const (
	ExternalJWTSigner_Sign_FullMethodName      = "/v1.ExternalJWTSigner/Sign"
	ExternalJWTSigner_FetchKeys_FullMethodName = "/v1.ExternalJWTSigner/FetchKeys"
	ExternalJWTSigner_Metadata_FullMethodName  = "/v1.ExternalJWTSigner/Metadata"
)

var ExternalJWTSigner_ServiceDesc = grpc.ServiceDesc{
	ServiceName: "v1.ExternalJWTSigner",
	HandlerType: (*ExternalJWTSignerServer)(nil),
	Methods: []grpc.MethodDesc{
		{
			MethodName: "Sign",
			Handler:    _ExternalJWTSigner_Sign_Handler,
		},
		{
			MethodName: "FetchKeys",
			Handler:    _ExternalJWTSigner_FetchKeys_Handler,
		},
		{
			MethodName: "Metadata",
			Handler:    _ExternalJWTSigner_Metadata_Handler,
		},
	},
	Streams:  []grpc.StreamDesc{},
	Metadata: "staging/src/k8s.io/externaljwt/apis/v1/api.proto",
}

var File_staging_src_k8s_io_externaljwt_apis_v1_api_proto protoreflect.FileDescriptor

type ExternalJWTSignerClient interface {
	// Sign takes a serialized JWT payload, and returns the serialized header and
	// signature. The caller can then assemble the JWT from the header, payload,
	// and signature. Signature can be generated by signing
	// `base64url(header) + "." + base64url(payload)` with signing key.
	//
	// The plugin MUST set a key id in the returned JWT header.
	Sign(ctx context.Context, in *SignJWTRequest, opts ...grpc.CallOption) (*SignJWTResponse, error)
	// FetchKeys returns the set of public keys that are trusted to sign
	// Kubernetes service account tokens. Kube-apiserver will call this RPC:
	//
	// * Every time it tries to validate a JWT from the service account issuer with an unknown key ID, and
	//
	//   - Periodically, so it can serve reasonably-up-to-date keys from the OIDC
	//     JWKs endpoint.
	FetchKeys(ctx context.Context, in *FetchKeysRequest, opts ...grpc.CallOption) (*FetchKeysResponse, error)
	// Metadata is meant to be called once on startup.
	// Enables sharing metadata with kube-apiserver (eg: the max token lifetime that signer supports)
	Metadata(ctx context.Context, in *MetadataRequest, opts ...grpc.CallOption) (*MetadataResponse, error)
}

type ExternalJWTSignerServer interface {
	// Sign takes a serialized JWT payload, and returns the serialized header and
	// signature. The caller can then assemble the JWT from the header, payload,
	// and signature. Signature can be generated by signing
	// `base64url(header) + "." + base64url(payload)` with signing key.
	//
	// The plugin MUST set a key id in the returned JWT header.
	Sign(context.Context, *SignJWTRequest) (*SignJWTResponse, error)
	// FetchKeys returns the set of public keys that are trusted to sign
	// Kubernetes service account tokens. Kube-apiserver will call this RPC:
	//
	// * Every time it tries to validate a JWT from the service account issuer with an unknown key ID, and
	//
	//   - Periodically, so it can serve reasonably-up-to-date keys from the OIDC
	//     JWKs endpoint.
	FetchKeys(context.Context, *FetchKeysRequest) (*FetchKeysResponse, error)
	// Metadata is meant to be called once on startup.
	// Enables sharing metadata with kube-apiserver (eg: the max token lifetime that signer supports)
	Metadata(context.Context, *MetadataRequest) (*MetadataResponse, error)
	// contains filtered or unexported methods
}

type FetchKeysRequest struct {
	// contains filtered or unexported fields
}

type FetchKeysResponse struct {
	Keys []*Key `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
	// The timestamp when this data was pulled from the authoritative source of
	// truth for verification keys.
	// kube-apiserver can export this from metrics, to enable end-to-end SLOs.
	DataTimestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=data_timestamp,json=dataTimestamp,proto3" json:"data_timestamp,omitempty"`
	// refresh interval for verification keys to pick changes if any.
	// any value <= 0 is considered a misconfiguration.
	RefreshHintSeconds int64 `protobuf:"varint,3,opt,name=refresh_hint_seconds,json=refreshHintSeconds,proto3" json:"refresh_hint_seconds,omitempty"`
	// contains filtered or unexported fields
}

type Key struct {

	// A unique identifier for this key.
	// Length must be <=1024.
	KeyId string `protobuf:"bytes,1,opt,name=key_id,json=keyId,proto3" json:"key_id,omitempty"`
	// The public key, PKIX-serialized.
	// must be a public key supported by kube-apiserver (currently RSA 256 or ECDSA 256/384/521)
	Key []byte `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
	// Set only for keys that are not used to sign bound tokens.
	// eg: supported keys for legacy tokens.
	// If set, key is used for verification but excluded from OIDC discovery docs.
	// if set, external signer should not use this key to sign a JWT.
	ExcludeFromOidcDiscovery bool `protobuf:"varint,3,opt,name=exclude_from_oidc_discovery,json=excludeFromOidcDiscovery,proto3" json:"exclude_from_oidc_discovery,omitempty"`
	// contains filtered or unexported fields
}

type MetadataRequest struct {
	// contains filtered or unexported fields
}

type MetadataResponse struct {

	// used by kube-apiserver for defaulting/validation of JWT lifetime while accounting for configuration flag values:
	// 1. `--service-account-max-token-expiration`
	// 2. `--service-account-extend-token-expiration`
	//
	// * If `--service-account-max-token-expiration` is greater than `max_token_expiration_seconds`, kube-apiserver treats that as misconfiguration and exits.
	// * If `--service-account-max-token-expiration` is not explicitly set, kube-apiserver defaults to `max_token_expiration_seconds`.
	// * If `--service-account-extend-token-expiration` is true, the extended expiration is `min(1 year, max_token_expiration_seconds)`.
	//
	// `max_token_expiration_seconds` must be at least 600s.
	MaxTokenExpirationSeconds int64 `protobuf:"varint,1,opt,name=max_token_expiration_seconds,json=maxTokenExpirationSeconds,proto3" json:"max_token_expiration_seconds,omitempty"`
	// contains filtered or unexported fields
}

type SignJWTRequest struct {

	// URL-safe base64 wrapped payload to be signed.
	// Exactly as it appears in the second segment of the JWT
	Claims string `protobuf:"bytes,1,opt,name=claims,proto3" json:"claims,omitempty"`
	// contains filtered or unexported fields
}

type SignJWTResponse struct {

	// header must contain only alg, kid, typ claims.
	// typ must be “JWT”.
	// kid must be non-empty, <=1024 characters, and its corresponding public key should not be excluded from OIDC discovery.
	// alg must be one of the algorithms supported by kube-apiserver (currently RS256, ES256, ES384, ES512).
	// header cannot have any additional data that kube-apiserver does not recognize.
	// Already wrapped in URL-safe base64, exactly as it appears in the first segment of the JWT.
	Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
	// The signature for the JWT.
	// Already wrapped in URL-safe base64, exactly as it appears in the final segment of the JWT.
	Signature string `protobuf:"bytes,2,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedExternalJWTSignerServer struct{}

type UnsafeExternalJWTSignerServer interface {
	// contains filtered or unexported methods
}