syntax = "proto3";

// If you make any changes make sure you run: make regenerate-proto

package gitlab.agent.kubernetes_api.server;

option go_package = "gitlab.com/gitlab-org/cluster-integration/gitlab-agent/v18/internal/module/kubernetes_api/server";

import "internal/module/kubernetes_api/kubernetes_api.proto";
import "buf/validate/validate.proto";

message WebSocketTokenClaims {
  // These are registered claims:

  // the `iss` (Issuer) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1
  string registered_claim_issuer = 1 [json_name = "iss"];
  // the `sub` (Subject) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2
  string registered_claim_subject = 2 [json_name = "sub"];
  // the `aud` (Audience) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3
  repeated string registered_claim_audience = 3 [json_name = "aud"];
  // the `exp` (Expiration Time) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4
  int64 registered_claim_expires_at = 4 [json_name = "exp"];
  // the `nbf` (Not Before) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5
  int64 registered_claim_not_before = 5 [json_name = "nbf"];
  // the `iat` (Issued At) claim. See https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6
  int64 registered_claim_issued_at = 6 [json_name = "iat"];


  // These are custom private claims:
  string endpoint = 7 [json_name = "endpoint", (buf.validate.field).string.min_bytes = 1];
  int64 agent_id = 8 [json_name = "agent_id", (buf.validate.field).int64.gt = 0];
  kubernetes_api.ImpersonationConfig impersonation_config = 9 [json_name = "impersonation_config"];
  map<string, bool> feature_flags = 10 [json_name = "feature_flags"];
}
