feat: move permissions to shared, a new token proto

proto/auth.proto

@@ -1,5 +1,7 @@
 syntax = "proto3";
 
+import "permissions.proto";
+
 option go_package = "github.com/momentohq/client-sdk-go;client_sdk_go";
 option java_multiple_files = true;
 option java_package = "momento.auth";
@@ -69,98 +71,9 @@ message _GenerateApiTokenRequest {
         Expires expires = 2;
     }
 
-    // Aliases for categories of functionality.
-    enum CacheRole {
-      CachePermitNone = 0;
-      // Restricts access to apis that read and write data from caches: No higher level resource description or modification.
-      CacheReadWrite = 1;
-      // Restricts access to apis that read from caches: No higher level resource description or modification.
-      CacheReadOnly = 2;
-      // Doesn't allow conditional write APIs (SetIfNotExists, IncreaseTTL etc)
-      CacheWriteOnly = 3;
-    }
-
-    // Aliases for categories of functionality.
-    enum TopicRole {
-      TopicPermitNone = 0;
-      // Restricts access to apis that read and write data from topics: No higher level resource description or modification.
-      TopicReadWrite = 1;
-      // Restricts access to apis that read from topics: No higher level resource description or modification.
-      TopicReadOnly = 2;
-      // Only publish allowed
-      TopicWriteOnly = 3;
-    }
-
     string auth_token = 3;
 
-    enum SuperUserPermissions {
-      SuperUser = 0;
-    }
-
-    message Permissions {
-      oneof kind {
-        SuperUserPermissions super_user = 1;
-        ExplicitPermissions explicit = 2;
-      }
-    }
-
-    message ExplicitPermissions {
-      repeated PermissionsType permissions = 1;
-    }
-
-    message PermissionsType {
-      oneof kind {
-        CachePermissions cache_permissions = 1;
-        TopicPermissions topic_permissions = 2;
-      }
-
-      message All {}
-
-      message CacheSelector {
-        oneof kind {
-          string cache_name = 1;
-        }
-      }
-
-      message CacheItemSelector {
-        oneof kind {
-          bytes key = 1;
-          bytes key_prefix = 2;
-        }
-      }
-
-      message CachePermissions {
-        CacheRole role = 1;
-        oneof cache {
-          All all_caches = 2;
-          CacheSelector cache_selector = 3;
-        }
-        oneof cache_item {
-          All all_items = 4;
-          CacheItemSelector item_selector = 5;
-        }
-      }
-
-      message TopicSelector {
-        oneof kind {
-          string topic_name = 1;
-        }
-      }
-
-      message TopicPermissions {
-        TopicRole role = 1;
-        oneof cache {
-          All all_caches = 2;
-          CacheSelector cache_selector = 3;
-        }
-        oneof topic {
-          All all_topics = 4;
-          TopicSelector topic_selector = 5;
-        }        
-      }
-    }
-
-    Permissions permissions = 4;
+  permissions.Permissions permissions = 4;
 }
 
 message _GenerateApiTokenResponse {

proto/permissions.proto

@@ -0,0 +1,96 @@
+syntax = "proto3";
+
+option go_package = "github.com/momentohq/client-sdk-go;client_sdk_go";
+option java_multiple_files = true;
+option java_package = "momento.shared.permissions";
+
+package permissions;
+
+// Aliases for categories of functionality.
+enum CacheRole {
+  CachePermitNone = 0;
+  // Restricts access to apis that read and write data from caches: No higher level resource description or modification.
+  CacheReadWrite = 1;
+  // Restricts access to apis that read from caches: No higher level resource description or modification.
+  CacheReadOnly = 2;
+  // Doesn't allow conditional write APIs (SetIfNotExists, IncreaseTTL etc)
+  CacheWriteOnly = 3;
+}
+
+// Aliases for categories of functionality.
+enum TopicRole {
+  TopicPermitNone = 0;
+  // Restricts access to apis that read and write data from topics: No higher level resource description or modification.
+  TopicReadWrite = 1;
+  // Restricts access to apis that read from topics: No higher level resource description or modification.
+  TopicReadOnly = 2;
+  // Only publish allowed
+  TopicWriteOnly = 3;
+}
+
+enum SuperUserPermissions {
+  SuperUser = 0;
+}
+
+message Permissions {
+  oneof kind {
+    SuperUserPermissions super_user = 1;
+    ExplicitPermissions explicit = 2;
+  }
+}
+
+message ExplicitPermissions {
+  repeated PermissionsType permissions = 1;
+}
+
+message PermissionsType {
+  oneof kind {
+    CachePermissions cache_permissions = 1;
+    TopicPermissions topic_permissions = 2;
+  }
+
+  message All {}
+
+  message CacheSelector {
+    oneof kind {
+      string cache_name = 1;
+    }
+  }
+
+  message CacheItemSelector {
+    oneof kind {
+      bytes key = 1;
+      bytes key_prefix = 2;
+    }
+  }
+
+  message CachePermissions {
+    CacheRole role = 1;
+    oneof cache {
+      All all_caches = 2;
+      CacheSelector cache_selector = 3;
+    }
+    oneof cache_item {
+      All all_items = 4;
+      CacheItemSelector item_selector = 5;
+    }
+  }
+
+  message TopicSelector {
+    oneof kind {
+      string topic_name = 1;
+    }
+  }
+
+  message TopicPermissions {
+    TopicRole role = 1;
+    oneof cache {
+      All all_caches = 2;
+      CacheSelector cache_selector = 3;
+    }
+    oneof topic {
+      All all_topics = 4;
+      TopicSelector topic_selector = 5;
+    }
+  }
+}

proto/token.proto

@@ -0,0 +1,35 @@
+syntax = "proto3";
+
+import "permissions.proto";
+
+option go_package = "github.com/momentohq/client-sdk-go;client_sdk_go";
+option java_multiple_files = true;
+option java_package = "momento.auth";
+
+package token;
+
+service Token {
+  rpc GenerateTempAuthToken (_GenerateTempAuthTokenRequest) returns (stream _GenerateTempAuthTokenResponse) {}
+}
+
+message _GenerateTempAuthTokenRequest {
+    // generate a token that has an expiry
+    message Expires {
+        // how many seconds do you want the api token to be valid for?
+        uint32 valid_for_seconds = 1;
+    }
+
+    Expires expires = 1;
+
+    permissions.Permissions permissions = 2;
+}
+
+message _GenerateTempAuthTokenResponse {
+  // the new api key used for authentication against Momento backend
+  string api_key = 1;
+  // the Momento endpoint that this token is allowed to make requests against
+  string endpoint = 2;
+  // epoch seconds when the api token expires
+  uint64 valid_until = 3;
+
+}

rust/momento-protos/src/lib.rs

@@ -1,7 +1,15 @@
+pub mod permissions {
+  include!("permissions.rs");
+}
+
 pub mod auth {
   include!("auth.rs");
 }
 
+pub mod token {
+  include!("token.rs");
+}
+
 pub mod cache_client {
   include!("cache_client.rs");
 

rust/proto_generator/build.rs

@@ -15,7 +15,9 @@ fn main() {
         .out_dir(out_dir)
         .compile(
             &[
+                format!("{proto_dir}/permissions.proto"),
                 format!("{proto_dir}/auth.proto"),
+                format!("{proto_dir}/token.proto"),
                 format!("{proto_dir}/cacheclient.proto"),
                 format!("{proto_dir}/cachepubsub.proto"),
                 format!("{proto_dir}/controlclient.proto"),