// MeService -- the caller-bound surface for self-management of sessions
// and API keys -- plus the admin-side ResolveApiKey used by the auth
// middleware to map an inbound API key to its owning Identity.
//
// Milestone A (Login / Logout / GetMe) and milestone B (IssueMyKey /
// ListMyKeys / RevokeMyKey / ResolveApiKey) RPCs land here. Sessions
// listing, JWK registration, and the broader IdentityService admin
// surface (BootstrapIdentity, GetInternalIdentity, ListIdentities) are
// deferred to milestone C.

// Code generated by protoc-gen-connect-go. DO NOT EDIT.
//
// Source: tars/identity/v1/identity_service.proto

package identityv1connect

import (
	connect "connectrpc.com/connect"
	context "context"
	errors "errors"
	v1 "github.com/tetrateio/agentrouter-go/genapi/api/tars/identity/v1"
	http "net/http"
	strings "strings"
)

// This is a compile-time assertion to ensure that this generated file and the connect package are
// compatible. If you get a compiler error that this constant is not defined, this code was
// generated with a version of connect newer than the one compiled into your binary. You can fix the
// problem by either regenerating this code with an older version of connect or updating the connect
// version compiled into your binary.
const _ = connect.IsAtLeastVersion1_13_0

const (
	// MeServiceName is the fully-qualified name of the MeService service.
	MeServiceName = "tars.identity.v1.MeService"
	// IdentityServiceName is the fully-qualified name of the IdentityService service.
	IdentityServiceName = "tars.identity.v1.IdentityService"
)

// These constants are the fully-qualified names of the RPCs defined in this package. They're
// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
//
// Note that these are different from the fully-qualified method names used by
// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
// period.
const (
	// MeServiceLoginProcedure is the fully-qualified name of the MeService's Login RPC.
	MeServiceLoginProcedure = "/tars.identity.v1.MeService/Login"
	// MeServiceLogoutProcedure is the fully-qualified name of the MeService's Logout RPC.
	MeServiceLogoutProcedure = "/tars.identity.v1.MeService/Logout"
	// MeServiceGetMeProcedure is the fully-qualified name of the MeService's GetMe RPC.
	MeServiceGetMeProcedure = "/tars.identity.v1.MeService/GetMe"
	// MeServiceIssueMyKeyProcedure is the fully-qualified name of the MeService's IssueMyKey RPC.
	MeServiceIssueMyKeyProcedure = "/tars.identity.v1.MeService/IssueMyKey"
	// MeServiceListMyKeysProcedure is the fully-qualified name of the MeService's ListMyKeys RPC.
	MeServiceListMyKeysProcedure = "/tars.identity.v1.MeService/ListMyKeys"
	// MeServiceRevokeMyKeyProcedure is the fully-qualified name of the MeService's RevokeMyKey RPC.
	MeServiceRevokeMyKeyProcedure = "/tars.identity.v1.MeService/RevokeMyKey"
	// IdentityServiceResolveApiKeyProcedure is the fully-qualified name of the IdentityService's
	// ResolveApiKey RPC.
	IdentityServiceResolveApiKeyProcedure = "/tars.identity.v1.IdentityService/ResolveApiKey"
)

// MeServiceClient is a client for the tars.identity.v1.MeService service.
type MeServiceClient interface {
	// Login initiates an OIDC authorization-code + PKCE flow. Returns an
	// authorization_url the caller must redirect the user's browser to.
	// After the IdP authenticates and redirects to redirect_uri, the
	// platform establishes a session cookie for subsequent requests.
	Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error)
	// Logout invalidates the caller's current OIDC session. Subsequent
	// requests using the session cookie return 401 unauthenticated. Does
	// not revoke API keys the identity may have issued.
	Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error)
	// GetMe returns the full identity record for the authenticated caller.
	// Use to verify which identity a credential belongs to, populate a
	// "logged in as" UI element, or confirm role assignments before making
	// permission-gated calls.
	GetMe(context.Context, *connect.Request[v1.GetMeRequest]) (*connect.Response[v1.GetMeResponse], error)
	// IssueMyKey issues a new long-lived API key for the caller. The
	// secret field in the response is returned exactly once and cannot be
	// retrieved again. Store it in a secrets manager immediately.
	IssueMyKey(context.Context, *connect.Request[v1.IssueMyKeyRequest]) (*connect.Response[v1.IssueMyKeyResponse], error)
	// ListMyKeys lists all API keys belonging to the caller. Returns
	// metadata (id, name, creation timestamp, last-used timestamp) but
	// never the plaintext secret.
	ListMyKeys(context.Context, *connect.Request[v1.ListMyKeysRequest]) (*connect.Response[v1.ListMyKeysResponse], error)
	// RevokeMyKey permanently and irrevocably revokes an API key.
	// Revocation propagates to all active data planes within sub-second;
	// requests already in flight that passed authentication before
	// propagation may still complete.
	RevokeMyKey(context.Context, *connect.Request[v1.RevokeMyKeyRequest]) (*connect.Response[v1.RevokeMyKeyResponse], error)
}

// NewMeServiceClient constructs a client for the tars.identity.v1.MeService service. By default, it
// uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses, and sends
// uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
// connect.WithGRPCWeb() options.
//
// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
// http://api.acme.com or https://acme.com/grpc).
func NewMeServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) MeServiceClient {
	baseURL = strings.TrimRight(baseURL, "/")
	meServiceMethods := v1.File_tars_identity_v1_identity_service_proto.Services().ByName("MeService").Methods()
	return &meServiceClient{
		login: connect.NewClient[v1.LoginRequest, v1.LoginResponse](
			httpClient,
			baseURL+MeServiceLoginProcedure,
			connect.WithSchema(meServiceMethods.ByName("Login")),
			connect.WithClientOptions(opts...),
		),
		logout: connect.NewClient[v1.LogoutRequest, v1.LogoutResponse](
			httpClient,
			baseURL+MeServiceLogoutProcedure,
			connect.WithSchema(meServiceMethods.ByName("Logout")),
			connect.WithClientOptions(opts...),
		),
		getMe: connect.NewClient[v1.GetMeRequest, v1.GetMeResponse](
			httpClient,
			baseURL+MeServiceGetMeProcedure,
			connect.WithSchema(meServiceMethods.ByName("GetMe")),
			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
			connect.WithClientOptions(opts...),
		),
		issueMyKey: connect.NewClient[v1.IssueMyKeyRequest, v1.IssueMyKeyResponse](
			httpClient,
			baseURL+MeServiceIssueMyKeyProcedure,
			connect.WithSchema(meServiceMethods.ByName("IssueMyKey")),
			connect.WithClientOptions(opts...),
		),
		listMyKeys: connect.NewClient[v1.ListMyKeysRequest, v1.ListMyKeysResponse](
			httpClient,
			baseURL+MeServiceListMyKeysProcedure,
			connect.WithSchema(meServiceMethods.ByName("ListMyKeys")),
			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
			connect.WithClientOptions(opts...),
		),
		revokeMyKey: connect.NewClient[v1.RevokeMyKeyRequest, v1.RevokeMyKeyResponse](
			httpClient,
			baseURL+MeServiceRevokeMyKeyProcedure,
			connect.WithSchema(meServiceMethods.ByName("RevokeMyKey")),
			connect.WithClientOptions(opts...),
		),
	}
}

// meServiceClient implements MeServiceClient.
type meServiceClient struct {
	login       *connect.Client[v1.LoginRequest, v1.LoginResponse]
	logout      *connect.Client[v1.LogoutRequest, v1.LogoutResponse]
	getMe       *connect.Client[v1.GetMeRequest, v1.GetMeResponse]
	issueMyKey  *connect.Client[v1.IssueMyKeyRequest, v1.IssueMyKeyResponse]
	listMyKeys  *connect.Client[v1.ListMyKeysRequest, v1.ListMyKeysResponse]
	revokeMyKey *connect.Client[v1.RevokeMyKeyRequest, v1.RevokeMyKeyResponse]
}

// Login calls tars.identity.v1.MeService.Login.
func (c *meServiceClient) Login(ctx context.Context, req *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error) {
	return c.login.CallUnary(ctx, req)
}

// Logout calls tars.identity.v1.MeService.Logout.
func (c *meServiceClient) Logout(ctx context.Context, req *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error) {
	return c.logout.CallUnary(ctx, req)
}

// GetMe calls tars.identity.v1.MeService.GetMe.
func (c *meServiceClient) GetMe(ctx context.Context, req *connect.Request[v1.GetMeRequest]) (*connect.Response[v1.GetMeResponse], error) {
	return c.getMe.CallUnary(ctx, req)
}

// IssueMyKey calls tars.identity.v1.MeService.IssueMyKey.
func (c *meServiceClient) IssueMyKey(ctx context.Context, req *connect.Request[v1.IssueMyKeyRequest]) (*connect.Response[v1.IssueMyKeyResponse], error) {
	return c.issueMyKey.CallUnary(ctx, req)
}

// ListMyKeys calls tars.identity.v1.MeService.ListMyKeys.
func (c *meServiceClient) ListMyKeys(ctx context.Context, req *connect.Request[v1.ListMyKeysRequest]) (*connect.Response[v1.ListMyKeysResponse], error) {
	return c.listMyKeys.CallUnary(ctx, req)
}

// RevokeMyKey calls tars.identity.v1.MeService.RevokeMyKey.
func (c *meServiceClient) RevokeMyKey(ctx context.Context, req *connect.Request[v1.RevokeMyKeyRequest]) (*connect.Response[v1.RevokeMyKeyResponse], error) {
	return c.revokeMyKey.CallUnary(ctx, req)
}

// MeServiceHandler is an implementation of the tars.identity.v1.MeService service.
type MeServiceHandler interface {
	// Login initiates an OIDC authorization-code + PKCE flow. Returns an
	// authorization_url the caller must redirect the user's browser to.
	// After the IdP authenticates and redirects to redirect_uri, the
	// platform establishes a session cookie for subsequent requests.
	Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error)
	// Logout invalidates the caller's current OIDC session. Subsequent
	// requests using the session cookie return 401 unauthenticated. Does
	// not revoke API keys the identity may have issued.
	Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error)
	// GetMe returns the full identity record for the authenticated caller.
	// Use to verify which identity a credential belongs to, populate a
	// "logged in as" UI element, or confirm role assignments before making
	// permission-gated calls.
	GetMe(context.Context, *connect.Request[v1.GetMeRequest]) (*connect.Response[v1.GetMeResponse], error)
	// IssueMyKey issues a new long-lived API key for the caller. The
	// secret field in the response is returned exactly once and cannot be
	// retrieved again. Store it in a secrets manager immediately.
	IssueMyKey(context.Context, *connect.Request[v1.IssueMyKeyRequest]) (*connect.Response[v1.IssueMyKeyResponse], error)
	// ListMyKeys lists all API keys belonging to the caller. Returns
	// metadata (id, name, creation timestamp, last-used timestamp) but
	// never the plaintext secret.
	ListMyKeys(context.Context, *connect.Request[v1.ListMyKeysRequest]) (*connect.Response[v1.ListMyKeysResponse], error)
	// RevokeMyKey permanently and irrevocably revokes an API key.
	// Revocation propagates to all active data planes within sub-second;
	// requests already in flight that passed authentication before
	// propagation may still complete.
	RevokeMyKey(context.Context, *connect.Request[v1.RevokeMyKeyRequest]) (*connect.Response[v1.RevokeMyKeyResponse], error)
}

// NewMeServiceHandler builds an HTTP handler from the service implementation. It returns the path
// on which to mount the handler and the handler itself.
//
// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
// and JSON codecs. They also support gzip compression.
func NewMeServiceHandler(svc MeServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	meServiceMethods := v1.File_tars_identity_v1_identity_service_proto.Services().ByName("MeService").Methods()
	meServiceLoginHandler := connect.NewUnaryHandler(
		MeServiceLoginProcedure,
		svc.Login,
		connect.WithSchema(meServiceMethods.ByName("Login")),
		connect.WithHandlerOptions(opts...),
	)
	meServiceLogoutHandler := connect.NewUnaryHandler(
		MeServiceLogoutProcedure,
		svc.Logout,
		connect.WithSchema(meServiceMethods.ByName("Logout")),
		connect.WithHandlerOptions(opts...),
	)
	meServiceGetMeHandler := connect.NewUnaryHandler(
		MeServiceGetMeProcedure,
		svc.GetMe,
		connect.WithSchema(meServiceMethods.ByName("GetMe")),
		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
		connect.WithHandlerOptions(opts...),
	)
	meServiceIssueMyKeyHandler := connect.NewUnaryHandler(
		MeServiceIssueMyKeyProcedure,
		svc.IssueMyKey,
		connect.WithSchema(meServiceMethods.ByName("IssueMyKey")),
		connect.WithHandlerOptions(opts...),
	)
	meServiceListMyKeysHandler := connect.NewUnaryHandler(
		MeServiceListMyKeysProcedure,
		svc.ListMyKeys,
		connect.WithSchema(meServiceMethods.ByName("ListMyKeys")),
		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
		connect.WithHandlerOptions(opts...),
	)
	meServiceRevokeMyKeyHandler := connect.NewUnaryHandler(
		MeServiceRevokeMyKeyProcedure,
		svc.RevokeMyKey,
		connect.WithSchema(meServiceMethods.ByName("RevokeMyKey")),
		connect.WithHandlerOptions(opts...),
	)
	return "/tars.identity.v1.MeService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case MeServiceLoginProcedure:
			meServiceLoginHandler.ServeHTTP(w, r)
		case MeServiceLogoutProcedure:
			meServiceLogoutHandler.ServeHTTP(w, r)
		case MeServiceGetMeProcedure:
			meServiceGetMeHandler.ServeHTTP(w, r)
		case MeServiceIssueMyKeyProcedure:
			meServiceIssueMyKeyHandler.ServeHTTP(w, r)
		case MeServiceListMyKeysProcedure:
			meServiceListMyKeysHandler.ServeHTTP(w, r)
		case MeServiceRevokeMyKeyProcedure:
			meServiceRevokeMyKeyHandler.ServeHTTP(w, r)
		default:
			http.NotFound(w, r)
		}
	})
}

// UnimplementedMeServiceHandler returns CodeUnimplemented from all methods.
type UnimplementedMeServiceHandler struct{}

func (UnimplementedMeServiceHandler) Login(context.Context, *connect.Request[v1.LoginRequest]) (*connect.Response[v1.LoginResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.Login is not implemented"))
}

func (UnimplementedMeServiceHandler) Logout(context.Context, *connect.Request[v1.LogoutRequest]) (*connect.Response[v1.LogoutResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.Logout is not implemented"))
}

func (UnimplementedMeServiceHandler) GetMe(context.Context, *connect.Request[v1.GetMeRequest]) (*connect.Response[v1.GetMeResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.GetMe is not implemented"))
}

func (UnimplementedMeServiceHandler) IssueMyKey(context.Context, *connect.Request[v1.IssueMyKeyRequest]) (*connect.Response[v1.IssueMyKeyResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.IssueMyKey is not implemented"))
}

func (UnimplementedMeServiceHandler) ListMyKeys(context.Context, *connect.Request[v1.ListMyKeysRequest]) (*connect.Response[v1.ListMyKeysResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.ListMyKeys is not implemented"))
}

func (UnimplementedMeServiceHandler) RevokeMyKey(context.Context, *connect.Request[v1.RevokeMyKeyRequest]) (*connect.Response[v1.RevokeMyKeyResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.MeService.RevokeMyKey is not implemented"))
}

// IdentityServiceClient is a client for the tars.identity.v1.IdentityService service.
type IdentityServiceClient interface {
	// ResolveApiKey maps an API-key plaintext to its owning Identity.
	// Internal-only -- only callable over the mTLS-protected internal
	// subdomain. The auth middleware calls this on every inbound request
	// that presents Authorization: Bearer <api_key>.
	ResolveApiKey(context.Context, *connect.Request[v1.ResolveApiKeyRequest]) (*connect.Response[v1.ResolveApiKeyResponse], error)
}

// NewIdentityServiceClient constructs a client for the tars.identity.v1.IdentityService service. By
// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
// connect.WithGRPC() or connect.WithGRPCWeb() options.
//
// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
// http://api.acme.com or https://acme.com/grpc).
func NewIdentityServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) IdentityServiceClient {
	baseURL = strings.TrimRight(baseURL, "/")
	identityServiceMethods := v1.File_tars_identity_v1_identity_service_proto.Services().ByName("IdentityService").Methods()
	return &identityServiceClient{
		resolveApiKey: connect.NewClient[v1.ResolveApiKeyRequest, v1.ResolveApiKeyResponse](
			httpClient,
			baseURL+IdentityServiceResolveApiKeyProcedure,
			connect.WithSchema(identityServiceMethods.ByName("ResolveApiKey")),
			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
			connect.WithClientOptions(opts...),
		),
	}
}

// identityServiceClient implements IdentityServiceClient.
type identityServiceClient struct {
	resolveApiKey *connect.Client[v1.ResolveApiKeyRequest, v1.ResolveApiKeyResponse]
}

// ResolveApiKey calls tars.identity.v1.IdentityService.ResolveApiKey.
func (c *identityServiceClient) ResolveApiKey(ctx context.Context, req *connect.Request[v1.ResolveApiKeyRequest]) (*connect.Response[v1.ResolveApiKeyResponse], error) {
	return c.resolveApiKey.CallUnary(ctx, req)
}

// IdentityServiceHandler is an implementation of the tars.identity.v1.IdentityService service.
type IdentityServiceHandler interface {
	// ResolveApiKey maps an API-key plaintext to its owning Identity.
	// Internal-only -- only callable over the mTLS-protected internal
	// subdomain. The auth middleware calls this on every inbound request
	// that presents Authorization: Bearer <api_key>.
	ResolveApiKey(context.Context, *connect.Request[v1.ResolveApiKeyRequest]) (*connect.Response[v1.ResolveApiKeyResponse], error)
}

// NewIdentityServiceHandler builds an HTTP handler from the service implementation. It returns the
// path on which to mount the handler and the handler itself.
//
// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
// and JSON codecs. They also support gzip compression.
func NewIdentityServiceHandler(svc IdentityServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
	identityServiceMethods := v1.File_tars_identity_v1_identity_service_proto.Services().ByName("IdentityService").Methods()
	identityServiceResolveApiKeyHandler := connect.NewUnaryHandler(
		IdentityServiceResolveApiKeyProcedure,
		svc.ResolveApiKey,
		connect.WithSchema(identityServiceMethods.ByName("ResolveApiKey")),
		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
		connect.WithHandlerOptions(opts...),
	)
	return "/tars.identity.v1.IdentityService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch r.URL.Path {
		case IdentityServiceResolveApiKeyProcedure:
			identityServiceResolveApiKeyHandler.ServeHTTP(w, r)
		default:
			http.NotFound(w, r)
		}
	})
}

// UnimplementedIdentityServiceHandler returns CodeUnimplemented from all methods.
type UnimplementedIdentityServiceHandler struct{}

func (UnimplementedIdentityServiceHandler) ResolveApiKey(context.Context, *connect.Request[v1.ResolveApiKeyRequest]) (*connect.Response[v1.ResolveApiKeyResponse], error) {
	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("tars.identity.v1.IdentityService.ResolveApiKey is not implemented"))
}
