// This file is @generated by prost-build.
/// Request message for RetrieveCredentials.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RetrieveCredentialsRequest {
    /// Required. The parent resource name of the Connector.
    /// Format: `projects/{project}/locations/{location}/connectors/{connector}`
    #[prost(string, tag = "1")]
    pub connector: ::prost::alloc::string::String,
    /// Required. The identity of the end user.
    #[prost(string, tag = "2")]
    pub user_id: ::prost::alloc::string::String,
    /// Optional. The OAuth scopes required for this access.
    #[prost(string, repeated, tag = "3")]
    pub scopes: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Optional. The URI to redirect the user to after consent is completed.
    #[prost(string, tag = "4")]
    pub continue_uri: ::prost::alloc::string::String,
    /// Optional. If true, forces fetching a fresh access token. Use only if the
    /// previously supplied token was expired or invalid. If the token cannot be
    /// refreshed without a login, the user is prompted for consent.
    #[prost(bool, tag = "5")]
    pub force_refresh: bool,
}
/// Response message for RetrieveCredentials.
/// Contains the access tokens and related artifacts.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RetrieveCredentialsResponse {
    /// The retrieved access token or credential for the end user.
    ///
    /// On MCPTool call, for an invalid token OAuth spec says this should
    /// return 401 or 403, but MCPServers may implement this differently. If you
    /// get any flavor of `PERMISSION_DENIED`, retry your original request to
    /// RetrieveCredentials with
    /// \[force_refresh\]\[google.cloud.iamconnectorcredentials.v1alpha.RetrieveCredentialsRequest.force_refresh\]
    /// set to `true`, which will fetch a new token or initiate a new consent flow.
    #[prost(string, tag = "1")]
    pub token: ::prost::alloc::string::String,
    /// The HTTP header name where the token should be placed.
    #[prost(string, tag = "2")]
    pub header: ::prost::alloc::string::String,
    /// The expiration time of the token.
    ///
    /// This does not guarantee that the token will be valid until this time, since
    /// the token could be revoked earlier.
    /// There could also be clock skew between the auth provider and the client so
    /// it may expire slightly earlier.
    /// If not set, the token might be permanent or it may be that the service does
    /// not (or cannot) know when it will expire.
    #[prost(message, optional, tag = "3")]
    pub expire_time: ::core::option::Option<::prost_types::Timestamp>,
    /// The scopes actually associated with the retrieved token.
    ///
    /// End users may have rejected some requested scopes, or the third-party
    /// authorization servers can return a different set of scopes than what was
    /// asked for. Callers should verify that all required scopes for their
    /// intended use are included in this list.
    #[prost(string, repeated, tag = "4")]
    pub scopes: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
}
/// Metadata for the RetrieveCredentials operation.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct RetrieveCredentialsMetadata {
    /// Output only. The time when the operation was created.
    #[prost(message, optional, tag = "1")]
    pub create_time: ::core::option::Option<::prost_types::Timestamp>,
    /// Indicates what requirements, if any, must be fulfilled to acquire a token.
    /// See the comments on the specific message for the client behavior.
    ///
    /// Note: All polling or retries should follow an exponential backoff
    /// (seconds): `0.5`, `1`, `2`, `4`, `8`, etc...
    #[prost(oneof = "retrieve_credentials_metadata::Status", tags = "6, 4, 5")]
    pub status: ::core::option::Option<retrieve_credentials_metadata::Status>,
}
/// Nested message and enum types in `RetrieveCredentialsMetadata`.
pub mod retrieve_credentials_metadata {
    /// Indicates that the user must visit the provided URI to consent to
    /// delegate permission to the agent to act on their behalf. The caller can
    /// either poll the provided operation, or await the user ID validation
    /// callback
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct UriConsentRequired {
        /// Output only. The URL where the user should be redirected to grant
        /// consent. This will always be present.
        #[prost(string, tag = "1")]
        pub authorization_uri: ::prost::alloc::string::String,
        /// Output only. A one-time, randomly generated value that validates the
        /// entire consent flow is handled by a single user, avoiding CSRF attacks.
        /// It must be submitted with the FinalizeCredentials request to complete the
        /// OAuth exchange. This will always be present. Implemented per
        /// <https://www.rfc-editor.org/rfc/rfc6819#section-5.3.5>
        #[prost(string, tag = "2")]
        pub consent_nonce: ::prost::alloc::string::String,
    }
    /// Indicates that the consent flow is pending external action.
    /// No action is required by the caller. Simply retry the RetrieveCredentials
    /// request.
    #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct ConsentPending {}
    /// Indicates the user has rejected the permission delegation or cancelled the
    /// request.
    #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
    pub struct ConsentRejected {}
    /// Indicates what requirements, if any, must be fulfilled to acquire a token.
    /// See the comments on the specific message for the client behavior.
    ///
    /// Note: All polling or retries should follow an exponential backoff
    /// (seconds): `0.5`, `1`, `2`, `4`, `8`, etc...
    #[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
    pub enum Status {
        /// Message indicating consent is pending.
        #[prost(message, tag = "6")]
        ConsentPending(ConsentPending),
        /// Message indicating uri based consent is required.
        #[prost(message, tag = "4")]
        UriConsentRequired(UriConsentRequired),
        /// Message indicating consent was rejected.
        #[prost(message, tag = "5")]
        ConsentRejected(ConsentRejected),
    }
}
/// Request message for FinalizeCredentials.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct FinalizeCredentialsRequest {
    /// Required. The resource name of the Connector.
    /// Format: `projects/{project}/locations/{location}/connectors/{connector}`
    #[prost(string, tag = "1")]
    pub connector: ::prost::alloc::string::String,
    /// Required. The identity of the end user.
    #[prost(string, tag = "2")]
    pub user_id: ::prost::alloc::string::String,
    /// Required. The encrypted state passed back from the consent flow.
    #[prost(bytes = "vec", tag = "3")]
    pub user_id_validation_state: ::prost::alloc::vec::Vec<u8>,
    /// Required. The same consent_nonce value that was provided during redirect in
    /// the UriConsentRequired metadata.
    #[prost(string, tag = "4")]
    pub consent_nonce: ::prost::alloc::string::String,
}
/// Response message for FinalizeCredentials. Intentionally empty
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct FinalizeCredentialsResponse {}
/// Generated client implementations.
pub mod iam_connector_credentials_service_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value,
    )]
    use tonic::codegen::*;
    use tonic::codegen::http::Uri;
    /// Service for managing Connector Credentials.
    #[derive(Debug, Clone)]
    pub struct IamConnectorCredentialsServiceClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl IamConnectorCredentialsServiceClient<tonic::transport::Channel> {
        /// Attempt to create a new client by connecting to a given endpoint.
        pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
        where
            D: TryInto<tonic::transport::Endpoint>,
            D::Error: Into<StdError>,
        {
            let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
            Ok(Self::new(conn))
        }
    }
    impl<T> IamConnectorCredentialsServiceClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(
            inner: T,
            interceptor: F,
        ) -> IamConnectorCredentialsServiceClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<
                http::Request<tonic::body::Body>,
            >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            IamConnectorCredentialsServiceClient::new(
                InterceptedService::new(inner, interceptor),
            )
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Generates a credential request operation.
        /// Initiates the retrieval of authorization credentials for a connector.
        /// If `operation.done` is `true`, the `operation.response` field contains a
        /// `RetrieveCredentialsResponse` containing the token. Otherwise, the
        /// `operation.metadata` field contains a `RetrieveCredentialsMetadata`.
        ///
        /// Depending on the type contained in `RetrieveCredentialsMetadata`
        /// callers will need to take different actions to obtain the credential.
        /// View the comments on each type for more information.
        pub async fn retrieve_credentials(
            &mut self,
            request: impl tonic::IntoRequest<super::RetrieveCredentialsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::super::super::super::longrunning::Operation>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.iamconnectorcredentials.v1alpha.IAMConnectorCredentialsService/RetrieveCredentials",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.iamconnectorcredentials.v1alpha.IAMConnectorCredentialsService",
                        "RetrieveCredentials",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
        /// Finalizes the credentials after a successful consent flow.
        pub async fn finalize_credentials(
            &mut self,
            request: impl tonic::IntoRequest<super::FinalizeCredentialsRequest>,
        ) -> std::result::Result<
            tonic::Response<super::FinalizeCredentialsResponse>,
            tonic::Status,
        > {
            self.inner
                .ready()
                .await
                .map_err(|e| {
                    tonic::Status::unknown(
                        format!("Service was not ready: {}", e.into()),
                    )
                })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static(
                "/google.cloud.iamconnectorcredentials.v1alpha.IAMConnectorCredentialsService/FinalizeCredentials",
            );
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(
                    GrpcMethod::new(
                        "google.cloud.iamconnectorcredentials.v1alpha.IAMConnectorCredentialsService",
                        "FinalizeCredentials",
                    ),
                );
            self.inner.unary(req, path, codec).await
        }
    }
}
