + "tableFrom": "oauthRefreshToken", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "organization": { + "name": "organization", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "slug": { + "name": "slug", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "logo": { + "name": "logo", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "metadata": { + "name": "metadata", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "organization_slug_unique": { + "name": "organization_slug_unique", + "columns": [ + "slug" + ], + "isUnique": true + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "session": { + "name": "session", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "token": { + "name": "token", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "ip_address": { + "name": "ip_address", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_agent": { + "name": "user_agent", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "user_id": { + "name": "user_id", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "impersonated_by": { + "name": "impersonated_by", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "active_organization_id": { + "name": "active_organization_id", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + } + }, + "indexes": { + "session_token_unique": { + "name": "session_token_unique", + "columns": [ + "token" + ], + "isUnique": true + }, + "session_userId_idx": { + "name": "session_userId_idx", + "columns": [ + "user_id" + ], + "isUnique": false + }, + "session_created_idx": { + "name": "session_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + } + }, + "foreignKeys": { + "session_user_id_user_id_fk": { + "name": "session_user_id_user_id_fk", + "tableFrom": "session", + "tableTo": "user", + "columnsFrom": [ + "user_id" + ], + "columnsTo": [ + "id" + ], + "onDelete": "cascade", + "onUpdate": "no action" + } + }, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "user": { + "name": "user", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "name": { + "name": "name", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email": { + "name": "email", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "email_verified": { + "name": "email_verified", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": false + }, + "image": { + "name": "image", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "role": { + "name": "role", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "banned": { + "name": "banned", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false, + "default": false + }, + "ban_reason": { + "name": "ban_reason", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "ban_expires": { + "name": "ban_expires", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "username": { + "name": "username", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "display_username": { + "name": "display_username", + "type": "text", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "last_active_at": { + "name": "last_active_at", + "type": "integer", + "primaryKey": false, + "notNull": false, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "user_email_unique": { + "name": "user_email_unique", + "columns": [ + "email" + ], + "isUnique": true + }, + "user_username_unique": { + "name": "user_username_unique", + "columns": [ + "username" + ], + "isUnique": true + }, + "user_created_idx": { + "name": "user_created_idx", + "columns": [ + "created_at" + ], + "isUnique": false + }, + "user_lastActiveAt_idx": { + "name": "user_lastActiveAt_idx", + "columns": [ + "last_active_at" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + }, + "verification": { + "name": "verification", + "columns": { + "id": { + "name": "id", + "type": "text", + "primaryKey": true, + "notNull": true, + "autoincrement": false + }, + "identifier": { + "name": "identifier", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "value": { + "name": "value", + "type": "text", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "expires_at": { + "name": "expires_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false + }, + "created_at": { + "name": "created_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + }, + "updated_at": { + "name": "updated_at", + "type": "integer", + "primaryKey": false, + "notNull": true, + "autoincrement": false, + "default": "(cast(unixepoch('subsecond') * 1000 as integer))" + } + }, + "indexes": { + "verification_identifier_idx": { + "name": "verification_identifier_idx", + "columns": [ + "identifier" + ], + "isUnique": false + } + }, + "foreignKeys": {}, + "compositePrimaryKeys": {}, + "uniqueConstraints": {}, + "checkConstraints": {} + } + }, + "views": {}, + "enums": {}, + "_meta": { + "schemas": {}, + "tables": {}, + "columns": {} + }, + "internal": { + "indexes": { + "matters_webdav_children_idx": { + "columns": { + "\"dirtype\" desc": { + "isExpression": true + } + } + }, + "matters_list_page_idx": { + "columns": { + "\"dirtype\" desc": { + "isExpression": true + } + } + } + } + } +} \ No newline at end of file diff --git a/migrations/meta/_journal.json b/migrations/meta/_journal.json index a9086b2b..d54cf148 100644 --- a/migrations/meta/_journal.json +++ b/migrations/meta/_journal.json @@ -561,6 +561,13 @@ "when": 1785289409896, "tag": "0080_downloader-bootstrap-credentials", "breakpoints": true + }, + { + "idx": 81, + "version": "6", + "when": 1785337905649, + "tag": "0081_spotty_boomerang", + "breakpoints": true } ] } \ No newline at end of file diff --git a/package.json b/package.json index 034c7594..4f97dc52 100644 --- a/package.json +++ b/package.json @@ -57,6 +57,7 @@ "@aws-sdk/s3-request-presigner": "^3.1022.0", "@azure/functions": "^4.12.0", "@better-auth/api-key": "^1.6.14", + "@better-auth/oauth-provider": "1.6.14", "@better-captcha/react": "^0.7.0", "@dnd-kit/core": "^6.3.1", "@hono/node-server": "^2.0.10", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 58f0e66f..7af97a8b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -38,6 +38,9 @@ importers: '@better-auth/api-key': specifier: ^1.6.14 version: 1.6.14(@better-auth/core@1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(better-auth@1.6.14(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.10.0)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@cloudflare/workers-types@4.20260606.1)(@libsql/client@0.17.2)(@opentelemetry/api@1.9.1)(@types/better-sqlite3@7.6.13)(better-sqlite3@12.10.0)(kysely@0.28.17))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(vitest@4.1.4))(better-call@1.3.5(zod@4.4.3)) + '@better-auth/oauth-provider': + specifier: 1.6.14 + version: 1.6.14(@better-auth/core@1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-auth@1.6.14(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.10.0)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@cloudflare/workers-types@4.20260606.1)(@libsql/client@0.17.2)(@opentelemetry/api@1.9.1)(@types/better-sqlite3@7.6.13)(better-sqlite3@12.10.0)(kysely@0.28.17))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(vitest@4.1.4))(better-call@1.3.5(zod@4.4.3)) '@better-captcha/react': specifier: ^0.7.0 version: 0.7.0(react@19.2.5)(typescript@5.9.3) @@ -626,6 +629,15 @@ packages: mongodb: optional: true + '@better-auth/oauth-provider@1.6.14': + resolution: {integrity: sha512-JL5UNKayERwRbYyZL7DsjOMtMjPWiOVnzUwztIuDNuYK5JZC2Pfm/16MdkEtic8+8YCv9qGK7dph/TTU5fdlKA==} + peerDependencies: + '@better-auth/core': 1.6.14 + '@better-auth/utils': 0.4.1 + '@better-fetch/fetch': 1.1.21 + better-auth: ^1.6.14 + better-call: 1.3.5 + '@better-auth/prisma-adapter@1.6.14': resolution: {integrity: sha512-9b9wSqhCthMmOYo0QdX+N/cOv+fNck/JE5CZQuuWwEJl5QeoYhCZesXjts5VfLAPMIf6vKw3QNBrn0SVMXXi2Q==} peerDependencies: @@ -6452,6 +6464,16 @@ snapshots: '@better-auth/core': 1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) '@better-auth/utils': 0.4.1 + '@better-auth/oauth-provider@1.6.14(@better-auth/core@1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0))(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(better-auth@1.6.14(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.10.0)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@cloudflare/workers-types@4.20260606.1)(@libsql/client@0.17.2)(@opentelemetry/api@1.9.1)(@types/better-sqlite3@7.6.13)(better-sqlite3@12.10.0)(kysely@0.28.17))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(vitest@4.1.4))(better-call@1.3.5(zod@4.4.3))': + dependencies: + '@better-auth/core': 1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) + '@better-auth/utils': 0.4.1 + '@better-fetch/fetch': 1.1.21 + better-auth: 1.6.14(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-sqlite3@12.10.0)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@cloudflare/workers-types@4.20260606.1)(@libsql/client@0.17.2)(@opentelemetry/api@1.9.1)(@types/better-sqlite3@7.6.13)(better-sqlite3@12.10.0)(kysely@0.28.17))(react-dom@19.2.5(react@19.2.5))(react@19.2.5)(vitest@4.1.4) + better-call: 1.3.5(zod@4.4.3) + jose: 6.2.3 + zod: 4.4.3 + '@better-auth/prisma-adapter@1.6.14(@better-auth/core@1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0))(@better-auth/utils@0.4.1)': dependencies: '@better-auth/core': 1.6.14(@better-auth/utils@0.4.1)(@better-fetch/fetch@1.1.21)(@cloudflare/workers-types@4.20260606.1)(@opentelemetry/api@1.9.1)(better-call@1.3.5(zod@4.4.3))(jose@6.2.3)(kysely@0.28.17)(nanostores@1.3.0) diff --git a/server/adapters/repos/agent-oauth.test.ts b/server/adapters/repos/agent-oauth.test.ts new file mode 100644 index 00000000..e125865a --- /dev/null +++ b/server/adapters/repos/agent-oauth.test.ts @@ -0,0 +1,318 @@ +import { createHash } from 'node:crypto' +import { AGENT_OAUTH_CLIENT_ID } from '@shared/agent-oauth' +import { AuthorizationScope } from '@shared/authorization' +import { eq, isNull } from 'drizzle-orm' +import { describe, expect, it } from 'vitest' +import * as authSchema from '../../db/auth-schema' +import { createTestApp } from '../../test/setup' +import { createAgentOAuthGateway } from './agent-oauth' + +describe('Agent OAuth gateway', () => { + it('provisions the system public native client', async () => { + const { db } = await createTestApp() + const [client] = await db + .select() + .from(authSchema.oauthClient) + .where(eq(authSchema.oauthClient.clientId, AGENT_OAUTH_CLIENT_ID)) + + expect(client).toMatchObject({ + clientId: AGENT_OAUTH_CLIENT_ID, + tokenEndpointAuthMethod: 'none', + public: true, + type: 'native', + requirePKCE: true, + disabled: false, + }) + expect(JSON.parse(client.redirectUris)).toEqual([ + 'http://localhost:8484/callback', + 'http://127.0.0.1:8484/callback', + ]) + expect(JSON.parse(client.grantTypes ?? '[]')).toEqual(['authorization_code', 'refresh_token']) + }) + + it('verifies access tokens only while consent is live and scoped to the workspace', async () => { + const { db } = await createTestApp() + const userId = 'oauth-user' + const orgId = 'oauth-org' + await insertUserAndOrg(db, userId, orgId) + await db.insert(authSchema.oauthConsent).values({ + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date(), + updatedAt: new Date(), + }) + await db.insert(authSchema.oauthAccessToken).values({ + id: 'access-1', + token: hashStoredToken('opaque-token'), + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }) + + const token = await createAgentOAuthGateway().verifyAccessToken(db, 'opaque-token') + + expect(token).toEqual({ + grantId: 'grant-1', + userId, + orgId, + clientId: AGENT_OAUTH_CLIENT_ID, + scopes: [AuthorizationScope.OBJECTS_READ], + }) + + await db.delete(authSchema.oauthConsent).where(eq(authSchema.oauthConsent.id, 'grant-1')) + await expect(createAgentOAuthGateway().verifyAccessToken(db, 'opaque-token')).resolves.toBeNull() + }) + + it('requires the managed client, workspace, and granted scopes before minting claims', async () => { + const { db } = await createTestApp() + const userId = 'oauth-user' + const orgId = 'oauth-org' + await insertUserAndOrg(db, userId, orgId) + await db.insert(authSchema.oauthConsent).values({ + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date(), + updatedAt: new Date(), + }) + + await expect( + createAgentOAuthGateway().assertLiveGrant(db, { + userId, + clientId: AGENT_OAUTH_CLIENT_ID, + scopes: [AuthorizationScope.OBJECTS_READ], + }), + ).rejects.toThrow('agent_oauth_workspace_required') + + await expect( + createAgentOAuthGateway().assertLiveGrant(db, { + userId, + clientId: 'other-client', + orgId, + scopes: [AuthorizationScope.OBJECTS_READ], + }), + ).rejects.toThrow('agent_oauth_client_denied') + + await expect( + createAgentOAuthGateway().assertLiveGrant(db, { + userId, + clientId: AGENT_OAUTH_CLIENT_ID, + orgId, + scopes: [AuthorizationScope.OBJECTS_READ, AuthorizationScope.QUOTA_READ], + }), + ).rejects.toThrow('agent_oauth_scope_denied') + }) + + it('lists only workspace-bound grants for the managed client', async () => { + const { db } = await createTestApp() + const userId = 'oauth-user' + const orgId = 'oauth-org' + await insertUserAndOrg(db, userId, orgId) + await db.insert(authSchema.oauthConsent).values([ + { + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date('2026-07-29T12:00:00.000Z'), + updatedAt: new Date('2026-07-29T12:01:00.000Z'), + }, + { + id: 'grant-without-workspace', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: null, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date('2026-07-29T12:02:00.000Z'), + updatedAt: new Date('2026-07-29T12:03:00.000Z'), + }, + ]) + + await expect(createAgentOAuthGateway().listGrants(db, userId)).resolves.toEqual([ + { + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + orgId, + scopes: [AuthorizationScope.OBJECTS_READ], + createdAt: '2026-07-29T12:00:00.000Z', + updatedAt: '2026-07-29T12:01:00.000Z', + }, + ]) + }) + + it('revokes only the managed client grant for the selected workspace', async () => { + const { db } = await createTestApp() + const userId = 'oauth-user' + const orgId = 'oauth-org' + await insertUserAndOrg(db, userId, orgId) + await db.insert(authSchema.organization).values({ id: 'oauth-org-2', name: 'OAuth Org 2', slug: 'oauth-org-2' }) + await db + .insert(authSchema.member) + .values({ id: 'oauth-org-2-member', organizationId: 'oauth-org-2', userId, role: 'owner' }) + await db.insert(authSchema.oauthClient).values({ + id: 'other-client', + clientId: 'other-client', + clientSecret: null, + disabled: false, + skipConsent: false, + enableEndSession: false, + subjectType: 'public', + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + name: 'Other Client', + redirectUris: JSON.stringify(['http://localhost/callback']), + tokenEndpointAuthMethod: 'none', + grantTypes: JSON.stringify(['authorization_code']), + responseTypes: JSON.stringify(['code']), + public: true, + type: 'native', + requirePKCE: true, + }) + await db.insert(authSchema.oauthConsent).values({ + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date(), + updatedAt: new Date(), + }) + await db.insert(authSchema.oauthConsent).values([ + { + id: 'grant-2', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: 'oauth-org-2', + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date(), + updatedAt: new Date(), + }, + { + id: 'other-grant', + clientId: 'other-client', + userId, + referenceId: orgId, + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + createdAt: new Date(), + updatedAt: new Date(), + }, + ]) + await db.insert(authSchema.oauthRefreshToken).values({ + id: 'refresh-1', + token: 'hashed-refresh', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }) + await db.insert(authSchema.oauthRefreshToken).values([ + { + id: 'refresh-2', + token: 'hashed-refresh-2', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: 'oauth-org-2', + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }, + { + id: 'other-refresh', + token: 'hashed-other-refresh', + clientId: 'other-client', + userId, + referenceId: orgId, + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }, + ]) + await db.insert(authSchema.oauthAccessToken).values({ + id: 'access-1', + token: 'hashed-access', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: orgId, + refreshId: 'refresh-1', + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }) + await db.insert(authSchema.oauthAccessToken).values([ + { + id: 'access-2', + token: 'hashed-access-2', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + referenceId: 'oauth-org-2', + refreshId: 'refresh-2', + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }, + { + id: 'other-access', + token: 'hashed-other-access', + clientId: 'other-client', + userId, + referenceId: orgId, + refreshId: 'other-refresh', + expiresAt: new Date(Date.now() + 60_000), + createdAt: new Date(), + scopes: JSON.stringify([AuthorizationScope.OBJECTS_READ]), + }, + ]) + + const revoked = await createAgentOAuthGateway().revokeGrant(db, { + userId, + grantId: 'grant-1', + now: new Date('2026-07-29T12:00:00.000Z'), + }) + + expect(revoked).toBe(true) + expect((await db.select().from(authSchema.oauthConsent)).map((row) => row.id).sort()).toEqual([ + 'grant-2', + 'other-grant', + ]) + expect((await db.select().from(authSchema.oauthAccessToken)).map((row) => row.id).sort()).toEqual([ + 'access-2', + 'other-access', + ]) + const [refresh] = await db + .select() + .from(authSchema.oauthRefreshToken) + .where(eq(authSchema.oauthRefreshToken.id, 'refresh-1')) + expect(refresh.revoked?.toISOString()).toBe('2026-07-29T12:00:00.000Z') + const liveRefreshes = await db + .select() + .from(authSchema.oauthRefreshToken) + .where(isNull(authSchema.oauthRefreshToken.revoked)) + expect(liveRefreshes.map((row) => row.id).sort()).toEqual(['other-refresh', 'refresh-2']) + }) +}) + +async function insertUserAndOrg(db: Awaited>['db'], userId: string, orgId: string) { + await db.insert(authSchema.user).values({ + id: userId, + name: 'OAuth User', + email: `${userId}@example.com`, + emailVerified: true, + }) + await db.insert(authSchema.organization).values({ id: orgId, name: 'OAuth Org', slug: orgId }) + await db.insert(authSchema.member).values({ id: `${orgId}-member`, organizationId: orgId, userId, role: 'owner' }) +} + +function hashStoredToken(token: string): string { + return createHash('sha256').update(token).digest('base64url') +} diff --git a/server/adapters/repos/agent-oauth.ts b/server/adapters/repos/agent-oauth.ts new file mode 100644 index 00000000..0815b88d --- /dev/null +++ b/server/adapters/repos/agent-oauth.ts @@ -0,0 +1,233 @@ +import { createHash } from 'node:crypto' +import { + AGENT_OAUTH_CLIENT_ID, + AGENT_OAUTH_CLIENT_NAME, + AGENT_OAUTH_SCOPES, + RESTISH_OAUTH_REDIRECT_URIS, +} from '@shared/agent-oauth' +import { type AuthorizationScope, isAuthorizationScope } from '@shared/authorization' +import { and, eq, gt, inArray, isNull } from 'drizzle-orm' +import { oauthAccessToken, oauthClient, oauthConsent, oauthRefreshToken, user as userTable } from '../../db/auth-schema' +import { executeWriteTransaction } from '../../db/transaction' +import type { Database } from '../../platform/interface' +import type { AgentOAuthGateway, AgentOAuthGrant } from '../../usecases/ports' + +export function createAgentOAuthGateway(): AgentOAuthGateway { + return { + async ensureSystemClient(db) { + const now = new Date() + const row = { + id: AGENT_OAUTH_CLIENT_ID, + clientId: AGENT_OAUTH_CLIENT_ID, + clientSecret: null, + disabled: false, + skipConsent: false, + enableEndSession: false, + subjectType: 'public', + scopes: JSON.stringify([...AGENT_OAUTH_SCOPES]), + userId: null, + createdAt: now, + updatedAt: now, + name: AGENT_OAUTH_CLIENT_NAME, + uri: null, + icon: null, + contacts: null, + tos: null, + policy: null, + softwareId: 'zpan-agent', + softwareVersion: null, + softwareStatement: null, + redirectUris: JSON.stringify([...RESTISH_OAUTH_REDIRECT_URIS]), + postLogoutRedirectUris: null, + tokenEndpointAuthMethod: 'none', + grantTypes: JSON.stringify(['authorization_code', 'refresh_token']), + responseTypes: JSON.stringify(['code']), + public: true, + type: 'native', + requirePKCE: true, + referenceId: 'system', + metadata: JSON.stringify({ systemManaged: true }), + } + await db + .insert(oauthClient) + .values(row) + .onConflictDoUpdate({ + target: oauthClient.clientId, + set: { + disabled: false, + scopes: row.scopes, + updatedAt: now, + redirectUris: row.redirectUris, + tokenEndpointAuthMethod: row.tokenEndpointAuthMethod, + grantTypes: row.grantTypes, + responseTypes: row.responseTypes, + public: true, + type: row.type, + requirePKCE: true, + metadata: row.metadata, + }, + }) + }, + + async assertLiveGrant(db, input) { + const orgId = input.orgId + if (!orgId) throw new Error('agent_oauth_workspace_required') + if (input.clientId !== AGENT_OAUTH_CLIENT_ID) throw new Error('agent_oauth_client_denied') + const requestedScopes = input.scopes.filter(isAuthorizationScope) + const consent = await findConsent(db, input.userId, input.clientId, orgId) + if (!consent) throw new Error('agent_oauth_grant_revoked') + const grantedScopes = parseScopes(consent.scopes).filter(isAuthorizationScope) + if (!requestedScopes.every((scope) => grantedScopes.includes(scope))) throw new Error('agent_oauth_scope_denied') + }, + + async verifyAccessToken(db, token) { + const rows = await db + .select({ + userId: oauthAccessToken.userId, + clientId: oauthAccessToken.clientId, + orgId: oauthAccessToken.referenceId, + scopes: oauthAccessToken.scopes, + }) + .from(oauthAccessToken) + .innerJoin(userTable, eq(userTable.id, oauthAccessToken.userId)) + .innerJoin(oauthClient, eq(oauthClient.clientId, oauthAccessToken.clientId)) + .where( + and( + eq(oauthAccessToken.token, hashStoredToken(token)), + eq(oauthAccessToken.clientId, AGENT_OAUTH_CLIENT_ID), + gt(oauthAccessToken.expiresAt, new Date()), + eq(oauthClient.disabled, false), + eq(userTable.banned, false), + ), + ) + .limit(1) + const result = rows[0] + if (!result?.userId || !result.orgId) return null + const scopes = parseScopes(result.scopes).filter(isAuthorizationScope) + const consent = await findConsent(db, result.userId, result.clientId, result.orgId) + if (!consent) return null + const grantedScopes = parseScopes(consent.scopes).filter(isAuthorizationScope) + return { + grantId: consent.id, + userId: result.userId, + orgId: result.orgId, + clientId: result.clientId, + scopes: scopes.filter((scope) => grantedScopes.includes(scope)), + } + }, + + async listGrants(db, userId) { + const rows = await db + .select({ + id: oauthConsent.id, + clientId: oauthConsent.clientId, + userId: oauthConsent.userId, + orgId: oauthConsent.referenceId, + scopes: oauthConsent.scopes, + createdAt: oauthConsent.createdAt, + updatedAt: oauthConsent.updatedAt, + }) + .from(oauthConsent) + .where(and(eq(oauthConsent.userId, userId), eq(oauthConsent.clientId, AGENT_OAUTH_CLIENT_ID))) + return rows.flatMap((row): AgentOAuthGrant[] => { + if (!row.userId || !row.orgId) return [] + return [ + { + id: row.id, + clientId: row.clientId, + userId: row.userId, + orgId: row.orgId, + scopes: parseScopes(row.scopes).filter(isAuthorizationScope), + createdAt: toIso(row.createdAt), + updatedAt: toIso(row.updatedAt), + }, + ] + }) + }, + + async revokeGrant(db, input) { + const grants = await db + .select({ + id: oauthConsent.id, + clientId: oauthConsent.clientId, + userId: oauthConsent.userId, + referenceId: oauthConsent.referenceId, + }) + .from(oauthConsent) + .where( + and( + eq(oauthConsent.id, input.grantId), + eq(oauthConsent.userId, input.userId), + eq(oauthConsent.clientId, AGENT_OAUTH_CLIENT_ID), + ), + ) + .limit(1) + const grant = grants[0] + if (!grant?.userId || !grant.referenceId) return false + const refreshRows = await db + .select({ id: oauthRefreshToken.id }) + .from(oauthRefreshToken) + .where( + and( + eq(oauthRefreshToken.clientId, grant.clientId), + eq(oauthRefreshToken.userId, grant.userId), + eq(oauthRefreshToken.referenceId, grant.referenceId), + isNull(oauthRefreshToken.revoked), + ), + ) + const refreshIds = refreshRows.map((row) => row.id) + await executeWriteTransaction(db, [ + db + .delete(oauthAccessToken) + .where( + and( + eq(oauthAccessToken.clientId, grant.clientId), + eq(oauthAccessToken.userId, grant.userId), + eq(oauthAccessToken.referenceId, grant.referenceId), + ), + ), + ...(refreshIds.length > 0 + ? [db.update(oauthRefreshToken).set({ revoked: input.now }).where(inArray(oauthRefreshToken.id, refreshIds))] + : []), + db.delete(oauthConsent).where(eq(oauthConsent.id, grant.id)), + ]) + return true + }, + } +} + +async function findConsent(db: Database, userId: string, clientId: string, orgId: string) { + const rows = await db + .select({ id: oauthConsent.id, scopes: oauthConsent.scopes }) + .from(oauthConsent) + .innerJoin(userTable, eq(userTable.id, oauthConsent.userId)) + .where( + and( + eq(oauthConsent.userId, userId), + eq(oauthConsent.clientId, clientId), + eq(oauthConsent.referenceId, orgId), + eq(userTable.banned, false), + ), + ) + .limit(1) + return rows[0] ?? null +} + +function parseScopes(value: string | string[] | null): AuthorizationScope[] { + if (Array.isArray(value)) return value.filter(isAuthorizationScope) + if (!value) return [] + const parsed = JSON.parse(value) as unknown + return Array.isArray(parsed) + ? parsed.filter((scope): scope is AuthorizationScope => typeof scope === 'string' && isAuthorizationScope(scope)) + : [] +} + +function toIso(value: Date | number | string): string { + const date = new Date(value) + if (Number.isNaN(date.getTime())) throw new Error('invalid_agent_oauth_date') + return date.toISOString() +} + +function hashStoredToken(token: string): string { + return createHash('sha256').update(token).digest('base64url') +} diff --git a/server/app.ts b/server/app.ts index 636cefb8..102ac5d6 100644 --- a/server/app.ts +++ b/server/app.ts @@ -10,6 +10,7 @@ import { isPotentialWebDavPublicRequest, isWebDavPublicRequest } from './domain/ import { adminOverview } from './http/admin-overview' import { adminStats } from './http/admin-stats' import agentApiKeys from './http/agent-api-keys' +import { agentOAuthGrants } from './http/agent-oauth-grants' import { serveAvatarBlob } from './http/avatar-blobs' import backgroundJobs from './http/background-jobs' import { configz } from './http/configz' @@ -131,11 +132,41 @@ export function createApp(platform: Platform, auth: Auth, deps: Deps = createDep }), ) - app.on(['POST', 'GET'], '/api/auth/*', async (c) => { + app.on(['POST', 'GET', 'HEAD'], '/api/auth/*', async (c) => { const a = c.get('auth') return a.handler(c.req.raw) }) + app.on(['GET', 'HEAD'], '/.well-known/oauth-authorization-server/api/auth', async (c) => { + return c.get('auth').handler(c.req.raw) + }) + + app.on(['GET', 'HEAD'], '/.well-known/openid-configuration/api/auth', async (c) => { + return c.get('auth').handler(c.req.raw) + }) + + app.on(['GET', 'HEAD'], '/.well-known/oauth-protected-resource/api', async (c) => { + const origin = new URL(c.req.url).origin + const authorizationServer = (await c.get('auth').$context).baseURL + return c.json({ + resource: `${origin}/api`, + authorization_servers: [authorizationServer], + bearer_methods_supported: ['header'], + scopes_supported: [ + 'objects:read', + 'objects:create', + 'objects:update', + 'objects:delete', + 'shares:read', + 'shares:create', + 'shares:delete', + 'quota:read', + 'storage-usage:read', + ], + resource_name: 'ZPan API', + }) + }) + // Global OpenAPI document. Aggregates every route defined with `.openapi()` // across all mounted sub-apps — a route appears here as soon as its resource is // converted to OpenAPIHono, no curation needed. better-auth endpoints (incl. the @@ -166,10 +197,79 @@ export function createApp(platform: Platform, auth: Auth, deps: Deps = createDep doc.paths[`/api/auth${path}`] = item as (typeof doc.paths)[string] } doc.components ??= {} + doc.components.securitySchemes = { + ...(doc.components.securitySchemes ?? {}), + cookieAuth: { type: 'apiKey', in: 'cookie', name: 'zp.session_token' }, + bearerAuth: { type: 'http', scheme: 'bearer' }, + agentOAuth2: { + type: 'oauth2', + flows: { + authorizationCode: { + authorizationUrl: '/api/auth/oauth2/authorize', + tokenUrl: '/api/auth/oauth2/token', + refreshUrl: '/api/auth/oauth2/token', + scopes: { + 'objects:read': 'List, inspect, and download objects', + 'objects:create': 'Create folders and upload objects', + 'objects:update': 'Rename, move, and copy objects', + 'objects:delete': 'Soft-delete objects', + 'shares:read': 'List and inspect shares', + 'shares:create': 'Create public shares', + 'shares:delete': 'Revoke shares', + 'quota:read': 'Inspect workspace quota', + 'storage-usage:read': 'Inspect workspace storage usage', + }, + }, + }, + }, + agentApiKey: { type: 'http', scheme: 'bearer', description: 'Workspace-scoped Agent API key' }, + } doc.components.schemas = { ...(authDoc.components?.schemas as typeof doc.components.schemas), ...doc.components.schemas, } + Object.assign(doc, { + 'x-cli-config': { + auth: { + reader: { + type: 'oauth-authorization-code', + params: { + authorize_url: '/api/auth/oauth2/authorize', + token_url: '/api/auth/oauth2/token', + client_id: 'zpan-agent', + scopes: 'openid offline_access objects:read shares:read quota:read storage-usage:read', + redirect_path: '/callback', + }, + }, + 'file-manager': { + type: 'oauth-authorization-code', + params: { + authorize_url: '/api/auth/oauth2/authorize', + token_url: '/api/auth/oauth2/token', + client_id: 'zpan-agent', + scopes: + 'openid offline_access objects:read objects:create objects:update objects:delete shares:read quota:read storage-usage:read', + redirect_path: '/callback', + }, + }, + publisher: { + type: 'oauth-authorization-code', + params: { + authorize_url: '/api/auth/oauth2/authorize', + token_url: '/api/auth/oauth2/token', + client_id: 'zpan-agent', + scopes: + 'openid offline_access objects:read shares:read shares:create shares:delete quota:read storage-usage:read', + redirect_path: '/callback', + }, + }, + ci: { + type: 'http-bearer', + params: { token: 'env:ZPAN_AGENT_API_KEY' }, + }, + }, + }, + }) // better-auth's device-authorization plugin advertises POST /device/token as // returning { session, user }, but its handler actually returns the OAuth @@ -255,6 +355,7 @@ export function createApp(platform: Platform, auth: Auth, deps: Deps = createDep app.route('/api/shares', authedShares) app.route('/api/trash', trash) app.route('/api/workspaces', agentApiKeys) + app.route('/api', agentOAuthGrants) app.route('/api/teams', teams) app.route('/api/teams', adminTeams) app.route('/api/site/storages', storages) diff --git a/server/auth.integration.test.ts b/server/auth.integration.test.ts index d6e9d4a7..b6e2d388 100644 --- a/server/auth.integration.test.ts +++ b/server/auth.integration.test.ts @@ -1,6 +1,6 @@ import { isPersonalOrgLike } from '@shared/org-slugs' import { eq } from 'drizzle-orm' -import { describe, expect, it } from 'vitest' +import { afterEach, describe, expect, it, vi } from 'vitest' import { createInviteRepo } from './adapters/repos/invite.js' import { createSiteInvitationRepo } from './adapters/repos/site-invitations.js' import { createApp } from './app.js' @@ -12,6 +12,10 @@ import { createTestApp, seedProLicense } from './test/setup.js' type TestCtx = Awaited> +afterEach(() => { + vi.unstubAllGlobals() +}) + async function signUp(ctx: TestCtx, email: string, extra?: Record) { return ctx.app.request('/api/auth/sign-up/email', { method: 'POST', @@ -595,6 +599,73 @@ describe('loadProviderConfigs — builtin social provider resolution', () => { expect([200, 302]).toContain(res.status) }) + it('social sign-in with a configured and enabled OIDC provider returns a redirect', async () => { + const ctx = await createTestApp() + const oidcConfig = JSON.stringify({ + providerId: 'my-oidc', + type: 'oidc', + clientId: 'oidc-client', + clientSecret: 'oidc-secret', + enabled: true, + discoveryUrl: 'https://auth.example.com/.well-known/openid-configuration', + scopes: ['openid', 'email'], + }) + await ctx.db.insert(schema.systemOptions).values({ key: 'oauth_provider_my-oidc', value: oidcConfig }) + vi.stubGlobal( + 'fetch', + vi.fn(async (input: string | URL | Request) => { + const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url + if (url === 'https://auth.example.com/.well-known/openid-configuration') { + return new Response( + JSON.stringify({ + issuer: 'https://auth.example.com', + authorization_endpoint: 'https://auth.example.com/oauth2/authorize', + token_endpoint: 'https://auth.example.com/oauth2/token', + jwks_uri: 'https://auth.example.com/.well-known/jwks.json', + response_types_supported: ['code'], + subject_types_supported: ['public'], + id_token_signing_alg_values_supported: ['RS256'], + }), + { + headers: { 'Content-Type': 'application/json' }, + }, + ) + } + throw new Error(`unexpected fetch: ${url}`) + }), + ) + const auth = await createAuth(ctx.platform, 'test-secret', 'http://localhost:3000') + const app = createApp(ctx.platform, auth) + const res = await app.request('/api/auth/sign-in/social', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ provider: 'my-oidc', callbackURL: 'http://localhost:3000/callback' }), + }) + + expect([200, 302]).toContain(res.status) + }) + + it('social sign-in ignores a disabled builtin provider config', async () => { + const ctx = await createTestApp() + const builtinConfig = JSON.stringify({ + providerId: 'github', + type: 'builtin', + clientId: 'gh-client', + clientSecret: 'gh-secret', + enabled: false, + }) + await ctx.db.insert(schema.systemOptions).values({ key: 'oauth_provider_github', value: builtinConfig }) + const auth = await createAuth(ctx.platform, 'test-secret', 'http://localhost:3000') + const app = createApp(ctx.platform, auth) + const res = await app.request('/api/auth/sign-in/social', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ provider: 'github', callbackURL: 'http://localhost:3000/callback' }), + }) + + expect(res.status).not.toBe(200) + }) + it('createAuth runs exactly one DB query during init (no per-provider I/O)', async () => { const ctx = await createTestApp() let selectCalls = 0 @@ -623,6 +694,70 @@ describe('loadProviderConfigs — builtin social provider resolution', () => { }) }) +describe('Agent OAuth consent guards', () => { + it('issues an authorization code after full consent for the managed PKCE client', async () => { + const ctx = await createTestApp() + const previewOrigin = 'https://preview-zpan.example.com' + const auth = await createAuth(ctx.platform, 'test-secret', 'https://zpan-staging.example.com', [previewOrigin]) + const app = createApp(ctx.platform, auth) + const signUpResponse = await signUp({ ...ctx, app }, 'agent-oauth-consent@example.com') + const cookie = signUpResponse.headers + .getSetCookie() + .map((value) => value.split(';', 1)[0]) + .join('; ') + const params = new URLSearchParams({ + client_id: 'zpan-agent', + redirect_uri: 'http://127.0.0.1:8484/callback', + response_type: 'code', + scope: 'openid offline_access objects:read quota:read', + state: 'oauth-consent-test', + code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM', + code_challenge_method: 'S256', + }) + const authorize = await app.request(`${previewOrigin}/api/auth/oauth2/authorize?${params}`, { + headers: { Cookie: cookie, Origin: previewOrigin }, + }) + const consentLocation = authorize.headers.get('location') + expect(authorize.status).toBe(302) + expect(consentLocation).toMatch(/^\/settings\/agent-access\?/) + + const consent = await app.request(`${previewOrigin}/api/auth/oauth2/consent`, { + method: 'POST', + headers: { + Cookie: cookie, + Origin: previewOrigin, + 'Content-Type': 'application/json', + }, + body: JSON.stringify({ + accept: true, + oauth_query: consentLocation?.slice(consentLocation.indexOf('?') + 1), + }), + }) + const consentBody = await consent.text() + + expect(consent.status, consentBody).toBe(200) + expect(JSON.parse(consentBody)).toMatchObject({ + url: expect.stringMatching(/^http:\/\/127\.0\.0\.1:8484\/callback\?code=/), + }) + }) + + it('blocks partial Agent OAuth consent changes through the Better Auth endpoint', async () => { + const ctx = await createTestApp() + + const res = await ctx.app.request('/api/auth/oauth2/consent', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ client_id: 'zpan-agent', scope: 'objects:read' }), + }) + + expect(res.status).toBe(400) + await expect(res.json()).resolves.toMatchObject({ + error: 'invalid_request', + error_description: 'Partial Agent OAuth consent is not supported', + }) + }) +}) + describe('session hook — activeOrganizationId is set on sign-in after sign-up', () => { it('sign-in after sign-up succeeds and returns a session cookie', async () => { const ctx = await createTestApp() diff --git a/server/auth.ts b/server/auth.ts index cb4c515d..3579b568 100644 --- a/server/auth.ts +++ b/server/auth.ts @@ -1,4 +1,5 @@ import { apiKey } from '@better-auth/api-key' +import { oauthProvider } from '@better-auth/oauth-provider' import { APIError, type BetterAuthOptions, type BetterAuthPlugin, betterAuth } from 'better-auth' import { drizzleAdapter } from 'better-auth/adapters/drizzle' import { createAuthMiddleware, getSessionFromCtx } from 'better-auth/api' @@ -38,6 +39,7 @@ import { } from '../shared/oauth-providers' import { generateUserOrgSlug, isPersonalOrgLike } from '../shared/org-slugs' import { createEmailGateway } from './adapters/gateways/email' +import { createAgentOAuthGateway } from './adapters/repos/agent-oauth' import { deleteApiKeysScopedToOrganization } from './adapters/repos/api-key-scopes' import { createAuditRepo } from './adapters/repos/audit' import { createDownloadTokenGateway } from './adapters/repos/download-tokens' @@ -51,6 +53,7 @@ import { createSiteInvitationRepo } from './adapters/repos/site-invitations' import { initialStorageUsageProjectionQueries } from './adapters/repos/storage-usage-breakdown' import { createSystemOptionsRepo } from './adapters/repos/system-options' import { recordUserActivity } from './adapters/repos/user-activity' +import { createAgentOAuthProviderOptions } from './auth/agent-oauth-provider' import * as authSchema from './db/auth-schema' import { orgQuotaEntitlements, orgQuotas, systemOptions } from './db/schema' import { executeWriteTransaction } from './db/transaction' @@ -344,6 +347,8 @@ export async function createAuth( const systemOptionsRepo = createSystemOptionsRepo(db) const email = createEmailGateway(systemOptionsRepo) const providerConfigs = await loadProviderConfigs(rawDb) + const agentOAuth = createAgentOAuthGateway() + await agentOAuth.ensureSystemClient(db) const usesNativeWebDavRateLimit = Boolean(authPlatform.getBinding(WEBDAV_RATE_LIMITER_BINDING)) const authOptions = { database: drizzleAdapter(db, { provider: 'sqlite', schema: authSchema }), @@ -423,6 +428,22 @@ export async function createAuth( } return } + if (ctx.path === '/oauth2/consent') { + const body = ctx.body as Record | undefined + if (body?.scope !== undefined) { + throw new APIError('BAD_REQUEST', { + error: 'invalid_request', + error_description: 'Partial Agent OAuth consent is not supported', + }) + } + return + } + if (ctx.path === '/oauth2/update-consent' || ctx.path === '/oauth2/delete-consent') { + throw new APIError('FORBIDDEN', { + error: 'invalid_request', + error_description: 'Manage Agent OAuth grants from the Agent Access API', + }) + } if (ctx.path !== '/api-key/create') return const body = ctx.body as Record | undefined @@ -609,6 +630,7 @@ export async function createAuth( verificationUri: '/device', validateClient: async (clientId) => clientId === LEGACY_DOWNLOADER_CLIENT_ID, }), + oauthProvider(createAgentOAuthProviderOptions({ db, agentOAuth })), apiKey([ { configId: ApiKeyTemplate.IHOST, diff --git a/server/auth/agent-oauth-provider.test.ts b/server/auth/agent-oauth-provider.test.ts new file mode 100644 index 00000000..02abdbff --- /dev/null +++ b/server/auth/agent-oauth-provider.test.ts @@ -0,0 +1,143 @@ +import { AGENT_OAUTH_ACCESS_TOKEN_SECONDS, AGENT_OAUTH_CLIENT_ID, AGENT_OAUTH_SCOPES } from '@shared/agent-oauth' +import { AuthorizationScope } from '@shared/authorization' +import { describe, expect, it, vi } from 'vitest' +import type { AgentOAuthGateway } from '../usecases/ports' +import { createAgentOAuthProviderOptions } from './agent-oauth-provider' + +const db = {} as never + +function createGateway(): AgentOAuthGateway { + return { + ensureSystemClient: vi.fn(), + assertLiveGrant: vi.fn(), + verifyAccessToken: vi.fn(), + listGrants: vi.fn(), + revokeGrant: vi.fn(), + } +} + +function createOptions(input?: { + findPersonalOrg?: (userId: string) => Promise + getMemberRole?: (orgId: string, userId: string) => Promise + gateway?: AgentOAuthGateway +}) { + return createAgentOAuthProviderOptions({ + db, + agentOAuth: input?.gateway ?? createGateway(), + orgs: { + findPersonalOrg: input?.findPersonalOrg ?? vi.fn(async () => 'personal-org'), + getMemberRole: input?.getMemberRole ?? vi.fn(async () => 'owner'), + }, + }) +} + +describe('createAgentOAuthProviderOptions', () => { + it('configures the managed public native Agent OAuth provider contract', async () => { + const options = createOptions() + + expect(options).toMatchObject({ + disableJwtPlugin: true, + loginPage: '/sign-in', + consentPage: '/settings/agent-access', + accessTokenExpiresIn: AGENT_OAUTH_ACCESS_TOKEN_SECONDS, + grantTypes: ['authorization_code', 'refresh_token'], + postLogin: { page: '/settings/agent-access' }, + }) + expect(options.scopes).toEqual([...AGENT_OAUTH_SCOPES]) + expect(options.cachedTrustedClients?.has(AGENT_OAUTH_CLIENT_ID)).toBe(true) + await expect(options.postLogin?.shouldRedirect?.({} as never)).resolves.toBe(false) + }) + + it('binds consent to the active workspace when the user still has access', async () => { + const options = createOptions() + + await expect( + options.postLogin?.consentReferenceId?.({ + user: { id: 'user-1' }, + session: { activeOrganizationId: 'team-org' }, + scopes: ['openid', AuthorizationScope.OBJECTS_READ], + } as never), + ).resolves.toBe('team-org') + }) + + it('falls back to the personal workspace when no active workspace is set', async () => { + const options = createOptions({ + findPersonalOrg: vi.fn(async () => 'personal-org'), + getMemberRole: vi.fn(async () => null), + }) + + await expect( + options.postLogin?.consentReferenceId?.({ + user: { id: 'user-1' }, + session: {}, + scopes: [AuthorizationScope.OBJECTS_READ], + } as never), + ).resolves.toBe('personal-org') + }) + + it('rejects ungrantable scopes, missing workspaces, and inaccessible active workspaces', async () => { + await expect( + createOptions().postLogin?.consentReferenceId?.({ + user: { id: 'user-1' }, + session: {}, + scopes: ['objects:read', 'admin:root'], + } as never), + ).rejects.toMatchObject({ body: expect.objectContaining({ error: 'invalid_scope' }) }) + + await expect( + createOptions({ findPersonalOrg: vi.fn(async () => null) }).postLogin?.consentReferenceId?.({ + user: { id: 'user-1' }, + session: {}, + scopes: [AuthorizationScope.OBJECTS_READ], + } as never), + ).rejects.toMatchObject({ + body: expect.objectContaining({ error_description: 'A workspace is required for Agent OAuth' }), + }) + + await expect( + createOptions({ + findPersonalOrg: vi.fn(async () => 'personal-org'), + getMemberRole: vi.fn(async () => null), + }).postLogin?.consentReferenceId?.({ + user: { id: 'user-1' }, + session: { activeOrganizationId: 'team-org' }, + scopes: [AuthorizationScope.OBJECTS_READ], + } as never), + ).rejects.toMatchObject({ + body: expect.objectContaining({ error_description: 'Workspace access is required for Agent OAuth' }), + }) + }) + + it('adds ZPan Agent claims only for valid live grants', async () => { + const gateway = createGateway() + const options = createOptions({ gateway }) + + await expect( + options.customAccessTokenClaims?.({ + user: { id: 'user-1' }, + referenceId: 'team-org', + scopes: [AuthorizationScope.OBJECTS_READ], + metadata: {}, + } as never), + ).resolves.toEqual({ zpan_org_id: 'team-org', zpan_actor: 'agent_oauth' }) + expect(gateway.assertLiveGrant).toHaveBeenCalledWith(db, { + userId: 'user-1', + clientId: AGENT_OAUTH_CLIENT_ID, + orgId: 'team-org', + scopes: [AuthorizationScope.OBJECTS_READ], + }) + }) + + it('skips non-agent clients and rejects missing user or workspace context', async () => { + const options = createOptions() + + await expect( + options.customAccessTokenClaims?.({ metadata: { client_id: 'other-client' }, scopes: [] } as never), + ).resolves.toEqual({}) + await expect( + options.customAccessTokenClaims?.({ user: { id: 'user-1' }, scopes: [] } as never), + ).rejects.toMatchObject({ + body: expect.objectContaining({ error_description: 'Agent OAuth grant is missing workspace context' }), + }) + }) +}) diff --git a/server/auth/agent-oauth-provider.ts b/server/auth/agent-oauth-provider.ts new file mode 100644 index 00000000..95e68a0c --- /dev/null +++ b/server/auth/agent-oauth-provider.ts @@ -0,0 +1,83 @@ +import type { oauthProvider } from '@better-auth/oauth-provider' +import { APIError } from 'better-auth' +import { + AGENT_OAUTH_ACCESS_TOKEN_SECONDS, + AGENT_OAUTH_CLIENT_ID, + AGENT_OAUTH_REFRESH_TOKEN_SECONDS, + AGENT_OAUTH_SCOPES, +} from '../../shared/agent-oauth' +import { createOrgRepo } from '../adapters/repos/org' +import type { Database } from '../platform/interface' +import type { AgentOAuthGateway } from '../usecases/ports' + +type AgentOAuthOrgLookup = Pick, 'findPersonalOrg' | 'getMemberRole'> +type AgentOAuthProviderOptions = Parameters[0] + +export function createAgentOAuthProviderOptions(input: { + db: Database + agentOAuth: AgentOAuthGateway + orgs?: AgentOAuthOrgLookup +}): AgentOAuthProviderOptions { + const orgs = input.orgs ?? createOrgRepo(input.db) + return { + disableJwtPlugin: true, + loginPage: '/sign-in', + consentPage: '/settings/agent-access', + accessTokenExpiresIn: AGENT_OAUTH_ACCESS_TOKEN_SECONDS, + refreshTokenExpiresIn: AGENT_OAUTH_REFRESH_TOKEN_SECONDS, + grantTypes: ['authorization_code', 'refresh_token'], + scopes: [...AGENT_OAUTH_SCOPES], + advertisedMetadata: { scopes_supported: [...AGENT_OAUTH_SCOPES] }, + cachedTrustedClients: new Set([AGENT_OAUTH_CLIENT_ID]), + silenceWarnings: { + oauthAuthServerConfig: true, + openidConfig: true, + }, + postLogin: { + page: '/settings/agent-access', + shouldRedirect: async () => false, + consentReferenceId: async ({ user, session, scopes }) => { + const clientScopes = scopes.filter((scope) => scope !== 'openid' && scope !== 'profile' && scope !== 'email') + const grantableScopes = new Set(AGENT_OAUTH_SCOPES) + if (clientScopes.some((scope) => !grantableScopes.has(scope))) { + throw new APIError('BAD_REQUEST', { error: 'invalid_scope', error_description: 'Scope is not grantable' }) + } + const orgId = typeof session.activeOrganizationId === 'string' ? session.activeOrganizationId : null + const selectedOrgId = orgId || (await orgs.findPersonalOrg(user.id)) + if (!selectedOrgId) { + throw new APIError('BAD_REQUEST', { + error: 'invalid_request', + error_description: 'A workspace is required for Agent OAuth', + }) + } + const role = await orgs.getMemberRole(selectedOrgId, user.id) + if (!role && selectedOrgId !== (await orgs.findPersonalOrg(user.id))) { + throw new APIError('FORBIDDEN', { + error: 'access_denied', + error_description: 'Workspace access is required for Agent OAuth', + }) + } + return selectedOrgId + }, + }, + customAccessTokenClaims: async ({ user, referenceId, scopes, metadata }) => { + if (metadata?.client_id && metadata.client_id !== AGENT_OAUTH_CLIENT_ID) return {} + if (!user?.id || !referenceId) { + throw new APIError('BAD_REQUEST', { + error: 'invalid_grant', + error_description: 'Agent OAuth grant is missing workspace context', + }) + } + await input.agentOAuth.assertLiveGrant(input.db, { + userId: user.id, + clientId: AGENT_OAUTH_CLIENT_ID, + orgId: referenceId, + scopes, + }) + return { + zpan_org_id: referenceId, + zpan_actor: 'agent_oauth', + } + }, + } +} diff --git a/server/composition.ts b/server/composition.ts index 0aa1e1d7..5888988d 100644 --- a/server/composition.ts +++ b/server/composition.ts @@ -15,6 +15,7 @@ import { createZipGateway } from './adapters/gateways/zip' import { createChangelogProvider } from './adapters/providers/changelog' import { createImageDomainProviderGateway } from './adapters/providers/image-domain-provider' import { createAdminStatsRepo } from './adapters/repos/admin-stats' +import { createAgentOAuthGateway } from './adapters/repos/agent-oauth' import { createAnnouncementRepo } from './adapters/repos/announcement' import { createApiKeyGateway } from './adapters/repos/api-keys' import { createArchiveTargetFolderRepo } from './adapters/repos/archive-target-folder' @@ -80,6 +81,7 @@ export function createDeps(platform: Platform, options: CreateDepsOptions = {}): return { audit: createAuditRepo(db), adminStats: createAdminStatsRepo(db), + agentOAuth: createAgentOAuthGateway(), announcements: createAnnouncementRepo(db), apiKeys: createApiKeyGateway(), archiveJobs: createArchiveJobsGateway(platform), diff --git a/server/db/auth-schema.test.ts b/server/db/auth-schema.test.ts index 5a99b87e..258663a3 100644 --- a/server/db/auth-schema.test.ts +++ b/server/db/auth-schema.test.ts @@ -1,6 +1,13 @@ import { getTableConfig } from 'drizzle-orm/sqlite-core' import { describe, expect, it } from 'vitest' -import { downloaderBootstrapCredential, user } from './auth-schema.js' +import { + downloaderBootstrapCredential, + oauthAccessToken, + oauthClient, + oauthConsent, + oauthRefreshToken, + user, +} from './auth-schema.js' describe('auth-schema user table', () => { it('has a username column', () => { @@ -86,3 +93,73 @@ describe('downloaderBootstrapCredential table', () => { expect(foreignKeys[0].reference().foreignColumns[0].name).toBe('id') }) }) + +describe('Agent OAuth tables', () => { + it('declares the managed client columns and indexes', () => { + const { foreignKeys, indexes } = getTableConfig(oauthClient) + + expect(oauthClient.clientId.name).toBe('client_id') + expect(oauthClient.redirectUris.notNull).toBe(true) + expect(oauthClient.requirePKCE.name).toBe('require_pkce') + expect(oauthClient.updatedAt.onUpdateFn?.()).toBeInstanceOf(Date) + expect(foreignKeys.map((foreignKey) => foreignKey.reference().foreignColumns[0].name)).toEqual(['id']) + expect(indexes.map((index) => index.config.name).sort()).toEqual([ + 'oauthClient_client_id_idx', + 'oauthClient_user_id_idx', + ]) + }) + + it('declares refresh-token relationships and lookup indexes', () => { + const { foreignKeys, indexes } = getTableConfig(oauthRefreshToken) + + expect(oauthRefreshToken.referenceId.name).toBe('reference_id') + expect(oauthRefreshToken.revoked.name).toBe('revoked') + expect(foreignKeys).toHaveLength(3) + expect(foreignKeys.map((foreignKey) => foreignKey.reference().foreignColumns[0].name)).toEqual([ + 'client_id', + 'id', + 'id', + ]) + expect(indexes.map((index) => index.config.name).sort()).toEqual([ + 'oauthRefreshToken_client_id_idx', + 'oauthRefreshToken_session_id_idx', + 'oauthRefreshToken_token_idx', + 'oauthRefreshToken_user_id_idx', + ]) + }) + + it('declares access-token relationships and lookup indexes', () => { + const { foreignKeys, indexes } = getTableConfig(oauthAccessToken) + + expect(oauthAccessToken.referenceId.name).toBe('reference_id') + expect(oauthAccessToken.expiresAt.notNull).toBe(true) + expect(foreignKeys).toHaveLength(4) + expect(foreignKeys.map((foreignKey) => foreignKey.reference().foreignColumns[0].name)).toEqual([ + 'client_id', + 'id', + 'id', + 'id', + ]) + expect(indexes.map((index) => index.config.name).sort()).toEqual([ + 'oauthAccessToken_client_id_idx', + 'oauthAccessToken_refresh_id_idx', + 'oauthAccessToken_session_id_idx', + 'oauthAccessToken_token_idx', + 'oauthAccessToken_user_id_idx', + ]) + }) + + it('declares consent relationships and lookup indexes', () => { + const { foreignKeys, indexes } = getTableConfig(oauthConsent) + + expect(oauthConsent.referenceId.name).toBe('reference_id') + expect(oauthConsent.scopes.notNull).toBe(true) + expect(foreignKeys).toHaveLength(2) + expect(oauthConsent.updatedAt.onUpdateFn?.()).toBeInstanceOf(Date) + expect(foreignKeys.map((foreignKey) => foreignKey.reference().foreignColumns[0].name)).toEqual(['client_id', 'id']) + expect(indexes.map((index) => index.config.name).sort()).toEqual([ + 'oauthConsent_client_id_idx', + 'oauthConsent_user_id_idx', + ]) + }) +}) diff --git a/server/db/auth-schema.ts b/server/db/auth-schema.ts index b6793aca..2a2ba97b 100644 --- a/server/db/auth-schema.ts +++ b/server/db/auth-schema.ts @@ -216,6 +216,128 @@ export const deviceCode = sqliteTable( ], ) +export const oauthClient = sqliteTable( + 'oauthClient', + { + id: text('id').primaryKey(), + clientId: text('client_id').notNull().unique(), + clientSecret: text('client_secret'), + disabled: integer('disabled', { mode: 'boolean' }).default(false), + skipConsent: integer('skip_consent', { mode: 'boolean' }), + enableEndSession: integer('enable_end_session', { mode: 'boolean' }), + subjectType: text('subject_type'), + scopes: text('scopes'), // JSON-serialized string[] + userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }), + createdAt: integer('created_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .notNull(), + updatedAt: integer('updated_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .$onUpdate(() => /* @__PURE__ */ new Date()) + .notNull(), + name: text('name'), + uri: text('uri'), + icon: text('icon'), + contacts: text('contacts'), // JSON-serialized string[] + tos: text('tos'), + policy: text('policy'), + softwareId: text('software_id'), + softwareVersion: text('software_version'), + softwareStatement: text('software_statement'), + redirectUris: text('redirect_uris').notNull(), // JSON-serialized string[] + postLogoutRedirectUris: text('post_logout_redirect_uris'), // JSON-serialized string[] + tokenEndpointAuthMethod: text('token_endpoint_auth_method'), + grantTypes: text('grant_types'), // JSON-serialized string[] + responseTypes: text('response_types'), // JSON-serialized string[] + public: integer('public', { mode: 'boolean' }), + type: text('type'), + requirePKCE: integer('require_pkce', { mode: 'boolean' }), + referenceId: text('reference_id'), + metadata: text('metadata'), + }, + (table) => [index('oauthClient_client_id_idx').on(table.clientId), index('oauthClient_user_id_idx').on(table.userId)], +) + +export const oauthRefreshToken = sqliteTable( + 'oauthRefreshToken', + { + id: text('id').primaryKey(), + token: text('token').notNull().unique(), + clientId: text('client_id') + .notNull() + .references(() => oauthClient.clientId, { onDelete: 'cascade' }), + sessionId: text('session_id').references(() => session.id, { onDelete: 'set null' }), + userId: text('user_id') + .notNull() + .references(() => user.id, { onDelete: 'cascade' }), + referenceId: text('reference_id'), + expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(), + createdAt: integer('created_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .notNull(), + revoked: integer('revoked', { mode: 'timestamp_ms' }), + authTime: integer('auth_time', { mode: 'timestamp_ms' }), + scopes: text('scopes').notNull(), // JSON-serialized string[] + }, + (table) => [ + index('oauthRefreshToken_client_id_idx').on(table.clientId), + index('oauthRefreshToken_session_id_idx').on(table.sessionId), + index('oauthRefreshToken_user_id_idx').on(table.userId), + index('oauthRefreshToken_token_idx').on(table.token), + ], +) + +export const oauthAccessToken = sqliteTable( + 'oauthAccessToken', + { + id: text('id').primaryKey(), + token: text('token').notNull().unique(), + clientId: text('client_id') + .notNull() + .references(() => oauthClient.clientId, { onDelete: 'cascade' }), + sessionId: text('session_id').references(() => session.id, { onDelete: 'set null' }), + userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }), + referenceId: text('reference_id'), + refreshId: text('refresh_id').references(() => oauthRefreshToken.id, { onDelete: 'cascade' }), + expiresAt: integer('expires_at', { mode: 'timestamp_ms' }).notNull(), + createdAt: integer('created_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .notNull(), + scopes: text('scopes').notNull(), // JSON-serialized string[] + }, + (table) => [ + index('oauthAccessToken_client_id_idx').on(table.clientId), + index('oauthAccessToken_session_id_idx').on(table.sessionId), + index('oauthAccessToken_user_id_idx').on(table.userId), + index('oauthAccessToken_refresh_id_idx').on(table.refreshId), + index('oauthAccessToken_token_idx').on(table.token), + ], +) + +export const oauthConsent = sqliteTable( + 'oauthConsent', + { + id: text('id').primaryKey(), + clientId: text('client_id') + .notNull() + .references(() => oauthClient.clientId, { onDelete: 'cascade' }), + userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }), + referenceId: text('reference_id'), + scopes: text('scopes').notNull(), // JSON-serialized string[] + createdAt: integer('created_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .notNull(), + updatedAt: integer('updated_at', { mode: 'timestamp_ms' }) + .default(sql`(cast(unixepoch('subsecond') * 1000 as integer))`) + .$onUpdate(() => /* @__PURE__ */ new Date()) + .notNull(), + }, + (table) => [ + index('oauthConsent_client_id_idx').on(table.clientId), + index('oauthConsent_user_id_idx').on(table.userId), + ], +) + export const downloaderBootstrapCredential = sqliteTable( 'downloader_bootstrap_credentials', { diff --git a/server/http/agent-oauth-grants.integration.test.ts b/server/http/agent-oauth-grants.integration.test.ts new file mode 100644 index 00000000..7f3571ff --- /dev/null +++ b/server/http/agent-oauth-grants.integration.test.ts @@ -0,0 +1,159 @@ +import { createHash } from 'node:crypto' +import { AGENT_OAUTH_CLIENT_ID } from '@shared/agent-oauth' +import { AuthorizationScope } from '@shared/authorization' +import { sql } from 'drizzle-orm' +import { describe, expect, it } from 'vitest' +import * as authSchema from '../db/auth-schema.js' +import { authedHeaders, createTestApp } from '../test/setup.js' + +type TestContext = Awaited> + +async function getUserAndPersonalOrg(db: TestContext['db'], email: string) { + const rows = await db.all<{ userId: string; orgId: string }>(sql` + SELECT u.id AS userId, o.id AS orgId + FROM user u + INNER JOIN member m ON m.user_id = u.id + INNER JOIN organization o ON o.id = m.organization_id + WHERE u.email = ${email} AND o.metadata LIKE '%"type":"personal"%' + LIMIT 1 + `) + if (!rows[0]) throw new Error(`expected personal org for ${email}`) + return rows[0] +} + +async function insertTeamOrg(db: TestContext['db'], orgId: string, userId: string) { + const now = Date.now() + await db.run(sql` + INSERT INTO organization (id, name, slug, metadata, created_at, updated_at) + VALUES (${orgId}, ${`Team ${orgId}`}, ${orgId}, '{"type":"team"}', ${now}, ${now}) + `) + await db.run(sql` + INSERT INTO member (id, organization_id, user_id, role, created_at) + VALUES (${`${orgId}-member`}, ${orgId}, ${userId}, 'owner', ${now}) + `) +} + +async function insertGrant( + db: TestContext['db'], + input: { userId: string; orgId: string; scopes: AuthorizationScope[] }, +) { + const now = new Date('2026-07-29T12:00:00.000Z') + await db.insert(authSchema.oauthConsent).values({ + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId: input.userId, + referenceId: input.orgId, + scopes: JSON.stringify(input.scopes), + createdAt: now, + updatedAt: now, + }) + await db.insert(authSchema.oauthRefreshToken).values({ + id: 'refresh-1', + token: 'hashed-refresh', + clientId: AGENT_OAUTH_CLIENT_ID, + userId: input.userId, + referenceId: input.orgId, + expiresAt: new Date(Date.now() + 60_000), + createdAt: now, + scopes: JSON.stringify(input.scopes), + }) + await db.insert(authSchema.oauthAccessToken).values({ + id: 'access-1', + token: hashStoredToken('live-agent-token'), + clientId: AGENT_OAUTH_CLIENT_ID, + userId: input.userId, + referenceId: input.orgId, + refreshId: 'refresh-1', + expiresAt: new Date(Date.now() + 60_000), + createdAt: now, + scopes: JSON.stringify(input.scopes), + }) +} + +describe('Agent OAuth grants API integration', () => { + it('lists and revokes the current user grant family', async () => { + const { app, db } = await createTestApp() + const headers = await authedHeaders(app, 'agent-grants@example.com') + const { userId, orgId } = await getUserAndPersonalOrg(db, 'agent-grants@example.com') + await insertGrant(db, { userId, orgId, scopes: [AuthorizationScope.OBJECTS_READ, AuthorizationScope.QUOTA_READ] }) + + const list = await app.request('/api/agent-oauth-grants', { headers }) + expect(list.status).toBe(200) + await expect(list.json()).resolves.toEqual({ + items: [ + { + id: 'grant-1', + clientId: AGENT_OAUTH_CLIENT_ID, + userId, + orgId, + scopes: [AuthorizationScope.OBJECTS_READ, AuthorizationScope.QUOTA_READ], + createdAt: '2026-07-29T12:00:00.000Z', + updatedAt: '2026-07-29T12:00:00.000Z', + }, + ], + }) + + const revoke = await app.request('/api/agent-oauth-grants/grant-1', { method: 'DELETE', headers }) + expect(revoke.status).toBe(204) + expect(await db.select().from(authSchema.oauthConsent)).toHaveLength(0) + expect(await db.select().from(authSchema.oauthAccessToken)).toHaveLength(0) + const [refresh] = await db.select().from(authSchema.oauthRefreshToken) + expect(refresh.revoked).not.toBeNull() + }) + + it('enforces live grant membership and fixed workspace for Agent OAuth bearer access', async () => { + const { app, db } = await createTestApp() + const headers = await authedHeaders(app, 'agent-scope@example.com') + const { userId, orgId } = await getUserAndPersonalOrg(db, 'agent-scope@example.com') + await insertTeamOrg(db, 'other-workspace', userId) + await insertGrant(db, { userId, orgId, scopes: [AuthorizationScope.OBJECTS_READ] }) + + const bearer = { Authorization: 'Bearer live-agent-token' } + const allowed = await app.request('/api/objects', { headers: bearer }) + expect(allowed.status).toBe(200) + + const wrongWorkspace = await app.request('/api/objects?orgId=other-workspace', { headers: bearer }) + expect(wrongWorkspace.status).toBe(403) + + const revoke = await app.request('/api/agent-oauth-grants/grant-1', { method: 'DELETE', headers }) + expect(revoke.status).toBe(204) + + const revoked = await app.request('/api/objects', { headers: bearer }) + expect(revoked.status).toBe(401) + }) + + it('blocks generic Better Auth OAuth consent mutation endpoints', async () => { + const { app } = await createTestApp() + + for (const path of ['/api/auth/oauth2/update-consent', '/api/auth/oauth2/delete-consent']) { + const res = await app.request(path, { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ client_id: AGENT_OAUTH_CLIENT_ID }), + }) + + expect(res.status).toBe(403) + await expect(res.json()).resolves.toMatchObject({ + error_description: 'Manage Agent OAuth grants from the Agent Access API', + }) + } + }) + + it('returns 404 when revoking a missing Agent OAuth grant', async () => { + const { app } = await createTestApp() + const headers = await authedHeaders(app, 'agent-missing-grant@example.com') + + const revoke = await app.request('/api/agent-oauth-grants/missing-grant', { method: 'DELETE', headers }) + + expect(revoke.status).toBe(404) + await expect(revoke.json()).resolves.toMatchObject({ + error: { + message: 'Agent OAuth grant not found', + }, + }) + }) +}) + +function hashStoredToken(token: string): string { + return createHash('sha256').update(token).digest('base64url') +} diff --git a/server/http/agent-oauth-grants.ts b/server/http/agent-oauth-grants.ts new file mode 100644 index 00000000..cde29087 --- /dev/null +++ b/server/http/agent-oauth-grants.ts @@ -0,0 +1,65 @@ +import { OpenAPIHono, z } from '@hono/zod-openapi' +import { AuthorizationScope } from '@shared/authorization' +import { requireAuth } from '../middleware/auth' +import type { Env } from '../middleware/platform' +import { listAgentOAuthGrants, revokeAgentOAuthGrant } from '../usecases/agent-oauth-grants' +import { authRoute, errorResponse, jsonContent } from './openapi' + +const agentOAuthGrantSchema = z.object({ + id: z.string(), + clientId: z.string(), + userId: z.string(), + orgId: z.string(), + scopes: z.array(z.enum(Object.values(AuthorizationScope) as [AuthorizationScope, ...AuthorizationScope[]])), + createdAt: z.string(), + updatedAt: z.string(), +}) + +const listSchema = z.object({ items: z.array(agentOAuthGrantSchema) }) +const paramsSchema = z.object({ grantId: z.string().min(1) }) + +const listRoute = authRoute( + { access: 'session' }, + { + operationId: 'listAgentOAuthGrants', + summary: 'List Agent OAuth grants', + tags: ['Agent Access'], + method: 'get', + path: '/agent-oauth-grants', + middleware: [requireAuth] as const, + responses: { + 200: jsonContent(listSchema, 'Agent OAuth grants'), + }, + }, +) + +const revokeRoute = authRoute( + { access: 'session' }, + { + operationId: 'revokeAgentOAuthGrant', + summary: 'Revoke an Agent OAuth grant', + tags: ['Agent Access'], + method: 'delete', + path: '/agent-oauth-grants/{grantId}', + middleware: [requireAuth] as const, + request: { params: paramsSchema }, + responses: { + 204: { description: 'Revoked' }, + 404: errorResponse('Agent OAuth grant not found'), + }, + }, +) + +export const agentOAuthGrants = new OpenAPIHono() + .openapi(listRoute, async (c) => { + const result = await listAgentOAuthGrants(c.get('deps'), c.get('platform').db, { userId: c.get('userId')! }) + return c.json(result, 200) + }) + .openapi(revokeRoute, async (c) => { + const { grantId } = c.req.valid('param') + await revokeAgentOAuthGrant(c.get('deps'), c.get('platform').db, { + userId: c.get('userId')!, + grantId, + }) + return c.body(null, 204) + }) diff --git a/server/http/auth/auth.cf-test.ts b/server/http/auth/auth.cf-test.ts index ace97d2d..5403160f 100644 --- a/server/http/auth/auth.cf-test.ts +++ b/server/http/auth/auth.cf-test.ts @@ -40,6 +40,53 @@ describe('[CF] Auth API', () => { expect(res.headers.get('set-cookie')).toBeTruthy() }) + it('completes managed Agent OAuth consent on D1', async () => { + const app = await buildApp() + const signUp = await app.request('/api/auth/sign-up/email', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + name: 'CF Agent OAuth', + email: `cf-agent-oauth-${Date.now()}@example.com`, + password: 'password123456', + }), + }) + const cookie = signUp.headers + .getSetCookie() + .map((value) => value.split(';', 1)[0]) + .join('; ') + const params = new URLSearchParams({ + client_id: 'zpan-agent', + redirect_uri: 'http://127.0.0.1:8484/callback', + response_type: 'code', + scope: 'openid offline_access objects:read quota:read', + state: 'cf-agent-oauth', + code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM', + code_challenge_method: 'S256', + }) + const authorize = await app.request(`/api/auth/oauth2/authorize?${params}`, { + headers: { Cookie: cookie, Origin: 'http://localhost' }, + }) + const consentLocation = authorize.headers.get('location') + expect(authorize.status).toBe(302) + expect(consentLocation).toMatch(/^\/settings\/agent-access\?/) + + const consent = await app.request('/api/auth/oauth2/consent', { + method: 'POST', + headers: { Cookie: cookie, Origin: 'http://localhost', 'Content-Type': 'application/json' }, + body: JSON.stringify({ + accept: true, + oauth_query: consentLocation?.slice(consentLocation.indexOf('?') + 1), + }), + }) + const consentBody = await consent.text() + + expect(consent.status, consentBody).toBe(200) + expect(JSON.parse(consentBody)).toMatchObject({ + url: expect.stringMatching(/^http:\/\/127\.0\.0\.1:8484\/callback\?code=/), + }) + }) + // Wrong password test is covered by Node tests (auth.test.ts). // Better Auth throws an unhandled rejection internally on auth failure // that leaks into the Miniflare isolate, causing a false test failure. diff --git a/server/middleware/audit-actor.test.ts b/server/middleware/audit-actor.test.ts index c0a6fde7..d951100c 100644 --- a/server/middleware/audit-actor.test.ts +++ b/server/middleware/audit-actor.test.ts @@ -3,6 +3,24 @@ import { auditActor } from './audit-actor' import type { AuthPrincipal } from './platform' describe('auditActor', () => { + it('records Agent OAuth principals as delegated Agent actors', () => { + const principal: AuthPrincipal = { + kind: 'agent-oauth', + userId: 'user-1', + grantId: 'grant-1', + clientId: 'zpan-agent', + orgId: 'org-1', + scopes: [], + authMethod: 'bearer', + } + + expect(auditActor(principal)).toEqual({ + userId: 'user-1', + actorType: 'agent_oauth', + actorRef: 'grant-1', + }) + }) + it('records downloader bootstrap principals as user actors', () => { const principal: AuthPrincipal = { kind: 'downloader-bootstrap', diff --git a/server/middleware/audit-actor.ts b/server/middleware/audit-actor.ts index ef1bbd59..55e970f1 100644 --- a/server/middleware/audit-actor.ts +++ b/server/middleware/audit-actor.ts @@ -9,6 +9,9 @@ export function auditActor(principal: AuthPrincipal | null): AuditActor { if (principal.kind === 'api-key') { return { userId: principal.userId, actorType: 'api_key', actorRef: principal.keyId } } + if (principal.kind === 'agent-oauth') { + return { userId: principal.userId, actorType: 'agent_oauth', actorRef: principal.grantId } + } if (principal.kind === 'downloader') { return { userId: null, actorType: 'downloader', actorRef: principal.downloaderId } } diff --git a/server/middleware/auth.ts b/server/middleware/auth.ts index 3c0f938c..cbcbeb61 100644 --- a/server/middleware/auth.ts +++ b/server/middleware/auth.ts @@ -117,6 +117,33 @@ export const authMiddleware = createMiddleware(async (c, next) => { await next() return } + const agentOAuth = await deps.agentOAuth.verifyAccessToken(platform.db, token) + if (agentOAuth) { + if (await deps.userAdmin.isBanned(agentOAuth.userId)) throw unauthorized('Unauthorized') + c.set('principal', { + kind: 'agent-oauth', + grantId: agentOAuth.grantId, + clientId: agentOAuth.clientId, + orgId: agentOAuth.orgId, + userId: agentOAuth.userId, + scopes: agentOAuth.scopes, + authMethod: 'bearer', + }) + c.set('authzContext', { + credential: 'agent_oauth', + userId: agentOAuth.userId, + orgId: agentOAuth.orgId, + fixedOrgId: agentOAuth.orgId, + grantedScopes: new Set(agentOAuth.scopes), + actor: { type: 'agent_oauth', ref: agentOAuth.grantId }, + state: { clientId: agentOAuth.clientId }, + }) + c.set('userId', agentOAuth.userId) + c.set('userRole', null) + c.set('orgId', agentOAuth.orgId) + await next() + return + } const bootstrap = await deps.downloaderBootstrapCredentials.resolve(platform, token, new Date()) if (bootstrap) { c.set('userId', bootstrap.userId) diff --git a/server/middleware/platform.ts b/server/middleware/platform.ts index 20afb0bc..83ac92a4 100644 --- a/server/middleware/platform.ts +++ b/server/middleware/platform.ts @@ -52,6 +52,15 @@ export type AuthPrincipal = permissions: Record | null authMethod: 'api-key' } + | { + kind: 'agent-oauth' + grantId: string + clientId: string + orgId: string + userId: string + scopes: readonly AuthorizationScope[] + authMethod: 'bearer' + } | { kind: 'downloader' downloaderId: string @@ -95,6 +104,15 @@ export type AuthzContext = actor: { type: 'api_key'; ref: string } state: { configId: string; enabled: true } } + | { + credential: 'agent_oauth' + userId: string + orgId: string + fixedOrgId: string + grantedScopes: ReadonlySet + actor: { type: 'agent_oauth'; ref: string } + state: { clientId: string } + } | { credential: 'downloader' userId: null diff --git a/server/openapi.test.ts b/server/openapi.test.ts index 8d8a9b1f..f258334e 100644 --- a/server/openapi.test.ts +++ b/server/openapi.test.ts @@ -53,6 +53,62 @@ describe('global OpenAPI document', () => { expect(html).toContain('/api/openapi.json') }) + it('publishes Agent OAuth security schemes and Restish profiles', async () => { + const { app } = await createTestApp({ DOWNLOAD_TOKEN_SECRET: 'test-download-token-secret' }) + const res = await app.request('/api/openapi.json') + const doc = (await res.json()) as { + components?: { securitySchemes?: Record } + 'x-cli-config'?: { auth?: Record } + } + + expect(doc.components?.securitySchemes?.agentOAuth2).toMatchObject({ + type: 'oauth2', + flows: { authorizationCode: { authorizationUrl: '/api/auth/oauth2/authorize' } }, + }) + expect(doc.components?.securitySchemes?.agentApiKey).toMatchObject({ type: 'http', scheme: 'bearer' }) + expect(doc['x-cli-config']?.auth?.reader?.params).toMatchObject({ + client_id: 'zpan-agent', + redirect_path: '/callback', + }) + }) + + it('publishes OAuth discovery and protected-resource metadata at root locations', async () => { + const { app } = await createTestApp({ DOWNLOAD_TOKEN_SECRET: 'test-download-token-secret' }) + const [authServer, protectedResource] = await Promise.all([ + app.request('/.well-known/oauth-authorization-server/api/auth'), + app.request('/.well-known/oauth-protected-resource/api'), + ]) + + expect(authServer.status).toBe(200) + expect(await authServer.json()).toMatchObject({ + issuer: 'http://localhost:3000/api/auth', + authorization_endpoint: 'http://localhost:3000/api/auth/oauth2/authorize', + token_endpoint: 'http://localhost:3000/api/auth/oauth2/token', + code_challenge_methods_supported: ['S256'], + }) + expect(protectedResource.status).toBe(200) + expect(await protectedResource.json()).toMatchObject({ + resource: 'http://localhost/api', + authorization_servers: ['http://localhost:3000/api/auth'], + scopes_supported: expect.arrayContaining([AuthorizationScope.OBJECTS_READ]), + }) + + const protectedHead = await app.request('/.well-known/oauth-protected-resource/api', { method: 'HEAD' }) + expect(protectedHead.status).toBe(200) + }) + + it('serves HEAD for OAuth discovery and OpenID metadata endpoints', async () => { + const { app } = await createTestApp({ DOWNLOAD_TOKEN_SECRET: 'test-download-token-secret' }) + const [authServer, openidConfig] = await Promise.all([ + app.request('/.well-known/oauth-authorization-server/api/auth', { method: 'HEAD' }), + app.request('/.well-known/openid-configuration/api/auth', { method: 'HEAD' }), + ]) + + expect(authServer.status).toBe(200) + expect(openidConfig.status).toBe(404) + expect(await authServer.text()).toBe('') + }) + it('documents the workspace-scoped API-key event-stream authorization contract', async () => { const { app } = await createTestApp({ DOWNLOAD_TOKEN_SECRET: 'test-download-token-secret' }) const res = await app.request('/api/openapi.json') diff --git a/server/test/setup.ts b/server/test/setup.ts index 67eefacc..42171b29 100644 --- a/server/test/setup.ts +++ b/server/test/setup.ts @@ -114,6 +114,85 @@ const AUTH_SCHEMA_SQL = ` CREATE INDEX IF NOT EXISTS deviceCode_device_code_idx ON deviceCode(device_code); CREATE INDEX IF NOT EXISTS deviceCode_user_code_idx ON deviceCode(user_code); CREATE INDEX IF NOT EXISTS deviceCode_status_idx ON deviceCode(status); + CREATE TABLE IF NOT EXISTS oauthClient ( + id TEXT PRIMARY KEY, + client_id TEXT NOT NULL UNIQUE, + client_secret TEXT, + disabled INTEGER DEFAULT 0, + skip_consent INTEGER, + enable_end_session INTEGER, + subject_type TEXT, + scopes TEXT, + user_id TEXT REFERENCES user(id) ON DELETE CASCADE, + created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)), + updated_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)), + name TEXT, + uri TEXT, + icon TEXT, + contacts TEXT, + tos TEXT, + policy TEXT, + software_id TEXT, + software_version TEXT, + software_statement TEXT, + redirect_uris TEXT NOT NULL, + post_logout_redirect_uris TEXT, + token_endpoint_auth_method TEXT, + grant_types TEXT, + response_types TEXT, + public INTEGER, + type TEXT, + require_pkce INTEGER, + reference_id TEXT, + metadata TEXT + ); + CREATE INDEX IF NOT EXISTS oauthClient_client_id_idx ON oauthClient(client_id); + CREATE INDEX IF NOT EXISTS oauthClient_user_id_idx ON oauthClient(user_id); + CREATE TABLE IF NOT EXISTS oauthRefreshToken ( + id TEXT PRIMARY KEY, + token TEXT NOT NULL UNIQUE, + client_id TEXT NOT NULL REFERENCES oauthClient(client_id) ON DELETE CASCADE, + session_id TEXT REFERENCES session(id) ON DELETE SET NULL, + user_id TEXT NOT NULL REFERENCES user(id) ON DELETE CASCADE, + reference_id TEXT, + expires_at INTEGER NOT NULL, + created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)), + revoked INTEGER, + auth_time INTEGER, + scopes TEXT NOT NULL + ); + CREATE INDEX IF NOT EXISTS oauthRefreshToken_client_id_idx ON oauthRefreshToken(client_id); + CREATE INDEX IF NOT EXISTS oauthRefreshToken_session_id_idx ON oauthRefreshToken(session_id); + CREATE INDEX IF NOT EXISTS oauthRefreshToken_user_id_idx ON oauthRefreshToken(user_id); + CREATE INDEX IF NOT EXISTS oauthRefreshToken_token_idx ON oauthRefreshToken(token); + CREATE TABLE IF NOT EXISTS oauthAccessToken ( + id TEXT PRIMARY KEY, + token TEXT NOT NULL UNIQUE, + client_id TEXT NOT NULL REFERENCES oauthClient(client_id) ON DELETE CASCADE, + session_id TEXT REFERENCES session(id) ON DELETE SET NULL, + user_id TEXT REFERENCES user(id) ON DELETE CASCADE, + reference_id TEXT, + refresh_id TEXT REFERENCES oauthRefreshToken(id) ON DELETE CASCADE, + expires_at INTEGER NOT NULL, + created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)), + scopes TEXT NOT NULL + ); + CREATE INDEX IF NOT EXISTS oauthAccessToken_client_id_idx ON oauthAccessToken(client_id); + CREATE INDEX IF NOT EXISTS oauthAccessToken_session_id_idx ON oauthAccessToken(session_id); + CREATE INDEX IF NOT EXISTS oauthAccessToken_user_id_idx ON oauthAccessToken(user_id); + CREATE INDEX IF NOT EXISTS oauthAccessToken_refresh_id_idx ON oauthAccessToken(refresh_id); + CREATE INDEX IF NOT EXISTS oauthAccessToken_token_idx ON oauthAccessToken(token); + CREATE TABLE IF NOT EXISTS oauthConsent ( + id TEXT PRIMARY KEY, + client_id TEXT NOT NULL REFERENCES oauthClient(client_id) ON DELETE CASCADE, + user_id TEXT REFERENCES user(id) ON DELETE CASCADE, + reference_id TEXT, + scopes TEXT NOT NULL, + created_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)), + updated_at INTEGER NOT NULL DEFAULT (cast(unixepoch('subsecond') * 1000 as integer)) + ); + CREATE INDEX IF NOT EXISTS oauthConsent_client_id_idx ON oauthConsent(client_id); + CREATE INDEX IF NOT EXISTS oauthConsent_user_id_idx ON oauthConsent(user_id); CREATE TABLE IF NOT EXISTS downloader_bootstrap_credentials ( id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, diff --git a/server/usecases/agent-oauth-grants.test.ts b/server/usecases/agent-oauth-grants.test.ts new file mode 100644 index 00000000..e3061ef2 --- /dev/null +++ b/server/usecases/agent-oauth-grants.test.ts @@ -0,0 +1,59 @@ +import { describe, expect, it, vi } from 'vitest' +import { listAgentOAuthGrants, revokeAgentOAuthGrant } from './agent-oauth-grants' +import type { AgentOAuthGateway } from './ports' + +const db = {} as never + +function gateway(overrides: Partial = {}): AgentOAuthGateway { + return { + ensureSystemClient: vi.fn(), + assertLiveGrant: vi.fn(), + verifyAccessToken: vi.fn(), + listGrants: vi.fn(async () => []), + revokeGrant: vi.fn(async () => true), + ...overrides, + } +} + +describe('Agent OAuth grant usecases', () => { + it('lists grants through the gateway', async () => { + const agentOAuth = gateway({ + listGrants: vi.fn(async () => [ + { + id: 'grant-1', + clientId: 'zpan-agent', + userId: 'user-1', + orgId: 'org-1', + scopes: [], + createdAt: '2026-07-29T12:00:00.000Z', + updatedAt: '2026-07-29T12:00:00.000Z', + }, + ]), + }) + + await expect(listAgentOAuthGrants({ agentOAuth }, db, { userId: 'user-1' })).resolves.toEqual({ + items: [ + { + id: 'grant-1', + clientId: 'zpan-agent', + userId: 'user-1', + orgId: 'org-1', + scopes: [], + createdAt: '2026-07-29T12:00:00.000Z', + updatedAt: '2026-07-29T12:00:00.000Z', + }, + ], + }) + }) + + it('throws not found when revoke does not remove a grant', async () => { + const agentOAuth = gateway({ revokeGrant: vi.fn(async () => false) }) + + await expect( + revokeAgentOAuthGrant({ agentOAuth }, db, { userId: 'user-1', grantId: 'missing' }), + ).rejects.toMatchObject({ + httpStatus: 404, + message: 'Agent OAuth grant not found', + }) + }) +}) diff --git a/server/usecases/agent-oauth-grants.ts b/server/usecases/agent-oauth-grants.ts new file mode 100644 index 00000000..c8171364 --- /dev/null +++ b/server/usecases/agent-oauth-grants.ts @@ -0,0 +1,25 @@ +import type { Database } from '../platform/interface' +import type { Deps } from './deps' +import type { AgentOAuthGrant } from './ports' +import { notFound } from './ports' + +export async function listAgentOAuthGrants( + deps: Pick, + db: Database, + input: { userId: string }, +): Promise<{ items: AgentOAuthGrant[] }> { + return { items: await deps.agentOAuth.listGrants(db, input.userId) } +} + +export async function revokeAgentOAuthGrant( + deps: Pick, + db: Database, + input: { userId: string; grantId: string; now?: Date }, +): Promise { + const revoked = await deps.agentOAuth.revokeGrant(db, { + userId: input.userId, + grantId: input.grantId, + now: input.now ?? new Date(), + }) + if (!revoked) throw notFound('Agent OAuth grant not found') +} diff --git a/server/usecases/deps.ts b/server/usecases/deps.ts index 64486735..4a87ed41 100644 --- a/server/usecases/deps.ts +++ b/server/usecases/deps.ts @@ -4,6 +4,7 @@ import type { AdminStatsRepo, + AgentOAuthGateway, AnnouncementRepo, ApiKeyGateway, ArchiveJobsGateway, @@ -56,6 +57,7 @@ import type { export interface Deps { audit: AuditRepo adminStats: AdminStatsRepo + agentOAuth: AgentOAuthGateway announcements: AnnouncementRepo apiKeys: ApiKeyGateway archiveJobs: ArchiveJobsGateway diff --git a/server/usecases/ports.ts b/server/usecases/ports.ts index 26cd11af..ad0db0c5 100644 --- a/server/usecases/ports.ts +++ b/server/usecases/ports.ts @@ -4,6 +4,7 @@ // resource owns its own file under ports/. export * from './ports/admin-stats' +export * from './ports/agent-oauth' export * from './ports/announcement' export * from './ports/api-keys' export * from './ports/app-error' diff --git a/server/usecases/ports/agent-oauth.ts b/server/usecases/ports/agent-oauth.ts new file mode 100644 index 00000000..9aa309f5 --- /dev/null +++ b/server/usecases/ports/agent-oauth.ts @@ -0,0 +1,31 @@ +import type { AuthorizationScope } from '@shared/authorization' +import type { Database } from '../../platform/interface' + +export interface VerifiedAgentOAuthToken { + grantId: string + userId: string + orgId: string + clientId: string + scopes: AuthorizationScope[] +} + +export interface AgentOAuthGrant { + id: string + clientId: string + userId: string + orgId: string + scopes: AuthorizationScope[] + createdAt: string + updatedAt: string +} + +export interface AgentOAuthGateway { + ensureSystemClient(db: Database): Promise + assertLiveGrant( + db: Database, + input: { userId: string; clientId: string; orgId?: string; scopes: readonly string[] }, + ): Promise + verifyAccessToken(db: Database, token: string): Promise + listGrants(db: Database, userId: string): Promise + revokeGrant(db: Database, input: { userId: string; grantId: string; now: Date }): Promise +} diff --git a/shared/agent-oauth.ts b/shared/agent-oauth.ts new file mode 100644 index 00000000..ba90d3fa --- /dev/null +++ b/shared/agent-oauth.ts @@ -0,0 +1,10 @@ +import { AGENT_GRANTABLE_API_KEY_SCOPES } from './api-key-templates' + +export const AGENT_OAUTH_CLIENT_ID = 'zpan-agent' +export const AGENT_OAUTH_CLIENT_NAME = 'ZPan Agent' +export const AGENT_OAUTH_ACCESS_TOKEN_SECONDS = 15 * 60 +export const AGENT_OAUTH_REFRESH_TOKEN_SECONDS = 30 * 24 * 60 * 60 +export const RESTISH_OAUTH_REDIRECT_URIS = ['http://localhost:8484/callback', 'http://127.0.0.1:8484/callback'] as const + +export const AGENT_OAUTH_STANDARD_SCOPES = ['openid', 'profile', 'email', 'offline_access'] as const +export const AGENT_OAUTH_SCOPES = [...AGENT_OAUTH_STANDARD_SCOPES, ...AGENT_GRANTABLE_API_KEY_SCOPES] as const diff --git a/wrangler.toml b/wrangler.toml index 6ed86ce8..21869786 100644 --- a/wrangler.toml +++ b/wrangler.toml @@ -6,7 +6,7 @@ compatibility_flags = ["nodejs_compat", "global_fetch_strictly_public"] [assets] binding = "ASSETS" not_found_handling = "single-page-application" -run_worker_first = ["/api/*", "/dav", "/dav/*", "/ih/*", "/r/*", "/s/*"] +run_worker_first = ["/api/*", "/.well-known/*", "/dav", "/dav/*", "/ih/*", "/r/*", "/s/*"] [[d1_databases]] binding = "DB"