ory-hydra-client (empty) → 1.9.2
raw patch · 20 files changed
+10444/−0 lines, 20 filesdep +QuickCheckdep +aesondep +basesetup-changed
Dependencies added: QuickCheck, aeson, base, base64-bytestring, bytestring, case-insensitive, containers, deepseq, exceptions, hspec, http-api-data, http-client, http-client-tls, http-media, http-types, iso8601-time, katip, microlens, monad-logger, mtl, network, ory-hydra-client, random, safe-exceptions, semigroups, text, time, transformers, unordered-containers, vector
Files
- LICENSE +21/−0
- README.md +202/−0
- Setup.hs +2/−0
- lib/ORYHydra.hs +30/−0
- lib/ORYHydra/API/Admin.hs +757/−0
- lib/ORYHydra/API/Public.hs +242/−0
- lib/ORYHydra/Client.hs +217/−0
- lib/ORYHydra/Core.hs +563/−0
- lib/ORYHydra/Logging.hs +33/−0
- lib/ORYHydra/LoggingKatip.hs +118/−0
- lib/ORYHydra/LoggingMonadLogger.hs +127/−0
- lib/ORYHydra/MimeTypes.hs +203/−0
- lib/ORYHydra/Model.hs +2145/−0
- lib/ORYHydra/ModelLens.hs +1380/−0
- openapi.yaml +3493/−0
- ory-hydra-client.cabal +112/−0
- tests/ApproxEq.hs +81/−0
- tests/Instances.hs +607/−0
- tests/PropMime.hs +51/−0
- tests/Test.hs +60/−0
+ LICENSE view
@@ -0,0 +1,21 @@+MIT License++Copyright (c) 2021 Boris Lykah, Mercury++Permission is hereby granted, free of charge, to any person obtaining a copy+of this software and associated documentation files (the "Software"), to deal+in the Software without restriction, including without limitation the rights+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell+copies of the Software, and to permit persons to whom the Software is+furnished to do so, subject to the following conditions:++The above copyright notice and this permission notice shall be included in all+copies or substantial portions of the Software.++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE+SOFTWARE.
+ README.md view
@@ -0,0 +1,202 @@+## OpenAPI Auto-Generated [http-client](https://www.stackage.org/lts-10.0/package/http-client-0.5.7.1) Bindings to `ORY Hydra`++The library in `lib` provides auto-generated-from-OpenAPI [http-client](https://www.stackage.org/lts-10.0/package/http-client-0.5.7.1) bindings to the ORY Hydra API.++OpenApi Version: 3.0.1++## Installation++Installation follows the standard approach to installing Stack-based projects.++1. Install the [Haskell `stack` tool](http://docs.haskellstack.org/en/stable/README).+2. To build the package, and generate the documentation (recommended):+```+stack haddock+```+which will generate docs for this lib in the `docs` folder.++To generate the docs in the normal location (to enable hyperlinks to external libs), remove +```+build:+ haddock-arguments:+ haddock-args:+ - "--odir=./docs"+```+from the stack.yaml file and run `stack haddock` again.++3. To run unit tests:+```+stack test+```++## OpenAPI-Generator++The code generator that produced this library, and which explains how+to obtain and use the openapi-generator cli tool lives at++https://openapi-generator.tech++The _generator-name_ argument (`--generator-name`) passed to the cli tool used should be++```+haskell-http-client+```++### Unsupported OpenAPI Features++* Model Inheritance++This is beta software; other cases may not be supported.++### Codegen "additional properties" parameters++These options allow some customization of the code generation process.++**haskell-http-client additional properties:**++| OPTION | DESCRIPTION | DEFAULT | ACTUAL |+| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------- |+| allowFromJsonNulls | allow JSON Null during model decoding from JSON | true | true |+| allowNonUniqueOperationIds | allow *different* API modules to contain the same operationId. Each API must be imported qualified | false | true |+| allowToJsonNulls | allow emitting JSON Null during model encoding to JSON | false | false |+| baseModule | Set the base module namespace | | ORYHydra |+| cabalPackage | Set the cabal package name, which consists of one or more alphanumeric words separated by hyphens | | ory-hydra-client |+| cabalVersion | Set the cabal version number, consisting of a sequence of one or more integers separated by dots | 0.1.0.0 | 0.1.0.0 |+| customTestInstanceModule | test module used to provide typeclass instances for types not known by the generator | | |+| configType | Set the name of the type used for configuration | | ORYHydraConfig |+| dateFormat | format string used to parse/render a date | %Y-%m-%d | %Y-%m-%d |+| dateTimeFormat | format string used to parse/render a datetime. (Defaults to [formatISO8601Millis][1] when not provided) | | |+| dateTimeParseFormat | overrides the format string used to parse a datetime | | |+| generateEnums | Generate specific datatypes for OpenAPI enums | true | true |+| generateFormUrlEncodedInstances | Generate FromForm/ToForm instances for models used by x-www-form-urlencoded operations (model fields must be primitive types) | true | true |+| generateLenses | Generate Lens optics for Models | true | true |+| generateModelConstructors | Generate smart constructors (only supply required fields) for models | true | true |+| inlineMimeTypes | Inline (hardcode) the content-type and accept parameters on operations, when there is only 1 option | true | true |+| modelDeriving | Additional classes to include in the deriving() clause of Models | | |+| requestType | Set the name of the type used to generate requests | | ORYHydraRequest |+| strictFields | Add strictness annotations to all model fields | true | false |+| useKatip | Sets the default value for the UseKatip cabal flag. If true, the katip package provides logging instead of monad-logger | true | true |++[1]: https://www.stackage.org/haddock/lts-9.0/iso8601-time-0.1.4/Data-Time-ISO8601.html#v:formatISO8601Millis++An example setting _dateTimeFormat_ and _strictFields_:++```+java -jar openapi-generator-cli.jar generate -i petstore.yaml -g haskell-http-client -o output/haskell-http-client --additional-properties=dateTimeFormat="%Y-%m-%dT%H:%M:%S%Q%z" --additional-properties=strictFields=false +```++View the full list of Codegen "config option" parameters with the command:++```+java -jar openapi-generator-cli.jar config-help -g haskell-http-client+```++## Usage Notes++### Example Petstore Haddock documentation++An example of the generated haddock documentation targeting the server http://petstore.swagger.io/ (Petstore) can be found [here][2]++[2]: https://hackage.haskell.org/package/swagger-petstore++### Example Petstore App++An example application using the auto-generated haskell-http-client bindings for the server http://petstore.swagger.io/ can be found [here][3]++[3]: https://github.com/openapitools/openapi-generator/tree/master/samples/client/petstore/haskell-http-client/example-app++This library is intended to be imported qualified.++### Modules++| MODULE | NOTES |+| ------------------- | --------------------------------------------------- |+| ORYHydra.Client | use the "dispatch" functions to send requests |+| ORYHydra.Core | core funcions, config and request types |+| ORYHydra.API | construct api requests |+| ORYHydra.Model | describes api models |+| ORYHydra.MimeTypes | encoding/decoding MIME types (content-types/accept) |+| ORYHydra.ModelLens | lenses for model fields |+| ORYHydra.Logging | logging functions and utils |+++### MimeTypes++This library adds type safety around what OpenAPI specifies as+Produces and Consumes for each Operation (e.g. the list of MIME types an+Operation can Produce (using 'accept' headers) and Consume (using 'content-type' headers).++For example, if there is an Operation named _addFoo_, there will be a+data type generated named _AddFoo_ (note the capitalization), which+describes additional constraints and actions on the _addFoo_ operation+via its typeclass instances. These typeclass instances can be viewed+in GHCi or via the Haddocks.++* required parameters are included as function arguments to _addFoo_+* optional non-body parameters are included by using `applyOptionalParam`+* optional body parameters are set by using `setBodyParam`++Example code generated for pretend _addFoo_ operation: ++```haskell+data AddFoo +instance Consumes AddFoo MimeJSON+instance Produces AddFoo MimeJSON+instance Produces AddFoo MimeXML+instance HasBodyParam AddFoo FooModel+instance HasOptionalParam AddFoo FooName+instance HasOptionalParam AddFoo FooId+```++this would indicate that:++* the _addFoo_ operation can consume JSON+* the _addFoo_ operation produces JSON or XML, depending on the argument passed to the dispatch function+* the _addFoo_ operation can set it's body param of _FooModel_ via `setBodyParam`+* the _addFoo_ operation can set 2 different optional parameters via `applyOptionalParam`++If the OpenAPI spec doesn't declare it can accept or produce a certain+MIME type for a given Operation, you should either add a Produces or+Consumes instance for the desired MIME types (assuming the server+supports it), use `dispatchLbsUnsafe` or modify the OpenAPI spec and+run the generator again.++New MIME type instances can be added via MimeType/MimeRender/MimeUnrender++Only JSON instances are generated by default, and in some case+x-www-form-urlencoded instances (FromFrom, ToForm) will also be+generated if the model fields are primitive types, and there are+Operations using x-www-form-urlencoded which use those models.++### Authentication++A haskell data type will be generated for each OpenAPI authentication type.++If for example the AuthMethod `AuthOAuthFoo` is generated for OAuth operations, then+`addAuthMethod` should be used to add the AuthMethod config.++When a request is dispatched, if a matching auth method is found in+the config, it will be applied to the request.++### Example++```haskell+mgr <- newManager defaultManagerSettings+config0 <- withStdoutLogging =<< newConfig +let config = config0+ `addAuthMethod` AuthOAuthFoo "secret-key"++let addFooRequest = + addFoo + (ContentType MimeJSON) + (Accept MimeXML) + (ParamBar paramBar)+ (ParamQux paramQux)+ modelBaz+ `applyOptionalParam` FooId 1+ `applyOptionalParam` FooName "name"+ `setHeader` [("qux_header","xxyy")]+addFooResult <- dispatchMime mgr config addFooRequest+```++See the example app and the haddocks for details.
+ Setup.hs view
@@ -0,0 +1,2 @@+import Distribution.Simple+main = defaultMain
+ lib/ORYHydra.hs view
@@ -0,0 +1,30 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra+-}++module ORYHydra+ ( module ORYHydra.Client+ , module ORYHydra.Core+ , module ORYHydra.Logging+ , module ORYHydra.MimeTypes+ , module ORYHydra.Model+ , module ORYHydra.ModelLens+ ) where+++import ORYHydra.Client+import ORYHydra.Core+import ORYHydra.Logging+import ORYHydra.MimeTypes+import ORYHydra.Model+import ORYHydra.ModelLens
+ lib/ORYHydra/API/Admin.hs view
@@ -0,0 +1,757 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.API.Admin+-}++{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE FlexibleInstances #-}+{-# LANGUAGE MonoLocalBinds #-}+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE OverloadedStrings #-}+{-# OPTIONS_GHC -fno-warn-name-shadowing -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.API.Admin where++import ORYHydra.Core+import ORYHydra.MimeTypes+import ORYHydra.Model as M++import qualified Data.Aeson as A+import qualified Data.ByteString as B+import qualified Data.ByteString.Lazy as BL+import qualified Data.Data as P (Typeable, TypeRep, typeOf, typeRep)+import qualified Data.Foldable as P+import qualified Data.Map as Map+import qualified Data.Maybe as P+import qualified Data.Proxy as P (Proxy(..))+import qualified Data.Set as Set+import qualified Data.String as P+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Data.Text.Lazy as TL+import qualified Data.Text.Lazy.Encoding as TL+import qualified Data.Time as TI+import qualified Network.HTTP.Client.MultipartFormData as NH+import qualified Network.HTTP.Media as ME+import qualified Network.HTTP.Types as NH+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH++import Data.Text (Text)+import GHC.Base ((<|>))++import Prelude ((==),(/=),($), (.),(<$>),(<*>),(>>=),Maybe(..),Bool(..),Char,Double,FilePath,Float,Int,Integer,String,fmap,undefined,mempty,maybe,pure,Monad,Applicative,Functor)+import qualified Prelude as P++-- * Operations+++-- ** Admin++-- *** acceptConsentRequest0++-- | @PUT \/oauth2\/auth\/requests\/consent\/accept@+-- +-- Accept a Consent Request+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf. The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope (\"Application my-dropbox-app wants write access to all your private files\"). The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request. This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider includes additional information, such as session data for access and ID tokens, and if the consent request should be used as basis for future requests. The response contains a redirect URL which the consent provider should redirect the user-agent to.+-- +acceptConsentRequest0 + :: (Consumes AcceptConsentRequest0 MimeJSON)+ => ConsentChallenge -- ^ "consentChallenge"+ -> ORYHydraRequest AcceptConsentRequest0 MimeJSON CompletedRequest MimeJSON+acceptConsentRequest0 (ConsentChallenge consentChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/consent/accept"]+ `addQuery` toQuery ("consent_challenge", Just consentChallenge)++data AcceptConsentRequest0 +instance HasBodyParam AcceptConsentRequest0 AcceptConsentRequest ++-- | @application/json@+instance Consumes AcceptConsentRequest0 MimeJSON++-- | @application/json@+instance Produces AcceptConsentRequest0 MimeJSON+++-- *** acceptLoginRequest0++-- | @PUT \/oauth2\/auth\/requests\/login\/accept@+-- +-- Accept a Login Request+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called \"identity provider\") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate (\"show the subject a login screen\") a subject (in OAuth2 the proper name for subject is \"resource owner\"). The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process. This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting a cookie. The response contains a redirect URL which the login provider should redirect the user-agent to.+-- +acceptLoginRequest0 + :: (Consumes AcceptLoginRequest0 MimeJSON)+ => LoginChallenge -- ^ "loginChallenge"+ -> ORYHydraRequest AcceptLoginRequest0 MimeJSON CompletedRequest MimeJSON+acceptLoginRequest0 (LoginChallenge loginChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/login/accept"]+ `addQuery` toQuery ("login_challenge", Just loginChallenge)++data AcceptLoginRequest0 +instance HasBodyParam AcceptLoginRequest0 AcceptLoginRequest ++-- | @application/json@+instance Consumes AcceptLoginRequest0 MimeJSON++-- | @application/json@+instance Produces AcceptLoginRequest0 MimeJSON+++-- *** acceptLogoutRequest++-- | @PUT \/oauth2\/auth\/requests\/logout\/accept@+-- +-- Accept a Logout Request+-- +-- When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request. No body is required. The response contains a redirect URL which the consent provider should redirect the user-agent to.+-- +acceptLogoutRequest + :: LogoutChallenge -- ^ "logoutChallenge"+ -> ORYHydraRequest AcceptLogoutRequest MimeNoContent CompletedRequest MimeJSON+acceptLogoutRequest (LogoutChallenge logoutChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/logout/accept"]+ `addQuery` toQuery ("logout_challenge", Just logoutChallenge)++data AcceptLogoutRequest +-- | @application/json@+instance Produces AcceptLogoutRequest MimeJSON+++-- *** createJsonWebKeySet++-- | @POST \/keys\/{set}@+-- +-- Generate a New JSON Web Key+-- +-- This endpoint is capable of generating JSON Web Key Sets for you. There a different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +createJsonWebKeySet + :: (Consumes CreateJsonWebKeySet MimeJSON)+ => Set -- ^ "set" - The set+ -> ORYHydraRequest CreateJsonWebKeySet MimeJSON JSONWebKeySet MimeJSON+createJsonWebKeySet (Set set) =+ _mkRequest "POST" ["/keys/",toPath set]++data CreateJsonWebKeySet +instance HasBodyParam CreateJsonWebKeySet JsonWebKeySetGeneratorRequest ++-- | @application/json@+instance Consumes CreateJsonWebKeySet MimeJSON++-- | @application/json@+instance Produces CreateJsonWebKeySet MimeJSON+++-- *** createOAuth2Client++-- | @POST \/clients@+-- +-- Create an OAuth 2.0 Client+-- +-- Create a new OAuth 2.0 client If you pass `client_secret` the secret will be used, otherwise a random secret will be generated. The secret will be returned in the response and you will not be able to retrieve it later on. Write the secret down and keep it somwhere safe. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+-- +createOAuth2Client + :: (Consumes CreateOAuth2Client MimeJSON, MimeRender MimeJSON OAuth2Client)+ => OAuth2Client -- ^ "body"+ -> ORYHydraRequest CreateOAuth2Client MimeJSON OAuth2Client MimeJSON+createOAuth2Client body =+ _mkRequest "POST" ["/clients"]+ `setBodyParam` body++data CreateOAuth2Client +instance HasBodyParam CreateOAuth2Client OAuth2Client ++-- | @application/json@+instance Consumes CreateOAuth2Client MimeJSON++-- | @application/json@+instance Produces CreateOAuth2Client MimeJSON+++-- *** deleteJsonWebKey++-- | @DELETE \/keys\/{set}\/{kid}@+-- +-- Delete a JSON Web Key+-- +-- Use this endpoint to delete a single JSON Web Key. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +deleteJsonWebKey + :: Kid -- ^ "kid" - The kid of the desired key+ -> Set -- ^ "set" - The set+ -> ORYHydraRequest DeleteJsonWebKey MimeNoContent res MimeJSON+deleteJsonWebKey (Kid kid) (Set set) =+ _mkRequest "DELETE" ["/keys/",toPath set,"/",toPath kid]++data DeleteJsonWebKey +-- | @application/json@+instance Produces DeleteJsonWebKey MimeJSON+++-- *** deleteJsonWebKeySet++-- | @DELETE \/keys\/{set}@+-- +-- Delete a JSON Web Key Set+-- +-- Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +deleteJsonWebKeySet + :: Set -- ^ "set" - The set+ -> ORYHydraRequest DeleteJsonWebKeySet MimeNoContent res MimeJSON+deleteJsonWebKeySet (Set set) =+ _mkRequest "DELETE" ["/keys/",toPath set]++data DeleteJsonWebKeySet +-- | @application/json@+instance Produces DeleteJsonWebKeySet MimeJSON+++-- *** deleteOAuth2Client++-- | @DELETE \/clients\/{id}@+-- +-- Deletes an OAuth 2.0 Client+-- +-- Delete an existing OAuth 2.0 Client by its ID. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +deleteOAuth2Client + :: Id -- ^ "id" - The id of the OAuth 2.0 Client.+ -> ORYHydraRequest DeleteOAuth2Client MimeNoContent res MimeJSON+deleteOAuth2Client (Id id) =+ _mkRequest "DELETE" ["/clients/",toPath id]++data DeleteOAuth2Client +-- | @application/json@+instance Produces DeleteOAuth2Client MimeJSON+++-- *** deleteOAuth2Token++-- | @DELETE \/oauth2\/tokens@+-- +-- Delete OAuth2 Access Tokens from a Client+-- +-- This endpoint deletes OAuth2 access tokens issued for a client from the database+-- +-- Note: Has 'Produces' instances, but no response schema+-- +deleteOAuth2Token + :: ClientId -- ^ "clientId"+ -> ORYHydraRequest DeleteOAuth2Token MimeNoContent res MimeJSON+deleteOAuth2Token (ClientId clientId) =+ _mkRequest "DELETE" ["/oauth2/tokens"]+ `addQuery` toQuery ("client_id", Just clientId)++data DeleteOAuth2Token +-- | @application/json@+instance Produces DeleteOAuth2Token MimeJSON+++-- *** flushInactiveOAuth2Tokens++-- | @POST \/oauth2\/flush@+-- +-- Flush Expired OAuth2 Access Tokens+-- +-- This endpoint flushes expired OAuth2 access tokens from the database. You can set a time after which no tokens will be not be touched, in case you want to keep recent tokens for auditing. Refresh tokens can not be flushed as they are deleted automatically when performing the refresh flow.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +flushInactiveOAuth2Tokens + :: (Consumes FlushInactiveOAuth2Tokens MimeJSON)+ => ORYHydraRequest FlushInactiveOAuth2Tokens MimeJSON res MimeJSON+flushInactiveOAuth2Tokens =+ _mkRequest "POST" ["/oauth2/flush"]++data FlushInactiveOAuth2Tokens +instance HasBodyParam FlushInactiveOAuth2Tokens FlushInactiveOAuth2TokensRequest ++-- | @application/json@+instance Consumes FlushInactiveOAuth2Tokens MimeJSON++-- | @application/json@+instance Produces FlushInactiveOAuth2Tokens MimeJSON+++-- *** getConsentRequest++-- | @GET \/oauth2\/auth\/requests\/consent@+-- +-- Get Consent Request Information+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf. The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope (\"Application my-dropbox-app wants write access to all your private files\"). The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request.+-- +getConsentRequest + :: ConsentChallenge -- ^ "consentChallenge"+ -> ORYHydraRequest GetConsentRequest MimeNoContent ConsentRequest MimeJSON+getConsentRequest (ConsentChallenge consentChallenge) =+ _mkRequest "GET" ["/oauth2/auth/requests/consent"]+ `addQuery` toQuery ("consent_challenge", Just consentChallenge)++data GetConsentRequest +-- | @application/json@+instance Produces GetConsentRequest MimeJSON+++-- *** getJsonWebKey++-- | @GET \/keys\/{set}\/{kid}@+-- +-- Fetch a JSON Web Key+-- +-- This endpoint returns a singular JSON Web Key, identified by the set and the specific key ID (kid).+-- +getJsonWebKey + :: Kid -- ^ "kid" - The kid of the desired key+ -> Set -- ^ "set" - The set+ -> ORYHydraRequest GetJsonWebKey MimeNoContent JSONWebKeySet MimeJSON+getJsonWebKey (Kid kid) (Set set) =+ _mkRequest "GET" ["/keys/",toPath set,"/",toPath kid]++data GetJsonWebKey +-- | @application/json@+instance Produces GetJsonWebKey MimeJSON+++-- *** getJsonWebKeySet++-- | @GET \/keys\/{set}@+-- +-- Retrieve a JSON Web Key Set+-- +-- This endpoint can be used to retrieve JWK Sets stored in ORY Hydra. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +getJsonWebKeySet + :: Set -- ^ "set" - The set+ -> ORYHydraRequest GetJsonWebKeySet MimeNoContent JSONWebKeySet MimeJSON+getJsonWebKeySet (Set set) =+ _mkRequest "GET" ["/keys/",toPath set]++data GetJsonWebKeySet +-- | @application/json@+instance Produces GetJsonWebKeySet MimeJSON+++-- *** getLoginRequest++-- | @GET \/oauth2\/auth\/requests\/login@+-- +-- Get a Login Request+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called \"identity provider\") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate (\"show the subject a login screen\") a subject (in OAuth2 the proper name for subject is \"resource owner\"). The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.+-- +getLoginRequest + :: LoginChallenge -- ^ "loginChallenge"+ -> ORYHydraRequest GetLoginRequest MimeNoContent LoginRequest MimeJSON+getLoginRequest (LoginChallenge loginChallenge) =+ _mkRequest "GET" ["/oauth2/auth/requests/login"]+ `addQuery` toQuery ("login_challenge", Just loginChallenge)++data GetLoginRequest +-- | @application/json@+instance Produces GetLoginRequest MimeJSON+++-- *** getLogoutRequest++-- | @GET \/oauth2\/auth\/requests\/logout@+-- +-- Get a Logout Request+-- +-- Use this endpoint to fetch a logout request.+-- +getLogoutRequest + :: LogoutChallenge -- ^ "logoutChallenge"+ -> ORYHydraRequest GetLogoutRequest MimeNoContent LogoutRequest MimeJSON+getLogoutRequest (LogoutChallenge logoutChallenge) =+ _mkRequest "GET" ["/oauth2/auth/requests/logout"]+ `addQuery` toQuery ("logout_challenge", Just logoutChallenge)++data GetLogoutRequest +-- | @application/json@+instance Produces GetLogoutRequest MimeJSON+++-- *** getOAuth2Client++-- | @GET \/clients\/{id}@+-- +-- Get an OAuth 2.0 Client.+-- +-- Get an OAUth 2.0 client by its ID. This endpoint never returns passwords. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+-- +getOAuth2Client + :: Id -- ^ "id" - The id of the OAuth 2.0 Client.+ -> ORYHydraRequest GetOAuth2Client MimeNoContent OAuth2Client MimeJSON+getOAuth2Client (Id id) =+ _mkRequest "GET" ["/clients/",toPath id]++data GetOAuth2Client +-- | @application/json@+instance Produces GetOAuth2Client MimeJSON+++-- *** getVersion++-- | @GET \/version@+-- +-- Get Service Version+-- +-- This endpoint returns the service version typically notated using semantic versioning. If the service supports TLS Edge Termination, this endpoint does not require the `X-Forwarded-Proto` header to be set.+-- +getVersion + :: ORYHydraRequest GetVersion MimeNoContent Version MimeJSON+getVersion =+ _mkRequest "GET" ["/version"]++data GetVersion +-- | @application/json@+instance Produces GetVersion MimeJSON+++-- *** introspectOAuth2Token++-- | @POST \/oauth2\/introspect@+-- +-- Introspect OAuth2 Tokens+-- +-- The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked. If a token is active, additional information on the token will be included. You can set additional data for a token by setting `accessTokenExtra` during the consent flow. For more information [read this blog post](https://www.oauth.com/oauth2-servers/token-introspection-endpoint/).+-- +introspectOAuth2Token + :: (Consumes IntrospectOAuth2Token MimeFormUrlEncoded)+ => Token -- ^ "token" - The string value of the token. For access tokens, this is the \\\"access_token\\\" value returned from the token endpoint defined in OAuth 2.0. For refresh tokens, this is the \\\"refresh_token\\\" value returned.+ -> ORYHydraRequest IntrospectOAuth2Token MimeFormUrlEncoded OAuth2TokenIntrospection MimeJSON+introspectOAuth2Token (Token token) =+ _mkRequest "POST" ["/oauth2/introspect"]+ `addForm` toForm ("token", token)++data IntrospectOAuth2Token ++-- | /Optional Param/ "scope" - An optional, space separated list of required scopes. If the access token was not granted one of the scopes, the result of active will be false.+instance HasOptionalParam IntrospectOAuth2Token Scope where+ applyOptionalParam req (Scope xs) =+ req `addForm` toForm ("scope", xs)++-- | @application/x-www-form-urlencoded@+instance Consumes IntrospectOAuth2Token MimeFormUrlEncoded++-- | @application/json@+instance Produces IntrospectOAuth2Token MimeJSON+++-- *** isInstanceAlive++-- | @GET \/health\/alive@+-- +-- Check Alive Status+-- +-- This endpoint returns a 200 status code when the HTTP server is up running. This status does currently not include checks whether the database connection is working. If the service supports TLS Edge Termination, this endpoint does not require the `X-Forwarded-Proto` header to be set. Be aware that if you are running multiple nodes of this service, the health status will never refer to the cluster state, only to a single instance.+-- +isInstanceAlive + :: ORYHydraRequest IsInstanceAlive MimeNoContent HealthStatus MimeJSON+isInstanceAlive =+ _mkRequest "GET" ["/health/alive"]++data IsInstanceAlive +-- | @application/json@+instance Produces IsInstanceAlive MimeJSON+++-- *** listOAuth2Clients++-- | @GET \/clients@+-- +-- List OAuth 2.0 Clients+-- +-- This endpoint lists all clients in the database, and never returns client secrets. As a default it lists the first 100 clients. The `limit` parameter can be used to retrieve more clients, but it has an upper bound at 500 objects. Pagination should be used to retrieve more than 500 objects. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components. The \"Link\" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/clients?limit={limit}&offset={offset}>; rel=\"{page}\"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'. Multiple links can be included in this header, and will be separated by a comma.+-- +listOAuth2Clients + :: ORYHydraRequest ListOAuth2Clients MimeNoContent [OAuth2Client] MimeJSON+listOAuth2Clients =+ _mkRequest "GET" ["/clients"]++data ListOAuth2Clients ++-- | /Optional Param/ "limit" - The maximum amount of policies returned, upper bound is 500 policies+instance HasOptionalParam ListOAuth2Clients Limit where+ applyOptionalParam req (Limit xs) =+ req `addQuery` toQuery ("limit", Just xs)++-- | /Optional Param/ "offset" - The offset from where to start looking.+instance HasOptionalParam ListOAuth2Clients Offset where+ applyOptionalParam req (Offset xs) =+ req `addQuery` toQuery ("offset", Just xs)+-- | @application/json@+instance Produces ListOAuth2Clients MimeJSON+++-- *** listSubjectConsentSessions++-- | @GET \/oauth2\/auth\/sessions\/consent@+-- +-- Lists All Consent Sessions of a Subject+-- +-- This endpoint lists all subject's granted consent sessions, including client and granted scope. If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an empty JSON array with status code 200 OK. The \"Link\" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel=\"{page}\"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'. Multiple links can be included in this header, and will be separated by a comma.+-- +listSubjectConsentSessions + :: Subject -- ^ "subject"+ -> ORYHydraRequest ListSubjectConsentSessions MimeNoContent [PreviousConsentSession] MimeJSON+listSubjectConsentSessions (Subject subject) =+ _mkRequest "GET" ["/oauth2/auth/sessions/consent"]+ `addQuery` toQuery ("subject", Just subject)++data ListSubjectConsentSessions +-- | @application/json@+instance Produces ListSubjectConsentSessions MimeJSON+++-- *** prometheus++-- | @GET \/metrics\/prometheus@+-- +-- Get Snapshot Metrics from the Hydra Service.+-- +-- If you're using k8s, you can then add annotations to your deployment like so: ``` metadata: annotations: prometheus.io/port: \"4445\" prometheus.io/path: \"/metrics/prometheus\" ``` If the service supports TLS Edge Termination, this endpoint does not require the `X-Forwarded-Proto` header to be set.+-- +prometheus + :: ORYHydraRequest Prometheus MimeNoContent NoContent MimeNoContent+prometheus =+ _mkRequest "GET" ["/metrics/prometheus"]++data Prometheus +instance Produces Prometheus MimeNoContent+++-- *** rejectConsentRequest++-- | @PUT \/oauth2\/auth\/requests\/consent\/reject@+-- +-- Reject a Consent Request+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf. The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to grant or deny the client access to the requested scope (\"Application my-dropbox-app wants write access to all your private files\"). The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted or rejected the request. This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf. The consent provider must include a reason why the consent was not granted. The response contains a redirect URL which the consent provider should redirect the user-agent to.+-- +rejectConsentRequest + :: (Consumes RejectConsentRequest MimeJSON)+ => ConsentChallenge -- ^ "consentChallenge"+ -> ORYHydraRequest RejectConsentRequest MimeJSON CompletedRequest MimeJSON+rejectConsentRequest (ConsentChallenge consentChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/consent/reject"]+ `addQuery` toQuery ("consent_challenge", Just consentChallenge)++data RejectConsentRequest +instance HasBodyParam RejectConsentRequest RejectRequest ++-- | @application/json@+instance Consumes RejectConsentRequest MimeJSON++-- | @application/json@+instance Produces RejectConsentRequest MimeJSON+++-- *** rejectLoginRequest++-- | @PUT \/oauth2\/auth\/requests\/login\/reject@+-- +-- Reject a Login Request+-- +-- When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider (sometimes called \"identity provider\") to authenticate the subject and then tell ORY Hydra now about it. The login provider is an web-app you write and host, and it must be able to authenticate (\"show the subject a login screen\") a subject (in OAuth2 the proper name for subject is \"resource owner\"). The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process. This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication was be denied. The response contains a redirect URL which the login provider should redirect the user-agent to.+-- +rejectLoginRequest + :: (Consumes RejectLoginRequest MimeJSON)+ => LoginChallenge -- ^ "loginChallenge"+ -> ORYHydraRequest RejectLoginRequest MimeJSON CompletedRequest MimeJSON+rejectLoginRequest (LoginChallenge loginChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/login/reject"]+ `addQuery` toQuery ("login_challenge", Just loginChallenge)++data RejectLoginRequest +instance HasBodyParam RejectLoginRequest RejectRequest ++-- | @application/json@+instance Consumes RejectLoginRequest MimeJSON++-- | @application/json@+instance Produces RejectLoginRequest MimeJSON+++-- *** rejectLogoutRequest++-- | @PUT \/oauth2\/auth\/requests\/logout\/reject@+-- +-- Reject a Logout Request+-- +-- When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request. No body is required. The response is empty as the logout provider has to chose what action to perform next.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +rejectLogoutRequest + :: (Consumes RejectLogoutRequest contentType)+ => ContentType contentType -- ^ request content-type ('MimeType')+ -> LogoutChallenge -- ^ "logoutChallenge"+ -> ORYHydraRequest RejectLogoutRequest contentType res MimeJSON+rejectLogoutRequest _ (LogoutChallenge logoutChallenge) =+ _mkRequest "PUT" ["/oauth2/auth/requests/logout/reject"]+ `addQuery` toQuery ("logout_challenge", Just logoutChallenge)++data RejectLogoutRequest +instance HasBodyParam RejectLogoutRequest RejectRequest ++-- | @application/json@+instance Consumes RejectLogoutRequest MimeJSON+-- | @application/x-www-form-urlencoded@+instance Consumes RejectLogoutRequest MimeFormUrlEncoded++-- | @application/json@+instance Produces RejectLogoutRequest MimeJSON+++-- *** revokeAuthenticationSession++-- | @DELETE \/oauth2\/auth\/sessions\/login@+-- +-- Invalidates All Login Sessions of a Certain User Invalidates a Subject's Authentication Session+-- +-- This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect Front- or Back-channel logout.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +revokeAuthenticationSession + :: Subject -- ^ "subject"+ -> ORYHydraRequest RevokeAuthenticationSession MimeNoContent res MimeJSON+revokeAuthenticationSession (Subject subject) =+ _mkRequest "DELETE" ["/oauth2/auth/sessions/login"]+ `addQuery` toQuery ("subject", Just subject)++data RevokeAuthenticationSession +-- | @application/json@+instance Produces RevokeAuthenticationSession MimeJSON+++-- *** revokeConsentSessions++-- | @DELETE \/oauth2\/auth\/sessions\/consent@+-- +-- Revokes Consent Sessions of a Subject for a Specific OAuth 2.0 Client+-- +-- This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all associated OAuth 2.0 Access Tokens.+-- +-- Note: Has 'Produces' instances, but no response schema+-- +revokeConsentSessions + :: Subject -- ^ "subject" - The subject (Subject) who's consent sessions should be deleted.+ -> ORYHydraRequest RevokeConsentSessions MimeNoContent res MimeJSON+revokeConsentSessions (Subject subject) =+ _mkRequest "DELETE" ["/oauth2/auth/sessions/consent"]+ `addQuery` toQuery ("subject", Just subject)++data RevokeConsentSessions ++-- | /Optional Param/ "client" - If set, deletes only those consent sessions by the Subject that have been granted to the specified OAuth 2.0 Client ID+instance HasOptionalParam RevokeConsentSessions Client where+ applyOptionalParam req (Client xs) =+ req `addQuery` toQuery ("client", Just xs)++-- | /Optional Param/ "all" - If set to `?all=true`, deletes all consent sessions by the Subject that have been granted.+instance HasOptionalParam RevokeConsentSessions All where+ applyOptionalParam req (All xs) =+ req `addQuery` toQuery ("all", Just xs)+-- | @application/json@+instance Produces RevokeConsentSessions MimeJSON+++-- *** updateJsonWebKey++-- | @PUT \/keys\/{set}\/{kid}@+-- +-- Update a JSON Web Key+-- +-- Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +updateJsonWebKey + :: (Consumes UpdateJsonWebKey MimeJSON)+ => Kid -- ^ "kid" - The kid of the desired key+ -> Set -- ^ "set" - The set+ -> ORYHydraRequest UpdateJsonWebKey MimeJSON JSONWebKey MimeJSON+updateJsonWebKey (Kid kid) (Set set) =+ _mkRequest "PUT" ["/keys/",toPath set,"/",toPath kid]++data UpdateJsonWebKey +instance HasBodyParam UpdateJsonWebKey JSONWebKey ++-- | @application/json@+instance Consumes UpdateJsonWebKey MimeJSON++-- | @application/json@+instance Produces UpdateJsonWebKey MimeJSON+++-- *** updateJsonWebKeySet++-- | @PUT \/keys\/{set}@+-- +-- Update a JSON Web Key Set+-- +-- Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own. A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+-- +updateJsonWebKeySet + :: (Consumes UpdateJsonWebKeySet MimeJSON)+ => Set -- ^ "set" - The set+ -> ORYHydraRequest UpdateJsonWebKeySet MimeJSON JSONWebKeySet MimeJSON+updateJsonWebKeySet (Set set) =+ _mkRequest "PUT" ["/keys/",toPath set]++data UpdateJsonWebKeySet +instance HasBodyParam UpdateJsonWebKeySet JSONWebKeySet ++-- | @application/json@+instance Consumes UpdateJsonWebKeySet MimeJSON++-- | @application/json@+instance Produces UpdateJsonWebKeySet MimeJSON+++-- *** updateOAuth2Client++-- | @PUT \/clients\/{id}@+-- +-- Update an OAuth 2.0 Client+-- +-- Update an existing OAuth 2.0 Client. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe. OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+-- +updateOAuth2Client + :: (Consumes UpdateOAuth2Client MimeJSON, MimeRender MimeJSON OAuth2Client)+ => OAuth2Client -- ^ "body"+ -> Id -- ^ "id"+ -> ORYHydraRequest UpdateOAuth2Client MimeJSON OAuth2Client MimeJSON+updateOAuth2Client body (Id id) =+ _mkRequest "PUT" ["/clients/",toPath id]+ `setBodyParam` body++data UpdateOAuth2Client +instance HasBodyParam UpdateOAuth2Client OAuth2Client ++-- | @application/json@+instance Consumes UpdateOAuth2Client MimeJSON++-- | @application/json@+instance Produces UpdateOAuth2Client MimeJSON+
+ lib/ORYHydra/API/Public.hs view
@@ -0,0 +1,242 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.API.Public+-}++{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE FlexibleInstances #-}+{-# LANGUAGE MonoLocalBinds #-}+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE OverloadedStrings #-}+{-# OPTIONS_GHC -fno-warn-name-shadowing -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.API.Public where++import ORYHydra.Core+import ORYHydra.MimeTypes+import ORYHydra.Model as M++import qualified Data.Aeson as A+import qualified Data.ByteString as B+import qualified Data.ByteString.Lazy as BL+import qualified Data.Data as P (Typeable, TypeRep, typeOf, typeRep)+import qualified Data.Foldable as P+import qualified Data.Map as Map+import qualified Data.Maybe as P+import qualified Data.Proxy as P (Proxy(..))+import qualified Data.Set as Set+import qualified Data.String as P+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Data.Text.Lazy as TL+import qualified Data.Text.Lazy.Encoding as TL+import qualified Data.Time as TI+import qualified Network.HTTP.Client.MultipartFormData as NH+import qualified Network.HTTP.Media as ME+import qualified Network.HTTP.Types as NH+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH++import Data.Text (Text)+import GHC.Base ((<|>))++import Prelude ((==),(/=),($), (.),(<$>),(<*>),(>>=),Maybe(..),Bool(..),Char,Double,FilePath,Float,Int,Integer,String,fmap,undefined,mempty,maybe,pure,Monad,Applicative,Functor)+import qualified Prelude as P++-- * Operations+++-- ** Public++-- *** disconnectUser++-- | @GET \/oauth2\/sessions\/logout@+-- +-- OpenID Connect Front-Backchannel Enabled Logout+-- +-- This endpoint initiates and completes user logout at ORY Hydra and initiates OpenID Connect Front-/Back-channel logout: https://openid.net/specs/openid-connect-frontchannel-1_0.html https://openid.net/specs/openid-connect-backchannel-1_0.html+-- +disconnectUser + :: ORYHydraRequest DisconnectUser MimeNoContent NoContent MimeNoContent+disconnectUser =+ _mkRequest "GET" ["/oauth2/sessions/logout"]++data DisconnectUser +instance Produces DisconnectUser MimeNoContent+++-- *** discoverOpenIDConfiguration++-- | @GET \/.well-known\/openid-configuration@+-- +-- OpenID Connect Discovery+-- +-- The well known endpoint an be used to retrieve information for OpenID Connect clients. We encourage you to not roll your own OpenID Connect client but to use an OpenID Connect client library instead. You can learn more on this flow at https://openid.net/specs/openid-connect-discovery-1_0.html . Popular libraries for OpenID Connect clients include oidc-client-js (JavaScript), go-oidc (Golang), and others. For a full list of clients go here: https://openid.net/developers/certified/+-- +discoverOpenIDConfiguration + :: ORYHydraRequest DiscoverOpenIDConfiguration MimeNoContent WellKnown MimeJSON+discoverOpenIDConfiguration =+ _mkRequest "GET" ["/.well-known/openid-configuration"]++data DiscoverOpenIDConfiguration +-- | @application/json@+instance Produces DiscoverOpenIDConfiguration MimeJSON+++-- *** isInstanceReady++-- | @GET \/health\/ready@+-- +-- Check Readiness Status+-- +-- This endpoint returns a 200 status code when the HTTP server is up running and the environment dependencies (e.g. the database) are responsive as well. If the service supports TLS Edge Termination, this endpoint does not require the `X-Forwarded-Proto` header to be set. Be aware that if you are running multiple nodes of this service, the health status will never refer to the cluster state, only to a single instance.+-- +isInstanceReady + :: ORYHydraRequest IsInstanceReady MimeNoContent HealthStatus MimeJSON+isInstanceReady =+ _mkRequest "GET" ["/health/ready"]++data IsInstanceReady +-- | @application/json@+instance Produces IsInstanceReady MimeJSON+++-- *** oauth2Token++-- | @POST \/oauth2\/token@+-- +-- The OAuth 2.0 Token Endpoint+-- +-- The client makes a request to the token endpoint by sending the following parameters using the \"application/x-www-form-urlencoded\" HTTP request entity-body. > Do not implement a client for this endpoint yourself. Use a library. There are many libraries > available for any programming language. You can find a list of libraries here: https://oauth.net/code/ > > Do note that Hydra SDK does not implement this endpoint properly. Use one of the libraries listed above!+-- +-- AuthMethod: 'AuthBasicBasic', 'AuthOAuthOauth2'+-- +oauth2Token + :: (Consumes Oauth2Token MimeFormUrlEncoded)+ => GrantType -- ^ "grantType"+ -> ORYHydraRequest Oauth2Token MimeFormUrlEncoded Oauth2TokenResponse MimeJSON+oauth2Token (GrantType grantType) =+ _mkRequest "POST" ["/oauth2/token"]+ `_hasAuthType` (P.Proxy :: P.Proxy AuthBasicBasic)+ `_hasAuthType` (P.Proxy :: P.Proxy AuthOAuthOauth2)+ `addForm` toForm ("grant_type", grantType)++data Oauth2Token +instance HasOptionalParam Oauth2Token Code where+ applyOptionalParam req (Code xs) =+ req `addForm` toForm ("code", xs)+instance HasOptionalParam Oauth2Token RefreshToken where+ applyOptionalParam req (RefreshToken xs) =+ req `addForm` toForm ("refresh_token", xs)+instance HasOptionalParam Oauth2Token RedirectUri where+ applyOptionalParam req (RedirectUri xs) =+ req `addForm` toForm ("redirect_uri", xs)+instance HasOptionalParam Oauth2Token ClientId where+ applyOptionalParam req (ClientId xs) =+ req `addForm` toForm ("client_id", xs)++-- | @application/x-www-form-urlencoded@+instance Consumes Oauth2Token MimeFormUrlEncoded++-- | @application/json@+instance Produces Oauth2Token MimeJSON+++-- *** oauthAuth++-- | @GET \/oauth2\/auth@+-- +-- The OAuth 2.0 Authorize Endpoint+-- +-- This endpoint is not documented here because you should never use your own implementation to perform OAuth2 flows. OAuth2 is a very popular protocol and a library for your programming language will exists. To learn more about this flow please refer to the specification: https://tools.ietf.org/html/rfc6749+-- +-- Note: Has 'Produces' instances, but no response schema+-- +oauthAuth + :: ORYHydraRequest OauthAuth MimeNoContent res MimeJSON+oauthAuth =+ _mkRequest "GET" ["/oauth2/auth"]++data OauthAuth +-- | @application/json@+instance Produces OauthAuth MimeJSON+++-- *** revokeOAuth2Token++-- | @POST \/oauth2\/revoke@+-- +-- Revoke OAuth2 Tokens+-- +-- Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token. Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by the client the token was generated for.+-- +-- AuthMethod: 'AuthBasicBasic', 'AuthOAuthOauth2'+-- +-- Note: Has 'Produces' instances, but no response schema+-- +revokeOAuth2Token + :: (Consumes RevokeOAuth2Token MimeFormUrlEncoded)+ => Token -- ^ "token"+ -> ORYHydraRequest RevokeOAuth2Token MimeFormUrlEncoded res MimeJSON+revokeOAuth2Token (Token token) =+ _mkRequest "POST" ["/oauth2/revoke"]+ `_hasAuthType` (P.Proxy :: P.Proxy AuthBasicBasic)+ `_hasAuthType` (P.Proxy :: P.Proxy AuthOAuthOauth2)+ `addForm` toForm ("token", token)++data RevokeOAuth2Token ++-- | @application/x-www-form-urlencoded@+instance Consumes RevokeOAuth2Token MimeFormUrlEncoded++-- | @application/json@+instance Produces RevokeOAuth2Token MimeJSON+++-- *** userinfo++-- | @GET \/userinfo@+-- +-- OpenID Connect Userinfo+-- +-- This endpoint returns the payload of the ID Token, including the idTokenExtra values, of the provided OAuth 2.0 Access Token. For more information please [refer to the spec](http://openid.net/specs/openid-connect-core-1_0.html#UserInfo).+-- +-- AuthMethod: 'AuthOAuthOauth2'+-- +userinfo + :: ORYHydraRequest Userinfo MimeNoContent UserinfoResponse MimeJSON+userinfo =+ _mkRequest "GET" ["/userinfo"]+ `_hasAuthType` (P.Proxy :: P.Proxy AuthOAuthOauth2)++data Userinfo +-- | @application/json@+instance Produces Userinfo MimeJSON+++-- *** wellKnown0++-- | @GET \/.well-known\/jwks.json@+-- +-- JSON Web Keys Discovery+-- +-- This endpoint returns JSON Web Keys to be used as public keys for verifying OpenID Connect ID Tokens and, if enabled, OAuth 2.0 JWT Access Tokens. This endpoint can be used with client libraries like [node-jwks-rsa](https://github.com/auth0/node-jwks-rsa) among others.+-- +wellKnown0 + :: ORYHydraRequest WellKnown0 MimeNoContent JSONWebKeySet MimeJSON+wellKnown0 =+ _mkRequest "GET" ["/.well-known/jwks.json"]++data WellKnown0 +-- | @application/json@+instance Produces WellKnown0 MimeJSON+
+ lib/ORYHydra/Client.hs view
@@ -0,0 +1,217 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.Client+-}++{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RankNTypes #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE ScopedTypeVariables #-}+{-# LANGUAGE DeriveFunctor #-}+{-# LANGUAGE DeriveFoldable #-}+{-# LANGUAGE DeriveTraversable #-}+{-# OPTIONS_GHC -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.Client where++import ORYHydra.Core+import ORYHydra.Logging+import ORYHydra.MimeTypes++import qualified Control.Exception.Safe as E+import qualified Control.Monad.IO.Class as P+import qualified Control.Monad as P+import qualified Data.Aeson.Types as A+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as BL+import qualified Data.ByteString.Lazy.Char8 as BCL+import qualified Data.Proxy as P (Proxy(..))+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Network.HTTP.Client as NH+import qualified Network.HTTP.Client.MultipartFormData as NH+import qualified Network.HTTP.Types as NH+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH++import Data.Function ((&))+import Data.Monoid ((<>))+import Data.Text (Text)+import GHC.Exts (IsString(..))++-- * Dispatch++-- ** Lbs++-- | send a request returning the raw http response+dispatchLbs+ :: (Produces req accept, MimeType contentType)+ => NH.Manager -- ^ http-client Connection manager+ -> ORYHydraConfig -- ^ config+ -> ORYHydraRequest req contentType res accept -- ^ request+ -> IO (NH.Response BCL.ByteString) -- ^ response+dispatchLbs manager config request = do+ initReq <- _toInitRequest config request+ dispatchInitUnsafe manager config initReq++-- ** Mime++-- | pair of decoded http body and http response+data MimeResult res =+ MimeResult { mimeResult :: Either MimeError res -- ^ decoded http body+ , mimeResultResponse :: NH.Response BCL.ByteString -- ^ http response + }+ deriving (Show, Functor, Foldable, Traversable)++-- | pair of unrender/parser error and http response+data MimeError =+ MimeError {+ mimeError :: String -- ^ unrender/parser error+ , mimeErrorResponse :: NH.Response BCL.ByteString -- ^ http response + } deriving (Eq, Show)++-- | send a request returning the 'MimeResult'+dispatchMime+ :: forall req contentType res accept. (Produces req accept, MimeUnrender accept res, MimeType contentType)+ => NH.Manager -- ^ http-client Connection manager+ -> ORYHydraConfig -- ^ config+ -> ORYHydraRequest req contentType res accept -- ^ request+ -> IO (MimeResult res) -- ^ response+dispatchMime manager config request = do+ httpResponse <- dispatchLbs manager config request+ let statusCode = NH.statusCode . NH.responseStatus $ httpResponse+ parsedResult <-+ runConfigLogWithExceptions "Client" config $+ do if (statusCode >= 400 && statusCode < 600)+ then do+ let s = "error statusCode: " ++ show statusCode+ _log "Client" levelError (T.pack s)+ pure (Left (MimeError s httpResponse))+ else case mimeUnrender (P.Proxy :: P.Proxy accept) (NH.responseBody httpResponse) of+ Left s -> do+ _log "Client" levelError (T.pack s)+ pure (Left (MimeError s httpResponse))+ Right r -> pure (Right r)+ return (MimeResult parsedResult httpResponse)++-- | like 'dispatchMime', but only returns the decoded http body+dispatchMime'+ :: (Produces req accept, MimeUnrender accept res, MimeType contentType)+ => NH.Manager -- ^ http-client Connection manager+ -> ORYHydraConfig -- ^ config+ -> ORYHydraRequest req contentType res accept -- ^ request+ -> IO (Either MimeError res) -- ^ response+dispatchMime' manager config request = do+ MimeResult parsedResult _ <- dispatchMime manager config request+ return parsedResult++-- ** Unsafe++-- | like 'dispatchReqLbs', but does not validate the operation is a 'Producer' of the "accept" 'MimeType'. (Useful if the server's response is undocumented)+dispatchLbsUnsafe+ :: (MimeType accept, MimeType contentType)+ => NH.Manager -- ^ http-client Connection manager+ -> ORYHydraConfig -- ^ config+ -> ORYHydraRequest req contentType res accept -- ^ request+ -> IO (NH.Response BCL.ByteString) -- ^ response+dispatchLbsUnsafe manager config request = do+ initReq <- _toInitRequest config request+ dispatchInitUnsafe manager config initReq++-- | dispatch an InitRequest+dispatchInitUnsafe+ :: NH.Manager -- ^ http-client Connection manager+ -> ORYHydraConfig -- ^ config+ -> InitRequest req contentType res accept -- ^ init request+ -> IO (NH.Response BCL.ByteString) -- ^ response+dispatchInitUnsafe manager config (InitRequest req) = do+ runConfigLogWithExceptions src config $+ do _log src levelInfo requestLogMsg+ _log src levelDebug requestDbgLogMsg+ res <- P.liftIO $ NH.httpLbs req manager+ _log src levelInfo (responseLogMsg res)+ _log src levelDebug ((T.pack . show) res)+ return res+ where+ src = "Client"+ endpoint =+ T.pack $+ BC.unpack $+ NH.method req <> " " <> NH.host req <> NH.path req <> NH.queryString req+ requestLogMsg = "REQ:" <> endpoint+ requestDbgLogMsg =+ "Headers=" <> (T.pack . show) (NH.requestHeaders req) <> " Body=" <>+ (case NH.requestBody req of+ NH.RequestBodyLBS xs -> T.decodeUtf8 (BL.toStrict xs)+ _ -> "<RequestBody>")+ responseStatusCode = (T.pack . show) . NH.statusCode . NH.responseStatus+ responseLogMsg res =+ "RES:statusCode=" <> responseStatusCode res <> " (" <> endpoint <> ")"++-- * InitRequest++-- | wraps an http-client 'Request' with request/response type parameters+newtype InitRequest req contentType res accept = InitRequest+ { unInitRequest :: NH.Request+ } deriving (Show)++-- | Build an http-client 'Request' record from the supplied config and request+_toInitRequest+ :: (MimeType accept, MimeType contentType)+ => ORYHydraConfig -- ^ config+ -> ORYHydraRequest req contentType res accept -- ^ request+ -> IO (InitRequest req contentType res accept) -- ^ initialized request+_toInitRequest config req0 = + runConfigLogWithExceptions "Client" config $ do+ parsedReq <- P.liftIO $ NH.parseRequest $ BCL.unpack $ BCL.append (configHost config) (BCL.concat (rUrlPath req0))+ req1 <- P.liftIO $ _applyAuthMethods req0 config+ P.when+ (configValidateAuthMethods config && (not . null . rAuthTypes) req1)+ (E.throw $ AuthMethodException $ "AuthMethod not configured: " <> (show . head . rAuthTypes) req1)+ let req2 = req1 & _setContentTypeHeader & _setAcceptHeader+ reqHeaders = ("User-Agent", WH.toHeader (configUserAgent config)) : paramsHeaders (rParams req2)+ reqQuery = NH.renderQuery True (paramsQuery (rParams req2))+ pReq = parsedReq { NH.method = (rMethod req2)+ , NH.requestHeaders = reqHeaders+ , NH.queryString = reqQuery+ }+ outReq <- case paramsBody (rParams req2) of+ ParamBodyNone -> pure (pReq { NH.requestBody = mempty })+ ParamBodyB bs -> pure (pReq { NH.requestBody = NH.RequestBodyBS bs })+ ParamBodyBL bl -> pure (pReq { NH.requestBody = NH.RequestBodyLBS bl })+ ParamBodyFormUrlEncoded form -> pure (pReq { NH.requestBody = NH.RequestBodyLBS (WH.urlEncodeForm form) })+ ParamBodyMultipartFormData parts -> NH.formDataBody parts pReq++ pure (InitRequest outReq)++-- | modify the underlying Request+modifyInitRequest :: InitRequest req contentType res accept -> (NH.Request -> NH.Request) -> InitRequest req contentType res accept+modifyInitRequest (InitRequest req) f = InitRequest (f req)++-- | modify the underlying Request (monadic)+modifyInitRequestM :: Monad m => InitRequest req contentType res accept -> (NH.Request -> m NH.Request) -> m (InitRequest req contentType res accept)+modifyInitRequestM (InitRequest req) f = fmap InitRequest (f req)++-- ** Logging ++-- | Run a block using the configured logger instance+runConfigLog+ :: P.MonadIO m+ => ORYHydraConfig -> LogExec m+runConfigLog config = configLogExecWithContext config (configLogContext config)++-- | Run a block using the configured logger instance (logs exceptions)+runConfigLogWithExceptions+ :: (E.MonadCatch m, P.MonadIO m)+ => T.Text -> ORYHydraConfig -> LogExec m+runConfigLogWithExceptions src config = runConfigLog config . logExceptions src
+ lib/ORYHydra/Core.hs view
@@ -0,0 +1,563 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.Core+-}++{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE ExistentialQuantification #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RankNTypes #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE ScopedTypeVariables #-}+{-# LANGUAGE TupleSections #-}+{-# LANGUAGE TypeFamilies #-}+{-# OPTIONS_GHC -fno-warn-name-shadowing -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.Core where++import ORYHydra.MimeTypes+import ORYHydra.Logging++import qualified Control.Arrow as P (left)+import qualified Control.DeepSeq as NF+import qualified Control.Exception.Safe as E+import qualified Data.Aeson as A+import qualified Data.ByteString as B+import qualified Data.ByteString.Base64.Lazy as BL64+import qualified Data.ByteString.Builder as BB+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as BL+import qualified Data.ByteString.Lazy.Char8 as BCL+import qualified Data.CaseInsensitive as CI+import qualified Data.Data as P (Data, Typeable, TypeRep, typeRep)+import qualified Data.Foldable as P+import qualified Data.Ix as P+import qualified Data.Maybe as P+import qualified Data.Proxy as P (Proxy(..))+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Data.Time as TI+import qualified Data.Time.ISO8601 as TI+import qualified GHC.Base as P (Alternative)+import qualified Lens.Micro as L+import qualified Network.HTTP.Client.MultipartFormData as NH+import qualified Network.HTTP.Types as NH+import qualified Prelude as P+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH+import qualified Text.Printf as T++import Control.Applicative ((<|>))+import Control.Applicative (Alternative)+import Control.Monad.Fail (MonadFail)+import Data.Function ((&))+import Data.Foldable(foldlM)+import Data.Monoid ((<>))+import Data.Text (Text)+import Prelude (($), (.), (<$>), (<*>), Maybe(..), Bool(..), Char, String, fmap, mempty, pure, return, show, IO, Monad, Functor)++-- * ORYHydraConfig++-- | +data ORYHydraConfig = ORYHydraConfig+ { configHost :: BCL.ByteString -- ^ host supplied in the Request+ , configUserAgent :: Text -- ^ user-agent supplied in the Request+ , configLogExecWithContext :: LogExecWithContext -- ^ Run a block using a Logger instance+ , configLogContext :: LogContext -- ^ Configures the logger+ , configAuthMethods :: [AnyAuthMethod] -- ^ List of configured auth methods+ , configValidateAuthMethods :: Bool -- ^ throw exceptions if auth methods are not configured+ }++-- | display the config+instance P.Show ORYHydraConfig where+ show c =+ T.printf+ "{ configHost = %v, configUserAgent = %v, ..}"+ (show (configHost c))+ (show (configUserAgent c))++-- | constructs a default ORYHydraConfig+--+-- configHost:+--+-- @http://localhost@+--+-- configUserAgent:+--+-- @"ory-hydra-client/0.1.0.0"@+--+newConfig :: IO ORYHydraConfig+newConfig = do+ logCxt <- initLogContext+ return $ ORYHydraConfig+ { configHost = "http://localhost"+ , configUserAgent = "ory-hydra-client/0.1.0.0"+ , configLogExecWithContext = runDefaultLogExecWithContext+ , configLogContext = logCxt+ , configAuthMethods = []+ , configValidateAuthMethods = True+ } ++-- | updates config use AuthMethod on matching requests+addAuthMethod :: AuthMethod auth => ORYHydraConfig -> auth -> ORYHydraConfig+addAuthMethod config@ORYHydraConfig {configAuthMethods = as} a =+ config { configAuthMethods = AnyAuthMethod a : as}++-- | updates the config to use stdout logging+withStdoutLogging :: ORYHydraConfig -> IO ORYHydraConfig+withStdoutLogging p = do+ logCxt <- stdoutLoggingContext (configLogContext p)+ return $ p { configLogExecWithContext = stdoutLoggingExec, configLogContext = logCxt }++-- | updates the config to use stderr logging+withStderrLogging :: ORYHydraConfig -> IO ORYHydraConfig+withStderrLogging p = do+ logCxt <- stderrLoggingContext (configLogContext p)+ return $ p { configLogExecWithContext = stderrLoggingExec, configLogContext = logCxt }++-- | updates the config to disable logging+withNoLogging :: ORYHydraConfig -> ORYHydraConfig+withNoLogging p = p { configLogExecWithContext = runNullLogExec}+ +-- * ORYHydraRequest++-- | Represents a request.+--+-- Type Variables:+--+-- * req - request operation+-- * contentType - 'MimeType' associated with request body+-- * res - response model+-- * accept - 'MimeType' associated with response body+data ORYHydraRequest req contentType res accept = ORYHydraRequest+ { rMethod :: NH.Method -- ^ Method of ORYHydraRequest+ , rUrlPath :: [BCL.ByteString] -- ^ Endpoint of ORYHydraRequest+ , rParams :: Params -- ^ params of ORYHydraRequest+ , rAuthTypes :: [P.TypeRep] -- ^ types of auth methods+ }+ deriving (P.Show)++-- | 'rMethod' Lens+rMethodL :: Lens_' (ORYHydraRequest req contentType res accept) NH.Method+rMethodL f ORYHydraRequest{..} = (\rMethod -> ORYHydraRequest { rMethod, ..} ) <$> f rMethod+{-# INLINE rMethodL #-}++-- | 'rUrlPath' Lens+rUrlPathL :: Lens_' (ORYHydraRequest req contentType res accept) [BCL.ByteString]+rUrlPathL f ORYHydraRequest{..} = (\rUrlPath -> ORYHydraRequest { rUrlPath, ..} ) <$> f rUrlPath+{-# INLINE rUrlPathL #-}++-- | 'rParams' Lens+rParamsL :: Lens_' (ORYHydraRequest req contentType res accept) Params+rParamsL f ORYHydraRequest{..} = (\rParams -> ORYHydraRequest { rParams, ..} ) <$> f rParams+{-# INLINE rParamsL #-}++-- | 'rParams' Lens+rAuthTypesL :: Lens_' (ORYHydraRequest req contentType res accept) [P.TypeRep]+rAuthTypesL f ORYHydraRequest{..} = (\rAuthTypes -> ORYHydraRequest { rAuthTypes, ..} ) <$> f rAuthTypes+{-# INLINE rAuthTypesL #-}++-- * HasBodyParam++-- | Designates the body parameter of a request+class HasBodyParam req param where+ setBodyParam :: forall contentType res accept. (Consumes req contentType, MimeRender contentType param) => ORYHydraRequest req contentType res accept -> param -> ORYHydraRequest req contentType res accept+ setBodyParam req xs =+ req `_setBodyLBS` mimeRender (P.Proxy :: P.Proxy contentType) xs & _setContentTypeHeader++-- * HasOptionalParam++-- | Designates the optional parameters of a request+class HasOptionalParam req param where+ {-# MINIMAL applyOptionalParam | (-&-) #-}++ -- | Apply an optional parameter to a request+ applyOptionalParam :: ORYHydraRequest req contentType res accept -> param -> ORYHydraRequest req contentType res accept+ applyOptionalParam = (-&-)+ {-# INLINE applyOptionalParam #-}++ -- | infix operator \/ alias for 'addOptionalParam'+ (-&-) :: ORYHydraRequest req contentType res accept -> param -> ORYHydraRequest req contentType res accept+ (-&-) = applyOptionalParam+ {-# INLINE (-&-) #-}++infixl 2 -&-++-- | Request Params+data Params = Params+ { paramsQuery :: NH.Query+ , paramsHeaders :: NH.RequestHeaders+ , paramsBody :: ParamBody+ }+ deriving (P.Show)++-- | 'paramsQuery' Lens+paramsQueryL :: Lens_' Params NH.Query+paramsQueryL f Params{..} = (\paramsQuery -> Params { paramsQuery, ..} ) <$> f paramsQuery+{-# INLINE paramsQueryL #-}++-- | 'paramsHeaders' Lens+paramsHeadersL :: Lens_' Params NH.RequestHeaders+paramsHeadersL f Params{..} = (\paramsHeaders -> Params { paramsHeaders, ..} ) <$> f paramsHeaders+{-# INLINE paramsHeadersL #-}++-- | 'paramsBody' Lens+paramsBodyL :: Lens_' Params ParamBody+paramsBodyL f Params{..} = (\paramsBody -> Params { paramsBody, ..} ) <$> f paramsBody+{-# INLINE paramsBodyL #-}++-- | Request Body+data ParamBody+ = ParamBodyNone+ | ParamBodyB B.ByteString+ | ParamBodyBL BL.ByteString+ | ParamBodyFormUrlEncoded WH.Form+ | ParamBodyMultipartFormData [NH.Part]+ deriving (P.Show)++-- ** ORYHydraRequest Utils++_mkRequest :: NH.Method -- ^ Method + -> [BCL.ByteString] -- ^ Endpoint+ -> ORYHydraRequest req contentType res accept -- ^ req: Request Type, res: Response Type+_mkRequest m u = ORYHydraRequest m u _mkParams []++_mkParams :: Params+_mkParams = Params [] [] ParamBodyNone++setHeader ::+ ORYHydraRequest req contentType res accept+ -> [NH.Header]+ -> ORYHydraRequest req contentType res accept+setHeader req header =+ req `removeHeader` P.fmap P.fst header+ & (`addHeader` header)++addHeader ::+ ORYHydraRequest req contentType res accept+ -> [NH.Header]+ -> ORYHydraRequest req contentType res accept+addHeader req header = L.over (rParamsL . paramsHeadersL) (header P.++) req++removeHeader :: ORYHydraRequest req contentType res accept -> [NH.HeaderName] -> ORYHydraRequest req contentType res accept+removeHeader req header =+ req &+ L.over+ (rParamsL . paramsHeadersL)+ (P.filter (\h -> cifst h `P.notElem` P.fmap CI.mk header))+ where+ cifst = CI.mk . P.fst+++_setContentTypeHeader :: forall req contentType res accept. MimeType contentType => ORYHydraRequest req contentType res accept -> ORYHydraRequest req contentType res accept+_setContentTypeHeader req =+ case mimeType (P.Proxy :: P.Proxy contentType) of + Just m -> req `setHeader` [("content-type", BC.pack $ P.show m)]+ Nothing -> req `removeHeader` ["content-type"]++_setAcceptHeader :: forall req contentType res accept. MimeType accept => ORYHydraRequest req contentType res accept -> ORYHydraRequest req contentType res accept+_setAcceptHeader req =+ case mimeType (P.Proxy :: P.Proxy accept) of + Just m -> req `setHeader` [("accept", BC.pack $ P.show m)]+ Nothing -> req `removeHeader` ["accept"]++setQuery ::+ ORYHydraRequest req contentType res accept+ -> [NH.QueryItem]+ -> ORYHydraRequest req contentType res accept+setQuery req query =+ req &+ L.over+ (rParamsL . paramsQueryL)+ (P.filter (\q -> cifst q `P.notElem` P.fmap cifst query)) &+ (`addQuery` query)+ where+ cifst = CI.mk . P.fst++addQuery ::+ ORYHydraRequest req contentType res accept+ -> [NH.QueryItem]+ -> ORYHydraRequest req contentType res accept+addQuery req query = req & L.over (rParamsL . paramsQueryL) (query P.++)++addForm :: ORYHydraRequest req contentType res accept -> WH.Form -> ORYHydraRequest req contentType res accept+addForm req newform = + let form = case paramsBody (rParams req) of+ ParamBodyFormUrlEncoded _form -> _form+ _ -> mempty+ in req & L.set (rParamsL . paramsBodyL) (ParamBodyFormUrlEncoded (newform <> form))++_addMultiFormPart :: ORYHydraRequest req contentType res accept -> NH.Part -> ORYHydraRequest req contentType res accept+_addMultiFormPart req newpart = + let parts = case paramsBody (rParams req) of+ ParamBodyMultipartFormData _parts -> _parts+ _ -> []+ in req & L.set (rParamsL . paramsBodyL) (ParamBodyMultipartFormData (newpart : parts))++_setBodyBS :: ORYHydraRequest req contentType res accept -> B.ByteString -> ORYHydraRequest req contentType res accept+_setBodyBS req body = + req & L.set (rParamsL . paramsBodyL) (ParamBodyB body)++_setBodyLBS :: ORYHydraRequest req contentType res accept -> BL.ByteString -> ORYHydraRequest req contentType res accept+_setBodyLBS req body = + req & L.set (rParamsL . paramsBodyL) (ParamBodyBL body)++_hasAuthType :: AuthMethod authMethod => ORYHydraRequest req contentType res accept -> P.Proxy authMethod -> ORYHydraRequest req contentType res accept+_hasAuthType req proxy =+ req & L.over rAuthTypesL (P.typeRep proxy :)++-- ** Params Utils++toPath+ :: WH.ToHttpApiData a+ => a -> BCL.ByteString+toPath = BB.toLazyByteString . WH.toEncodedUrlPiece++toHeader :: WH.ToHttpApiData a => (NH.HeaderName, a) -> [NH.Header]+toHeader x = [fmap WH.toHeader x]++toForm :: WH.ToHttpApiData v => (BC.ByteString, v) -> WH.Form+toForm (k,v) = WH.toForm [(BC.unpack k,v)]++toQuery :: WH.ToHttpApiData a => (BC.ByteString, Maybe a) -> [NH.QueryItem]+toQuery x = [(fmap . fmap) toQueryParam x]+ where toQueryParam = T.encodeUtf8 . WH.toQueryParam++-- *** OpenAPI `CollectionFormat` Utils++-- | Determines the format of the array if type array is used.+data CollectionFormat+ = CommaSeparated -- ^ CSV format for multiple parameters.+ | SpaceSeparated -- ^ Also called "SSV"+ | TabSeparated -- ^ Also called "TSV"+ | PipeSeparated -- ^ `value1|value2|value2`+ | MultiParamArray -- ^ Using multiple GET parameters, e.g. `foo=bar&foo=baz`. This is valid only for parameters in "query" ('NH.Query') or "formData" ('WH.Form')++toHeaderColl :: WH.ToHttpApiData a => CollectionFormat -> (NH.HeaderName, [a]) -> [NH.Header]+toHeaderColl c xs = _toColl c toHeader xs++toFormColl :: WH.ToHttpApiData v => CollectionFormat -> (BC.ByteString, [v]) -> WH.Form+toFormColl c xs = WH.toForm $ fmap unpack $ _toColl c toHeader $ pack xs+ where+ pack (k,v) = (CI.mk k, v)+ unpack (k,v) = (BC.unpack (CI.original k), BC.unpack v)++toQueryColl :: WH.ToHttpApiData a => CollectionFormat -> (BC.ByteString, Maybe [a]) -> NH.Query+toQueryColl c xs = _toCollA c toQuery xs++_toColl :: P.Traversable f => CollectionFormat -> (f a -> [(b, BC.ByteString)]) -> f [a] -> [(b, BC.ByteString)]+_toColl c encode xs = fmap (fmap P.fromJust) (_toCollA' c fencode BC.singleton (fmap Just xs))+ where fencode = fmap (fmap Just) . encode . fmap P.fromJust+ {-# INLINE fencode #-}++_toCollA :: (P.Traversable f, P.Traversable t, P.Alternative t) => CollectionFormat -> (f (t a) -> [(b, t BC.ByteString)]) -> f (t [a]) -> [(b, t BC.ByteString)]+_toCollA c encode xs = _toCollA' c encode BC.singleton xs++_toCollA' :: (P.Monoid c, P.Traversable f, P.Traversable t, P.Alternative t) => CollectionFormat -> (f (t a) -> [(b, t c)]) -> (Char -> c) -> f (t [a]) -> [(b, t c)]+_toCollA' c encode one xs = case c of+ CommaSeparated -> go (one ',')+ SpaceSeparated -> go (one ' ')+ TabSeparated -> go (one '\t')+ PipeSeparated -> go (one '|')+ MultiParamArray -> expandList+ where+ go sep =+ [P.foldl1 (\(sk, sv) (_, v) -> (sk, (combine sep <$> sv <*> v) <|> sv <|> v)) expandList]+ combine sep x y = x <> sep <> y+ expandList = (P.concatMap encode . (P.traverse . P.traverse) P.toList) xs+ {-# INLINE go #-}+ {-# INLINE expandList #-}+ {-# INLINE combine #-}+ +-- * AuthMethods++-- | Provides a method to apply auth methods to requests+class P.Typeable a =>+ AuthMethod a where+ applyAuthMethod+ :: ORYHydraConfig+ -> a+ -> ORYHydraRequest req contentType res accept+ -> IO (ORYHydraRequest req contentType res accept)++-- | An existential wrapper for any AuthMethod+data AnyAuthMethod = forall a. AuthMethod a => AnyAuthMethod a deriving (P.Typeable)++instance AuthMethod AnyAuthMethod where applyAuthMethod config (AnyAuthMethod a) req = applyAuthMethod config a req++-- | indicates exceptions related to AuthMethods+data AuthMethodException = AuthMethodException String deriving (P.Show, P.Typeable)++instance E.Exception AuthMethodException++-- | apply all matching AuthMethods in config to request+_applyAuthMethods+ :: ORYHydraRequest req contentType res accept+ -> ORYHydraConfig+ -> IO (ORYHydraRequest req contentType res accept)+_applyAuthMethods req config@(ORYHydraConfig {configAuthMethods = as}) =+ foldlM go req as+ where+ go r (AnyAuthMethod a) = applyAuthMethod config a r+ +-- * Utils++-- | Removes Null fields. (OpenAPI-Specification 2.0 does not allow Null in JSON)+_omitNulls :: [(Text, A.Value)] -> A.Value+_omitNulls = A.object . P.filter notNull+ where+ notNull (_, A.Null) = False+ notNull _ = True++-- | Encodes fields using WH.toQueryParam+_toFormItem :: (WH.ToHttpApiData a, Functor f) => t -> f a -> f (t, [Text])+_toFormItem name x = (name,) . (:[]) . WH.toQueryParam <$> x++-- | Collapse (Just "") to Nothing+_emptyToNothing :: Maybe String -> Maybe String+_emptyToNothing (Just "") = Nothing+_emptyToNothing x = x+{-# INLINE _emptyToNothing #-}++-- | Collapse (Just mempty) to Nothing+_memptyToNothing :: (P.Monoid a, P.Eq a) => Maybe a -> Maybe a+_memptyToNothing (Just x) | x P.== P.mempty = Nothing+_memptyToNothing x = x+{-# INLINE _memptyToNothing #-}++-- * DateTime Formatting++newtype DateTime = DateTime { unDateTime :: TI.UTCTime }+ deriving (P.Eq,P.Data,P.Ord,P.Typeable,NF.NFData)+instance A.FromJSON DateTime where+ parseJSON = A.withText "DateTime" (_readDateTime . T.unpack)+instance A.ToJSON DateTime where+ toJSON (DateTime t) = A.toJSON (_showDateTime t)+instance WH.FromHttpApiData DateTime where+ parseUrlPiece = P.maybe (P.Left "parseUrlPiece @DateTime") P.Right . _readDateTime . T.unpack+instance WH.ToHttpApiData DateTime where+ toUrlPiece (DateTime t) = T.pack (_showDateTime t)+instance P.Show DateTime where+ show (DateTime t) = _showDateTime t+instance MimeRender MimeMultipartFormData DateTime where+ mimeRender _ = mimeRenderDefaultMultipartFormData++-- | @_parseISO8601@+_readDateTime :: (MonadFail m, Alternative m) => String -> m DateTime+_readDateTime s =+ DateTime <$> _parseISO8601 s+{-# INLINE _readDateTime #-}++-- | @TI.formatISO8601Millis@+_showDateTime :: (t ~ TI.UTCTime, TI.FormatTime t) => t -> String+_showDateTime =+ TI.formatISO8601Millis+{-# INLINE _showDateTime #-}++-- | parse an ISO8601 date-time string+_parseISO8601 :: (TI.ParseTime t, MonadFail m, Alternative m) => String -> m t+_parseISO8601 t =+ P.asum $+ P.flip (TI.parseTimeM True TI.defaultTimeLocale) t <$>+ ["%FT%T%QZ", "%FT%T%Q%z", "%FT%T%Q%Z"]+{-# INLINE _parseISO8601 #-}++-- * Date Formatting++newtype Date = Date { unDate :: TI.Day }+ deriving (P.Enum,P.Eq,P.Data,P.Ord,P.Ix,NF.NFData)+instance A.FromJSON Date where+ parseJSON = A.withText "Date" (_readDate . T.unpack)+instance A.ToJSON Date where+ toJSON (Date t) = A.toJSON (_showDate t)+instance WH.FromHttpApiData Date where+ parseUrlPiece = P.maybe (P.Left "parseUrlPiece @Date") P.Right . _readDate . T.unpack+instance WH.ToHttpApiData Date where+ toUrlPiece (Date t) = T.pack (_showDate t)+instance P.Show Date where+ show (Date t) = _showDate t+instance MimeRender MimeMultipartFormData Date where+ mimeRender _ = mimeRenderDefaultMultipartFormData++-- | @TI.parseTimeM True TI.defaultTimeLocale "%Y-%m-%d"@+_readDate :: MonadFail m => String -> m Date+_readDate s = Date <$> TI.parseTimeM True TI.defaultTimeLocale "%Y-%m-%d" s+{-# INLINE _readDate #-}++-- | @TI.formatTime TI.defaultTimeLocale "%Y-%m-%d"@+_showDate :: TI.FormatTime t => t -> String+_showDate =+ TI.formatTime TI.defaultTimeLocale "%Y-%m-%d"+{-# INLINE _showDate #-}++-- * Byte/Binary Formatting++ +-- | base64 encoded characters+newtype ByteArray = ByteArray { unByteArray :: BL.ByteString }+ deriving (P.Eq,P.Data,P.Ord,P.Typeable,NF.NFData)++instance A.FromJSON ByteArray where+ parseJSON = A.withText "ByteArray" _readByteArray+instance A.ToJSON ByteArray where+ toJSON = A.toJSON . _showByteArray+instance WH.FromHttpApiData ByteArray where+ parseUrlPiece = P.maybe (P.Left "parseUrlPiece @ByteArray") P.Right . _readByteArray+instance WH.ToHttpApiData ByteArray where+ toUrlPiece = _showByteArray+instance P.Show ByteArray where+ show = T.unpack . _showByteArray+instance MimeRender MimeMultipartFormData ByteArray where+ mimeRender _ = mimeRenderDefaultMultipartFormData++-- | read base64 encoded characters+_readByteArray :: MonadFail m => Text -> m ByteArray+_readByteArray = P.either P.fail (pure . ByteArray) . BL64.decode . BL.fromStrict . T.encodeUtf8+{-# INLINE _readByteArray #-}++-- | show base64 encoded characters+_showByteArray :: ByteArray -> Text+_showByteArray = T.decodeUtf8 . BL.toStrict . BL64.encode . unByteArray+{-# INLINE _showByteArray #-}++-- | any sequence of octets+newtype Binary = Binary { unBinary :: BL.ByteString }+ deriving (P.Eq,P.Data,P.Ord,P.Typeable,NF.NFData)++instance A.FromJSON Binary where+ parseJSON = A.withText "Binary" _readBinaryBase64+instance A.ToJSON Binary where+ toJSON = A.toJSON . _showBinaryBase64+instance WH.FromHttpApiData Binary where+ parseUrlPiece = P.maybe (P.Left "parseUrlPiece @Binary") P.Right . _readBinaryBase64+instance WH.ToHttpApiData Binary where+ toUrlPiece = _showBinaryBase64+instance P.Show Binary where+ show = T.unpack . _showBinaryBase64+instance MimeRender MimeMultipartFormData Binary where+ mimeRender _ = unBinary++_readBinaryBase64 :: MonadFail m => Text -> m Binary+_readBinaryBase64 = P.either P.fail (pure . Binary) . BL64.decode . BL.fromStrict . T.encodeUtf8+{-# INLINE _readBinaryBase64 #-}++_showBinaryBase64 :: Binary -> Text+_showBinaryBase64 = T.decodeUtf8 . BL.toStrict . BL64.encode . unBinary+{-# INLINE _showBinaryBase64 #-}++-- * Lens Type Aliases++type Lens_' s a = Lens_ s s a a+type Lens_ s t a b = forall (f :: * -> *). Functor f => (a -> f b) -> s -> f t
+ lib/ORYHydra/Logging.hs view
@@ -0,0 +1,33 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.Logging+Logging functions+-}+{-# LANGUAGE CPP #-}++#ifdef USE_KATIP++module ORYHydra.Logging+ ( module ORYHydra.LoggingKatip+ ) where++import ORYHydra.LoggingKatip++#else++module ORYHydra.Logging+ ( module ORYHydra.LoggingMonadLogger+ ) where++import ORYHydra.LoggingMonadLogger++#endif
+ lib/ORYHydra/LoggingKatip.hs view
@@ -0,0 +1,118 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.LoggingKatip+Katip Logging functions+-}++{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RankNTypes #-}+{-# LANGUAGE ScopedTypeVariables #-}++module ORYHydra.LoggingKatip where++import qualified Control.Exception.Safe as E+import qualified Control.Monad.IO.Class as P+import qualified Control.Monad.Trans.Reader as P+import qualified Data.Text as T+import qualified Lens.Micro as L+import qualified System.IO as IO++import Data.Text (Text)+import GHC.Exts (IsString(..))++import qualified Katip as LG++-- * Type Aliases (for compatibility)++-- | Runs a Katip logging block with the Log environment+type LogExecWithContext = forall m. P.MonadIO m =>+ LogContext -> LogExec m++-- | A Katip logging block+type LogExec m = forall a. LG.KatipT m a -> m a++-- | A Katip Log environment+type LogContext = LG.LogEnv++-- | A Katip Log severity+type LogLevel = LG.Severity++-- * default logger++-- | the default log environment+initLogContext :: IO LogContext+initLogContext = LG.initLogEnv "ORYHydra" "dev"++-- | Runs a Katip logging block with the Log environment+runDefaultLogExecWithContext :: LogExecWithContext+runDefaultLogExecWithContext = LG.runKatipT++-- * stdout logger++-- | Runs a Katip logging block with the Log environment+stdoutLoggingExec :: LogExecWithContext+stdoutLoggingExec = runDefaultLogExecWithContext++-- | A Katip Log environment which targets stdout+stdoutLoggingContext :: LogContext -> IO LogContext+stdoutLoggingContext cxt = do+ handleScribe <- LG.mkHandleScribe LG.ColorIfTerminal IO.stdout (LG.permitItem LG.InfoS) LG.V2+ LG.registerScribe "stdout" handleScribe LG.defaultScribeSettings cxt++-- * stderr logger++-- | Runs a Katip logging block with the Log environment+stderrLoggingExec :: LogExecWithContext+stderrLoggingExec = runDefaultLogExecWithContext++-- | A Katip Log environment which targets stderr+stderrLoggingContext :: LogContext -> IO LogContext+stderrLoggingContext cxt = do+ handleScribe <- LG.mkHandleScribe LG.ColorIfTerminal IO.stderr (LG.permitItem LG.InfoS) LG.V2+ LG.registerScribe "stderr" handleScribe LG.defaultScribeSettings cxt++-- * Null logger++-- | Disables Katip logging+runNullLogExec :: LogExecWithContext+runNullLogExec le (LG.KatipT f) = P.runReaderT f (L.set LG.logEnvScribes mempty le)++-- * Log Msg++-- | Log a katip message+_log :: (Applicative m, LG.Katip m) => Text -> LogLevel -> Text -> m ()+_log src level msg = do+ LG.logMsg (fromString $ T.unpack src) level (LG.logStr msg)++-- * Log Exceptions++-- | re-throws exceptions after logging them+logExceptions+ :: (LG.Katip m, E.MonadCatch m, Applicative m)+ => Text -> m a -> m a+logExceptions src =+ E.handle+ (\(e :: E.SomeException) -> do+ _log src LG.ErrorS ((T.pack . show) e)+ E.throw e)++-- * Log Level++levelInfo :: LogLevel+levelInfo = LG.InfoS++levelError :: LogLevel+levelError = LG.ErrorS++levelDebug :: LogLevel+levelDebug = LG.DebugS+
+ lib/ORYHydra/LoggingMonadLogger.hs view
@@ -0,0 +1,127 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.LoggingMonadLogger+monad-logger Logging functions+-}++{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RankNTypes #-}+{-# LANGUAGE ScopedTypeVariables #-}++module ORYHydra.LoggingMonadLogger where++import qualified Control.Exception.Safe as E+import qualified Control.Monad.IO.Class as P+import qualified Data.Text as T+import qualified Data.Time as TI++import Data.Monoid ((<>))+import Data.Text (Text)++import qualified Control.Monad.Logger as LG++-- * Type Aliases (for compatibility)++-- | Runs a monad-logger block with the filter predicate+type LogExecWithContext = forall m. P.MonadIO m =>+ LogContext -> LogExec m++-- | A monad-logger block+type LogExec m = forall a. LG.LoggingT m a -> m a++-- | A monad-logger filter predicate+type LogContext = LG.LogSource -> LG.LogLevel -> Bool++-- | A monad-logger log level+type LogLevel = LG.LogLevel++-- * default logger++-- | the default log environment+initLogContext :: IO LogContext+initLogContext = pure infoLevelFilter++-- | Runs a monad-logger block with the filter predicate+runDefaultLogExecWithContext :: LogExecWithContext+runDefaultLogExecWithContext = runNullLogExec++-- * stdout logger++-- | Runs a monad-logger block targeting stdout, with the filter predicate+stdoutLoggingExec :: LogExecWithContext+stdoutLoggingExec cxt = LG.runStdoutLoggingT . LG.filterLogger cxt++-- | @pure@+stdoutLoggingContext :: LogContext -> IO LogContext+stdoutLoggingContext = pure++-- * stderr logger++-- | Runs a monad-logger block targeting stderr, with the filter predicate+stderrLoggingExec :: LogExecWithContext+stderrLoggingExec cxt = LG.runStderrLoggingT . LG.filterLogger cxt++-- | @pure@+stderrLoggingContext :: LogContext -> IO LogContext+stderrLoggingContext = pure++-- * Null logger++-- | Disables monad-logger logging+runNullLogExec :: LogExecWithContext+runNullLogExec = const (`LG.runLoggingT` nullLogger)++-- | monad-logger which does nothing+nullLogger :: LG.Loc -> LG.LogSource -> LG.LogLevel -> LG.LogStr -> IO ()+nullLogger _ _ _ _ = return ()++-- * Log Msg++-- | Log a message using the current time+_log :: (P.MonadIO m, LG.MonadLogger m) => Text -> LG.LogLevel -> Text -> m ()+_log src level msg = do+ now <- P.liftIO (formatTimeLog <$> TI.getCurrentTime)+ LG.logOtherNS ("ORYHydra." <> src) level ("[" <> now <> "] " <> msg)+ where+ formatTimeLog =+ T.pack . TI.formatTime TI.defaultTimeLocale "%Y-%m-%dT%H:%M:%S%Z"++-- * Log Exceptions++-- | re-throws exceptions after logging them+logExceptions+ :: (LG.MonadLogger m, E.MonadCatch m, P.MonadIO m)+ => Text -> m a -> m a+logExceptions src =+ E.handle+ (\(e :: E.SomeException) -> do+ _log src LG.LevelError ((T.pack . show) e)+ E.throw e)++-- * Log Level++levelInfo :: LogLevel+levelInfo = LG.LevelInfo++levelError :: LogLevel+levelError = LG.LevelError++levelDebug :: LogLevel+levelDebug = LG.LevelDebug++-- * Level Filter++minLevelFilter :: LG.LogLevel -> LG.LogSource -> LG.LogLevel -> Bool+minLevelFilter l _ l' = l' >= l++infoLevelFilter :: LG.LogSource -> LG.LogLevel -> Bool+infoLevelFilter = minLevelFilter LG.LevelInfo
+ lib/ORYHydra/MimeTypes.hs view
@@ -0,0 +1,203 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.MimeTypes+-}++{-# LANGUAGE ConstraintKinds #-}+{-# LANGUAGE ExistentialQuantification #-}+{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE FlexibleInstances #-}+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ScopedTypeVariables #-}+{-# OPTIONS_GHC -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.MimeTypes where++import qualified Control.Arrow as P (left)+import qualified Data.Aeson as A+import qualified Data.ByteString as B+import qualified Data.ByteString.Builder as BB+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as BL+import qualified Data.ByteString.Lazy.Char8 as BCL+import qualified Data.Data as P (Typeable)+import qualified Data.Proxy as P (Proxy(..))+import qualified Data.String as P+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Network.HTTP.Media as ME+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH++import Prelude (($), (.),(<$>),(<*>),Maybe(..),Bool(..),Char,Double,FilePath,Float,Int,Integer,String,fmap,undefined,mempty)+import qualified Prelude as P++-- * ContentType MimeType++data ContentType a = MimeType a => ContentType { unContentType :: a }++-- * Accept MimeType++data Accept a = MimeType a => Accept { unAccept :: a }++-- * Consumes Class++class MimeType mtype => Consumes req mtype where++-- * Produces Class++class MimeType mtype => Produces req mtype where++-- * Default Mime Types++data MimeJSON = MimeJSON deriving (P.Typeable)+data MimeXML = MimeXML deriving (P.Typeable)+data MimePlainText = MimePlainText deriving (P.Typeable)+data MimeFormUrlEncoded = MimeFormUrlEncoded deriving (P.Typeable)+data MimeMultipartFormData = MimeMultipartFormData deriving (P.Typeable)+data MimeOctetStream = MimeOctetStream deriving (P.Typeable)+data MimeNoContent = MimeNoContent deriving (P.Typeable)+data MimeAny = MimeAny deriving (P.Typeable)++-- | A type for responses without content-body.+data NoContent = NoContent+ deriving (P.Show, P.Eq, P.Typeable)+++-- * MimeType Class++class P.Typeable mtype => MimeType mtype where+ {-# MINIMAL mimeType | mimeTypes #-}++ mimeTypes :: P.Proxy mtype -> [ME.MediaType]+ mimeTypes p =+ case mimeType p of+ Just x -> [x]+ Nothing -> []++ mimeType :: P.Proxy mtype -> Maybe ME.MediaType+ mimeType p =+ case mimeTypes p of+ [] -> Nothing+ (x:_) -> Just x++ mimeType' :: mtype -> Maybe ME.MediaType+ mimeType' _ = mimeType (P.Proxy :: P.Proxy mtype)+ mimeTypes' :: mtype -> [ME.MediaType]+ mimeTypes' _ = mimeTypes (P.Proxy :: P.Proxy mtype)++-- Default MimeType Instances++-- | @application/json; charset=utf-8@+instance MimeType MimeJSON where+ mimeType _ = Just $ P.fromString "application/json"+-- | @application/xml; charset=utf-8@+instance MimeType MimeXML where+ mimeType _ = Just $ P.fromString "application/xml"+-- | @application/x-www-form-urlencoded@+instance MimeType MimeFormUrlEncoded where+ mimeType _ = Just $ P.fromString "application/x-www-form-urlencoded"+-- | @multipart/form-data@+instance MimeType MimeMultipartFormData where+ mimeType _ = Just $ P.fromString "multipart/form-data"+-- | @text/plain; charset=utf-8@+instance MimeType MimePlainText where+ mimeType _ = Just $ P.fromString "text/plain"+-- | @application/octet-stream@+instance MimeType MimeOctetStream where+ mimeType _ = Just $ P.fromString "application/octet-stream"+-- | @"*/*"@+instance MimeType MimeAny where+ mimeType _ = Just $ P.fromString "*/*"+instance MimeType MimeNoContent where+ mimeType _ = Nothing++-- * MimeRender Class++class MimeType mtype => MimeRender mtype x where+ mimeRender :: P.Proxy mtype -> x -> BL.ByteString+ mimeRender' :: mtype -> x -> BL.ByteString+ mimeRender' _ x = mimeRender (P.Proxy :: P.Proxy mtype) x+++mimeRenderDefaultMultipartFormData :: WH.ToHttpApiData a => a -> BL.ByteString+mimeRenderDefaultMultipartFormData = BL.fromStrict . T.encodeUtf8 . WH.toQueryParam++-- Default MimeRender Instances++-- | `A.encode`+instance A.ToJSON a => MimeRender MimeJSON a where mimeRender _ = A.encode+-- | @WH.urlEncodeAsForm@+instance WH.ToForm a => MimeRender MimeFormUrlEncoded a where mimeRender _ = WH.urlEncodeAsForm++-- | @P.id@+instance MimeRender MimePlainText BL.ByteString where mimeRender _ = P.id+-- | @BL.fromStrict . T.encodeUtf8@+instance MimeRender MimePlainText T.Text where mimeRender _ = BL.fromStrict . T.encodeUtf8+-- | @BCL.pack@+instance MimeRender MimePlainText String where mimeRender _ = BCL.pack++-- | @P.id@+instance MimeRender MimeOctetStream BL.ByteString where mimeRender _ = P.id+-- | @BL.fromStrict . T.encodeUtf8@+instance MimeRender MimeOctetStream T.Text where mimeRender _ = BL.fromStrict . T.encodeUtf8+-- | @BCL.pack@+instance MimeRender MimeOctetStream String where mimeRender _ = BCL.pack++instance MimeRender MimeMultipartFormData BL.ByteString where mimeRender _ = P.id++instance MimeRender MimeMultipartFormData Bool where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData Char where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData Double where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData Float where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData Int where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData Integer where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData String where mimeRender _ = mimeRenderDefaultMultipartFormData+instance MimeRender MimeMultipartFormData T.Text where mimeRender _ = mimeRenderDefaultMultipartFormData++-- | @P.Right . P.const NoContent@+instance MimeRender MimeNoContent NoContent where mimeRender _ = P.const BCL.empty+++-- * MimeUnrender Class++class MimeType mtype => MimeUnrender mtype o where+ mimeUnrender :: P.Proxy mtype -> BL.ByteString -> P.Either String o+ mimeUnrender' :: mtype -> BL.ByteString -> P.Either String o+ mimeUnrender' _ x = mimeUnrender (P.Proxy :: P.Proxy mtype) x++-- Default MimeUnrender Instances++-- | @A.eitherDecode@+instance A.FromJSON a => MimeUnrender MimeJSON a where mimeUnrender _ = A.eitherDecode+-- | @P.left T.unpack . WH.urlDecodeAsForm@+instance WH.FromForm a => MimeUnrender MimeFormUrlEncoded a where mimeUnrender _ = P.left T.unpack . WH.urlDecodeAsForm+-- | @P.Right . P.id@++instance MimeUnrender MimePlainText BL.ByteString where mimeUnrender _ = P.Right . P.id+-- | @P.left P.show . TL.decodeUtf8'@+instance MimeUnrender MimePlainText T.Text where mimeUnrender _ = P.left P.show . T.decodeUtf8' . BL.toStrict+-- | @P.Right . BCL.unpack@+instance MimeUnrender MimePlainText String where mimeUnrender _ = P.Right . BCL.unpack++-- | @P.Right . P.id@+instance MimeUnrender MimeOctetStream BL.ByteString where mimeUnrender _ = P.Right . P.id+-- | @P.left P.show . T.decodeUtf8' . BL.toStrict@+instance MimeUnrender MimeOctetStream T.Text where mimeUnrender _ = P.left P.show . T.decodeUtf8' . BL.toStrict+-- | @P.Right . BCL.unpack@+instance MimeUnrender MimeOctetStream String where mimeUnrender _ = P.Right . BCL.unpack++-- | @P.Right . P.const NoContent@+instance MimeUnrender MimeNoContent NoContent where mimeUnrender _ = P.Right . P.const NoContent++
+ lib/ORYHydra/Model.hs view
@@ -0,0 +1,2145 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.Model+-}++{-# LANGUAGE DeriveDataTypeable #-}+{-# LANGUAGE DeriveFoldable #-}+{-# LANGUAGE DeriveGeneric #-}+{-# LANGUAGE DeriveTraversable #-}+{-# LANGUAGE GeneralizedNewtypeDeriving #-}+{-# LANGUAGE LambdaCase #-}+{-# LANGUAGE MultiParamTypeClasses #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE TupleSections #-}+{-# LANGUAGE TypeFamilies #-}+{-# OPTIONS_GHC -fno-warn-unused-matches -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.Model where++import ORYHydra.Core+import ORYHydra.MimeTypes++import Data.Aeson ((.:),(.:!),(.:?),(.=))++import qualified Control.Arrow as P (left)+import qualified Data.Aeson as A+import qualified Data.ByteString as B+import qualified Data.ByteString.Base64 as B64+import qualified Data.ByteString.Char8 as BC+import qualified Data.ByteString.Lazy as BL+import qualified Data.Data as P (Typeable, TypeRep, typeOf, typeRep)+import qualified Data.Foldable as P+import qualified Data.HashMap.Lazy as HM+import qualified Data.Map as Map+import qualified Data.Maybe as P+import qualified Data.Set as Set+import qualified Data.Text as T+import qualified Data.Text.Encoding as T+import qualified Data.Time as TI+import qualified Lens.Micro as L+import qualified Web.FormUrlEncoded as WH+import qualified Web.HttpApiData as WH++import Control.Applicative ((<|>))+import Control.Applicative (Alternative)+import Data.Function ((&))+import Data.Monoid ((<>))+import Data.Text (Text)+import Prelude (($),(/=),(.),(<$>),(<*>),(>>=),(=<<),Maybe(..),Bool(..),Char,Double,FilePath,Float,Int,Integer,String,fmap,undefined,mempty,maybe,pure,Monad,Applicative,Functor)++import qualified Prelude as P++++-- * Parameter newtypes+++-- ** All+newtype All = All { unAll :: Bool } deriving (P.Eq, P.Show)++-- ** Client+newtype Client = Client { unClient :: Text } deriving (P.Eq, P.Show)++-- ** ClientId+newtype ClientId = ClientId { unClientId :: Text } deriving (P.Eq, P.Show)++-- ** Code+newtype Code = Code { unCode :: Text } deriving (P.Eq, P.Show)++-- ** ConsentChallenge+newtype ConsentChallenge = ConsentChallenge { unConsentChallenge :: Text } deriving (P.Eq, P.Show)++-- ** GrantType+newtype GrantType = GrantType { unGrantType :: Text } deriving (P.Eq, P.Show)++-- ** Id+newtype Id = Id { unId :: Text } deriving (P.Eq, P.Show)++-- ** Kid+newtype Kid = Kid { unKid :: Text } deriving (P.Eq, P.Show)++-- ** Limit+newtype Limit = Limit { unLimit :: Integer } deriving (P.Eq, P.Show)++-- ** LoginChallenge+newtype LoginChallenge = LoginChallenge { unLoginChallenge :: Text } deriving (P.Eq, P.Show)++-- ** LogoutChallenge+newtype LogoutChallenge = LogoutChallenge { unLogoutChallenge :: Text } deriving (P.Eq, P.Show)++-- ** Offset+newtype Offset = Offset { unOffset :: Integer } deriving (P.Eq, P.Show)++-- ** RedirectUri+newtype RedirectUri = RedirectUri { unRedirectUri :: Text } deriving (P.Eq, P.Show)++-- ** RefreshToken+newtype RefreshToken = RefreshToken { unRefreshToken :: Text } deriving (P.Eq, P.Show)++-- ** Scope+newtype Scope = Scope { unScope :: Text } deriving (P.Eq, P.Show)++-- ** Set+newtype Set = Set { unSet :: Text } deriving (P.Eq, P.Show)++-- ** Subject+newtype Subject = Subject { unSubject :: Text } deriving (P.Eq, P.Show)++-- ** Token+newtype Token = Token { unToken :: Text } deriving (P.Eq, P.Show)++-- * Models+++-- ** AcceptConsentRequest+-- | AcceptConsentRequest+-- The request payload used to accept a consent request.+-- +data AcceptConsentRequest = AcceptConsentRequest+ { acceptConsentRequestGrantAccessTokenAudience :: Maybe [Text] -- ^ "grant_access_token_audience"+ , acceptConsentRequestGrantScope :: Maybe [Text] -- ^ "grant_scope"+ , acceptConsentRequestHandledAt :: Maybe DateTime -- ^ "handled_at"+ , acceptConsentRequestRemember :: Maybe Bool -- ^ "remember" - Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.+ , acceptConsentRequestRememberFor :: Maybe Integer -- ^ "remember_for" - RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.+ , acceptConsentRequestSession :: Maybe ConsentRequestSession -- ^ "session"+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON AcceptConsentRequest+instance A.FromJSON AcceptConsentRequest where+ parseJSON = A.withObject "AcceptConsentRequest" $ \o ->+ AcceptConsentRequest+ <$> (o .:? "grant_access_token_audience")+ <*> (o .:? "grant_scope")+ <*> (o .:? "handled_at")+ <*> (o .:? "remember")+ <*> (o .:? "remember_for")+ <*> (o .:? "session")++-- | ToJSON AcceptConsentRequest+instance A.ToJSON AcceptConsentRequest where+ toJSON AcceptConsentRequest {..} =+ _omitNulls+ [ "grant_access_token_audience" .= acceptConsentRequestGrantAccessTokenAudience+ , "grant_scope" .= acceptConsentRequestGrantScope+ , "handled_at" .= acceptConsentRequestHandledAt+ , "remember" .= acceptConsentRequestRemember+ , "remember_for" .= acceptConsentRequestRememberFor+ , "session" .= acceptConsentRequestSession+ ]+++-- | Construct a value of type 'AcceptConsentRequest' (by applying it's required fields, if any)+mkAcceptConsentRequest+ :: AcceptConsentRequest+mkAcceptConsentRequest =+ AcceptConsentRequest+ { acceptConsentRequestGrantAccessTokenAudience = Nothing+ , acceptConsentRequestGrantScope = Nothing+ , acceptConsentRequestHandledAt = Nothing+ , acceptConsentRequestRemember = Nothing+ , acceptConsentRequestRememberFor = Nothing+ , acceptConsentRequestSession = Nothing+ }++-- ** AcceptLoginRequest+-- | AcceptLoginRequest+-- HandledLoginRequest is the request payload used to accept a login request.+-- +data AcceptLoginRequest = AcceptLoginRequest+ { acceptLoginRequestAcr :: Maybe Text -- ^ "acr" - ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor authentication.+ , acceptLoginRequestContext :: Maybe A.Value -- ^ "context"+ , acceptLoginRequestForceSubjectIdentifier :: Maybe Text -- ^ "force_subject_identifier" - ForceSubjectIdentifier forces the \"pairwise\" user ID of the end-user that authenticated. The \"pairwise\" user ID refers to the (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID Connect specification. It allows you to set an obfuscated subject (\"user\") identifier that is unique to the client. Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the sub claim in the OAuth 2.0 Introspection. Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's configuration). Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies that you have to compute this value on every authentication process (probably depending on the client ID or some other unique value). If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.+ , acceptLoginRequestRemember :: Maybe Bool -- ^ "remember" - Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she will not be asked to log in again.+ , acceptLoginRequestRememberFor :: Maybe Integer -- ^ "remember_for" - RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the authorization will be remembered for the duration of the browser session (using a session cookie).+ , acceptLoginRequestSubject :: Text -- ^ /Required/ "subject" - Subject is the user ID of the end-user that authenticated.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON AcceptLoginRequest+instance A.FromJSON AcceptLoginRequest where+ parseJSON = A.withObject "AcceptLoginRequest" $ \o ->+ AcceptLoginRequest+ <$> (o .:? "acr")+ <*> (o .:? "context")+ <*> (o .:? "force_subject_identifier")+ <*> (o .:? "remember")+ <*> (o .:? "remember_for")+ <*> (o .: "subject")++-- | ToJSON AcceptLoginRequest+instance A.ToJSON AcceptLoginRequest where+ toJSON AcceptLoginRequest {..} =+ _omitNulls+ [ "acr" .= acceptLoginRequestAcr+ , "context" .= acceptLoginRequestContext+ , "force_subject_identifier" .= acceptLoginRequestForceSubjectIdentifier+ , "remember" .= acceptLoginRequestRemember+ , "remember_for" .= acceptLoginRequestRememberFor+ , "subject" .= acceptLoginRequestSubject+ ]+++-- | Construct a value of type 'AcceptLoginRequest' (by applying it's required fields, if any)+mkAcceptLoginRequest+ :: Text -- ^ 'acceptLoginRequestSubject': Subject is the user ID of the end-user that authenticated.+ -> AcceptLoginRequest+mkAcceptLoginRequest acceptLoginRequestSubject =+ AcceptLoginRequest+ { acceptLoginRequestAcr = Nothing+ , acceptLoginRequestContext = Nothing+ , acceptLoginRequestForceSubjectIdentifier = Nothing+ , acceptLoginRequestRemember = Nothing+ , acceptLoginRequestRememberFor = Nothing+ , acceptLoginRequestSubject+ }++-- ** CompletedRequest+-- | CompletedRequest+-- The response payload sent when accepting or rejecting a login or consent request.+-- +data CompletedRequest = CompletedRequest+ { completedRequestRedirectTo :: Text -- ^ /Required/ "redirect_to" - RedirectURL is the URL which you should redirect the user to once the authentication process is completed.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON CompletedRequest+instance A.FromJSON CompletedRequest where+ parseJSON = A.withObject "CompletedRequest" $ \o ->+ CompletedRequest+ <$> (o .: "redirect_to")++-- | ToJSON CompletedRequest+instance A.ToJSON CompletedRequest where+ toJSON CompletedRequest {..} =+ _omitNulls+ [ "redirect_to" .= completedRequestRedirectTo+ ]+++-- | Construct a value of type 'CompletedRequest' (by applying it's required fields, if any)+mkCompletedRequest+ :: Text -- ^ 'completedRequestRedirectTo': RedirectURL is the URL which you should redirect the user to once the authentication process is completed.+ -> CompletedRequest+mkCompletedRequest completedRequestRedirectTo =+ CompletedRequest+ { completedRequestRedirectTo+ }++-- ** ConsentRequest+-- | ConsentRequest+-- Contains information on an ongoing consent request.+-- +data ConsentRequest = ConsentRequest+ { consentRequestAcr :: Maybe Text -- ^ "acr" - ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it to express that, for example, a user authenticated using two factor authentication.+ , consentRequestChallenge :: Text -- ^ /Required/ "challenge" - ID is the identifier (\"authorization challenge\") of the consent authorization request. It is used to identify the session.+ , consentRequestClient :: Maybe OAuth2Client -- ^ "client"+ , consentRequestContext :: Maybe A.Value -- ^ "context"+ , consentRequestLoginChallenge :: Maybe Text -- ^ "login_challenge" - LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate a login and consent request in the login & consent app.+ , consentRequestLoginSessionId :: Maybe Text -- ^ "login_session_id" - LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the \"sid\" parameter in the ID Token and in OIDC Front-/Back- channel logout. It's value can generally be used to associate consecutive login requests by a certain user.+ , consentRequestOidcContext :: Maybe OpenIDConnectContext -- ^ "oidc_context"+ , consentRequestRequestUrl :: Maybe Text -- ^ "request_url" - RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.+ , consentRequestRequestedAccessTokenAudience :: Maybe [Text] -- ^ "requested_access_token_audience"+ , consentRequestRequestedScope :: Maybe [Text] -- ^ "requested_scope"+ , consentRequestSkip :: Maybe Bool -- ^ "skip" - Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the consent request using the usual API call.+ , consentRequestSubject :: Maybe Text -- ^ "subject" - Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON ConsentRequest+instance A.FromJSON ConsentRequest where+ parseJSON = A.withObject "ConsentRequest" $ \o ->+ ConsentRequest+ <$> (o .:? "acr")+ <*> (o .: "challenge")+ <*> (o .:? "client")+ <*> (o .:? "context")+ <*> (o .:? "login_challenge")+ <*> (o .:? "login_session_id")+ <*> (o .:? "oidc_context")+ <*> (o .:? "request_url")+ <*> (o .:? "requested_access_token_audience")+ <*> (o .:? "requested_scope")+ <*> (o .:? "skip")+ <*> (o .:? "subject")++-- | ToJSON ConsentRequest+instance A.ToJSON ConsentRequest where+ toJSON ConsentRequest {..} =+ _omitNulls+ [ "acr" .= consentRequestAcr+ , "challenge" .= consentRequestChallenge+ , "client" .= consentRequestClient+ , "context" .= consentRequestContext+ , "login_challenge" .= consentRequestLoginChallenge+ , "login_session_id" .= consentRequestLoginSessionId+ , "oidc_context" .= consentRequestOidcContext+ , "request_url" .= consentRequestRequestUrl+ , "requested_access_token_audience" .= consentRequestRequestedAccessTokenAudience+ , "requested_scope" .= consentRequestRequestedScope+ , "skip" .= consentRequestSkip+ , "subject" .= consentRequestSubject+ ]+++-- | Construct a value of type 'ConsentRequest' (by applying it's required fields, if any)+mkConsentRequest+ :: Text -- ^ 'consentRequestChallenge': ID is the identifier (\"authorization challenge\") of the consent authorization request. It is used to identify the session.+ -> ConsentRequest+mkConsentRequest consentRequestChallenge =+ ConsentRequest+ { consentRequestAcr = Nothing+ , consentRequestChallenge+ , consentRequestClient = Nothing+ , consentRequestContext = Nothing+ , consentRequestLoginChallenge = Nothing+ , consentRequestLoginSessionId = Nothing+ , consentRequestOidcContext = Nothing+ , consentRequestRequestUrl = Nothing+ , consentRequestRequestedAccessTokenAudience = Nothing+ , consentRequestRequestedScope = Nothing+ , consentRequestSkip = Nothing+ , consentRequestSubject = Nothing+ }++-- ** ConsentRequestSession+-- | ConsentRequestSession+-- Used to pass session data to a consent request.+-- +data ConsentRequestSession = ConsentRequestSession+ { consentRequestSessionAccessToken :: Maybe A.Value -- ^ "access_token" - AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection. If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!+ , consentRequestSessionIdToken :: Maybe A.Value -- ^ "id_token" - IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable by anyone that has access to the ID Challenge. Use with care!+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON ConsentRequestSession+instance A.FromJSON ConsentRequestSession where+ parseJSON = A.withObject "ConsentRequestSession" $ \o ->+ ConsentRequestSession+ <$> (o .:? "access_token")+ <*> (o .:? "id_token")++-- | ToJSON ConsentRequestSession+instance A.ToJSON ConsentRequestSession where+ toJSON ConsentRequestSession {..} =+ _omitNulls+ [ "access_token" .= consentRequestSessionAccessToken+ , "id_token" .= consentRequestSessionIdToken+ ]+++-- | Construct a value of type 'ConsentRequestSession' (by applying it's required fields, if any)+mkConsentRequestSession+ :: ConsentRequestSession+mkConsentRequestSession =+ ConsentRequestSession+ { consentRequestSessionAccessToken = Nothing+ , consentRequestSessionIdToken = Nothing+ }++-- ** ContainerWaitOKBodyError+-- | ContainerWaitOKBodyError+-- ContainerWaitOKBodyError container waiting error, if any+data ContainerWaitOKBodyError = ContainerWaitOKBodyError+ { containerWaitOKBodyErrorMessage :: Maybe Text -- ^ "Message" - Details of an error+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON ContainerWaitOKBodyError+instance A.FromJSON ContainerWaitOKBodyError where+ parseJSON = A.withObject "ContainerWaitOKBodyError" $ \o ->+ ContainerWaitOKBodyError+ <$> (o .:? "Message")++-- | ToJSON ContainerWaitOKBodyError+instance A.ToJSON ContainerWaitOKBodyError where+ toJSON ContainerWaitOKBodyError {..} =+ _omitNulls+ [ "Message" .= containerWaitOKBodyErrorMessage+ ]+++-- | Construct a value of type 'ContainerWaitOKBodyError' (by applying it's required fields, if any)+mkContainerWaitOKBodyError+ :: ContainerWaitOKBodyError+mkContainerWaitOKBodyError =+ ContainerWaitOKBodyError+ { containerWaitOKBodyErrorMessage = Nothing+ }++-- ** FlushInactiveOAuth2TokensRequest+-- | FlushInactiveOAuth2TokensRequest+data FlushInactiveOAuth2TokensRequest = FlushInactiveOAuth2TokensRequest+ { flushInactiveOAuth2TokensRequestNotAfter :: Maybe DateTime -- ^ "notAfter" - NotAfter sets after which point tokens should not be flushed. This is useful when you want to keep a history of recently issued tokens for auditing.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON FlushInactiveOAuth2TokensRequest+instance A.FromJSON FlushInactiveOAuth2TokensRequest where+ parseJSON = A.withObject "FlushInactiveOAuth2TokensRequest" $ \o ->+ FlushInactiveOAuth2TokensRequest+ <$> (o .:? "notAfter")++-- | ToJSON FlushInactiveOAuth2TokensRequest+instance A.ToJSON FlushInactiveOAuth2TokensRequest where+ toJSON FlushInactiveOAuth2TokensRequest {..} =+ _omitNulls+ [ "notAfter" .= flushInactiveOAuth2TokensRequestNotAfter+ ]+++-- | Construct a value of type 'FlushInactiveOAuth2TokensRequest' (by applying it's required fields, if any)+mkFlushInactiveOAuth2TokensRequest+ :: FlushInactiveOAuth2TokensRequest+mkFlushInactiveOAuth2TokensRequest =+ FlushInactiveOAuth2TokensRequest+ { flushInactiveOAuth2TokensRequestNotAfter = Nothing+ }++-- ** GenericError+-- | GenericError+-- Error response+-- +-- Error responses are sent when an error (e.g. unauthorized, bad request, ...) occurred.+data GenericError = GenericError+ { genericErrorDebug :: Maybe Text -- ^ "debug" - Debug contains debug information. This is usually not available and has to be enabled.+ , genericErrorError :: Text -- ^ /Required/ "error" - Name is the error name.+ , genericErrorErrorDescription :: Maybe Text -- ^ "error_description" - Description contains further information on the nature of the error.+ , genericErrorStatusCode :: Maybe Integer -- ^ "status_code" - Code represents the error status code (404, 403, 401, ...).+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON GenericError+instance A.FromJSON GenericError where+ parseJSON = A.withObject "GenericError" $ \o ->+ GenericError+ <$> (o .:? "debug")+ <*> (o .: "error")+ <*> (o .:? "error_description")+ <*> (o .:? "status_code")++-- | ToJSON GenericError+instance A.ToJSON GenericError where+ toJSON GenericError {..} =+ _omitNulls+ [ "debug" .= genericErrorDebug+ , "error" .= genericErrorError+ , "error_description" .= genericErrorErrorDescription+ , "status_code" .= genericErrorStatusCode+ ]+++-- | Construct a value of type 'GenericError' (by applying it's required fields, if any)+mkGenericError+ :: Text -- ^ 'genericErrorError': Name is the error name.+ -> GenericError+mkGenericError genericErrorError =+ GenericError+ { genericErrorDebug = Nothing+ , genericErrorError+ , genericErrorErrorDescription = Nothing+ , genericErrorStatusCode = Nothing+ }++-- ** HealthNotReadyStatus+-- | HealthNotReadyStatus+data HealthNotReadyStatus = HealthNotReadyStatus+ { healthNotReadyStatusErrors :: Maybe (Map.Map String Text) -- ^ "errors" - Errors contains a list of errors that caused the not ready status.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON HealthNotReadyStatus+instance A.FromJSON HealthNotReadyStatus where+ parseJSON = A.withObject "HealthNotReadyStatus" $ \o ->+ HealthNotReadyStatus+ <$> (o .:? "errors")++-- | ToJSON HealthNotReadyStatus+instance A.ToJSON HealthNotReadyStatus where+ toJSON HealthNotReadyStatus {..} =+ _omitNulls+ [ "errors" .= healthNotReadyStatusErrors+ ]+++-- | Construct a value of type 'HealthNotReadyStatus' (by applying it's required fields, if any)+mkHealthNotReadyStatus+ :: HealthNotReadyStatus+mkHealthNotReadyStatus =+ HealthNotReadyStatus+ { healthNotReadyStatusErrors = Nothing+ }++-- ** HealthStatus+-- | HealthStatus+data HealthStatus = HealthStatus+ { healthStatusStatus :: Maybe Text -- ^ "status" - Status always contains \"ok\".+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON HealthStatus+instance A.FromJSON HealthStatus where+ parseJSON = A.withObject "HealthStatus" $ \o ->+ HealthStatus+ <$> (o .:? "status")++-- | ToJSON HealthStatus+instance A.ToJSON HealthStatus where+ toJSON HealthStatus {..} =+ _omitNulls+ [ "status" .= healthStatusStatus+ ]+++-- | Construct a value of type 'HealthStatus' (by applying it's required fields, if any)+mkHealthStatus+ :: HealthStatus+mkHealthStatus =+ HealthStatus+ { healthStatusStatus = Nothing+ }++-- ** JSONWebKey+-- | JSONWebKey+-- It is important that this model object is named JSONWebKey for \"swagger generate spec\" to generate only on definition of a JSONWebKey.+data JSONWebKey = JSONWebKey+ { jSONWebKeyAlg :: Text -- ^ /Required/ "alg" - The \"alg\" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA \"JSON Web Signature and Encryption Algorithms\" registry established by [JWA] or be a value that contains a Collision- Resistant Name.+ , jSONWebKeyCrv :: Maybe Text -- ^ "crv"+ , jSONWebKeyD :: Maybe Text -- ^ "d"+ , jSONWebKeyDp :: Maybe Text -- ^ "dp"+ , jSONWebKeyDq :: Maybe Text -- ^ "dq"+ , jSONWebKeyE :: Maybe Text -- ^ "e"+ , jSONWebKeyK :: Maybe Text -- ^ "k"+ , jSONWebKeyKid :: Text -- ^ /Required/ "kid" - The \"kid\" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the \"kid\" value is unspecified. When \"kid\" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct \"kid\" values. (One example in which different keys might use the same \"kid\" value is if they have different \"kty\" (key type) values but are considered to be equivalent alternatives by the application using them.) The \"kid\" value is a case-sensitive string.+ , jSONWebKeyKty :: Text -- ^ /Required/ "kty" - The \"kty\" (key type) parameter identifies the cryptographic algorithm family used with the key, such as \"RSA\" or \"EC\". \"kty\" values should either be registered in the IANA \"JSON Web Key Types\" registry established by [JWA] or be a value that contains a Collision- Resistant Name. The \"kty\" value is a case-sensitive string.+ , jSONWebKeyN :: Maybe Text -- ^ "n"+ , jSONWebKeyP :: Maybe Text -- ^ "p"+ , jSONWebKeyQ :: Maybe Text -- ^ "q"+ , jSONWebKeyQi :: Maybe Text -- ^ "qi"+ , jSONWebKeyUse :: Text -- ^ /Required/ "use" - Use (\"public key use\") identifies the intended use of the public key. The \"use\" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly \"sig\" (signature) or \"enc\" (encryption).+ , jSONWebKeyX :: Maybe Text -- ^ "x"+ , jSONWebKeyX5c :: Maybe [Text] -- ^ "x5c" - The \"x5c\" (X.509 certificate chain) parameter contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64-encoded (Section 4 of [RFC4648] -- not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate.+ , jSONWebKeyY :: Maybe Text -- ^ "y"+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON JSONWebKey+instance A.FromJSON JSONWebKey where+ parseJSON = A.withObject "JSONWebKey" $ \o ->+ JSONWebKey+ <$> (o .: "alg")+ <*> (o .:? "crv")+ <*> (o .:? "d")+ <*> (o .:? "dp")+ <*> (o .:? "dq")+ <*> (o .:? "e")+ <*> (o .:? "k")+ <*> (o .: "kid")+ <*> (o .: "kty")+ <*> (o .:? "n")+ <*> (o .:? "p")+ <*> (o .:? "q")+ <*> (o .:? "qi")+ <*> (o .: "use")+ <*> (o .:? "x")+ <*> (o .:? "x5c")+ <*> (o .:? "y")++-- | ToJSON JSONWebKey+instance A.ToJSON JSONWebKey where+ toJSON JSONWebKey {..} =+ _omitNulls+ [ "alg" .= jSONWebKeyAlg+ , "crv" .= jSONWebKeyCrv+ , "d" .= jSONWebKeyD+ , "dp" .= jSONWebKeyDp+ , "dq" .= jSONWebKeyDq+ , "e" .= jSONWebKeyE+ , "k" .= jSONWebKeyK+ , "kid" .= jSONWebKeyKid+ , "kty" .= jSONWebKeyKty+ , "n" .= jSONWebKeyN+ , "p" .= jSONWebKeyP+ , "q" .= jSONWebKeyQ+ , "qi" .= jSONWebKeyQi+ , "use" .= jSONWebKeyUse+ , "x" .= jSONWebKeyX+ , "x5c" .= jSONWebKeyX5c+ , "y" .= jSONWebKeyY+ ]+++-- | Construct a value of type 'JSONWebKey' (by applying it's required fields, if any)+mkJSONWebKey+ :: Text -- ^ 'jSONWebKeyAlg': The \"alg\" (algorithm) parameter identifies the algorithm intended for use with the key. The values used should either be registered in the IANA \"JSON Web Signature and Encryption Algorithms\" registry established by [JWA] or be a value that contains a Collision- Resistant Name.+ -> Text -- ^ 'jSONWebKeyKid': The \"kid\" (key ID) parameter is used to match a specific key. This is used, for instance, to choose among a set of keys within a JWK Set during key rollover. The structure of the \"kid\" value is unspecified. When \"kid\" values are used within a JWK Set, different keys within the JWK Set SHOULD use distinct \"kid\" values. (One example in which different keys might use the same \"kid\" value is if they have different \"kty\" (key type) values but are considered to be equivalent alternatives by the application using them.) The \"kid\" value is a case-sensitive string.+ -> Text -- ^ 'jSONWebKeyKty': The \"kty\" (key type) parameter identifies the cryptographic algorithm family used with the key, such as \"RSA\" or \"EC\". \"kty\" values should either be registered in the IANA \"JSON Web Key Types\" registry established by [JWA] or be a value that contains a Collision- Resistant Name. The \"kty\" value is a case-sensitive string.+ -> Text -- ^ 'jSONWebKeyUse': Use (\"public key use\") identifies the intended use of the public key. The \"use\" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Values are commonly \"sig\" (signature) or \"enc\" (encryption).+ -> JSONWebKey+mkJSONWebKey jSONWebKeyAlg jSONWebKeyKid jSONWebKeyKty jSONWebKeyUse =+ JSONWebKey+ { jSONWebKeyAlg+ , jSONWebKeyCrv = Nothing+ , jSONWebKeyD = Nothing+ , jSONWebKeyDp = Nothing+ , jSONWebKeyDq = Nothing+ , jSONWebKeyE = Nothing+ , jSONWebKeyK = Nothing+ , jSONWebKeyKid+ , jSONWebKeyKty+ , jSONWebKeyN = Nothing+ , jSONWebKeyP = Nothing+ , jSONWebKeyQ = Nothing+ , jSONWebKeyQi = Nothing+ , jSONWebKeyUse+ , jSONWebKeyX = Nothing+ , jSONWebKeyX5c = Nothing+ , jSONWebKeyY = Nothing+ }++-- ** JSONWebKeySet+-- | JSONWebKeySet+-- It is important that this model object is named JSONWebKeySet for \"swagger generate spec\" to generate only on definition of a JSONWebKeySet. Since one with the same name is previously defined as client.Client.JSONWebKeys and this one is last, this one will be effectively written in the swagger spec.+data JSONWebKeySet = JSONWebKeySet+ { jSONWebKeySetKeys :: Maybe [JSONWebKey] -- ^ "keys" - The value of the \"keys\" parameter is an array of JWK values. By default, the order of the JWK values within the array does not imply an order of preference among them, although applications of JWK Sets can choose to assign a meaning to the order for their purposes, if desired.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON JSONWebKeySet+instance A.FromJSON JSONWebKeySet where+ parseJSON = A.withObject "JSONWebKeySet" $ \o ->+ JSONWebKeySet+ <$> (o .:? "keys")++-- | ToJSON JSONWebKeySet+instance A.ToJSON JSONWebKeySet where+ toJSON JSONWebKeySet {..} =+ _omitNulls+ [ "keys" .= jSONWebKeySetKeys+ ]+++-- | Construct a value of type 'JSONWebKeySet' (by applying it's required fields, if any)+mkJSONWebKeySet+ :: JSONWebKeySet+mkJSONWebKeySet =+ JSONWebKeySet+ { jSONWebKeySetKeys = Nothing+ }++-- ** JsonWebKeySetGeneratorRequest+-- | JsonWebKeySetGeneratorRequest+data JsonWebKeySetGeneratorRequest = JsonWebKeySetGeneratorRequest+ { jsonWebKeySetGeneratorRequestAlg :: Text -- ^ /Required/ "alg" - The algorithm to be used for creating the key. Supports \"RS256\", \"ES512\", \"HS512\", and \"HS256\"+ , jsonWebKeySetGeneratorRequestKid :: Text -- ^ /Required/ "kid" - The kid of the key to be created+ , jsonWebKeySetGeneratorRequestUse :: Text -- ^ /Required/ "use" - The \"use\" (public key use) parameter identifies the intended use of the public key. The \"use\" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Valid values are \"enc\" and \"sig\".+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON JsonWebKeySetGeneratorRequest+instance A.FromJSON JsonWebKeySetGeneratorRequest where+ parseJSON = A.withObject "JsonWebKeySetGeneratorRequest" $ \o ->+ JsonWebKeySetGeneratorRequest+ <$> (o .: "alg")+ <*> (o .: "kid")+ <*> (o .: "use")++-- | ToJSON JsonWebKeySetGeneratorRequest+instance A.ToJSON JsonWebKeySetGeneratorRequest where+ toJSON JsonWebKeySetGeneratorRequest {..} =+ _omitNulls+ [ "alg" .= jsonWebKeySetGeneratorRequestAlg+ , "kid" .= jsonWebKeySetGeneratorRequestKid+ , "use" .= jsonWebKeySetGeneratorRequestUse+ ]+++-- | Construct a value of type 'JsonWebKeySetGeneratorRequest' (by applying it's required fields, if any)+mkJsonWebKeySetGeneratorRequest+ :: Text -- ^ 'jsonWebKeySetGeneratorRequestAlg': The algorithm to be used for creating the key. Supports \"RS256\", \"ES512\", \"HS512\", and \"HS256\"+ -> Text -- ^ 'jsonWebKeySetGeneratorRequestKid': The kid of the key to be created+ -> Text -- ^ 'jsonWebKeySetGeneratorRequestUse': The \"use\" (public key use) parameter identifies the intended use of the public key. The \"use\" parameter is employed to indicate whether a public key is used for encrypting data or verifying the signature on data. Valid values are \"enc\" and \"sig\".+ -> JsonWebKeySetGeneratorRequest+mkJsonWebKeySetGeneratorRequest jsonWebKeySetGeneratorRequestAlg jsonWebKeySetGeneratorRequestKid jsonWebKeySetGeneratorRequestUse =+ JsonWebKeySetGeneratorRequest+ { jsonWebKeySetGeneratorRequestAlg+ , jsonWebKeySetGeneratorRequestKid+ , jsonWebKeySetGeneratorRequestUse+ }++-- ** LoginRequest+-- | LoginRequest+-- Contains information on an ongoing login request.+-- +data LoginRequest = LoginRequest+ { loginRequestChallenge :: Text -- ^ /Required/ "challenge" - ID is the identifier (\"login challenge\") of the login request. It is used to identify the session.+ , loginRequestClient :: OAuth2Client -- ^ /Required/ "client"+ , loginRequestOidcContext :: Maybe OpenIDConnectContext -- ^ "oidc_context"+ , loginRequestRequestUrl :: Text -- ^ /Required/ "request_url" - RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.+ , loginRequestRequestedAccessTokenAudience :: [Text] -- ^ /Required/ "requested_access_token_audience"+ , loginRequestRequestedScope :: [Text] -- ^ /Required/ "requested_scope"+ , loginRequestSessionId :: Maybe Text -- ^ "session_id" - SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the \"sid\" parameter in the ID Token and in OIDC Front-/Back- channel logout. It's value can generally be used to associate consecutive login requests by a certain user.+ , loginRequestSkip :: Bool -- ^ /Required/ "skip" - Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL. This feature allows you to update / set session information.+ , loginRequestSubject :: Text -- ^ /Required/ "subject" - Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type when accepting the login request, or the request will fail.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON LoginRequest+instance A.FromJSON LoginRequest where+ parseJSON = A.withObject "LoginRequest" $ \o ->+ LoginRequest+ <$> (o .: "challenge")+ <*> (o .: "client")+ <*> (o .:? "oidc_context")+ <*> (o .: "request_url")+ <*> (o .: "requested_access_token_audience")+ <*> (o .: "requested_scope")+ <*> (o .:? "session_id")+ <*> (o .: "skip")+ <*> (o .: "subject")++-- | ToJSON LoginRequest+instance A.ToJSON LoginRequest where+ toJSON LoginRequest {..} =+ _omitNulls+ [ "challenge" .= loginRequestChallenge+ , "client" .= loginRequestClient+ , "oidc_context" .= loginRequestOidcContext+ , "request_url" .= loginRequestRequestUrl+ , "requested_access_token_audience" .= loginRequestRequestedAccessTokenAudience+ , "requested_scope" .= loginRequestRequestedScope+ , "session_id" .= loginRequestSessionId+ , "skip" .= loginRequestSkip+ , "subject" .= loginRequestSubject+ ]+++-- | Construct a value of type 'LoginRequest' (by applying it's required fields, if any)+mkLoginRequest+ :: Text -- ^ 'loginRequestChallenge': ID is the identifier (\"login challenge\") of the login request. It is used to identify the session.+ -> OAuth2Client -- ^ 'loginRequestClient' + -> Text -- ^ 'loginRequestRequestUrl': RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.+ -> [Text] -- ^ 'loginRequestRequestedAccessTokenAudience' + -> [Text] -- ^ 'loginRequestRequestedScope' + -> Bool -- ^ 'loginRequestSkip': Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL. This feature allows you to update / set session information.+ -> Text -- ^ 'loginRequestSubject': Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type when accepting the login request, or the request will fail.+ -> LoginRequest+mkLoginRequest loginRequestChallenge loginRequestClient loginRequestRequestUrl loginRequestRequestedAccessTokenAudience loginRequestRequestedScope loginRequestSkip loginRequestSubject =+ LoginRequest+ { loginRequestChallenge+ , loginRequestClient+ , loginRequestOidcContext = Nothing+ , loginRequestRequestUrl+ , loginRequestRequestedAccessTokenAudience+ , loginRequestRequestedScope+ , loginRequestSessionId = Nothing+ , loginRequestSkip+ , loginRequestSubject+ }++-- ** LogoutRequest+-- | LogoutRequest+-- Contains information about an ongoing logout request.+-- +data LogoutRequest = LogoutRequest+ { logoutRequestRequestUrl :: Maybe Text -- ^ "request_url" - RequestURL is the original Logout URL requested.+ , logoutRequestRpInitiated :: Maybe Bool -- ^ "rp_initiated" - RPInitiated is set to true if the request was initiated by a Relying Party (RP), also known as an OAuth 2.0 Client.+ , logoutRequestSid :: Maybe Text -- ^ "sid" - SessionID is the login session ID that was requested to log out.+ , logoutRequestSubject :: Maybe Text -- ^ "subject" - Subject is the user for whom the logout was request.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON LogoutRequest+instance A.FromJSON LogoutRequest where+ parseJSON = A.withObject "LogoutRequest" $ \o ->+ LogoutRequest+ <$> (o .:? "request_url")+ <*> (o .:? "rp_initiated")+ <*> (o .:? "sid")+ <*> (o .:? "subject")++-- | ToJSON LogoutRequest+instance A.ToJSON LogoutRequest where+ toJSON LogoutRequest {..} =+ _omitNulls+ [ "request_url" .= logoutRequestRequestUrl+ , "rp_initiated" .= logoutRequestRpInitiated+ , "sid" .= logoutRequestSid+ , "subject" .= logoutRequestSubject+ ]+++-- | Construct a value of type 'LogoutRequest' (by applying it's required fields, if any)+mkLogoutRequest+ :: LogoutRequest+mkLogoutRequest =+ LogoutRequest+ { logoutRequestRequestUrl = Nothing+ , logoutRequestRpInitiated = Nothing+ , logoutRequestSid = Nothing+ , logoutRequestSubject = Nothing+ }++-- ** OAuth2Client+-- | OAuth2Client+-- Client represents an OAuth 2.0 Client.+-- +data OAuth2Client = OAuth2Client+ { oAuth2ClientAllowedCorsOrigins :: Maybe [Text] -- ^ "allowed_cors_origins"+ , oAuth2ClientAudience :: Maybe [Text] -- ^ "audience"+ , oAuth2ClientBackchannelLogoutSessionRequired :: Maybe Bool -- ^ "backchannel_logout_session_required" - Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout Token to identify the RP session with the OP when the backchannel_logout_uri is used. If omitted, the default value is false.+ , oAuth2ClientBackchannelLogoutUri :: Maybe Text -- ^ "backchannel_logout_uri" - RP URL that will cause the RP to log itself out when sent a Logout Token by the OP.+ , oAuth2ClientClientId :: Maybe Text -- ^ "client_id" - ID is the id for this client.+ , oAuth2ClientClientName :: Maybe Text -- ^ "client_name" - Name is the human-readable string name of the client to be presented to the end-user during authorization.+ , oAuth2ClientClientSecret :: Maybe Text -- ^ "client_secret" - Secret is the client's secret. The secret will be included in the create request as cleartext, and then never again. The secret is stored using BCrypt so it is impossible to recover it. Tell your users that they need to write the secret down as it will not be made available again.+ , oAuth2ClientClientSecretExpiresAt :: Maybe Integer -- ^ "client_secret_expires_at" - SecretExpiresAt is an integer holding the time at which the client secret will expire or 0 if it will not expire. The time is represented as the number of seconds from 1970-01-01T00:00:00Z as measured in UTC until the date/time of expiration. This feature is currently not supported and it's value will always be set to 0.+ , oAuth2ClientClientUri :: Maybe Text -- ^ "client_uri" - ClientURI is an URL string of a web page providing information about the client. If present, the server SHOULD display this URL to the end-user in a clickable fashion.+ , oAuth2ClientContacts :: Maybe [Text] -- ^ "contacts"+ , oAuth2ClientCreatedAt :: Maybe DateTime -- ^ "created_at" - CreatedAt returns the timestamp of the client's creation.+ , oAuth2ClientFrontchannelLogoutSessionRequired :: Maybe Bool -- ^ "frontchannel_logout_session_required" - Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be included to identify the RP session with the OP when the frontchannel_logout_uri is used. If omitted, the default value is false.+ , oAuth2ClientFrontchannelLogoutUri :: Maybe Text -- ^ "frontchannel_logout_uri" - RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the request and to determine which of the potentially multiple sessions is to be logged out; if either is included, both MUST be.+ , oAuth2ClientGrantTypes :: Maybe [Text] -- ^ "grant_types"+ , oAuth2ClientJwks :: Maybe A.Value -- ^ "jwks"+ , oAuth2ClientJwksUri :: Maybe Text -- ^ "jwks_uri" - URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.+ , oAuth2ClientLogoUri :: Maybe Text -- ^ "logo_uri" - LogoURI is an URL string that references a logo for the client.+ , oAuth2ClientMetadata :: Maybe A.Value -- ^ "metadata"+ , oAuth2ClientOwner :: Maybe Text -- ^ "owner" - Owner is a string identifying the owner of the OAuth 2.0 Client.+ , oAuth2ClientPolicyUri :: Maybe Text -- ^ "policy_uri" - PolicyURI is a URL string that points to a human-readable privacy policy document that describes how the deployment organization collects, uses, retains, and discloses personal data.+ , oAuth2ClientPostLogoutRedirectUris :: Maybe [Text] -- ^ "post_logout_redirect_uris"+ , oAuth2ClientRedirectUris :: Maybe [Text] -- ^ "redirect_uris"+ , oAuth2ClientRequestObjectSigningAlg :: Maybe Text -- ^ "request_object_signing_alg" - JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects from this Client MUST be rejected, if not signed with this algorithm.+ , oAuth2ClientRequestUris :: Maybe [Text] -- ^ "request_uris"+ , oAuth2ClientResponseTypes :: Maybe [Text] -- ^ "response_types"+ , oAuth2ClientScope :: Maybe Text -- ^ "scope" - Scope is a string containing a space-separated list of scope values (as described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client can use when requesting access tokens.+ , oAuth2ClientSectorIdentifierUri :: Maybe Text -- ^ "sector_identifier_uri" - URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a file with a single JSON array of redirect_uri values.+ , oAuth2ClientSubjectType :: Maybe Text -- ^ "subject_type" - SubjectType requested for responses to this Client. The subject_types_supported Discovery parameter contains a list of the supported subject_type values for this server. Valid types include `pairwise` and `public`.+ , oAuth2ClientTokenEndpointAuthMethod :: Maybe Text -- ^ "token_endpoint_auth_method" - Requested Client Authentication method for the Token Endpoint. The options are client_secret_post, client_secret_basic, private_key_jwt, and none.+ , oAuth2ClientTokenEndpointAuthSigningAlg :: Maybe Text -- ^ "token_endpoint_auth_signing_alg" - Requested Client Authentication signing algorithm for the Token Endpoint.+ , oAuth2ClientTosUri :: Maybe Text -- ^ "tos_uri" - TermsOfServiceURI is a URL string that points to a human-readable terms of service document for the client that describes a contractual relationship between the end-user and the client that the end-user accepts when authorizing the client.+ , oAuth2ClientUpdatedAt :: Maybe DateTime -- ^ "updated_at" - UpdatedAt returns the timestamp of the last update.+ , oAuth2ClientUserinfoSignedResponseAlg :: Maybe Text -- ^ "userinfo_signed_response_alg" - JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims as a UTF-8 encoded JSON object using the application/json content-type.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON OAuth2Client+instance A.FromJSON OAuth2Client where+ parseJSON = A.withObject "OAuth2Client" $ \o ->+ OAuth2Client+ <$> (o .:? "allowed_cors_origins")+ <*> (o .:? "audience")+ <*> (o .:? "backchannel_logout_session_required")+ <*> (o .:? "backchannel_logout_uri")+ <*> (o .:? "client_id")+ <*> (o .:? "client_name")+ <*> (o .:? "client_secret")+ <*> (o .:? "client_secret_expires_at")+ <*> (o .:? "client_uri")+ <*> (o .:? "contacts")+ <*> (o .:? "created_at")+ <*> (o .:? "frontchannel_logout_session_required")+ <*> (o .:? "frontchannel_logout_uri")+ <*> (o .:? "grant_types")+ <*> (o .:? "jwks")+ <*> (o .:? "jwks_uri")+ <*> (o .:? "logo_uri")+ <*> (o .:? "metadata")+ <*> (o .:? "owner")+ <*> (o .:? "policy_uri")+ <*> (o .:? "post_logout_redirect_uris")+ <*> (o .:? "redirect_uris")+ <*> (o .:? "request_object_signing_alg")+ <*> (o .:? "request_uris")+ <*> (o .:? "response_types")+ <*> (o .:? "scope")+ <*> (o .:? "sector_identifier_uri")+ <*> (o .:? "subject_type")+ <*> (o .:? "token_endpoint_auth_method")+ <*> (o .:? "token_endpoint_auth_signing_alg")+ <*> (o .:? "tos_uri")+ <*> (o .:? "updated_at")+ <*> (o .:? "userinfo_signed_response_alg")++-- | ToJSON OAuth2Client+instance A.ToJSON OAuth2Client where+ toJSON OAuth2Client {..} =+ _omitNulls+ [ "allowed_cors_origins" .= oAuth2ClientAllowedCorsOrigins+ , "audience" .= oAuth2ClientAudience+ , "backchannel_logout_session_required" .= oAuth2ClientBackchannelLogoutSessionRequired+ , "backchannel_logout_uri" .= oAuth2ClientBackchannelLogoutUri+ , "client_id" .= oAuth2ClientClientId+ , "client_name" .= oAuth2ClientClientName+ , "client_secret" .= oAuth2ClientClientSecret+ , "client_secret_expires_at" .= oAuth2ClientClientSecretExpiresAt+ , "client_uri" .= oAuth2ClientClientUri+ , "contacts" .= oAuth2ClientContacts+ , "created_at" .= oAuth2ClientCreatedAt+ , "frontchannel_logout_session_required" .= oAuth2ClientFrontchannelLogoutSessionRequired+ , "frontchannel_logout_uri" .= oAuth2ClientFrontchannelLogoutUri+ , "grant_types" .= oAuth2ClientGrantTypes+ , "jwks" .= oAuth2ClientJwks+ , "jwks_uri" .= oAuth2ClientJwksUri+ , "logo_uri" .= oAuth2ClientLogoUri+ , "metadata" .= oAuth2ClientMetadata+ , "owner" .= oAuth2ClientOwner+ , "policy_uri" .= oAuth2ClientPolicyUri+ , "post_logout_redirect_uris" .= oAuth2ClientPostLogoutRedirectUris+ , "redirect_uris" .= oAuth2ClientRedirectUris+ , "request_object_signing_alg" .= oAuth2ClientRequestObjectSigningAlg+ , "request_uris" .= oAuth2ClientRequestUris+ , "response_types" .= oAuth2ClientResponseTypes+ , "scope" .= oAuth2ClientScope+ , "sector_identifier_uri" .= oAuth2ClientSectorIdentifierUri+ , "subject_type" .= oAuth2ClientSubjectType+ , "token_endpoint_auth_method" .= oAuth2ClientTokenEndpointAuthMethod+ , "token_endpoint_auth_signing_alg" .= oAuth2ClientTokenEndpointAuthSigningAlg+ , "tos_uri" .= oAuth2ClientTosUri+ , "updated_at" .= oAuth2ClientUpdatedAt+ , "userinfo_signed_response_alg" .= oAuth2ClientUserinfoSignedResponseAlg+ ]+++-- | Construct a value of type 'OAuth2Client' (by applying it's required fields, if any)+mkOAuth2Client+ :: OAuth2Client+mkOAuth2Client =+ OAuth2Client+ { oAuth2ClientAllowedCorsOrigins = Nothing+ , oAuth2ClientAudience = Nothing+ , oAuth2ClientBackchannelLogoutSessionRequired = Nothing+ , oAuth2ClientBackchannelLogoutUri = Nothing+ , oAuth2ClientClientId = Nothing+ , oAuth2ClientClientName = Nothing+ , oAuth2ClientClientSecret = Nothing+ , oAuth2ClientClientSecretExpiresAt = Nothing+ , oAuth2ClientClientUri = Nothing+ , oAuth2ClientContacts = Nothing+ , oAuth2ClientCreatedAt = Nothing+ , oAuth2ClientFrontchannelLogoutSessionRequired = Nothing+ , oAuth2ClientFrontchannelLogoutUri = Nothing+ , oAuth2ClientGrantTypes = Nothing+ , oAuth2ClientJwks = Nothing+ , oAuth2ClientJwksUri = Nothing+ , oAuth2ClientLogoUri = Nothing+ , oAuth2ClientMetadata = Nothing+ , oAuth2ClientOwner = Nothing+ , oAuth2ClientPolicyUri = Nothing+ , oAuth2ClientPostLogoutRedirectUris = Nothing+ , oAuth2ClientRedirectUris = Nothing+ , oAuth2ClientRequestObjectSigningAlg = Nothing+ , oAuth2ClientRequestUris = Nothing+ , oAuth2ClientResponseTypes = Nothing+ , oAuth2ClientScope = Nothing+ , oAuth2ClientSectorIdentifierUri = Nothing+ , oAuth2ClientSubjectType = Nothing+ , oAuth2ClientTokenEndpointAuthMethod = Nothing+ , oAuth2ClientTokenEndpointAuthSigningAlg = Nothing+ , oAuth2ClientTosUri = Nothing+ , oAuth2ClientUpdatedAt = Nothing+ , oAuth2ClientUserinfoSignedResponseAlg = Nothing+ }++-- ** OAuth2TokenIntrospection+-- | OAuth2TokenIntrospection+-- Introspection contains an access token's session data as specified by IETF RFC 7662, see:+-- +-- https://tools.ietf.org/html/rfc7662+data OAuth2TokenIntrospection = OAuth2TokenIntrospection+ { oAuth2TokenIntrospectionActive :: Bool -- ^ /Required/ "active" - Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token's \"active\" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a \"true\" value return for the \"active\" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).+ , oAuth2TokenIntrospectionAud :: Maybe [Text] -- ^ "aud" - Audience contains a list of the token's intended audiences.+ , oAuth2TokenIntrospectionClientId :: Maybe Text -- ^ "client_id" - ID is aclient identifier for the OAuth 2.0 client that requested this token.+ , oAuth2TokenIntrospectionExp :: Maybe Integer -- ^ "exp" - Expires at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire.+ , oAuth2TokenIntrospectionExt :: Maybe A.Value -- ^ "ext" - Extra is arbitrary data set by the session.+ , oAuth2TokenIntrospectionIat :: Maybe Integer -- ^ "iat" - Issued at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued.+ , oAuth2TokenIntrospectionIss :: Maybe Text -- ^ "iss" - IssuerURL is a string representing the issuer of this token+ , oAuth2TokenIntrospectionNbf :: Maybe Integer -- ^ "nbf" - NotBefore is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before.+ , oAuth2TokenIntrospectionObfuscatedSubject :: Maybe Text -- ^ "obfuscated_subject" - ObfuscatedSubject is set when the subject identifier algorithm was set to \"pairwise\" during authorization. It is the `sub` value of the ID Token that was issued.+ , oAuth2TokenIntrospectionScope :: Maybe Text -- ^ "scope" - Scope is a JSON string containing a space-separated list of scopes associated with this token.+ , oAuth2TokenIntrospectionSub :: Maybe Text -- ^ "sub" - Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.+ , oAuth2TokenIntrospectionTokenType :: Maybe Text -- ^ "token_type" - TokenType is the introspected token's type, typically `Bearer`.+ , oAuth2TokenIntrospectionTokenUse :: Maybe Text -- ^ "token_use" - TokenUse is the introspected token's use, for example `access_token` or `refresh_token`.+ , oAuth2TokenIntrospectionUsername :: Maybe Text -- ^ "username" - Username is a human-readable identifier for the resource owner who authorized this token.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON OAuth2TokenIntrospection+instance A.FromJSON OAuth2TokenIntrospection where+ parseJSON = A.withObject "OAuth2TokenIntrospection" $ \o ->+ OAuth2TokenIntrospection+ <$> (o .: "active")+ <*> (o .:? "aud")+ <*> (o .:? "client_id")+ <*> (o .:? "exp")+ <*> (o .:? "ext")+ <*> (o .:? "iat")+ <*> (o .:? "iss")+ <*> (o .:? "nbf")+ <*> (o .:? "obfuscated_subject")+ <*> (o .:? "scope")+ <*> (o .:? "sub")+ <*> (o .:? "token_type")+ <*> (o .:? "token_use")+ <*> (o .:? "username")++-- | ToJSON OAuth2TokenIntrospection+instance A.ToJSON OAuth2TokenIntrospection where+ toJSON OAuth2TokenIntrospection {..} =+ _omitNulls+ [ "active" .= oAuth2TokenIntrospectionActive+ , "aud" .= oAuth2TokenIntrospectionAud+ , "client_id" .= oAuth2TokenIntrospectionClientId+ , "exp" .= oAuth2TokenIntrospectionExp+ , "ext" .= oAuth2TokenIntrospectionExt+ , "iat" .= oAuth2TokenIntrospectionIat+ , "iss" .= oAuth2TokenIntrospectionIss+ , "nbf" .= oAuth2TokenIntrospectionNbf+ , "obfuscated_subject" .= oAuth2TokenIntrospectionObfuscatedSubject+ , "scope" .= oAuth2TokenIntrospectionScope+ , "sub" .= oAuth2TokenIntrospectionSub+ , "token_type" .= oAuth2TokenIntrospectionTokenType+ , "token_use" .= oAuth2TokenIntrospectionTokenUse+ , "username" .= oAuth2TokenIntrospectionUsername+ ]+++-- | Construct a value of type 'OAuth2TokenIntrospection' (by applying it's required fields, if any)+mkOAuth2TokenIntrospection+ :: Bool -- ^ 'oAuth2TokenIntrospectionActive': Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token's \"active\" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a \"true\" value return for the \"active\" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).+ -> OAuth2TokenIntrospection+mkOAuth2TokenIntrospection oAuth2TokenIntrospectionActive =+ OAuth2TokenIntrospection+ { oAuth2TokenIntrospectionActive+ , oAuth2TokenIntrospectionAud = Nothing+ , oAuth2TokenIntrospectionClientId = Nothing+ , oAuth2TokenIntrospectionExp = Nothing+ , oAuth2TokenIntrospectionExt = Nothing+ , oAuth2TokenIntrospectionIat = Nothing+ , oAuth2TokenIntrospectionIss = Nothing+ , oAuth2TokenIntrospectionNbf = Nothing+ , oAuth2TokenIntrospectionObfuscatedSubject = Nothing+ , oAuth2TokenIntrospectionScope = Nothing+ , oAuth2TokenIntrospectionSub = Nothing+ , oAuth2TokenIntrospectionTokenType = Nothing+ , oAuth2TokenIntrospectionTokenUse = Nothing+ , oAuth2TokenIntrospectionUsername = Nothing+ }++-- ** Oauth2TokenResponse+-- | Oauth2TokenResponse+-- The Access Token Response+data Oauth2TokenResponse = Oauth2TokenResponse+ { oauth2TokenResponseAccessToken :: Maybe Text -- ^ "access_token"+ , oauth2TokenResponseExpiresIn :: Maybe Integer -- ^ "expires_in"+ , oauth2TokenResponseIdToken :: Maybe Text -- ^ "id_token"+ , oauth2TokenResponseRefreshToken :: Maybe Text -- ^ "refresh_token"+ , oauth2TokenResponseScope :: Maybe Text -- ^ "scope"+ , oauth2TokenResponseTokenType :: Maybe Text -- ^ "token_type"+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON Oauth2TokenResponse+instance A.FromJSON Oauth2TokenResponse where+ parseJSON = A.withObject "Oauth2TokenResponse" $ \o ->+ Oauth2TokenResponse+ <$> (o .:? "access_token")+ <*> (o .:? "expires_in")+ <*> (o .:? "id_token")+ <*> (o .:? "refresh_token")+ <*> (o .:? "scope")+ <*> (o .:? "token_type")++-- | ToJSON Oauth2TokenResponse+instance A.ToJSON Oauth2TokenResponse where+ toJSON Oauth2TokenResponse {..} =+ _omitNulls+ [ "access_token" .= oauth2TokenResponseAccessToken+ , "expires_in" .= oauth2TokenResponseExpiresIn+ , "id_token" .= oauth2TokenResponseIdToken+ , "refresh_token" .= oauth2TokenResponseRefreshToken+ , "scope" .= oauth2TokenResponseScope+ , "token_type" .= oauth2TokenResponseTokenType+ ]+++-- | Construct a value of type 'Oauth2TokenResponse' (by applying it's required fields, if any)+mkOauth2TokenResponse+ :: Oauth2TokenResponse+mkOauth2TokenResponse =+ Oauth2TokenResponse+ { oauth2TokenResponseAccessToken = Nothing+ , oauth2TokenResponseExpiresIn = Nothing+ , oauth2TokenResponseIdToken = Nothing+ , oauth2TokenResponseRefreshToken = Nothing+ , oauth2TokenResponseScope = Nothing+ , oauth2TokenResponseTokenType = Nothing+ }++-- ** OpenIDConnectContext+-- | OpenIDConnectContext+-- Contains optional information about the OpenID Connect request.+-- +data OpenIDConnectContext = OpenIDConnectContext+ { openIDConnectContextAcrValues :: Maybe [Text] -- ^ "acr_values" - ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request. It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required. OpenID Connect defines it as follows: > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request, with the values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a Voluntary Claim by this parameter.+ , openIDConnectContextDisplay :: Maybe Text -- ^ "display" - Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User. The defined values are: page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode. popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over. touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface. wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a \"feature phone\" type display. The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.+ , openIDConnectContextIdTokenHintClaims :: Maybe A.Value -- ^ "id_token_hint_claims" - IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the End-User's current or past authenticated session with the Client.+ , openIDConnectContextLoginHint :: Maybe Text -- ^ "login_hint" - LoginHint hints about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is optional.+ , openIDConnectContextUiLocales :: Maybe [Text] -- ^ "ui_locales" - UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value \"fr-CA fr en\" represents a preference for French as spoken in Canada, then French (without a region designation), followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested locales are not supported by the OpenID Provider.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON OpenIDConnectContext+instance A.FromJSON OpenIDConnectContext where+ parseJSON = A.withObject "OpenIDConnectContext" $ \o ->+ OpenIDConnectContext+ <$> (o .:? "acr_values")+ <*> (o .:? "display")+ <*> (o .:? "id_token_hint_claims")+ <*> (o .:? "login_hint")+ <*> (o .:? "ui_locales")++-- | ToJSON OpenIDConnectContext+instance A.ToJSON OpenIDConnectContext where+ toJSON OpenIDConnectContext {..} =+ _omitNulls+ [ "acr_values" .= openIDConnectContextAcrValues+ , "display" .= openIDConnectContextDisplay+ , "id_token_hint_claims" .= openIDConnectContextIdTokenHintClaims+ , "login_hint" .= openIDConnectContextLoginHint+ , "ui_locales" .= openIDConnectContextUiLocales+ ]+++-- | Construct a value of type 'OpenIDConnectContext' (by applying it's required fields, if any)+mkOpenIDConnectContext+ :: OpenIDConnectContext+mkOpenIDConnectContext =+ OpenIDConnectContext+ { openIDConnectContextAcrValues = Nothing+ , openIDConnectContextDisplay = Nothing+ , openIDConnectContextIdTokenHintClaims = Nothing+ , openIDConnectContextLoginHint = Nothing+ , openIDConnectContextUiLocales = Nothing+ }++-- ** PluginConfig+-- | PluginConfig+-- PluginConfig The config of a plugin.+-- +data PluginConfig = PluginConfig+ { pluginConfigArgs :: PluginConfigArgs -- ^ /Required/ "Args"+ , pluginConfigDescription :: Text -- ^ /Required/ "Description" - description+ , pluginConfigDockerVersion :: Maybe Text -- ^ "DockerVersion" - Docker Version used to create the plugin+ , pluginConfigDocumentation :: Text -- ^ /Required/ "Documentation" - documentation+ , pluginConfigEntrypoint :: [Text] -- ^ /Required/ "Entrypoint" - entrypoint+ , pluginConfigEnv :: [PluginEnv] -- ^ /Required/ "Env" - env+ , pluginConfigInterface :: PluginConfigInterface -- ^ /Required/ "Interface"+ , pluginConfigIpcHost :: Bool -- ^ /Required/ "IpcHost" - ipc host+ , pluginConfigLinux :: PluginConfigLinux -- ^ /Required/ "Linux"+ , pluginConfigMounts :: [PluginMount] -- ^ /Required/ "Mounts" - mounts+ , pluginConfigNetwork :: PluginConfigNetwork -- ^ /Required/ "Network"+ , pluginConfigPidHost :: Bool -- ^ /Required/ "PidHost" - pid host+ , pluginConfigPropagatedMount :: Text -- ^ /Required/ "PropagatedMount" - propagated mount+ , pluginConfigUser :: Maybe PluginConfigUser -- ^ "User"+ , pluginConfigWorkDir :: Text -- ^ /Required/ "WorkDir" - work dir+ , pluginConfigRootfs :: Maybe PluginConfigRootfs -- ^ "rootfs"+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfig+instance A.FromJSON PluginConfig where+ parseJSON = A.withObject "PluginConfig" $ \o ->+ PluginConfig+ <$> (o .: "Args")+ <*> (o .: "Description")+ <*> (o .:? "DockerVersion")+ <*> (o .: "Documentation")+ <*> (o .: "Entrypoint")+ <*> (o .: "Env")+ <*> (o .: "Interface")+ <*> (o .: "IpcHost")+ <*> (o .: "Linux")+ <*> (o .: "Mounts")+ <*> (o .: "Network")+ <*> (o .: "PidHost")+ <*> (o .: "PropagatedMount")+ <*> (o .:? "User")+ <*> (o .: "WorkDir")+ <*> (o .:? "rootfs")++-- | ToJSON PluginConfig+instance A.ToJSON PluginConfig where+ toJSON PluginConfig {..} =+ _omitNulls+ [ "Args" .= pluginConfigArgs+ , "Description" .= pluginConfigDescription+ , "DockerVersion" .= pluginConfigDockerVersion+ , "Documentation" .= pluginConfigDocumentation+ , "Entrypoint" .= pluginConfigEntrypoint+ , "Env" .= pluginConfigEnv+ , "Interface" .= pluginConfigInterface+ , "IpcHost" .= pluginConfigIpcHost+ , "Linux" .= pluginConfigLinux+ , "Mounts" .= pluginConfigMounts+ , "Network" .= pluginConfigNetwork+ , "PidHost" .= pluginConfigPidHost+ , "PropagatedMount" .= pluginConfigPropagatedMount+ , "User" .= pluginConfigUser+ , "WorkDir" .= pluginConfigWorkDir+ , "rootfs" .= pluginConfigRootfs+ ]+++-- | Construct a value of type 'PluginConfig' (by applying it's required fields, if any)+mkPluginConfig+ :: PluginConfigArgs -- ^ 'pluginConfigArgs' + -> Text -- ^ 'pluginConfigDescription': description+ -> Text -- ^ 'pluginConfigDocumentation': documentation+ -> [Text] -- ^ 'pluginConfigEntrypoint': entrypoint+ -> [PluginEnv] -- ^ 'pluginConfigEnv': env+ -> PluginConfigInterface -- ^ 'pluginConfigInterface' + -> Bool -- ^ 'pluginConfigIpcHost': ipc host+ -> PluginConfigLinux -- ^ 'pluginConfigLinux' + -> [PluginMount] -- ^ 'pluginConfigMounts': mounts+ -> PluginConfigNetwork -- ^ 'pluginConfigNetwork' + -> Bool -- ^ 'pluginConfigPidHost': pid host+ -> Text -- ^ 'pluginConfigPropagatedMount': propagated mount+ -> Text -- ^ 'pluginConfigWorkDir': work dir+ -> PluginConfig+mkPluginConfig pluginConfigArgs pluginConfigDescription pluginConfigDocumentation pluginConfigEntrypoint pluginConfigEnv pluginConfigInterface pluginConfigIpcHost pluginConfigLinux pluginConfigMounts pluginConfigNetwork pluginConfigPidHost pluginConfigPropagatedMount pluginConfigWorkDir =+ PluginConfig+ { pluginConfigArgs+ , pluginConfigDescription+ , pluginConfigDockerVersion = Nothing+ , pluginConfigDocumentation+ , pluginConfigEntrypoint+ , pluginConfigEnv+ , pluginConfigInterface+ , pluginConfigIpcHost+ , pluginConfigLinux+ , pluginConfigMounts+ , pluginConfigNetwork+ , pluginConfigPidHost+ , pluginConfigPropagatedMount+ , pluginConfigUser = Nothing+ , pluginConfigWorkDir+ , pluginConfigRootfs = Nothing+ }++-- ** PluginConfigArgs+-- | PluginConfigArgs+-- PluginConfigArgs plugin config args+data PluginConfigArgs = PluginConfigArgs+ { pluginConfigArgsDescription :: Text -- ^ /Required/ "Description" - description+ , pluginConfigArgsName :: Text -- ^ /Required/ "Name" - name+ , pluginConfigArgsSettable :: [Text] -- ^ /Required/ "Settable" - settable+ , pluginConfigArgsValue :: [Text] -- ^ /Required/ "Value" - value+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigArgs+instance A.FromJSON PluginConfigArgs where+ parseJSON = A.withObject "PluginConfigArgs" $ \o ->+ PluginConfigArgs+ <$> (o .: "Description")+ <*> (o .: "Name")+ <*> (o .: "Settable")+ <*> (o .: "Value")++-- | ToJSON PluginConfigArgs+instance A.ToJSON PluginConfigArgs where+ toJSON PluginConfigArgs {..} =+ _omitNulls+ [ "Description" .= pluginConfigArgsDescription+ , "Name" .= pluginConfigArgsName+ , "Settable" .= pluginConfigArgsSettable+ , "Value" .= pluginConfigArgsValue+ ]+++-- | Construct a value of type 'PluginConfigArgs' (by applying it's required fields, if any)+mkPluginConfigArgs+ :: Text -- ^ 'pluginConfigArgsDescription': description+ -> Text -- ^ 'pluginConfigArgsName': name+ -> [Text] -- ^ 'pluginConfigArgsSettable': settable+ -> [Text] -- ^ 'pluginConfigArgsValue': value+ -> PluginConfigArgs+mkPluginConfigArgs pluginConfigArgsDescription pluginConfigArgsName pluginConfigArgsSettable pluginConfigArgsValue =+ PluginConfigArgs+ { pluginConfigArgsDescription+ , pluginConfigArgsName+ , pluginConfigArgsSettable+ , pluginConfigArgsValue+ }++-- ** PluginConfigInterface+-- | PluginConfigInterface+-- PluginConfigInterface The interface between Docker and the plugin+data PluginConfigInterface = PluginConfigInterface+ { pluginConfigInterfaceSocket :: Text -- ^ /Required/ "Socket" - socket+ , pluginConfigInterfaceTypes :: [PluginInterfaceType] -- ^ /Required/ "Types" - types+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigInterface+instance A.FromJSON PluginConfigInterface where+ parseJSON = A.withObject "PluginConfigInterface" $ \o ->+ PluginConfigInterface+ <$> (o .: "Socket")+ <*> (o .: "Types")++-- | ToJSON PluginConfigInterface+instance A.ToJSON PluginConfigInterface where+ toJSON PluginConfigInterface {..} =+ _omitNulls+ [ "Socket" .= pluginConfigInterfaceSocket+ , "Types" .= pluginConfigInterfaceTypes+ ]+++-- | Construct a value of type 'PluginConfigInterface' (by applying it's required fields, if any)+mkPluginConfigInterface+ :: Text -- ^ 'pluginConfigInterfaceSocket': socket+ -> [PluginInterfaceType] -- ^ 'pluginConfigInterfaceTypes': types+ -> PluginConfigInterface+mkPluginConfigInterface pluginConfigInterfaceSocket pluginConfigInterfaceTypes =+ PluginConfigInterface+ { pluginConfigInterfaceSocket+ , pluginConfigInterfaceTypes+ }++-- ** PluginConfigLinux+-- | PluginConfigLinux+-- PluginConfigLinux plugin config linux+data PluginConfigLinux = PluginConfigLinux+ { pluginConfigLinuxAllowAllDevices :: Bool -- ^ /Required/ "AllowAllDevices" - allow all devices+ , pluginConfigLinuxCapabilities :: [Text] -- ^ /Required/ "Capabilities" - capabilities+ , pluginConfigLinuxDevices :: [PluginDevice] -- ^ /Required/ "Devices" - devices+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigLinux+instance A.FromJSON PluginConfigLinux where+ parseJSON = A.withObject "PluginConfigLinux" $ \o ->+ PluginConfigLinux+ <$> (o .: "AllowAllDevices")+ <*> (o .: "Capabilities")+ <*> (o .: "Devices")++-- | ToJSON PluginConfigLinux+instance A.ToJSON PluginConfigLinux where+ toJSON PluginConfigLinux {..} =+ _omitNulls+ [ "AllowAllDevices" .= pluginConfigLinuxAllowAllDevices+ , "Capabilities" .= pluginConfigLinuxCapabilities+ , "Devices" .= pluginConfigLinuxDevices+ ]+++-- | Construct a value of type 'PluginConfigLinux' (by applying it's required fields, if any)+mkPluginConfigLinux+ :: Bool -- ^ 'pluginConfigLinuxAllowAllDevices': allow all devices+ -> [Text] -- ^ 'pluginConfigLinuxCapabilities': capabilities+ -> [PluginDevice] -- ^ 'pluginConfigLinuxDevices': devices+ -> PluginConfigLinux+mkPluginConfigLinux pluginConfigLinuxAllowAllDevices pluginConfigLinuxCapabilities pluginConfigLinuxDevices =+ PluginConfigLinux+ { pluginConfigLinuxAllowAllDevices+ , pluginConfigLinuxCapabilities+ , pluginConfigLinuxDevices+ }++-- ** PluginConfigNetwork+-- | PluginConfigNetwork+-- PluginConfigNetwork plugin config network+data PluginConfigNetwork = PluginConfigNetwork+ { pluginConfigNetworkType :: Text -- ^ /Required/ "Type" - type+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigNetwork+instance A.FromJSON PluginConfigNetwork where+ parseJSON = A.withObject "PluginConfigNetwork" $ \o ->+ PluginConfigNetwork+ <$> (o .: "Type")++-- | ToJSON PluginConfigNetwork+instance A.ToJSON PluginConfigNetwork where+ toJSON PluginConfigNetwork {..} =+ _omitNulls+ [ "Type" .= pluginConfigNetworkType+ ]+++-- | Construct a value of type 'PluginConfigNetwork' (by applying it's required fields, if any)+mkPluginConfigNetwork+ :: Text -- ^ 'pluginConfigNetworkType': type+ -> PluginConfigNetwork+mkPluginConfigNetwork pluginConfigNetworkType =+ PluginConfigNetwork+ { pluginConfigNetworkType+ }++-- ** PluginConfigRootfs+-- | PluginConfigRootfs+-- PluginConfigRootfs plugin config rootfs+data PluginConfigRootfs = PluginConfigRootfs+ { pluginConfigRootfsDiffIds :: Maybe [Text] -- ^ "diff_ids" - diff ids+ , pluginConfigRootfsType :: Maybe Text -- ^ "type" - type+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigRootfs+instance A.FromJSON PluginConfigRootfs where+ parseJSON = A.withObject "PluginConfigRootfs" $ \o ->+ PluginConfigRootfs+ <$> (o .:? "diff_ids")+ <*> (o .:? "type")++-- | ToJSON PluginConfigRootfs+instance A.ToJSON PluginConfigRootfs where+ toJSON PluginConfigRootfs {..} =+ _omitNulls+ [ "diff_ids" .= pluginConfigRootfsDiffIds+ , "type" .= pluginConfigRootfsType+ ]+++-- | Construct a value of type 'PluginConfigRootfs' (by applying it's required fields, if any)+mkPluginConfigRootfs+ :: PluginConfigRootfs+mkPluginConfigRootfs =+ PluginConfigRootfs+ { pluginConfigRootfsDiffIds = Nothing+ , pluginConfigRootfsType = Nothing+ }++-- ** PluginConfigUser+-- | PluginConfigUser+-- PluginConfigUser plugin config user+data PluginConfigUser = PluginConfigUser+ { pluginConfigUserGid :: Maybe Int -- ^ "GID" - g ID+ , pluginConfigUserUid :: Maybe Int -- ^ "UID" - UID+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginConfigUser+instance A.FromJSON PluginConfigUser where+ parseJSON = A.withObject "PluginConfigUser" $ \o ->+ PluginConfigUser+ <$> (o .:? "GID")+ <*> (o .:? "UID")++-- | ToJSON PluginConfigUser+instance A.ToJSON PluginConfigUser where+ toJSON PluginConfigUser {..} =+ _omitNulls+ [ "GID" .= pluginConfigUserGid+ , "UID" .= pluginConfigUserUid+ ]+++-- | Construct a value of type 'PluginConfigUser' (by applying it's required fields, if any)+mkPluginConfigUser+ :: PluginConfigUser+mkPluginConfigUser =+ PluginConfigUser+ { pluginConfigUserGid = Nothing+ , pluginConfigUserUid = Nothing+ }++-- ** PluginDevice+-- | PluginDevice+-- PluginDevice plugin device+data PluginDevice = PluginDevice+ { pluginDeviceDescription :: Text -- ^ /Required/ "Description" - description+ , pluginDeviceName :: Text -- ^ /Required/ "Name" - name+ , pluginDevicePath :: Text -- ^ /Required/ "Path" - path+ , pluginDeviceSettable :: [Text] -- ^ /Required/ "Settable" - settable+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginDevice+instance A.FromJSON PluginDevice where+ parseJSON = A.withObject "PluginDevice" $ \o ->+ PluginDevice+ <$> (o .: "Description")+ <*> (o .: "Name")+ <*> (o .: "Path")+ <*> (o .: "Settable")++-- | ToJSON PluginDevice+instance A.ToJSON PluginDevice where+ toJSON PluginDevice {..} =+ _omitNulls+ [ "Description" .= pluginDeviceDescription+ , "Name" .= pluginDeviceName+ , "Path" .= pluginDevicePath+ , "Settable" .= pluginDeviceSettable+ ]+++-- | Construct a value of type 'PluginDevice' (by applying it's required fields, if any)+mkPluginDevice+ :: Text -- ^ 'pluginDeviceDescription': description+ -> Text -- ^ 'pluginDeviceName': name+ -> Text -- ^ 'pluginDevicePath': path+ -> [Text] -- ^ 'pluginDeviceSettable': settable+ -> PluginDevice+mkPluginDevice pluginDeviceDescription pluginDeviceName pluginDevicePath pluginDeviceSettable =+ PluginDevice+ { pluginDeviceDescription+ , pluginDeviceName+ , pluginDevicePath+ , pluginDeviceSettable+ }++-- ** PluginEnv+-- | PluginEnv+-- PluginEnv plugin env+data PluginEnv = PluginEnv+ { pluginEnvDescription :: Text -- ^ /Required/ "Description" - description+ , pluginEnvName :: Text -- ^ /Required/ "Name" - name+ , pluginEnvSettable :: [Text] -- ^ /Required/ "Settable" - settable+ , pluginEnvValue :: Text -- ^ /Required/ "Value" - value+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginEnv+instance A.FromJSON PluginEnv where+ parseJSON = A.withObject "PluginEnv" $ \o ->+ PluginEnv+ <$> (o .: "Description")+ <*> (o .: "Name")+ <*> (o .: "Settable")+ <*> (o .: "Value")++-- | ToJSON PluginEnv+instance A.ToJSON PluginEnv where+ toJSON PluginEnv {..} =+ _omitNulls+ [ "Description" .= pluginEnvDescription+ , "Name" .= pluginEnvName+ , "Settable" .= pluginEnvSettable+ , "Value" .= pluginEnvValue+ ]+++-- | Construct a value of type 'PluginEnv' (by applying it's required fields, if any)+mkPluginEnv+ :: Text -- ^ 'pluginEnvDescription': description+ -> Text -- ^ 'pluginEnvName': name+ -> [Text] -- ^ 'pluginEnvSettable': settable+ -> Text -- ^ 'pluginEnvValue': value+ -> PluginEnv+mkPluginEnv pluginEnvDescription pluginEnvName pluginEnvSettable pluginEnvValue =+ PluginEnv+ { pluginEnvDescription+ , pluginEnvName+ , pluginEnvSettable+ , pluginEnvValue+ }++-- ** PluginInterfaceType+-- | PluginInterfaceType+-- PluginInterfaceType plugin interface type+data PluginInterfaceType = PluginInterfaceType+ { pluginInterfaceTypeCapability :: Text -- ^ /Required/ "Capability" - capability+ , pluginInterfaceTypePrefix :: Text -- ^ /Required/ "Prefix" - prefix+ , pluginInterfaceTypeVersion :: Text -- ^ /Required/ "Version" - version+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginInterfaceType+instance A.FromJSON PluginInterfaceType where+ parseJSON = A.withObject "PluginInterfaceType" $ \o ->+ PluginInterfaceType+ <$> (o .: "Capability")+ <*> (o .: "Prefix")+ <*> (o .: "Version")++-- | ToJSON PluginInterfaceType+instance A.ToJSON PluginInterfaceType where+ toJSON PluginInterfaceType {..} =+ _omitNulls+ [ "Capability" .= pluginInterfaceTypeCapability+ , "Prefix" .= pluginInterfaceTypePrefix+ , "Version" .= pluginInterfaceTypeVersion+ ]+++-- | Construct a value of type 'PluginInterfaceType' (by applying it's required fields, if any)+mkPluginInterfaceType+ :: Text -- ^ 'pluginInterfaceTypeCapability': capability+ -> Text -- ^ 'pluginInterfaceTypePrefix': prefix+ -> Text -- ^ 'pluginInterfaceTypeVersion': version+ -> PluginInterfaceType+mkPluginInterfaceType pluginInterfaceTypeCapability pluginInterfaceTypePrefix pluginInterfaceTypeVersion =+ PluginInterfaceType+ { pluginInterfaceTypeCapability+ , pluginInterfaceTypePrefix+ , pluginInterfaceTypeVersion+ }++-- ** PluginMount+-- | PluginMount+-- PluginMount plugin mount+data PluginMount = PluginMount+ { pluginMountDescription :: Text -- ^ /Required/ "Description" - description+ , pluginMountDestination :: Text -- ^ /Required/ "Destination" - destination+ , pluginMountName :: Text -- ^ /Required/ "Name" - name+ , pluginMountOptions :: [Text] -- ^ /Required/ "Options" - options+ , pluginMountSettable :: [Text] -- ^ /Required/ "Settable" - settable+ , pluginMountSource :: Text -- ^ /Required/ "Source" - source+ , pluginMountType :: Text -- ^ /Required/ "Type" - type+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginMount+instance A.FromJSON PluginMount where+ parseJSON = A.withObject "PluginMount" $ \o ->+ PluginMount+ <$> (o .: "Description")+ <*> (o .: "Destination")+ <*> (o .: "Name")+ <*> (o .: "Options")+ <*> (o .: "Settable")+ <*> (o .: "Source")+ <*> (o .: "Type")++-- | ToJSON PluginMount+instance A.ToJSON PluginMount where+ toJSON PluginMount {..} =+ _omitNulls+ [ "Description" .= pluginMountDescription+ , "Destination" .= pluginMountDestination+ , "Name" .= pluginMountName+ , "Options" .= pluginMountOptions+ , "Settable" .= pluginMountSettable+ , "Source" .= pluginMountSource+ , "Type" .= pluginMountType+ ]+++-- | Construct a value of type 'PluginMount' (by applying it's required fields, if any)+mkPluginMount+ :: Text -- ^ 'pluginMountDescription': description+ -> Text -- ^ 'pluginMountDestination': destination+ -> Text -- ^ 'pluginMountName': name+ -> [Text] -- ^ 'pluginMountOptions': options+ -> [Text] -- ^ 'pluginMountSettable': settable+ -> Text -- ^ 'pluginMountSource': source+ -> Text -- ^ 'pluginMountType': type+ -> PluginMount+mkPluginMount pluginMountDescription pluginMountDestination pluginMountName pluginMountOptions pluginMountSettable pluginMountSource pluginMountType =+ PluginMount+ { pluginMountDescription+ , pluginMountDestination+ , pluginMountName+ , pluginMountOptions+ , pluginMountSettable+ , pluginMountSource+ , pluginMountType+ }++-- ** PluginSettings+-- | PluginSettings+-- PluginSettings Settings that can be modified by users.+-- +data PluginSettings = PluginSettings+ { pluginSettingsArgs :: [Text] -- ^ /Required/ "Args" - args+ , pluginSettingsDevices :: [PluginDevice] -- ^ /Required/ "Devices" - devices+ , pluginSettingsEnv :: [Text] -- ^ /Required/ "Env" - env+ , pluginSettingsMounts :: [PluginMount] -- ^ /Required/ "Mounts" - mounts+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PluginSettings+instance A.FromJSON PluginSettings where+ parseJSON = A.withObject "PluginSettings" $ \o ->+ PluginSettings+ <$> (o .: "Args")+ <*> (o .: "Devices")+ <*> (o .: "Env")+ <*> (o .: "Mounts")++-- | ToJSON PluginSettings+instance A.ToJSON PluginSettings where+ toJSON PluginSettings {..} =+ _omitNulls+ [ "Args" .= pluginSettingsArgs+ , "Devices" .= pluginSettingsDevices+ , "Env" .= pluginSettingsEnv+ , "Mounts" .= pluginSettingsMounts+ ]+++-- | Construct a value of type 'PluginSettings' (by applying it's required fields, if any)+mkPluginSettings+ :: [Text] -- ^ 'pluginSettingsArgs': args+ -> [PluginDevice] -- ^ 'pluginSettingsDevices': devices+ -> [Text] -- ^ 'pluginSettingsEnv': env+ -> [PluginMount] -- ^ 'pluginSettingsMounts': mounts+ -> PluginSettings+mkPluginSettings pluginSettingsArgs pluginSettingsDevices pluginSettingsEnv pluginSettingsMounts =+ PluginSettings+ { pluginSettingsArgs+ , pluginSettingsDevices+ , pluginSettingsEnv+ , pluginSettingsMounts+ }++-- ** PreviousConsentSession+-- | PreviousConsentSession+-- The response used to return used consent requests same as HandledLoginRequest, just with consent_request exposed as json+data PreviousConsentSession = PreviousConsentSession+ { previousConsentSessionConsentRequest :: Maybe ConsentRequest -- ^ "consent_request"+ , previousConsentSessionGrantAccessTokenAudience :: Maybe [Text] -- ^ "grant_access_token_audience"+ , previousConsentSessionGrantScope :: Maybe [Text] -- ^ "grant_scope"+ , previousConsentSessionHandledAt :: Maybe DateTime -- ^ "handled_at"+ , previousConsentSessionRemember :: Maybe Bool -- ^ "remember" - Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same client asks the same user for the same, or a subset of, scope.+ , previousConsentSessionRememberFor :: Maybe Integer -- ^ "remember_for" - RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the authorization will be remembered indefinitely.+ , previousConsentSessionSession :: Maybe ConsentRequestSession -- ^ "session"+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON PreviousConsentSession+instance A.FromJSON PreviousConsentSession where+ parseJSON = A.withObject "PreviousConsentSession" $ \o ->+ PreviousConsentSession+ <$> (o .:? "consent_request")+ <*> (o .:? "grant_access_token_audience")+ <*> (o .:? "grant_scope")+ <*> (o .:? "handled_at")+ <*> (o .:? "remember")+ <*> (o .:? "remember_for")+ <*> (o .:? "session")++-- | ToJSON PreviousConsentSession+instance A.ToJSON PreviousConsentSession where+ toJSON PreviousConsentSession {..} =+ _omitNulls+ [ "consent_request" .= previousConsentSessionConsentRequest+ , "grant_access_token_audience" .= previousConsentSessionGrantAccessTokenAudience+ , "grant_scope" .= previousConsentSessionGrantScope+ , "handled_at" .= previousConsentSessionHandledAt+ , "remember" .= previousConsentSessionRemember+ , "remember_for" .= previousConsentSessionRememberFor+ , "session" .= previousConsentSessionSession+ ]+++-- | Construct a value of type 'PreviousConsentSession' (by applying it's required fields, if any)+mkPreviousConsentSession+ :: PreviousConsentSession+mkPreviousConsentSession =+ PreviousConsentSession+ { previousConsentSessionConsentRequest = Nothing+ , previousConsentSessionGrantAccessTokenAudience = Nothing+ , previousConsentSessionGrantScope = Nothing+ , previousConsentSessionHandledAt = Nothing+ , previousConsentSessionRemember = Nothing+ , previousConsentSessionRememberFor = Nothing+ , previousConsentSessionSession = Nothing+ }++-- ** RejectRequest+-- | RejectRequest+-- The request payload used to accept a login or consent request.+-- +data RejectRequest = RejectRequest+ { rejectRequestError :: Maybe Text -- ^ "error" - The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`). Defaults to `request_denied`.+ , rejectRequestErrorDebug :: Maybe Text -- ^ "error_debug" - Debug contains information to help resolve the problem as a developer. Usually not exposed to the public but only in the server logs.+ , rejectRequestErrorDescription :: Maybe Text -- ^ "error_description" - Description of the error in a human readable format.+ , rejectRequestErrorHint :: Maybe Text -- ^ "error_hint" - Hint to help resolve the error.+ , rejectRequestStatusCode :: Maybe Integer -- ^ "status_code" - Represents the HTTP status code of the error (e.g. 401 or 403) Defaults to 400+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON RejectRequest+instance A.FromJSON RejectRequest where+ parseJSON = A.withObject "RejectRequest" $ \o ->+ RejectRequest+ <$> (o .:? "error")+ <*> (o .:? "error_debug")+ <*> (o .:? "error_description")+ <*> (o .:? "error_hint")+ <*> (o .:? "status_code")++-- | ToJSON RejectRequest+instance A.ToJSON RejectRequest where+ toJSON RejectRequest {..} =+ _omitNulls+ [ "error" .= rejectRequestError+ , "error_debug" .= rejectRequestErrorDebug+ , "error_description" .= rejectRequestErrorDescription+ , "error_hint" .= rejectRequestErrorHint+ , "status_code" .= rejectRequestStatusCode+ ]++-- | FromForm RejectRequest+instance WH.FromForm RejectRequest where+ fromForm f =+ RejectRequest+ <$> (WH.parseMaybe "error" f)+ <*> (WH.parseMaybe "error_debug" f)+ <*> (WH.parseMaybe "error_description" f)+ <*> (WH.parseMaybe "error_hint" f)+ <*> (WH.parseMaybe "status_code" f)++-- | ToForm RejectRequest+instance WH.ToForm RejectRequest where+ toForm RejectRequest {..} =+ WH.Form $ HM.fromList $ P.catMaybes $+ [ _toFormItem "error" (rejectRequestError)+ , _toFormItem "error_debug" (rejectRequestErrorDebug)+ , _toFormItem "error_description" (rejectRequestErrorDescription)+ , _toFormItem "error_hint" (rejectRequestErrorHint)+ , _toFormItem "status_code" (rejectRequestStatusCode)+ ]++-- | Construct a value of type 'RejectRequest' (by applying it's required fields, if any)+mkRejectRequest+ :: RejectRequest+mkRejectRequest =+ RejectRequest+ { rejectRequestError = Nothing+ , rejectRequestErrorDebug = Nothing+ , rejectRequestErrorDescription = Nothing+ , rejectRequestErrorHint = Nothing+ , rejectRequestStatusCode = Nothing+ }++-- ** UserinfoResponse+-- | UserinfoResponse+-- The userinfo response+data UserinfoResponse = UserinfoResponse+ { userinfoResponseBirthdate :: Maybe Text -- ^ "birthdate" - End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004] YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted. To represent only the year, YYYY format is allowed. Note that depending on the underlying platform's date related function, providing just year can result in varying month and day, so the implementers need to take this factor into account to correctly process the dates.+ , userinfoResponseEmail :: Maybe Text -- ^ "email" - End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7.+ , userinfoResponseEmailVerified :: Maybe Bool -- ^ "email_verified" - True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e-mail address was controlled by the End-User at the time the verification was performed. The means by which an e-mail address is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating.+ , userinfoResponseFamilyName :: Maybe Text -- ^ "family_name" - Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters.+ , userinfoResponseGender :: Maybe Text -- ^ "gender" - End-User's gender. Values defined by this specification are female and male. Other values MAY be used when neither of the defined values are applicable.+ , userinfoResponseGivenName :: Maybe Text -- ^ "given_name" - Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.+ , userinfoResponseLocale :: Maybe Text -- ^ "locale" - End-User's locale, represented as a BCP47 [RFC5646] language tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in lowercase and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code in uppercase, separated by a dash. For example, en-US or fr-CA. As a compatibility note, some implementations have used an underscore as the separator rather than a dash, for example, en_US; Relying Parties MAY choose to accept this locale syntax as well.+ , userinfoResponseMiddleName :: Maybe Text -- ^ "middle_name" - Middle name(s) of the End-User. Note that in some cultures, people can have multiple middle names; all can be present, with the names being separated by space characters. Also note that in some cultures, middle names are not used.+ , userinfoResponseName :: Maybe Text -- ^ "name" - End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences.+ , userinfoResponseNickname :: Maybe Text -- ^ "nickname" - Casual name of the End-User that may or may not be the same as the given_name. For instance, a nickname value of Mike might be returned alongside a given_name value of Michael.+ , userinfoResponsePhoneNumber :: Maybe Text -- ^ "phone_number" - End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2) 687 2400. If the phone number contains an extension, it is RECOMMENDED that the extension be represented using the RFC 3966 [RFC3966] extension syntax, for example, +1 (604) 555-1234;ext=5678.+ , userinfoResponsePhoneNumberVerified :: Maybe Bool -- ^ "phone_number_verified" - True if the End-User's phone number has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this phone number was controlled by the End-User at the time the verification was performed. The means by which a phone number is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating. When true, the phone_number Claim MUST be in E.164 format and any extensions MUST be represented in RFC 3966 format.+ , userinfoResponsePicture :: Maybe Text -- ^ "picture" - URL of the End-User's profile picture. This URL MUST refer to an image file (for example, a PNG, JPEG, or GIF image file), rather than to a Web page containing an image. Note that this URL SHOULD specifically reference a profile photo of the End-User suitable for displaying when describing the End-User, rather than an arbitrary photo taken by the End-User.+ , userinfoResponsePreferredUsername :: Maybe Text -- ^ "preferred_username" - Non-unique shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or whitespace.+ , userinfoResponseProfile :: Maybe Text -- ^ "profile" - URL of the End-User's profile page. The contents of this Web page SHOULD be about the End-User.+ , userinfoResponseSub :: Maybe Text -- ^ "sub" - Subject - Identifier for the End-User at the IssuerURL.+ , userinfoResponseUpdatedAt :: Maybe Integer -- ^ "updated_at" - Time the End-User's information was last updated. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.+ , userinfoResponseWebsite :: Maybe Text -- ^ "website" - URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an organization that the End-User is affiliated with.+ , userinfoResponseZoneinfo :: Maybe Text -- ^ "zoneinfo" - String from zoneinfo [zoneinfo] time zone database representing the End-User's time zone. For example, Europe/Paris or America/Los_Angeles.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON UserinfoResponse+instance A.FromJSON UserinfoResponse where+ parseJSON = A.withObject "UserinfoResponse" $ \o ->+ UserinfoResponse+ <$> (o .:? "birthdate")+ <*> (o .:? "email")+ <*> (o .:? "email_verified")+ <*> (o .:? "family_name")+ <*> (o .:? "gender")+ <*> (o .:? "given_name")+ <*> (o .:? "locale")+ <*> (o .:? "middle_name")+ <*> (o .:? "name")+ <*> (o .:? "nickname")+ <*> (o .:? "phone_number")+ <*> (o .:? "phone_number_verified")+ <*> (o .:? "picture")+ <*> (o .:? "preferred_username")+ <*> (o .:? "profile")+ <*> (o .:? "sub")+ <*> (o .:? "updated_at")+ <*> (o .:? "website")+ <*> (o .:? "zoneinfo")++-- | ToJSON UserinfoResponse+instance A.ToJSON UserinfoResponse where+ toJSON UserinfoResponse {..} =+ _omitNulls+ [ "birthdate" .= userinfoResponseBirthdate+ , "email" .= userinfoResponseEmail+ , "email_verified" .= userinfoResponseEmailVerified+ , "family_name" .= userinfoResponseFamilyName+ , "gender" .= userinfoResponseGender+ , "given_name" .= userinfoResponseGivenName+ , "locale" .= userinfoResponseLocale+ , "middle_name" .= userinfoResponseMiddleName+ , "name" .= userinfoResponseName+ , "nickname" .= userinfoResponseNickname+ , "phone_number" .= userinfoResponsePhoneNumber+ , "phone_number_verified" .= userinfoResponsePhoneNumberVerified+ , "picture" .= userinfoResponsePicture+ , "preferred_username" .= userinfoResponsePreferredUsername+ , "profile" .= userinfoResponseProfile+ , "sub" .= userinfoResponseSub+ , "updated_at" .= userinfoResponseUpdatedAt+ , "website" .= userinfoResponseWebsite+ , "zoneinfo" .= userinfoResponseZoneinfo+ ]+++-- | Construct a value of type 'UserinfoResponse' (by applying it's required fields, if any)+mkUserinfoResponse+ :: UserinfoResponse+mkUserinfoResponse =+ UserinfoResponse+ { userinfoResponseBirthdate = Nothing+ , userinfoResponseEmail = Nothing+ , userinfoResponseEmailVerified = Nothing+ , userinfoResponseFamilyName = Nothing+ , userinfoResponseGender = Nothing+ , userinfoResponseGivenName = Nothing+ , userinfoResponseLocale = Nothing+ , userinfoResponseMiddleName = Nothing+ , userinfoResponseName = Nothing+ , userinfoResponseNickname = Nothing+ , userinfoResponsePhoneNumber = Nothing+ , userinfoResponsePhoneNumberVerified = Nothing+ , userinfoResponsePicture = Nothing+ , userinfoResponsePreferredUsername = Nothing+ , userinfoResponseProfile = Nothing+ , userinfoResponseSub = Nothing+ , userinfoResponseUpdatedAt = Nothing+ , userinfoResponseWebsite = Nothing+ , userinfoResponseZoneinfo = Nothing+ }++-- ** Version+-- | Version+data Version = Version+ { versionVersion :: Maybe Text -- ^ "version" - Version is the service's version.+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON Version+instance A.FromJSON Version where+ parseJSON = A.withObject "Version" $ \o ->+ Version+ <$> (o .:? "version")++-- | ToJSON Version+instance A.ToJSON Version where+ toJSON Version {..} =+ _omitNulls+ [ "version" .= versionVersion+ ]+++-- | Construct a value of type 'Version' (by applying it's required fields, if any)+mkVersion+ :: Version+mkVersion =+ Version+ { versionVersion = Nothing+ }++-- ** VolumeUsageData+-- | VolumeUsageData+-- VolumeUsageData Usage details about the volume. This information is used by the `GET /system/df` endpoint, and omitted in other endpoints.+data VolumeUsageData = VolumeUsageData+ { volumeUsageDataRefCount :: Integer -- ^ /Required/ "RefCount" - The number of containers referencing this volume. This field is set to `-1` if the reference-count is not available.+ , volumeUsageDataSize :: Integer -- ^ /Required/ "Size" - Amount of disk space used by the volume (in bytes). This information is only available for volumes created with the `\"local\"` volume driver. For volumes created with other volume drivers, this field is set to `-1` (\"not available\")+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON VolumeUsageData+instance A.FromJSON VolumeUsageData where+ parseJSON = A.withObject "VolumeUsageData" $ \o ->+ VolumeUsageData+ <$> (o .: "RefCount")+ <*> (o .: "Size")++-- | ToJSON VolumeUsageData+instance A.ToJSON VolumeUsageData where+ toJSON VolumeUsageData {..} =+ _omitNulls+ [ "RefCount" .= volumeUsageDataRefCount+ , "Size" .= volumeUsageDataSize+ ]+++-- | Construct a value of type 'VolumeUsageData' (by applying it's required fields, if any)+mkVolumeUsageData+ :: Integer -- ^ 'volumeUsageDataRefCount': The number of containers referencing this volume. This field is set to `-1` if the reference-count is not available.+ -> Integer -- ^ 'volumeUsageDataSize': Amount of disk space used by the volume (in bytes). This information is only available for volumes created with the `\"local\"` volume driver. For volumes created with other volume drivers, this field is set to `-1` (\"not available\")+ -> VolumeUsageData+mkVolumeUsageData volumeUsageDataRefCount volumeUsageDataSize =+ VolumeUsageData+ { volumeUsageDataRefCount+ , volumeUsageDataSize+ }++-- ** WellKnown+-- | WellKnown+-- WellKnown represents important OpenID Connect discovery metadata+-- +-- It includes links to several endpoints (e.g. /oauth2/token) and exposes information on supported signature algorithms among others.+data WellKnown = WellKnown+ { wellKnownAuthorizationEndpoint :: Text -- ^ /Required/ "authorization_endpoint" - URL of the OP's OAuth 2.0 Authorization Endpoint.+ , wellKnownBackchannelLogoutSessionSupported :: Maybe Bool -- ^ "backchannel_logout_session_supported" - Boolean value specifying whether the OP can pass a sid (session ID) Claim in the Logout Token to identify the RP session with the OP. If supported, the sid Claim is also included in ID Tokens issued by the OP+ , wellKnownBackchannelLogoutSupported :: Maybe Bool -- ^ "backchannel_logout_supported" - Boolean value specifying whether the OP supports back-channel logout, with true indicating support.+ , wellKnownClaimsParameterSupported :: Maybe Bool -- ^ "claims_parameter_supported" - Boolean value specifying whether the OP supports use of the claims parameter, with true indicating support.+ , wellKnownClaimsSupported :: Maybe [Text] -- ^ "claims_supported" - JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.+ , wellKnownEndSessionEndpoint :: Maybe Text -- ^ "end_session_endpoint" - URL at the OP to which an RP can perform a redirect to request that the End-User be logged out at the OP.+ , wellKnownFrontchannelLogoutSessionSupported :: Maybe Bool -- ^ "frontchannel_logout_session_supported" - Boolean value specifying whether the OP can pass iss (issuer) and sid (session ID) query parameters to identify the RP session with the OP when the frontchannel_logout_uri is used. If supported, the sid Claim is also included in ID Tokens issued by the OP.+ , wellKnownFrontchannelLogoutSupported :: Maybe Bool -- ^ "frontchannel_logout_supported" - Boolean value specifying whether the OP supports HTTP-based logout, with true indicating support.+ , wellKnownGrantTypesSupported :: Maybe [Text] -- ^ "grant_types_supported" - JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports.+ , wellKnownIdTokenSigningAlgValuesSupported :: [Text] -- ^ /Required/ "id_token_signing_alg_values_supported" - JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT.+ , wellKnownIssuer :: Text -- ^ /Required/ "issuer" - URL using the https scheme with no query or fragment component that the OP asserts as its IssuerURL Identifier. If IssuerURL discovery is supported , this value MUST be identical to the issuer value returned by WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this IssuerURL.+ , wellKnownJwksUri :: Text -- ^ /Required/ "jwks_uri" - URL of the OP's JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to validate signatures from the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used by RPs to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.+ , wellKnownRegistrationEndpoint :: Maybe Text -- ^ "registration_endpoint" - URL of the OP's Dynamic Client Registration Endpoint.+ , wellKnownRequestObjectSigningAlgValuesSupported :: Maybe [Text] -- ^ "request_object_signing_alg_values_supported" - JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects, which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when the Request Object is passed by value (using the request parameter) and when it is passed by reference (using the request_uri parameter).+ , wellKnownRequestParameterSupported :: Maybe Bool -- ^ "request_parameter_supported" - Boolean value specifying whether the OP supports use of the request parameter, with true indicating support.+ , wellKnownRequestUriParameterSupported :: Maybe Bool -- ^ "request_uri_parameter_supported" - Boolean value specifying whether the OP supports use of the request_uri parameter, with true indicating support.+ , wellKnownRequireRequestUriRegistration :: Maybe Bool -- ^ "require_request_uri_registration" - Boolean value specifying whether the OP requires any request_uri values used to be pre-registered using the request_uris registration parameter.+ , wellKnownResponseModesSupported :: Maybe [Text] -- ^ "response_modes_supported" - JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports.+ , wellKnownResponseTypesSupported :: [Text] -- ^ /Required/ "response_types_supported" - JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values.+ , wellKnownRevocationEndpoint :: Maybe Text -- ^ "revocation_endpoint" - URL of the authorization server's OAuth 2.0 revocation endpoint.+ , wellKnownScopesSupported :: Maybe [Text] -- ^ "scopes_supported" - SON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used+ , wellKnownSubjectTypesSupported :: [Text] -- ^ /Required/ "subject_types_supported" - JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.+ , wellKnownTokenEndpoint :: Text -- ^ /Required/ "token_endpoint" - URL of the OP's OAuth 2.0 Token Endpoint+ , wellKnownTokenEndpointAuthMethodsSupported :: Maybe [Text] -- ^ "token_endpoint_auth_methods_supported" - JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0+ , wellKnownUserinfoEndpoint :: Maybe Text -- ^ "userinfo_endpoint" - URL of the OP's UserInfo Endpoint.+ , wellKnownUserinfoSigningAlgValuesSupported :: Maybe [Text] -- ^ "userinfo_signing_alg_values_supported" - JSON array containing a list of the JWS [JWS] signing algorithms (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims in a JWT [JWT].+ } deriving (P.Show, P.Eq, P.Typeable)++-- | FromJSON WellKnown+instance A.FromJSON WellKnown where+ parseJSON = A.withObject "WellKnown" $ \o ->+ WellKnown+ <$> (o .: "authorization_endpoint")+ <*> (o .:? "backchannel_logout_session_supported")+ <*> (o .:? "backchannel_logout_supported")+ <*> (o .:? "claims_parameter_supported")+ <*> (o .:? "claims_supported")+ <*> (o .:? "end_session_endpoint")+ <*> (o .:? "frontchannel_logout_session_supported")+ <*> (o .:? "frontchannel_logout_supported")+ <*> (o .:? "grant_types_supported")+ <*> (o .: "id_token_signing_alg_values_supported")+ <*> (o .: "issuer")+ <*> (o .: "jwks_uri")+ <*> (o .:? "registration_endpoint")+ <*> (o .:? "request_object_signing_alg_values_supported")+ <*> (o .:? "request_parameter_supported")+ <*> (o .:? "request_uri_parameter_supported")+ <*> (o .:? "require_request_uri_registration")+ <*> (o .:? "response_modes_supported")+ <*> (o .: "response_types_supported")+ <*> (o .:? "revocation_endpoint")+ <*> (o .:? "scopes_supported")+ <*> (o .: "subject_types_supported")+ <*> (o .: "token_endpoint")+ <*> (o .:? "token_endpoint_auth_methods_supported")+ <*> (o .:? "userinfo_endpoint")+ <*> (o .:? "userinfo_signing_alg_values_supported")++-- | ToJSON WellKnown+instance A.ToJSON WellKnown where+ toJSON WellKnown {..} =+ _omitNulls+ [ "authorization_endpoint" .= wellKnownAuthorizationEndpoint+ , "backchannel_logout_session_supported" .= wellKnownBackchannelLogoutSessionSupported+ , "backchannel_logout_supported" .= wellKnownBackchannelLogoutSupported+ , "claims_parameter_supported" .= wellKnownClaimsParameterSupported+ , "claims_supported" .= wellKnownClaimsSupported+ , "end_session_endpoint" .= wellKnownEndSessionEndpoint+ , "frontchannel_logout_session_supported" .= wellKnownFrontchannelLogoutSessionSupported+ , "frontchannel_logout_supported" .= wellKnownFrontchannelLogoutSupported+ , "grant_types_supported" .= wellKnownGrantTypesSupported+ , "id_token_signing_alg_values_supported" .= wellKnownIdTokenSigningAlgValuesSupported+ , "issuer" .= wellKnownIssuer+ , "jwks_uri" .= wellKnownJwksUri+ , "registration_endpoint" .= wellKnownRegistrationEndpoint+ , "request_object_signing_alg_values_supported" .= wellKnownRequestObjectSigningAlgValuesSupported+ , "request_parameter_supported" .= wellKnownRequestParameterSupported+ , "request_uri_parameter_supported" .= wellKnownRequestUriParameterSupported+ , "require_request_uri_registration" .= wellKnownRequireRequestUriRegistration+ , "response_modes_supported" .= wellKnownResponseModesSupported+ , "response_types_supported" .= wellKnownResponseTypesSupported+ , "revocation_endpoint" .= wellKnownRevocationEndpoint+ , "scopes_supported" .= wellKnownScopesSupported+ , "subject_types_supported" .= wellKnownSubjectTypesSupported+ , "token_endpoint" .= wellKnownTokenEndpoint+ , "token_endpoint_auth_methods_supported" .= wellKnownTokenEndpointAuthMethodsSupported+ , "userinfo_endpoint" .= wellKnownUserinfoEndpoint+ , "userinfo_signing_alg_values_supported" .= wellKnownUserinfoSigningAlgValuesSupported+ ]+++-- | Construct a value of type 'WellKnown' (by applying it's required fields, if any)+mkWellKnown+ :: Text -- ^ 'wellKnownAuthorizationEndpoint': URL of the OP's OAuth 2.0 Authorization Endpoint.+ -> [Text] -- ^ 'wellKnownIdTokenSigningAlgValuesSupported': JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT.+ -> Text -- ^ 'wellKnownIssuer': URL using the https scheme with no query or fragment component that the OP asserts as its IssuerURL Identifier. If IssuerURL discovery is supported , this value MUST be identical to the issuer value returned by WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this IssuerURL.+ -> Text -- ^ 'wellKnownJwksUri': URL of the OP's JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to validate signatures from the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used by RPs to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.+ -> [Text] -- ^ 'wellKnownResponseTypesSupported': JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values.+ -> [Text] -- ^ 'wellKnownSubjectTypesSupported': JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.+ -> Text -- ^ 'wellKnownTokenEndpoint': URL of the OP's OAuth 2.0 Token Endpoint+ -> WellKnown+mkWellKnown wellKnownAuthorizationEndpoint wellKnownIdTokenSigningAlgValuesSupported wellKnownIssuer wellKnownJwksUri wellKnownResponseTypesSupported wellKnownSubjectTypesSupported wellKnownTokenEndpoint =+ WellKnown+ { wellKnownAuthorizationEndpoint+ , wellKnownBackchannelLogoutSessionSupported = Nothing+ , wellKnownBackchannelLogoutSupported = Nothing+ , wellKnownClaimsParameterSupported = Nothing+ , wellKnownClaimsSupported = Nothing+ , wellKnownEndSessionEndpoint = Nothing+ , wellKnownFrontchannelLogoutSessionSupported = Nothing+ , wellKnownFrontchannelLogoutSupported = Nothing+ , wellKnownGrantTypesSupported = Nothing+ , wellKnownIdTokenSigningAlgValuesSupported+ , wellKnownIssuer+ , wellKnownJwksUri+ , wellKnownRegistrationEndpoint = Nothing+ , wellKnownRequestObjectSigningAlgValuesSupported = Nothing+ , wellKnownRequestParameterSupported = Nothing+ , wellKnownRequestUriParameterSupported = Nothing+ , wellKnownRequireRequestUriRegistration = Nothing+ , wellKnownResponseModesSupported = Nothing+ , wellKnownResponseTypesSupported+ , wellKnownRevocationEndpoint = Nothing+ , wellKnownScopesSupported = Nothing+ , wellKnownSubjectTypesSupported+ , wellKnownTokenEndpoint+ , wellKnownTokenEndpointAuthMethodsSupported = Nothing+ , wellKnownUserinfoEndpoint = Nothing+ , wellKnownUserinfoSigningAlgValuesSupported = Nothing+ }+++++-- * Auth Methods++-- ** AuthBasicBasic+data AuthBasicBasic =+ AuthBasicBasic B.ByteString B.ByteString -- ^ username password+ deriving (P.Eq, P.Show, P.Typeable)++instance AuthMethod AuthBasicBasic where+ applyAuthMethod _ a@(AuthBasicBasic user pw) req =+ P.pure $+ if (P.typeOf a `P.elem` rAuthTypes req)+ then req `setHeader` toHeader ("Authorization", T.decodeUtf8 cred)+ & L.over rAuthTypesL (P.filter (/= P.typeOf a))+ else req+ where cred = BC.append "Basic " (B64.encode $ BC.concat [ user, ":", pw ])++-- ** AuthOAuthOauth2+data AuthOAuthOauth2 =+ AuthOAuthOauth2 Text -- ^ secret+ deriving (P.Eq, P.Show, P.Typeable)++instance AuthMethod AuthOAuthOauth2 where+ applyAuthMethod _ a@(AuthOAuthOauth2 secret) req =+ P.pure $+ if (P.typeOf a `P.elem` rAuthTypes req)+ then req `setHeader` toHeader ("Authorization", "Bearer " <> secret) + & L.over rAuthTypesL (P.filter (/= P.typeOf a))+ else req++
+ lib/ORYHydra/ModelLens.hs view
@@ -0,0 +1,1380 @@+{-+ ORY Hydra++ Welcome to the ORY Hydra HTTP API documentation. You will find documentation for all HTTP APIs here.++ OpenAPI Version: 3.0.1+ ORY Hydra API version: latest+ Generated by OpenAPI Generator (https://openapi-generator.tech)+-}++{-|+Module : ORYHydra.Lens+-}++{-# LANGUAGE KindSignatures #-}+{-# LANGUAGE NamedFieldPuns #-}+{-# LANGUAGE RankNTypes #-}+{-# LANGUAGE RecordWildCards #-}+{-# OPTIONS_GHC -fno-warn-name-shadowing -fno-warn-unused-matches -fno-warn-unused-binds -fno-warn-unused-imports #-}++module ORYHydra.ModelLens where++import qualified Data.Aeson as A+import qualified Data.ByteString.Lazy as BL+import qualified Data.Data as P (Data, Typeable)+import qualified Data.Map as Map+import qualified Data.Set as Set+import qualified Data.Time as TI++import Data.Text (Text)++import Prelude (($), (.),(<$>),(<*>),(=<<),Maybe(..),Bool(..),Char,Double,FilePath,Float,Int,Integer,String,fmap,undefined,mempty,maybe,pure,Monad,Applicative,Functor)+import qualified Prelude as P++import ORYHydra.Model+import ORYHydra.Core+++-- * AcceptConsentRequest++-- | 'acceptConsentRequestGrantAccessTokenAudience' Lens+acceptConsentRequestGrantAccessTokenAudienceL :: Lens_' AcceptConsentRequest (Maybe [Text])+acceptConsentRequestGrantAccessTokenAudienceL f AcceptConsentRequest{..} = (\acceptConsentRequestGrantAccessTokenAudience -> AcceptConsentRequest { acceptConsentRequestGrantAccessTokenAudience, ..} ) <$> f acceptConsentRequestGrantAccessTokenAudience+{-# INLINE acceptConsentRequestGrantAccessTokenAudienceL #-}++-- | 'acceptConsentRequestGrantScope' Lens+acceptConsentRequestGrantScopeL :: Lens_' AcceptConsentRequest (Maybe [Text])+acceptConsentRequestGrantScopeL f AcceptConsentRequest{..} = (\acceptConsentRequestGrantScope -> AcceptConsentRequest { acceptConsentRequestGrantScope, ..} ) <$> f acceptConsentRequestGrantScope+{-# INLINE acceptConsentRequestGrantScopeL #-}++-- | 'acceptConsentRequestHandledAt' Lens+acceptConsentRequestHandledAtL :: Lens_' AcceptConsentRequest (Maybe DateTime)+acceptConsentRequestHandledAtL f AcceptConsentRequest{..} = (\acceptConsentRequestHandledAt -> AcceptConsentRequest { acceptConsentRequestHandledAt, ..} ) <$> f acceptConsentRequestHandledAt+{-# INLINE acceptConsentRequestHandledAtL #-}++-- | 'acceptConsentRequestRemember' Lens+acceptConsentRequestRememberL :: Lens_' AcceptConsentRequest (Maybe Bool)+acceptConsentRequestRememberL f AcceptConsentRequest{..} = (\acceptConsentRequestRemember -> AcceptConsentRequest { acceptConsentRequestRemember, ..} ) <$> f acceptConsentRequestRemember+{-# INLINE acceptConsentRequestRememberL #-}++-- | 'acceptConsentRequestRememberFor' Lens+acceptConsentRequestRememberForL :: Lens_' AcceptConsentRequest (Maybe Integer)+acceptConsentRequestRememberForL f AcceptConsentRequest{..} = (\acceptConsentRequestRememberFor -> AcceptConsentRequest { acceptConsentRequestRememberFor, ..} ) <$> f acceptConsentRequestRememberFor+{-# INLINE acceptConsentRequestRememberForL #-}++-- | 'acceptConsentRequestSession' Lens+acceptConsentRequestSessionL :: Lens_' AcceptConsentRequest (Maybe ConsentRequestSession)+acceptConsentRequestSessionL f AcceptConsentRequest{..} = (\acceptConsentRequestSession -> AcceptConsentRequest { acceptConsentRequestSession, ..} ) <$> f acceptConsentRequestSession+{-# INLINE acceptConsentRequestSessionL #-}++++-- * AcceptLoginRequest++-- | 'acceptLoginRequestAcr' Lens+acceptLoginRequestAcrL :: Lens_' AcceptLoginRequest (Maybe Text)+acceptLoginRequestAcrL f AcceptLoginRequest{..} = (\acceptLoginRequestAcr -> AcceptLoginRequest { acceptLoginRequestAcr, ..} ) <$> f acceptLoginRequestAcr+{-# INLINE acceptLoginRequestAcrL #-}++-- | 'acceptLoginRequestContext' Lens+acceptLoginRequestContextL :: Lens_' AcceptLoginRequest (Maybe A.Value)+acceptLoginRequestContextL f AcceptLoginRequest{..} = (\acceptLoginRequestContext -> AcceptLoginRequest { acceptLoginRequestContext, ..} ) <$> f acceptLoginRequestContext+{-# INLINE acceptLoginRequestContextL #-}++-- | 'acceptLoginRequestForceSubjectIdentifier' Lens+acceptLoginRequestForceSubjectIdentifierL :: Lens_' AcceptLoginRequest (Maybe Text)+acceptLoginRequestForceSubjectIdentifierL f AcceptLoginRequest{..} = (\acceptLoginRequestForceSubjectIdentifier -> AcceptLoginRequest { acceptLoginRequestForceSubjectIdentifier, ..} ) <$> f acceptLoginRequestForceSubjectIdentifier+{-# INLINE acceptLoginRequestForceSubjectIdentifierL #-}++-- | 'acceptLoginRequestRemember' Lens+acceptLoginRequestRememberL :: Lens_' AcceptLoginRequest (Maybe Bool)+acceptLoginRequestRememberL f AcceptLoginRequest{..} = (\acceptLoginRequestRemember -> AcceptLoginRequest { acceptLoginRequestRemember, ..} ) <$> f acceptLoginRequestRemember+{-# INLINE acceptLoginRequestRememberL #-}++-- | 'acceptLoginRequestRememberFor' Lens+acceptLoginRequestRememberForL :: Lens_' AcceptLoginRequest (Maybe Integer)+acceptLoginRequestRememberForL f AcceptLoginRequest{..} = (\acceptLoginRequestRememberFor -> AcceptLoginRequest { acceptLoginRequestRememberFor, ..} ) <$> f acceptLoginRequestRememberFor+{-# INLINE acceptLoginRequestRememberForL #-}++-- | 'acceptLoginRequestSubject' Lens+acceptLoginRequestSubjectL :: Lens_' AcceptLoginRequest (Text)+acceptLoginRequestSubjectL f AcceptLoginRequest{..} = (\acceptLoginRequestSubject -> AcceptLoginRequest { acceptLoginRequestSubject, ..} ) <$> f acceptLoginRequestSubject+{-# INLINE acceptLoginRequestSubjectL #-}++++-- * CompletedRequest++-- | 'completedRequestRedirectTo' Lens+completedRequestRedirectToL :: Lens_' CompletedRequest (Text)+completedRequestRedirectToL f CompletedRequest{..} = (\completedRequestRedirectTo -> CompletedRequest { completedRequestRedirectTo, ..} ) <$> f completedRequestRedirectTo+{-# INLINE completedRequestRedirectToL #-}++++-- * ConsentRequest++-- | 'consentRequestAcr' Lens+consentRequestAcrL :: Lens_' ConsentRequest (Maybe Text)+consentRequestAcrL f ConsentRequest{..} = (\consentRequestAcr -> ConsentRequest { consentRequestAcr, ..} ) <$> f consentRequestAcr+{-# INLINE consentRequestAcrL #-}++-- | 'consentRequestChallenge' Lens+consentRequestChallengeL :: Lens_' ConsentRequest (Text)+consentRequestChallengeL f ConsentRequest{..} = (\consentRequestChallenge -> ConsentRequest { consentRequestChallenge, ..} ) <$> f consentRequestChallenge+{-# INLINE consentRequestChallengeL #-}++-- | 'consentRequestClient' Lens+consentRequestClientL :: Lens_' ConsentRequest (Maybe OAuth2Client)+consentRequestClientL f ConsentRequest{..} = (\consentRequestClient -> ConsentRequest { consentRequestClient, ..} ) <$> f consentRequestClient+{-# INLINE consentRequestClientL #-}++-- | 'consentRequestContext' Lens+consentRequestContextL :: Lens_' ConsentRequest (Maybe A.Value)+consentRequestContextL f ConsentRequest{..} = (\consentRequestContext -> ConsentRequest { consentRequestContext, ..} ) <$> f consentRequestContext+{-# INLINE consentRequestContextL #-}++-- | 'consentRequestLoginChallenge' Lens+consentRequestLoginChallengeL :: Lens_' ConsentRequest (Maybe Text)+consentRequestLoginChallengeL f ConsentRequest{..} = (\consentRequestLoginChallenge -> ConsentRequest { consentRequestLoginChallenge, ..} ) <$> f consentRequestLoginChallenge+{-# INLINE consentRequestLoginChallengeL #-}++-- | 'consentRequestLoginSessionId' Lens+consentRequestLoginSessionIdL :: Lens_' ConsentRequest (Maybe Text)+consentRequestLoginSessionIdL f ConsentRequest{..} = (\consentRequestLoginSessionId -> ConsentRequest { consentRequestLoginSessionId, ..} ) <$> f consentRequestLoginSessionId+{-# INLINE consentRequestLoginSessionIdL #-}++-- | 'consentRequestOidcContext' Lens+consentRequestOidcContextL :: Lens_' ConsentRequest (Maybe OpenIDConnectContext)+consentRequestOidcContextL f ConsentRequest{..} = (\consentRequestOidcContext -> ConsentRequest { consentRequestOidcContext, ..} ) <$> f consentRequestOidcContext+{-# INLINE consentRequestOidcContextL #-}++-- | 'consentRequestRequestUrl' Lens+consentRequestRequestUrlL :: Lens_' ConsentRequest (Maybe Text)+consentRequestRequestUrlL f ConsentRequest{..} = (\consentRequestRequestUrl -> ConsentRequest { consentRequestRequestUrl, ..} ) <$> f consentRequestRequestUrl+{-# INLINE consentRequestRequestUrlL #-}++-- | 'consentRequestRequestedAccessTokenAudience' Lens+consentRequestRequestedAccessTokenAudienceL :: Lens_' ConsentRequest (Maybe [Text])+consentRequestRequestedAccessTokenAudienceL f ConsentRequest{..} = (\consentRequestRequestedAccessTokenAudience -> ConsentRequest { consentRequestRequestedAccessTokenAudience, ..} ) <$> f consentRequestRequestedAccessTokenAudience+{-# INLINE consentRequestRequestedAccessTokenAudienceL #-}++-- | 'consentRequestRequestedScope' Lens+consentRequestRequestedScopeL :: Lens_' ConsentRequest (Maybe [Text])+consentRequestRequestedScopeL f ConsentRequest{..} = (\consentRequestRequestedScope -> ConsentRequest { consentRequestRequestedScope, ..} ) <$> f consentRequestRequestedScope+{-# INLINE consentRequestRequestedScopeL #-}++-- | 'consentRequestSkip' Lens+consentRequestSkipL :: Lens_' ConsentRequest (Maybe Bool)+consentRequestSkipL f ConsentRequest{..} = (\consentRequestSkip -> ConsentRequest { consentRequestSkip, ..} ) <$> f consentRequestSkip+{-# INLINE consentRequestSkipL #-}++-- | 'consentRequestSubject' Lens+consentRequestSubjectL :: Lens_' ConsentRequest (Maybe Text)+consentRequestSubjectL f ConsentRequest{..} = (\consentRequestSubject -> ConsentRequest { consentRequestSubject, ..} ) <$> f consentRequestSubject+{-# INLINE consentRequestSubjectL #-}++++-- * ConsentRequestSession++-- | 'consentRequestSessionAccessToken' Lens+consentRequestSessionAccessTokenL :: Lens_' ConsentRequestSession (Maybe A.Value)+consentRequestSessionAccessTokenL f ConsentRequestSession{..} = (\consentRequestSessionAccessToken -> ConsentRequestSession { consentRequestSessionAccessToken, ..} ) <$> f consentRequestSessionAccessToken+{-# INLINE consentRequestSessionAccessTokenL #-}++-- | 'consentRequestSessionIdToken' Lens+consentRequestSessionIdTokenL :: Lens_' ConsentRequestSession (Maybe A.Value)+consentRequestSessionIdTokenL f ConsentRequestSession{..} = (\consentRequestSessionIdToken -> ConsentRequestSession { consentRequestSessionIdToken, ..} ) <$> f consentRequestSessionIdToken+{-# INLINE consentRequestSessionIdTokenL #-}++++-- * ContainerWaitOKBodyError++-- | 'containerWaitOKBodyErrorMessage' Lens+containerWaitOKBodyErrorMessageL :: Lens_' ContainerWaitOKBodyError (Maybe Text)+containerWaitOKBodyErrorMessageL f ContainerWaitOKBodyError{..} = (\containerWaitOKBodyErrorMessage -> ContainerWaitOKBodyError { containerWaitOKBodyErrorMessage, ..} ) <$> f containerWaitOKBodyErrorMessage+{-# INLINE containerWaitOKBodyErrorMessageL #-}++++-- * FlushInactiveOAuth2TokensRequest++-- | 'flushInactiveOAuth2TokensRequestNotAfter' Lens+flushInactiveOAuth2TokensRequestNotAfterL :: Lens_' FlushInactiveOAuth2TokensRequest (Maybe DateTime)+flushInactiveOAuth2TokensRequestNotAfterL f FlushInactiveOAuth2TokensRequest{..} = (\flushInactiveOAuth2TokensRequestNotAfter -> FlushInactiveOAuth2TokensRequest { flushInactiveOAuth2TokensRequestNotAfter, ..} ) <$> f flushInactiveOAuth2TokensRequestNotAfter+{-# INLINE flushInactiveOAuth2TokensRequestNotAfterL #-}++++-- * GenericError++-- | 'genericErrorDebug' Lens+genericErrorDebugL :: Lens_' GenericError (Maybe Text)+genericErrorDebugL f GenericError{..} = (\genericErrorDebug -> GenericError { genericErrorDebug, ..} ) <$> f genericErrorDebug+{-# INLINE genericErrorDebugL #-}++-- | 'genericErrorError' Lens+genericErrorErrorL :: Lens_' GenericError (Text)+genericErrorErrorL f GenericError{..} = (\genericErrorError -> GenericError { genericErrorError, ..} ) <$> f genericErrorError+{-# INLINE genericErrorErrorL #-}++-- | 'genericErrorErrorDescription' Lens+genericErrorErrorDescriptionL :: Lens_' GenericError (Maybe Text)+genericErrorErrorDescriptionL f GenericError{..} = (\genericErrorErrorDescription -> GenericError { genericErrorErrorDescription, ..} ) <$> f genericErrorErrorDescription+{-# INLINE genericErrorErrorDescriptionL #-}++-- | 'genericErrorStatusCode' Lens+genericErrorStatusCodeL :: Lens_' GenericError (Maybe Integer)+genericErrorStatusCodeL f GenericError{..} = (\genericErrorStatusCode -> GenericError { genericErrorStatusCode, ..} ) <$> f genericErrorStatusCode+{-# INLINE genericErrorStatusCodeL #-}++++-- * HealthNotReadyStatus++-- | 'healthNotReadyStatusErrors' Lens+healthNotReadyStatusErrorsL :: Lens_' HealthNotReadyStatus (Maybe (Map.Map String Text))+healthNotReadyStatusErrorsL f HealthNotReadyStatus{..} = (\healthNotReadyStatusErrors -> HealthNotReadyStatus { healthNotReadyStatusErrors, ..} ) <$> f healthNotReadyStatusErrors+{-# INLINE healthNotReadyStatusErrorsL #-}++++-- * HealthStatus++-- | 'healthStatusStatus' Lens+healthStatusStatusL :: Lens_' HealthStatus (Maybe Text)+healthStatusStatusL f HealthStatus{..} = (\healthStatusStatus -> HealthStatus { healthStatusStatus, ..} ) <$> f healthStatusStatus+{-# INLINE healthStatusStatusL #-}++++-- * JSONWebKey++-- | 'jSONWebKeyAlg' Lens+jSONWebKeyAlgL :: Lens_' JSONWebKey (Text)+jSONWebKeyAlgL f JSONWebKey{..} = (\jSONWebKeyAlg -> JSONWebKey { jSONWebKeyAlg, ..} ) <$> f jSONWebKeyAlg+{-# INLINE jSONWebKeyAlgL #-}++-- | 'jSONWebKeyCrv' Lens+jSONWebKeyCrvL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyCrvL f JSONWebKey{..} = (\jSONWebKeyCrv -> JSONWebKey { jSONWebKeyCrv, ..} ) <$> f jSONWebKeyCrv+{-# INLINE jSONWebKeyCrvL #-}++-- | 'jSONWebKeyD' Lens+jSONWebKeyDL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyDL f JSONWebKey{..} = (\jSONWebKeyD -> JSONWebKey { jSONWebKeyD, ..} ) <$> f jSONWebKeyD+{-# INLINE jSONWebKeyDL #-}++-- | 'jSONWebKeyDp' Lens+jSONWebKeyDpL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyDpL f JSONWebKey{..} = (\jSONWebKeyDp -> JSONWebKey { jSONWebKeyDp, ..} ) <$> f jSONWebKeyDp+{-# INLINE jSONWebKeyDpL #-}++-- | 'jSONWebKeyDq' Lens+jSONWebKeyDqL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyDqL f JSONWebKey{..} = (\jSONWebKeyDq -> JSONWebKey { jSONWebKeyDq, ..} ) <$> f jSONWebKeyDq+{-# INLINE jSONWebKeyDqL #-}++-- | 'jSONWebKeyE' Lens+jSONWebKeyEL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyEL f JSONWebKey{..} = (\jSONWebKeyE -> JSONWebKey { jSONWebKeyE, ..} ) <$> f jSONWebKeyE+{-# INLINE jSONWebKeyEL #-}++-- | 'jSONWebKeyK' Lens+jSONWebKeyKL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyKL f JSONWebKey{..} = (\jSONWebKeyK -> JSONWebKey { jSONWebKeyK, ..} ) <$> f jSONWebKeyK+{-# INLINE jSONWebKeyKL #-}++-- | 'jSONWebKeyKid' Lens+jSONWebKeyKidL :: Lens_' JSONWebKey (Text)+jSONWebKeyKidL f JSONWebKey{..} = (\jSONWebKeyKid -> JSONWebKey { jSONWebKeyKid, ..} ) <$> f jSONWebKeyKid+{-# INLINE jSONWebKeyKidL #-}++-- | 'jSONWebKeyKty' Lens+jSONWebKeyKtyL :: Lens_' JSONWebKey (Text)+jSONWebKeyKtyL f JSONWebKey{..} = (\jSONWebKeyKty -> JSONWebKey { jSONWebKeyKty, ..} ) <$> f jSONWebKeyKty+{-# INLINE jSONWebKeyKtyL #-}++-- | 'jSONWebKeyN' Lens+jSONWebKeyNL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyNL f JSONWebKey{..} = (\jSONWebKeyN -> JSONWebKey { jSONWebKeyN, ..} ) <$> f jSONWebKeyN+{-# INLINE jSONWebKeyNL #-}++-- | 'jSONWebKeyP' Lens+jSONWebKeyPL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyPL f JSONWebKey{..} = (\jSONWebKeyP -> JSONWebKey { jSONWebKeyP, ..} ) <$> f jSONWebKeyP+{-# INLINE jSONWebKeyPL #-}++-- | 'jSONWebKeyQ' Lens+jSONWebKeyQL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyQL f JSONWebKey{..} = (\jSONWebKeyQ -> JSONWebKey { jSONWebKeyQ, ..} ) <$> f jSONWebKeyQ+{-# INLINE jSONWebKeyQL #-}++-- | 'jSONWebKeyQi' Lens+jSONWebKeyQiL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyQiL f JSONWebKey{..} = (\jSONWebKeyQi -> JSONWebKey { jSONWebKeyQi, ..} ) <$> f jSONWebKeyQi+{-# INLINE jSONWebKeyQiL #-}++-- | 'jSONWebKeyUse' Lens+jSONWebKeyUseL :: Lens_' JSONWebKey (Text)+jSONWebKeyUseL f JSONWebKey{..} = (\jSONWebKeyUse -> JSONWebKey { jSONWebKeyUse, ..} ) <$> f jSONWebKeyUse+{-# INLINE jSONWebKeyUseL #-}++-- | 'jSONWebKeyX' Lens+jSONWebKeyXL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyXL f JSONWebKey{..} = (\jSONWebKeyX -> JSONWebKey { jSONWebKeyX, ..} ) <$> f jSONWebKeyX+{-# INLINE jSONWebKeyXL #-}++-- | 'jSONWebKeyX5c' Lens+jSONWebKeyX5cL :: Lens_' JSONWebKey (Maybe [Text])+jSONWebKeyX5cL f JSONWebKey{..} = (\jSONWebKeyX5c -> JSONWebKey { jSONWebKeyX5c, ..} ) <$> f jSONWebKeyX5c+{-# INLINE jSONWebKeyX5cL #-}++-- | 'jSONWebKeyY' Lens+jSONWebKeyYL :: Lens_' JSONWebKey (Maybe Text)+jSONWebKeyYL f JSONWebKey{..} = (\jSONWebKeyY -> JSONWebKey { jSONWebKeyY, ..} ) <$> f jSONWebKeyY+{-# INLINE jSONWebKeyYL #-}++++-- * JSONWebKeySet++-- | 'jSONWebKeySetKeys' Lens+jSONWebKeySetKeysL :: Lens_' JSONWebKeySet (Maybe [JSONWebKey])+jSONWebKeySetKeysL f JSONWebKeySet{..} = (\jSONWebKeySetKeys -> JSONWebKeySet { jSONWebKeySetKeys, ..} ) <$> f jSONWebKeySetKeys+{-# INLINE jSONWebKeySetKeysL #-}++++-- * JsonWebKeySetGeneratorRequest++-- | 'jsonWebKeySetGeneratorRequestAlg' Lens+jsonWebKeySetGeneratorRequestAlgL :: Lens_' JsonWebKeySetGeneratorRequest (Text)+jsonWebKeySetGeneratorRequestAlgL f JsonWebKeySetGeneratorRequest{..} = (\jsonWebKeySetGeneratorRequestAlg -> JsonWebKeySetGeneratorRequest { jsonWebKeySetGeneratorRequestAlg, ..} ) <$> f jsonWebKeySetGeneratorRequestAlg+{-# INLINE jsonWebKeySetGeneratorRequestAlgL #-}++-- | 'jsonWebKeySetGeneratorRequestKid' Lens+jsonWebKeySetGeneratorRequestKidL :: Lens_' JsonWebKeySetGeneratorRequest (Text)+jsonWebKeySetGeneratorRequestKidL f JsonWebKeySetGeneratorRequest{..} = (\jsonWebKeySetGeneratorRequestKid -> JsonWebKeySetGeneratorRequest { jsonWebKeySetGeneratorRequestKid, ..} ) <$> f jsonWebKeySetGeneratorRequestKid+{-# INLINE jsonWebKeySetGeneratorRequestKidL #-}++-- | 'jsonWebKeySetGeneratorRequestUse' Lens+jsonWebKeySetGeneratorRequestUseL :: Lens_' JsonWebKeySetGeneratorRequest (Text)+jsonWebKeySetGeneratorRequestUseL f JsonWebKeySetGeneratorRequest{..} = (\jsonWebKeySetGeneratorRequestUse -> JsonWebKeySetGeneratorRequest { jsonWebKeySetGeneratorRequestUse, ..} ) <$> f jsonWebKeySetGeneratorRequestUse+{-# INLINE jsonWebKeySetGeneratorRequestUseL #-}++++-- * LoginRequest++-- | 'loginRequestChallenge' Lens+loginRequestChallengeL :: Lens_' LoginRequest (Text)+loginRequestChallengeL f LoginRequest{..} = (\loginRequestChallenge -> LoginRequest { loginRequestChallenge, ..} ) <$> f loginRequestChallenge+{-# INLINE loginRequestChallengeL #-}++-- | 'loginRequestClient' Lens+loginRequestClientL :: Lens_' LoginRequest (OAuth2Client)+loginRequestClientL f LoginRequest{..} = (\loginRequestClient -> LoginRequest { loginRequestClient, ..} ) <$> f loginRequestClient+{-# INLINE loginRequestClientL #-}++-- | 'loginRequestOidcContext' Lens+loginRequestOidcContextL :: Lens_' LoginRequest (Maybe OpenIDConnectContext)+loginRequestOidcContextL f LoginRequest{..} = (\loginRequestOidcContext -> LoginRequest { loginRequestOidcContext, ..} ) <$> f loginRequestOidcContext+{-# INLINE loginRequestOidcContextL #-}++-- | 'loginRequestRequestUrl' Lens+loginRequestRequestUrlL :: Lens_' LoginRequest (Text)+loginRequestRequestUrlL f LoginRequest{..} = (\loginRequestRequestUrl -> LoginRequest { loginRequestRequestUrl, ..} ) <$> f loginRequestRequestUrl+{-# INLINE loginRequestRequestUrlL #-}++-- | 'loginRequestRequestedAccessTokenAudience' Lens+loginRequestRequestedAccessTokenAudienceL :: Lens_' LoginRequest ([Text])+loginRequestRequestedAccessTokenAudienceL f LoginRequest{..} = (\loginRequestRequestedAccessTokenAudience -> LoginRequest { loginRequestRequestedAccessTokenAudience, ..} ) <$> f loginRequestRequestedAccessTokenAudience+{-# INLINE loginRequestRequestedAccessTokenAudienceL #-}++-- | 'loginRequestRequestedScope' Lens+loginRequestRequestedScopeL :: Lens_' LoginRequest ([Text])+loginRequestRequestedScopeL f LoginRequest{..} = (\loginRequestRequestedScope -> LoginRequest { loginRequestRequestedScope, ..} ) <$> f loginRequestRequestedScope+{-# INLINE loginRequestRequestedScopeL #-}++-- | 'loginRequestSessionId' Lens+loginRequestSessionIdL :: Lens_' LoginRequest (Maybe Text)+loginRequestSessionIdL f LoginRequest{..} = (\loginRequestSessionId -> LoginRequest { loginRequestSessionId, ..} ) <$> f loginRequestSessionId+{-# INLINE loginRequestSessionIdL #-}++-- | 'loginRequestSkip' Lens+loginRequestSkipL :: Lens_' LoginRequest (Bool)+loginRequestSkipL f LoginRequest{..} = (\loginRequestSkip -> LoginRequest { loginRequestSkip, ..} ) <$> f loginRequestSkip+{-# INLINE loginRequestSkipL #-}++-- | 'loginRequestSubject' Lens+loginRequestSubjectL :: Lens_' LoginRequest (Text)+loginRequestSubjectL f LoginRequest{..} = (\loginRequestSubject -> LoginRequest { loginRequestSubject, ..} ) <$> f loginRequestSubject+{-# INLINE loginRequestSubjectL #-}++++-- * LogoutRequest++-- | 'logoutRequestRequestUrl' Lens+logoutRequestRequestUrlL :: Lens_' LogoutRequest (Maybe Text)+logoutRequestRequestUrlL f LogoutRequest{..} = (\logoutRequestRequestUrl -> LogoutRequest { logoutRequestRequestUrl, ..} ) <$> f logoutRequestRequestUrl+{-# INLINE logoutRequestRequestUrlL #-}++-- | 'logoutRequestRpInitiated' Lens+logoutRequestRpInitiatedL :: Lens_' LogoutRequest (Maybe Bool)+logoutRequestRpInitiatedL f LogoutRequest{..} = (\logoutRequestRpInitiated -> LogoutRequest { logoutRequestRpInitiated, ..} ) <$> f logoutRequestRpInitiated+{-# INLINE logoutRequestRpInitiatedL #-}++-- | 'logoutRequestSid' Lens+logoutRequestSidL :: Lens_' LogoutRequest (Maybe Text)+logoutRequestSidL f LogoutRequest{..} = (\logoutRequestSid -> LogoutRequest { logoutRequestSid, ..} ) <$> f logoutRequestSid+{-# INLINE logoutRequestSidL #-}++-- | 'logoutRequestSubject' Lens+logoutRequestSubjectL :: Lens_' LogoutRequest (Maybe Text)+logoutRequestSubjectL f LogoutRequest{..} = (\logoutRequestSubject -> LogoutRequest { logoutRequestSubject, ..} ) <$> f logoutRequestSubject+{-# INLINE logoutRequestSubjectL #-}++++-- * OAuth2Client++-- | 'oAuth2ClientAllowedCorsOrigins' Lens+oAuth2ClientAllowedCorsOriginsL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientAllowedCorsOriginsL f OAuth2Client{..} = (\oAuth2ClientAllowedCorsOrigins -> OAuth2Client { oAuth2ClientAllowedCorsOrigins, ..} ) <$> f oAuth2ClientAllowedCorsOrigins+{-# INLINE oAuth2ClientAllowedCorsOriginsL #-}++-- | 'oAuth2ClientAudience' Lens+oAuth2ClientAudienceL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientAudienceL f OAuth2Client{..} = (\oAuth2ClientAudience -> OAuth2Client { oAuth2ClientAudience, ..} ) <$> f oAuth2ClientAudience+{-# INLINE oAuth2ClientAudienceL #-}++-- | 'oAuth2ClientBackchannelLogoutSessionRequired' Lens+oAuth2ClientBackchannelLogoutSessionRequiredL :: Lens_' OAuth2Client (Maybe Bool)+oAuth2ClientBackchannelLogoutSessionRequiredL f OAuth2Client{..} = (\oAuth2ClientBackchannelLogoutSessionRequired -> OAuth2Client { oAuth2ClientBackchannelLogoutSessionRequired, ..} ) <$> f oAuth2ClientBackchannelLogoutSessionRequired+{-# INLINE oAuth2ClientBackchannelLogoutSessionRequiredL #-}++-- | 'oAuth2ClientBackchannelLogoutUri' Lens+oAuth2ClientBackchannelLogoutUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientBackchannelLogoutUriL f OAuth2Client{..} = (\oAuth2ClientBackchannelLogoutUri -> OAuth2Client { oAuth2ClientBackchannelLogoutUri, ..} ) <$> f oAuth2ClientBackchannelLogoutUri+{-# INLINE oAuth2ClientBackchannelLogoutUriL #-}++-- | 'oAuth2ClientClientId' Lens+oAuth2ClientClientIdL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientClientIdL f OAuth2Client{..} = (\oAuth2ClientClientId -> OAuth2Client { oAuth2ClientClientId, ..} ) <$> f oAuth2ClientClientId+{-# INLINE oAuth2ClientClientIdL #-}++-- | 'oAuth2ClientClientName' Lens+oAuth2ClientClientNameL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientClientNameL f OAuth2Client{..} = (\oAuth2ClientClientName -> OAuth2Client { oAuth2ClientClientName, ..} ) <$> f oAuth2ClientClientName+{-# INLINE oAuth2ClientClientNameL #-}++-- | 'oAuth2ClientClientSecret' Lens+oAuth2ClientClientSecretL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientClientSecretL f OAuth2Client{..} = (\oAuth2ClientClientSecret -> OAuth2Client { oAuth2ClientClientSecret, ..} ) <$> f oAuth2ClientClientSecret+{-# INLINE oAuth2ClientClientSecretL #-}++-- | 'oAuth2ClientClientSecretExpiresAt' Lens+oAuth2ClientClientSecretExpiresAtL :: Lens_' OAuth2Client (Maybe Integer)+oAuth2ClientClientSecretExpiresAtL f OAuth2Client{..} = (\oAuth2ClientClientSecretExpiresAt -> OAuth2Client { oAuth2ClientClientSecretExpiresAt, ..} ) <$> f oAuth2ClientClientSecretExpiresAt+{-# INLINE oAuth2ClientClientSecretExpiresAtL #-}++-- | 'oAuth2ClientClientUri' Lens+oAuth2ClientClientUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientClientUriL f OAuth2Client{..} = (\oAuth2ClientClientUri -> OAuth2Client { oAuth2ClientClientUri, ..} ) <$> f oAuth2ClientClientUri+{-# INLINE oAuth2ClientClientUriL #-}++-- | 'oAuth2ClientContacts' Lens+oAuth2ClientContactsL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientContactsL f OAuth2Client{..} = (\oAuth2ClientContacts -> OAuth2Client { oAuth2ClientContacts, ..} ) <$> f oAuth2ClientContacts+{-# INLINE oAuth2ClientContactsL #-}++-- | 'oAuth2ClientCreatedAt' Lens+oAuth2ClientCreatedAtL :: Lens_' OAuth2Client (Maybe DateTime)+oAuth2ClientCreatedAtL f OAuth2Client{..} = (\oAuth2ClientCreatedAt -> OAuth2Client { oAuth2ClientCreatedAt, ..} ) <$> f oAuth2ClientCreatedAt+{-# INLINE oAuth2ClientCreatedAtL #-}++-- | 'oAuth2ClientFrontchannelLogoutSessionRequired' Lens+oAuth2ClientFrontchannelLogoutSessionRequiredL :: Lens_' OAuth2Client (Maybe Bool)+oAuth2ClientFrontchannelLogoutSessionRequiredL f OAuth2Client{..} = (\oAuth2ClientFrontchannelLogoutSessionRequired -> OAuth2Client { oAuth2ClientFrontchannelLogoutSessionRequired, ..} ) <$> f oAuth2ClientFrontchannelLogoutSessionRequired+{-# INLINE oAuth2ClientFrontchannelLogoutSessionRequiredL #-}++-- | 'oAuth2ClientFrontchannelLogoutUri' Lens+oAuth2ClientFrontchannelLogoutUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientFrontchannelLogoutUriL f OAuth2Client{..} = (\oAuth2ClientFrontchannelLogoutUri -> OAuth2Client { oAuth2ClientFrontchannelLogoutUri, ..} ) <$> f oAuth2ClientFrontchannelLogoutUri+{-# INLINE oAuth2ClientFrontchannelLogoutUriL #-}++-- | 'oAuth2ClientGrantTypes' Lens+oAuth2ClientGrantTypesL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientGrantTypesL f OAuth2Client{..} = (\oAuth2ClientGrantTypes -> OAuth2Client { oAuth2ClientGrantTypes, ..} ) <$> f oAuth2ClientGrantTypes+{-# INLINE oAuth2ClientGrantTypesL #-}++-- | 'oAuth2ClientJwks' Lens+oAuth2ClientJwksL :: Lens_' OAuth2Client (Maybe A.Value)+oAuth2ClientJwksL f OAuth2Client{..} = (\oAuth2ClientJwks -> OAuth2Client { oAuth2ClientJwks, ..} ) <$> f oAuth2ClientJwks+{-# INLINE oAuth2ClientJwksL #-}++-- | 'oAuth2ClientJwksUri' Lens+oAuth2ClientJwksUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientJwksUriL f OAuth2Client{..} = (\oAuth2ClientJwksUri -> OAuth2Client { oAuth2ClientJwksUri, ..} ) <$> f oAuth2ClientJwksUri+{-# INLINE oAuth2ClientJwksUriL #-}++-- | 'oAuth2ClientLogoUri' Lens+oAuth2ClientLogoUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientLogoUriL f OAuth2Client{..} = (\oAuth2ClientLogoUri -> OAuth2Client { oAuth2ClientLogoUri, ..} ) <$> f oAuth2ClientLogoUri+{-# INLINE oAuth2ClientLogoUriL #-}++-- | 'oAuth2ClientMetadata' Lens+oAuth2ClientMetadataL :: Lens_' OAuth2Client (Maybe A.Value)+oAuth2ClientMetadataL f OAuth2Client{..} = (\oAuth2ClientMetadata -> OAuth2Client { oAuth2ClientMetadata, ..} ) <$> f oAuth2ClientMetadata+{-# INLINE oAuth2ClientMetadataL #-}++-- | 'oAuth2ClientOwner' Lens+oAuth2ClientOwnerL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientOwnerL f OAuth2Client{..} = (\oAuth2ClientOwner -> OAuth2Client { oAuth2ClientOwner, ..} ) <$> f oAuth2ClientOwner+{-# INLINE oAuth2ClientOwnerL #-}++-- | 'oAuth2ClientPolicyUri' Lens+oAuth2ClientPolicyUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientPolicyUriL f OAuth2Client{..} = (\oAuth2ClientPolicyUri -> OAuth2Client { oAuth2ClientPolicyUri, ..} ) <$> f oAuth2ClientPolicyUri+{-# INLINE oAuth2ClientPolicyUriL #-}++-- | 'oAuth2ClientPostLogoutRedirectUris' Lens+oAuth2ClientPostLogoutRedirectUrisL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientPostLogoutRedirectUrisL f OAuth2Client{..} = (\oAuth2ClientPostLogoutRedirectUris -> OAuth2Client { oAuth2ClientPostLogoutRedirectUris, ..} ) <$> f oAuth2ClientPostLogoutRedirectUris+{-# INLINE oAuth2ClientPostLogoutRedirectUrisL #-}++-- | 'oAuth2ClientRedirectUris' Lens+oAuth2ClientRedirectUrisL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientRedirectUrisL f OAuth2Client{..} = (\oAuth2ClientRedirectUris -> OAuth2Client { oAuth2ClientRedirectUris, ..} ) <$> f oAuth2ClientRedirectUris+{-# INLINE oAuth2ClientRedirectUrisL #-}++-- | 'oAuth2ClientRequestObjectSigningAlg' Lens+oAuth2ClientRequestObjectSigningAlgL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientRequestObjectSigningAlgL f OAuth2Client{..} = (\oAuth2ClientRequestObjectSigningAlg -> OAuth2Client { oAuth2ClientRequestObjectSigningAlg, ..} ) <$> f oAuth2ClientRequestObjectSigningAlg+{-# INLINE oAuth2ClientRequestObjectSigningAlgL #-}++-- | 'oAuth2ClientRequestUris' Lens+oAuth2ClientRequestUrisL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientRequestUrisL f OAuth2Client{..} = (\oAuth2ClientRequestUris -> OAuth2Client { oAuth2ClientRequestUris, ..} ) <$> f oAuth2ClientRequestUris+{-# INLINE oAuth2ClientRequestUrisL #-}++-- | 'oAuth2ClientResponseTypes' Lens+oAuth2ClientResponseTypesL :: Lens_' OAuth2Client (Maybe [Text])+oAuth2ClientResponseTypesL f OAuth2Client{..} = (\oAuth2ClientResponseTypes -> OAuth2Client { oAuth2ClientResponseTypes, ..} ) <$> f oAuth2ClientResponseTypes+{-# INLINE oAuth2ClientResponseTypesL #-}++-- | 'oAuth2ClientScope' Lens+oAuth2ClientScopeL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientScopeL f OAuth2Client{..} = (\oAuth2ClientScope -> OAuth2Client { oAuth2ClientScope, ..} ) <$> f oAuth2ClientScope+{-# INLINE oAuth2ClientScopeL #-}++-- | 'oAuth2ClientSectorIdentifierUri' Lens+oAuth2ClientSectorIdentifierUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientSectorIdentifierUriL f OAuth2Client{..} = (\oAuth2ClientSectorIdentifierUri -> OAuth2Client { oAuth2ClientSectorIdentifierUri, ..} ) <$> f oAuth2ClientSectorIdentifierUri+{-# INLINE oAuth2ClientSectorIdentifierUriL #-}++-- | 'oAuth2ClientSubjectType' Lens+oAuth2ClientSubjectTypeL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientSubjectTypeL f OAuth2Client{..} = (\oAuth2ClientSubjectType -> OAuth2Client { oAuth2ClientSubjectType, ..} ) <$> f oAuth2ClientSubjectType+{-# INLINE oAuth2ClientSubjectTypeL #-}++-- | 'oAuth2ClientTokenEndpointAuthMethod' Lens+oAuth2ClientTokenEndpointAuthMethodL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientTokenEndpointAuthMethodL f OAuth2Client{..} = (\oAuth2ClientTokenEndpointAuthMethod -> OAuth2Client { oAuth2ClientTokenEndpointAuthMethod, ..} ) <$> f oAuth2ClientTokenEndpointAuthMethod+{-# INLINE oAuth2ClientTokenEndpointAuthMethodL #-}++-- | 'oAuth2ClientTokenEndpointAuthSigningAlg' Lens+oAuth2ClientTokenEndpointAuthSigningAlgL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientTokenEndpointAuthSigningAlgL f OAuth2Client{..} = (\oAuth2ClientTokenEndpointAuthSigningAlg -> OAuth2Client { oAuth2ClientTokenEndpointAuthSigningAlg, ..} ) <$> f oAuth2ClientTokenEndpointAuthSigningAlg+{-# INLINE oAuth2ClientTokenEndpointAuthSigningAlgL #-}++-- | 'oAuth2ClientTosUri' Lens+oAuth2ClientTosUriL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientTosUriL f OAuth2Client{..} = (\oAuth2ClientTosUri -> OAuth2Client { oAuth2ClientTosUri, ..} ) <$> f oAuth2ClientTosUri+{-# INLINE oAuth2ClientTosUriL #-}++-- | 'oAuth2ClientUpdatedAt' Lens+oAuth2ClientUpdatedAtL :: Lens_' OAuth2Client (Maybe DateTime)+oAuth2ClientUpdatedAtL f OAuth2Client{..} = (\oAuth2ClientUpdatedAt -> OAuth2Client { oAuth2ClientUpdatedAt, ..} ) <$> f oAuth2ClientUpdatedAt+{-# INLINE oAuth2ClientUpdatedAtL #-}++-- | 'oAuth2ClientUserinfoSignedResponseAlg' Lens+oAuth2ClientUserinfoSignedResponseAlgL :: Lens_' OAuth2Client (Maybe Text)+oAuth2ClientUserinfoSignedResponseAlgL f OAuth2Client{..} = (\oAuth2ClientUserinfoSignedResponseAlg -> OAuth2Client { oAuth2ClientUserinfoSignedResponseAlg, ..} ) <$> f oAuth2ClientUserinfoSignedResponseAlg+{-# INLINE oAuth2ClientUserinfoSignedResponseAlgL #-}++++-- * OAuth2TokenIntrospection++-- | 'oAuth2TokenIntrospectionActive' Lens+oAuth2TokenIntrospectionActiveL :: Lens_' OAuth2TokenIntrospection (Bool)+oAuth2TokenIntrospectionActiveL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionActive -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionActive, ..} ) <$> f oAuth2TokenIntrospectionActive+{-# INLINE oAuth2TokenIntrospectionActiveL #-}++-- | 'oAuth2TokenIntrospectionAud' Lens+oAuth2TokenIntrospectionAudL :: Lens_' OAuth2TokenIntrospection (Maybe [Text])+oAuth2TokenIntrospectionAudL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionAud -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionAud, ..} ) <$> f oAuth2TokenIntrospectionAud+{-# INLINE oAuth2TokenIntrospectionAudL #-}++-- | 'oAuth2TokenIntrospectionClientId' Lens+oAuth2TokenIntrospectionClientIdL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionClientIdL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionClientId -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionClientId, ..} ) <$> f oAuth2TokenIntrospectionClientId+{-# INLINE oAuth2TokenIntrospectionClientIdL #-}++-- | 'oAuth2TokenIntrospectionExp' Lens+oAuth2TokenIntrospectionExpL :: Lens_' OAuth2TokenIntrospection (Maybe Integer)+oAuth2TokenIntrospectionExpL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionExp -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionExp, ..} ) <$> f oAuth2TokenIntrospectionExp+{-# INLINE oAuth2TokenIntrospectionExpL #-}++-- | 'oAuth2TokenIntrospectionExt' Lens+oAuth2TokenIntrospectionExtL :: Lens_' OAuth2TokenIntrospection (Maybe A.Value)+oAuth2TokenIntrospectionExtL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionExt -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionExt, ..} ) <$> f oAuth2TokenIntrospectionExt+{-# INLINE oAuth2TokenIntrospectionExtL #-}++-- | 'oAuth2TokenIntrospectionIat' Lens+oAuth2TokenIntrospectionIatL :: Lens_' OAuth2TokenIntrospection (Maybe Integer)+oAuth2TokenIntrospectionIatL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionIat -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionIat, ..} ) <$> f oAuth2TokenIntrospectionIat+{-# INLINE oAuth2TokenIntrospectionIatL #-}++-- | 'oAuth2TokenIntrospectionIss' Lens+oAuth2TokenIntrospectionIssL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionIssL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionIss -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionIss, ..} ) <$> f oAuth2TokenIntrospectionIss+{-# INLINE oAuth2TokenIntrospectionIssL #-}++-- | 'oAuth2TokenIntrospectionNbf' Lens+oAuth2TokenIntrospectionNbfL :: Lens_' OAuth2TokenIntrospection (Maybe Integer)+oAuth2TokenIntrospectionNbfL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionNbf -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionNbf, ..} ) <$> f oAuth2TokenIntrospectionNbf+{-# INLINE oAuth2TokenIntrospectionNbfL #-}++-- | 'oAuth2TokenIntrospectionObfuscatedSubject' Lens+oAuth2TokenIntrospectionObfuscatedSubjectL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionObfuscatedSubjectL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionObfuscatedSubject -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionObfuscatedSubject, ..} ) <$> f oAuth2TokenIntrospectionObfuscatedSubject+{-# INLINE oAuth2TokenIntrospectionObfuscatedSubjectL #-}++-- | 'oAuth2TokenIntrospectionScope' Lens+oAuth2TokenIntrospectionScopeL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionScopeL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionScope -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionScope, ..} ) <$> f oAuth2TokenIntrospectionScope+{-# INLINE oAuth2TokenIntrospectionScopeL #-}++-- | 'oAuth2TokenIntrospectionSub' Lens+oAuth2TokenIntrospectionSubL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionSubL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionSub -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionSub, ..} ) <$> f oAuth2TokenIntrospectionSub+{-# INLINE oAuth2TokenIntrospectionSubL #-}++-- | 'oAuth2TokenIntrospectionTokenType' Lens+oAuth2TokenIntrospectionTokenTypeL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionTokenTypeL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionTokenType -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionTokenType, ..} ) <$> f oAuth2TokenIntrospectionTokenType+{-# INLINE oAuth2TokenIntrospectionTokenTypeL #-}++-- | 'oAuth2TokenIntrospectionTokenUse' Lens+oAuth2TokenIntrospectionTokenUseL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionTokenUseL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionTokenUse -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionTokenUse, ..} ) <$> f oAuth2TokenIntrospectionTokenUse+{-# INLINE oAuth2TokenIntrospectionTokenUseL #-}++-- | 'oAuth2TokenIntrospectionUsername' Lens+oAuth2TokenIntrospectionUsernameL :: Lens_' OAuth2TokenIntrospection (Maybe Text)+oAuth2TokenIntrospectionUsernameL f OAuth2TokenIntrospection{..} = (\oAuth2TokenIntrospectionUsername -> OAuth2TokenIntrospection { oAuth2TokenIntrospectionUsername, ..} ) <$> f oAuth2TokenIntrospectionUsername+{-# INLINE oAuth2TokenIntrospectionUsernameL #-}++++-- * Oauth2TokenResponse++-- | 'oauth2TokenResponseAccessToken' Lens+oauth2TokenResponseAccessTokenL :: Lens_' Oauth2TokenResponse (Maybe Text)+oauth2TokenResponseAccessTokenL f Oauth2TokenResponse{..} = (\oauth2TokenResponseAccessToken -> Oauth2TokenResponse { oauth2TokenResponseAccessToken, ..} ) <$> f oauth2TokenResponseAccessToken+{-# INLINE oauth2TokenResponseAccessTokenL #-}++-- | 'oauth2TokenResponseExpiresIn' Lens+oauth2TokenResponseExpiresInL :: Lens_' Oauth2TokenResponse (Maybe Integer)+oauth2TokenResponseExpiresInL f Oauth2TokenResponse{..} = (\oauth2TokenResponseExpiresIn -> Oauth2TokenResponse { oauth2TokenResponseExpiresIn, ..} ) <$> f oauth2TokenResponseExpiresIn+{-# INLINE oauth2TokenResponseExpiresInL #-}++-- | 'oauth2TokenResponseIdToken' Lens+oauth2TokenResponseIdTokenL :: Lens_' Oauth2TokenResponse (Maybe Text)+oauth2TokenResponseIdTokenL f Oauth2TokenResponse{..} = (\oauth2TokenResponseIdToken -> Oauth2TokenResponse { oauth2TokenResponseIdToken, ..} ) <$> f oauth2TokenResponseIdToken+{-# INLINE oauth2TokenResponseIdTokenL #-}++-- | 'oauth2TokenResponseRefreshToken' Lens+oauth2TokenResponseRefreshTokenL :: Lens_' Oauth2TokenResponse (Maybe Text)+oauth2TokenResponseRefreshTokenL f Oauth2TokenResponse{..} = (\oauth2TokenResponseRefreshToken -> Oauth2TokenResponse { oauth2TokenResponseRefreshToken, ..} ) <$> f oauth2TokenResponseRefreshToken+{-# INLINE oauth2TokenResponseRefreshTokenL #-}++-- | 'oauth2TokenResponseScope' Lens+oauth2TokenResponseScopeL :: Lens_' Oauth2TokenResponse (Maybe Text)+oauth2TokenResponseScopeL f Oauth2TokenResponse{..} = (\oauth2TokenResponseScope -> Oauth2TokenResponse { oauth2TokenResponseScope, ..} ) <$> f oauth2TokenResponseScope+{-# INLINE oauth2TokenResponseScopeL #-}++-- | 'oauth2TokenResponseTokenType' Lens+oauth2TokenResponseTokenTypeL :: Lens_' Oauth2TokenResponse (Maybe Text)+oauth2TokenResponseTokenTypeL f Oauth2TokenResponse{..} = (\oauth2TokenResponseTokenType -> Oauth2TokenResponse { oauth2TokenResponseTokenType, ..} ) <$> f oauth2TokenResponseTokenType+{-# INLINE oauth2TokenResponseTokenTypeL #-}++++-- * OpenIDConnectContext++-- | 'openIDConnectContextAcrValues' Lens+openIDConnectContextAcrValuesL :: Lens_' OpenIDConnectContext (Maybe [Text])+openIDConnectContextAcrValuesL f OpenIDConnectContext{..} = (\openIDConnectContextAcrValues -> OpenIDConnectContext { openIDConnectContextAcrValues, ..} ) <$> f openIDConnectContextAcrValues+{-# INLINE openIDConnectContextAcrValuesL #-}++-- | 'openIDConnectContextDisplay' Lens+openIDConnectContextDisplayL :: Lens_' OpenIDConnectContext (Maybe Text)+openIDConnectContextDisplayL f OpenIDConnectContext{..} = (\openIDConnectContextDisplay -> OpenIDConnectContext { openIDConnectContextDisplay, ..} ) <$> f openIDConnectContextDisplay+{-# INLINE openIDConnectContextDisplayL #-}++-- | 'openIDConnectContextIdTokenHintClaims' Lens+openIDConnectContextIdTokenHintClaimsL :: Lens_' OpenIDConnectContext (Maybe A.Value)+openIDConnectContextIdTokenHintClaimsL f OpenIDConnectContext{..} = (\openIDConnectContextIdTokenHintClaims -> OpenIDConnectContext { openIDConnectContextIdTokenHintClaims, ..} ) <$> f openIDConnectContextIdTokenHintClaims+{-# INLINE openIDConnectContextIdTokenHintClaimsL #-}++-- | 'openIDConnectContextLoginHint' Lens+openIDConnectContextLoginHintL :: Lens_' OpenIDConnectContext (Maybe Text)+openIDConnectContextLoginHintL f OpenIDConnectContext{..} = (\openIDConnectContextLoginHint -> OpenIDConnectContext { openIDConnectContextLoginHint, ..} ) <$> f openIDConnectContextLoginHint+{-# INLINE openIDConnectContextLoginHintL #-}++-- | 'openIDConnectContextUiLocales' Lens+openIDConnectContextUiLocalesL :: Lens_' OpenIDConnectContext (Maybe [Text])+openIDConnectContextUiLocalesL f OpenIDConnectContext{..} = (\openIDConnectContextUiLocales -> OpenIDConnectContext { openIDConnectContextUiLocales, ..} ) <$> f openIDConnectContextUiLocales+{-# INLINE openIDConnectContextUiLocalesL #-}++++-- * PluginConfig++-- | 'pluginConfigArgs' Lens+pluginConfigArgsL :: Lens_' PluginConfig (PluginConfigArgs)+pluginConfigArgsL f PluginConfig{..} = (\pluginConfigArgs -> PluginConfig { pluginConfigArgs, ..} ) <$> f pluginConfigArgs+{-# INLINE pluginConfigArgsL #-}++-- | 'pluginConfigDescription' Lens+pluginConfigDescriptionL :: Lens_' PluginConfig (Text)+pluginConfigDescriptionL f PluginConfig{..} = (\pluginConfigDescription -> PluginConfig { pluginConfigDescription, ..} ) <$> f pluginConfigDescription+{-# INLINE pluginConfigDescriptionL #-}++-- | 'pluginConfigDockerVersion' Lens+pluginConfigDockerVersionL :: Lens_' PluginConfig (Maybe Text)+pluginConfigDockerVersionL f PluginConfig{..} = (\pluginConfigDockerVersion -> PluginConfig { pluginConfigDockerVersion, ..} ) <$> f pluginConfigDockerVersion+{-# INLINE pluginConfigDockerVersionL #-}++-- | 'pluginConfigDocumentation' Lens+pluginConfigDocumentationL :: Lens_' PluginConfig (Text)+pluginConfigDocumentationL f PluginConfig{..} = (\pluginConfigDocumentation -> PluginConfig { pluginConfigDocumentation, ..} ) <$> f pluginConfigDocumentation+{-# INLINE pluginConfigDocumentationL #-}++-- | 'pluginConfigEntrypoint' Lens+pluginConfigEntrypointL :: Lens_' PluginConfig ([Text])+pluginConfigEntrypointL f PluginConfig{..} = (\pluginConfigEntrypoint -> PluginConfig { pluginConfigEntrypoint, ..} ) <$> f pluginConfigEntrypoint+{-# INLINE pluginConfigEntrypointL #-}++-- | 'pluginConfigEnv' Lens+pluginConfigEnvL :: Lens_' PluginConfig ([PluginEnv])+pluginConfigEnvL f PluginConfig{..} = (\pluginConfigEnv -> PluginConfig { pluginConfigEnv, ..} ) <$> f pluginConfigEnv+{-# INLINE pluginConfigEnvL #-}++-- | 'pluginConfigInterface' Lens+pluginConfigInterfaceL :: Lens_' PluginConfig (PluginConfigInterface)+pluginConfigInterfaceL f PluginConfig{..} = (\pluginConfigInterface -> PluginConfig { pluginConfigInterface, ..} ) <$> f pluginConfigInterface+{-# INLINE pluginConfigInterfaceL #-}++-- | 'pluginConfigIpcHost' Lens+pluginConfigIpcHostL :: Lens_' PluginConfig (Bool)+pluginConfigIpcHostL f PluginConfig{..} = (\pluginConfigIpcHost -> PluginConfig { pluginConfigIpcHost, ..} ) <$> f pluginConfigIpcHost+{-# INLINE pluginConfigIpcHostL #-}++-- | 'pluginConfigLinux' Lens+pluginConfigLinuxL :: Lens_' PluginConfig (PluginConfigLinux)+pluginConfigLinuxL f PluginConfig{..} = (\pluginConfigLinux -> PluginConfig { pluginConfigLinux, ..} ) <$> f pluginConfigLinux+{-# INLINE pluginConfigLinuxL #-}++-- | 'pluginConfigMounts' Lens+pluginConfigMountsL :: Lens_' PluginConfig ([PluginMount])+pluginConfigMountsL f PluginConfig{..} = (\pluginConfigMounts -> PluginConfig { pluginConfigMounts, ..} ) <$> f pluginConfigMounts+{-# INLINE pluginConfigMountsL #-}++-- | 'pluginConfigNetwork' Lens+pluginConfigNetworkL :: Lens_' PluginConfig (PluginConfigNetwork)+pluginConfigNetworkL f PluginConfig{..} = (\pluginConfigNetwork -> PluginConfig { pluginConfigNetwork, ..} ) <$> f pluginConfigNetwork+{-# INLINE pluginConfigNetworkL #-}++-- | 'pluginConfigPidHost' Lens+pluginConfigPidHostL :: Lens_' PluginConfig (Bool)+pluginConfigPidHostL f PluginConfig{..} = (\pluginConfigPidHost -> PluginConfig { pluginConfigPidHost, ..} ) <$> f pluginConfigPidHost+{-# INLINE pluginConfigPidHostL #-}++-- | 'pluginConfigPropagatedMount' Lens+pluginConfigPropagatedMountL :: Lens_' PluginConfig (Text)+pluginConfigPropagatedMountL f PluginConfig{..} = (\pluginConfigPropagatedMount -> PluginConfig { pluginConfigPropagatedMount, ..} ) <$> f pluginConfigPropagatedMount+{-# INLINE pluginConfigPropagatedMountL #-}++-- | 'pluginConfigUser' Lens+pluginConfigUserL :: Lens_' PluginConfig (Maybe PluginConfigUser)+pluginConfigUserL f PluginConfig{..} = (\pluginConfigUser -> PluginConfig { pluginConfigUser, ..} ) <$> f pluginConfigUser+{-# INLINE pluginConfigUserL #-}++-- | 'pluginConfigWorkDir' Lens+pluginConfigWorkDirL :: Lens_' PluginConfig (Text)+pluginConfigWorkDirL f PluginConfig{..} = (\pluginConfigWorkDir -> PluginConfig { pluginConfigWorkDir, ..} ) <$> f pluginConfigWorkDir+{-# INLINE pluginConfigWorkDirL #-}++-- | 'pluginConfigRootfs' Lens+pluginConfigRootfsL :: Lens_' PluginConfig (Maybe PluginConfigRootfs)+pluginConfigRootfsL f PluginConfig{..} = (\pluginConfigRootfs -> PluginConfig { pluginConfigRootfs, ..} ) <$> f pluginConfigRootfs+{-# INLINE pluginConfigRootfsL #-}++++-- * PluginConfigArgs++-- | 'pluginConfigArgsDescription' Lens+pluginConfigArgsDescriptionL :: Lens_' PluginConfigArgs (Text)+pluginConfigArgsDescriptionL f PluginConfigArgs{..} = (\pluginConfigArgsDescription -> PluginConfigArgs { pluginConfigArgsDescription, ..} ) <$> f pluginConfigArgsDescription+{-# INLINE pluginConfigArgsDescriptionL #-}++-- | 'pluginConfigArgsName' Lens+pluginConfigArgsNameL :: Lens_' PluginConfigArgs (Text)+pluginConfigArgsNameL f PluginConfigArgs{..} = (\pluginConfigArgsName -> PluginConfigArgs { pluginConfigArgsName, ..} ) <$> f pluginConfigArgsName+{-# INLINE pluginConfigArgsNameL #-}++-- | 'pluginConfigArgsSettable' Lens+pluginConfigArgsSettableL :: Lens_' PluginConfigArgs ([Text])+pluginConfigArgsSettableL f PluginConfigArgs{..} = (\pluginConfigArgsSettable -> PluginConfigArgs { pluginConfigArgsSettable, ..} ) <$> f pluginConfigArgsSettable+{-# INLINE pluginConfigArgsSettableL #-}++-- | 'pluginConfigArgsValue' Lens+pluginConfigArgsValueL :: Lens_' PluginConfigArgs ([Text])+pluginConfigArgsValueL f PluginConfigArgs{..} = (\pluginConfigArgsValue -> PluginConfigArgs { pluginConfigArgsValue, ..} ) <$> f pluginConfigArgsValue+{-# INLINE pluginConfigArgsValueL #-}++++-- * PluginConfigInterface++-- | 'pluginConfigInterfaceSocket' Lens+pluginConfigInterfaceSocketL :: Lens_' PluginConfigInterface (Text)+pluginConfigInterfaceSocketL f PluginConfigInterface{..} = (\pluginConfigInterfaceSocket -> PluginConfigInterface { pluginConfigInterfaceSocket, ..} ) <$> f pluginConfigInterfaceSocket+{-# INLINE pluginConfigInterfaceSocketL #-}++-- | 'pluginConfigInterfaceTypes' Lens+pluginConfigInterfaceTypesL :: Lens_' PluginConfigInterface ([PluginInterfaceType])+pluginConfigInterfaceTypesL f PluginConfigInterface{..} = (\pluginConfigInterfaceTypes -> PluginConfigInterface { pluginConfigInterfaceTypes, ..} ) <$> f pluginConfigInterfaceTypes+{-# INLINE pluginConfigInterfaceTypesL #-}++++-- * PluginConfigLinux++-- | 'pluginConfigLinuxAllowAllDevices' Lens+pluginConfigLinuxAllowAllDevicesL :: Lens_' PluginConfigLinux (Bool)+pluginConfigLinuxAllowAllDevicesL f PluginConfigLinux{..} = (\pluginConfigLinuxAllowAllDevices -> PluginConfigLinux { pluginConfigLinuxAllowAllDevices, ..} ) <$> f pluginConfigLinuxAllowAllDevices+{-# INLINE pluginConfigLinuxAllowAllDevicesL #-}++-- | 'pluginConfigLinuxCapabilities' Lens+pluginConfigLinuxCapabilitiesL :: Lens_' PluginConfigLinux ([Text])+pluginConfigLinuxCapabilitiesL f PluginConfigLinux{..} = (\pluginConfigLinuxCapabilities -> PluginConfigLinux { pluginConfigLinuxCapabilities, ..} ) <$> f pluginConfigLinuxCapabilities+{-# INLINE pluginConfigLinuxCapabilitiesL #-}++-- | 'pluginConfigLinuxDevices' Lens+pluginConfigLinuxDevicesL :: Lens_' PluginConfigLinux ([PluginDevice])+pluginConfigLinuxDevicesL f PluginConfigLinux{..} = (\pluginConfigLinuxDevices -> PluginConfigLinux { pluginConfigLinuxDevices, ..} ) <$> f pluginConfigLinuxDevices+{-# INLINE pluginConfigLinuxDevicesL #-}++++-- * PluginConfigNetwork++-- | 'pluginConfigNetworkType' Lens+pluginConfigNetworkTypeL :: Lens_' PluginConfigNetwork (Text)+pluginConfigNetworkTypeL f PluginConfigNetwork{..} = (\pluginConfigNetworkType -> PluginConfigNetwork { pluginConfigNetworkType, ..} ) <$> f pluginConfigNetworkType+{-# INLINE pluginConfigNetworkTypeL #-}++++-- * PluginConfigRootfs++-- | 'pluginConfigRootfsDiffIds' Lens+pluginConfigRootfsDiffIdsL :: Lens_' PluginConfigRootfs (Maybe [Text])+pluginConfigRootfsDiffIdsL f PluginConfigRootfs{..} = (\pluginConfigRootfsDiffIds -> PluginConfigRootfs { pluginConfigRootfsDiffIds, ..} ) <$> f pluginConfigRootfsDiffIds+{-# INLINE pluginConfigRootfsDiffIdsL #-}++-- | 'pluginConfigRootfsType' Lens+pluginConfigRootfsTypeL :: Lens_' PluginConfigRootfs (Maybe Text)+pluginConfigRootfsTypeL f PluginConfigRootfs{..} = (\pluginConfigRootfsType -> PluginConfigRootfs { pluginConfigRootfsType, ..} ) <$> f pluginConfigRootfsType+{-# INLINE pluginConfigRootfsTypeL #-}++++-- * PluginConfigUser++-- | 'pluginConfigUserGid' Lens+pluginConfigUserGidL :: Lens_' PluginConfigUser (Maybe Int)+pluginConfigUserGidL f PluginConfigUser{..} = (\pluginConfigUserGid -> PluginConfigUser { pluginConfigUserGid, ..} ) <$> f pluginConfigUserGid+{-# INLINE pluginConfigUserGidL #-}++-- | 'pluginConfigUserUid' Lens+pluginConfigUserUidL :: Lens_' PluginConfigUser (Maybe Int)+pluginConfigUserUidL f PluginConfigUser{..} = (\pluginConfigUserUid -> PluginConfigUser { pluginConfigUserUid, ..} ) <$> f pluginConfigUserUid+{-# INLINE pluginConfigUserUidL #-}++++-- * PluginDevice++-- | 'pluginDeviceDescription' Lens+pluginDeviceDescriptionL :: Lens_' PluginDevice (Text)+pluginDeviceDescriptionL f PluginDevice{..} = (\pluginDeviceDescription -> PluginDevice { pluginDeviceDescription, ..} ) <$> f pluginDeviceDescription+{-# INLINE pluginDeviceDescriptionL #-}++-- | 'pluginDeviceName' Lens+pluginDeviceNameL :: Lens_' PluginDevice (Text)+pluginDeviceNameL f PluginDevice{..} = (\pluginDeviceName -> PluginDevice { pluginDeviceName, ..} ) <$> f pluginDeviceName+{-# INLINE pluginDeviceNameL #-}++-- | 'pluginDevicePath' Lens+pluginDevicePathL :: Lens_' PluginDevice (Text)+pluginDevicePathL f PluginDevice{..} = (\pluginDevicePath -> PluginDevice { pluginDevicePath, ..} ) <$> f pluginDevicePath+{-# INLINE pluginDevicePathL #-}++-- | 'pluginDeviceSettable' Lens+pluginDeviceSettableL :: Lens_' PluginDevice ([Text])+pluginDeviceSettableL f PluginDevice{..} = (\pluginDeviceSettable -> PluginDevice { pluginDeviceSettable, ..} ) <$> f pluginDeviceSettable+{-# INLINE pluginDeviceSettableL #-}++++-- * PluginEnv++-- | 'pluginEnvDescription' Lens+pluginEnvDescriptionL :: Lens_' PluginEnv (Text)+pluginEnvDescriptionL f PluginEnv{..} = (\pluginEnvDescription -> PluginEnv { pluginEnvDescription, ..} ) <$> f pluginEnvDescription+{-# INLINE pluginEnvDescriptionL #-}++-- | 'pluginEnvName' Lens+pluginEnvNameL :: Lens_' PluginEnv (Text)+pluginEnvNameL f PluginEnv{..} = (\pluginEnvName -> PluginEnv { pluginEnvName, ..} ) <$> f pluginEnvName+{-# INLINE pluginEnvNameL #-}++-- | 'pluginEnvSettable' Lens+pluginEnvSettableL :: Lens_' PluginEnv ([Text])+pluginEnvSettableL f PluginEnv{..} = (\pluginEnvSettable -> PluginEnv { pluginEnvSettable, ..} ) <$> f pluginEnvSettable+{-# INLINE pluginEnvSettableL #-}++-- | 'pluginEnvValue' Lens+pluginEnvValueL :: Lens_' PluginEnv (Text)+pluginEnvValueL f PluginEnv{..} = (\pluginEnvValue -> PluginEnv { pluginEnvValue, ..} ) <$> f pluginEnvValue+{-# INLINE pluginEnvValueL #-}++++-- * PluginInterfaceType++-- | 'pluginInterfaceTypeCapability' Lens+pluginInterfaceTypeCapabilityL :: Lens_' PluginInterfaceType (Text)+pluginInterfaceTypeCapabilityL f PluginInterfaceType{..} = (\pluginInterfaceTypeCapability -> PluginInterfaceType { pluginInterfaceTypeCapability, ..} ) <$> f pluginInterfaceTypeCapability+{-# INLINE pluginInterfaceTypeCapabilityL #-}++-- | 'pluginInterfaceTypePrefix' Lens+pluginInterfaceTypePrefixL :: Lens_' PluginInterfaceType (Text)+pluginInterfaceTypePrefixL f PluginInterfaceType{..} = (\pluginInterfaceTypePrefix -> PluginInterfaceType { pluginInterfaceTypePrefix, ..} ) <$> f pluginInterfaceTypePrefix+{-# INLINE pluginInterfaceTypePrefixL #-}++-- | 'pluginInterfaceTypeVersion' Lens+pluginInterfaceTypeVersionL :: Lens_' PluginInterfaceType (Text)+pluginInterfaceTypeVersionL f PluginInterfaceType{..} = (\pluginInterfaceTypeVersion -> PluginInterfaceType { pluginInterfaceTypeVersion, ..} ) <$> f pluginInterfaceTypeVersion+{-# INLINE pluginInterfaceTypeVersionL #-}++++-- * PluginMount++-- | 'pluginMountDescription' Lens+pluginMountDescriptionL :: Lens_' PluginMount (Text)+pluginMountDescriptionL f PluginMount{..} = (\pluginMountDescription -> PluginMount { pluginMountDescription, ..} ) <$> f pluginMountDescription+{-# INLINE pluginMountDescriptionL #-}++-- | 'pluginMountDestination' Lens+pluginMountDestinationL :: Lens_' PluginMount (Text)+pluginMountDestinationL f PluginMount{..} = (\pluginMountDestination -> PluginMount { pluginMountDestination, ..} ) <$> f pluginMountDestination+{-# INLINE pluginMountDestinationL #-}++-- | 'pluginMountName' Lens+pluginMountNameL :: Lens_' PluginMount (Text)+pluginMountNameL f PluginMount{..} = (\pluginMountName -> PluginMount { pluginMountName, ..} ) <$> f pluginMountName+{-# INLINE pluginMountNameL #-}++-- | 'pluginMountOptions' Lens+pluginMountOptionsL :: Lens_' PluginMount ([Text])+pluginMountOptionsL f PluginMount{..} = (\pluginMountOptions -> PluginMount { pluginMountOptions, ..} ) <$> f pluginMountOptions+{-# INLINE pluginMountOptionsL #-}++-- | 'pluginMountSettable' Lens+pluginMountSettableL :: Lens_' PluginMount ([Text])+pluginMountSettableL f PluginMount{..} = (\pluginMountSettable -> PluginMount { pluginMountSettable, ..} ) <$> f pluginMountSettable+{-# INLINE pluginMountSettableL #-}++-- | 'pluginMountSource' Lens+pluginMountSourceL :: Lens_' PluginMount (Text)+pluginMountSourceL f PluginMount{..} = (\pluginMountSource -> PluginMount { pluginMountSource, ..} ) <$> f pluginMountSource+{-# INLINE pluginMountSourceL #-}++-- | 'pluginMountType' Lens+pluginMountTypeL :: Lens_' PluginMount (Text)+pluginMountTypeL f PluginMount{..} = (\pluginMountType -> PluginMount { pluginMountType, ..} ) <$> f pluginMountType+{-# INLINE pluginMountTypeL #-}++++-- * PluginSettings++-- | 'pluginSettingsArgs' Lens+pluginSettingsArgsL :: Lens_' PluginSettings ([Text])+pluginSettingsArgsL f PluginSettings{..} = (\pluginSettingsArgs -> PluginSettings { pluginSettingsArgs, ..} ) <$> f pluginSettingsArgs+{-# INLINE pluginSettingsArgsL #-}++-- | 'pluginSettingsDevices' Lens+pluginSettingsDevicesL :: Lens_' PluginSettings ([PluginDevice])+pluginSettingsDevicesL f PluginSettings{..} = (\pluginSettingsDevices -> PluginSettings { pluginSettingsDevices, ..} ) <$> f pluginSettingsDevices+{-# INLINE pluginSettingsDevicesL #-}++-- | 'pluginSettingsEnv' Lens+pluginSettingsEnvL :: Lens_' PluginSettings ([Text])+pluginSettingsEnvL f PluginSettings{..} = (\pluginSettingsEnv -> PluginSettings { pluginSettingsEnv, ..} ) <$> f pluginSettingsEnv+{-# INLINE pluginSettingsEnvL #-}++-- | 'pluginSettingsMounts' Lens+pluginSettingsMountsL :: Lens_' PluginSettings ([PluginMount])+pluginSettingsMountsL f PluginSettings{..} = (\pluginSettingsMounts -> PluginSettings { pluginSettingsMounts, ..} ) <$> f pluginSettingsMounts+{-# INLINE pluginSettingsMountsL #-}++++-- * PreviousConsentSession++-- | 'previousConsentSessionConsentRequest' Lens+previousConsentSessionConsentRequestL :: Lens_' PreviousConsentSession (Maybe ConsentRequest)+previousConsentSessionConsentRequestL f PreviousConsentSession{..} = (\previousConsentSessionConsentRequest -> PreviousConsentSession { previousConsentSessionConsentRequest, ..} ) <$> f previousConsentSessionConsentRequest+{-# INLINE previousConsentSessionConsentRequestL #-}++-- | 'previousConsentSessionGrantAccessTokenAudience' Lens+previousConsentSessionGrantAccessTokenAudienceL :: Lens_' PreviousConsentSession (Maybe [Text])+previousConsentSessionGrantAccessTokenAudienceL f PreviousConsentSession{..} = (\previousConsentSessionGrantAccessTokenAudience -> PreviousConsentSession { previousConsentSessionGrantAccessTokenAudience, ..} ) <$> f previousConsentSessionGrantAccessTokenAudience+{-# INLINE previousConsentSessionGrantAccessTokenAudienceL #-}++-- | 'previousConsentSessionGrantScope' Lens+previousConsentSessionGrantScopeL :: Lens_' PreviousConsentSession (Maybe [Text])+previousConsentSessionGrantScopeL f PreviousConsentSession{..} = (\previousConsentSessionGrantScope -> PreviousConsentSession { previousConsentSessionGrantScope, ..} ) <$> f previousConsentSessionGrantScope+{-# INLINE previousConsentSessionGrantScopeL #-}++-- | 'previousConsentSessionHandledAt' Lens+previousConsentSessionHandledAtL :: Lens_' PreviousConsentSession (Maybe DateTime)+previousConsentSessionHandledAtL f PreviousConsentSession{..} = (\previousConsentSessionHandledAt -> PreviousConsentSession { previousConsentSessionHandledAt, ..} ) <$> f previousConsentSessionHandledAt+{-# INLINE previousConsentSessionHandledAtL #-}++-- | 'previousConsentSessionRemember' Lens+previousConsentSessionRememberL :: Lens_' PreviousConsentSession (Maybe Bool)+previousConsentSessionRememberL f PreviousConsentSession{..} = (\previousConsentSessionRemember -> PreviousConsentSession { previousConsentSessionRemember, ..} ) <$> f previousConsentSessionRemember+{-# INLINE previousConsentSessionRememberL #-}++-- | 'previousConsentSessionRememberFor' Lens+previousConsentSessionRememberForL :: Lens_' PreviousConsentSession (Maybe Integer)+previousConsentSessionRememberForL f PreviousConsentSession{..} = (\previousConsentSessionRememberFor -> PreviousConsentSession { previousConsentSessionRememberFor, ..} ) <$> f previousConsentSessionRememberFor+{-# INLINE previousConsentSessionRememberForL #-}++-- | 'previousConsentSessionSession' Lens+previousConsentSessionSessionL :: Lens_' PreviousConsentSession (Maybe ConsentRequestSession)+previousConsentSessionSessionL f PreviousConsentSession{..} = (\previousConsentSessionSession -> PreviousConsentSession { previousConsentSessionSession, ..} ) <$> f previousConsentSessionSession+{-# INLINE previousConsentSessionSessionL #-}++++-- * RejectRequest++-- | 'rejectRequestError' Lens+rejectRequestErrorL :: Lens_' RejectRequest (Maybe Text)+rejectRequestErrorL f RejectRequest{..} = (\rejectRequestError -> RejectRequest { rejectRequestError, ..} ) <$> f rejectRequestError+{-# INLINE rejectRequestErrorL #-}++-- | 'rejectRequestErrorDebug' Lens+rejectRequestErrorDebugL :: Lens_' RejectRequest (Maybe Text)+rejectRequestErrorDebugL f RejectRequest{..} = (\rejectRequestErrorDebug -> RejectRequest { rejectRequestErrorDebug, ..} ) <$> f rejectRequestErrorDebug+{-# INLINE rejectRequestErrorDebugL #-}++-- | 'rejectRequestErrorDescription' Lens+rejectRequestErrorDescriptionL :: Lens_' RejectRequest (Maybe Text)+rejectRequestErrorDescriptionL f RejectRequest{..} = (\rejectRequestErrorDescription -> RejectRequest { rejectRequestErrorDescription, ..} ) <$> f rejectRequestErrorDescription+{-# INLINE rejectRequestErrorDescriptionL #-}++-- | 'rejectRequestErrorHint' Lens+rejectRequestErrorHintL :: Lens_' RejectRequest (Maybe Text)+rejectRequestErrorHintL f RejectRequest{..} = (\rejectRequestErrorHint -> RejectRequest { rejectRequestErrorHint, ..} ) <$> f rejectRequestErrorHint+{-# INLINE rejectRequestErrorHintL #-}++-- | 'rejectRequestStatusCode' Lens+rejectRequestStatusCodeL :: Lens_' RejectRequest (Maybe Integer)+rejectRequestStatusCodeL f RejectRequest{..} = (\rejectRequestStatusCode -> RejectRequest { rejectRequestStatusCode, ..} ) <$> f rejectRequestStatusCode+{-# INLINE rejectRequestStatusCodeL #-}++++-- * UserinfoResponse++-- | 'userinfoResponseBirthdate' Lens+userinfoResponseBirthdateL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseBirthdateL f UserinfoResponse{..} = (\userinfoResponseBirthdate -> UserinfoResponse { userinfoResponseBirthdate, ..} ) <$> f userinfoResponseBirthdate+{-# INLINE userinfoResponseBirthdateL #-}++-- | 'userinfoResponseEmail' Lens+userinfoResponseEmailL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseEmailL f UserinfoResponse{..} = (\userinfoResponseEmail -> UserinfoResponse { userinfoResponseEmail, ..} ) <$> f userinfoResponseEmail+{-# INLINE userinfoResponseEmailL #-}++-- | 'userinfoResponseEmailVerified' Lens+userinfoResponseEmailVerifiedL :: Lens_' UserinfoResponse (Maybe Bool)+userinfoResponseEmailVerifiedL f UserinfoResponse{..} = (\userinfoResponseEmailVerified -> UserinfoResponse { userinfoResponseEmailVerified, ..} ) <$> f userinfoResponseEmailVerified+{-# INLINE userinfoResponseEmailVerifiedL #-}++-- | 'userinfoResponseFamilyName' Lens+userinfoResponseFamilyNameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseFamilyNameL f UserinfoResponse{..} = (\userinfoResponseFamilyName -> UserinfoResponse { userinfoResponseFamilyName, ..} ) <$> f userinfoResponseFamilyName+{-# INLINE userinfoResponseFamilyNameL #-}++-- | 'userinfoResponseGender' Lens+userinfoResponseGenderL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseGenderL f UserinfoResponse{..} = (\userinfoResponseGender -> UserinfoResponse { userinfoResponseGender, ..} ) <$> f userinfoResponseGender+{-# INLINE userinfoResponseGenderL #-}++-- | 'userinfoResponseGivenName' Lens+userinfoResponseGivenNameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseGivenNameL f UserinfoResponse{..} = (\userinfoResponseGivenName -> UserinfoResponse { userinfoResponseGivenName, ..} ) <$> f userinfoResponseGivenName+{-# INLINE userinfoResponseGivenNameL #-}++-- | 'userinfoResponseLocale' Lens+userinfoResponseLocaleL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseLocaleL f UserinfoResponse{..} = (\userinfoResponseLocale -> UserinfoResponse { userinfoResponseLocale, ..} ) <$> f userinfoResponseLocale+{-# INLINE userinfoResponseLocaleL #-}++-- | 'userinfoResponseMiddleName' Lens+userinfoResponseMiddleNameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseMiddleNameL f UserinfoResponse{..} = (\userinfoResponseMiddleName -> UserinfoResponse { userinfoResponseMiddleName, ..} ) <$> f userinfoResponseMiddleName+{-# INLINE userinfoResponseMiddleNameL #-}++-- | 'userinfoResponseName' Lens+userinfoResponseNameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseNameL f UserinfoResponse{..} = (\userinfoResponseName -> UserinfoResponse { userinfoResponseName, ..} ) <$> f userinfoResponseName+{-# INLINE userinfoResponseNameL #-}++-- | 'userinfoResponseNickname' Lens+userinfoResponseNicknameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseNicknameL f UserinfoResponse{..} = (\userinfoResponseNickname -> UserinfoResponse { userinfoResponseNickname, ..} ) <$> f userinfoResponseNickname+{-# INLINE userinfoResponseNicknameL #-}++-- | 'userinfoResponsePhoneNumber' Lens+userinfoResponsePhoneNumberL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponsePhoneNumberL f UserinfoResponse{..} = (\userinfoResponsePhoneNumber -> UserinfoResponse { userinfoResponsePhoneNumber, ..} ) <$> f userinfoResponsePhoneNumber+{-# INLINE userinfoResponsePhoneNumberL #-}++-- | 'userinfoResponsePhoneNumberVerified' Lens+userinfoResponsePhoneNumberVerifiedL :: Lens_' UserinfoResponse (Maybe Bool)+userinfoResponsePhoneNumberVerifiedL f UserinfoResponse{..} = (\userinfoResponsePhoneNumberVerified -> UserinfoResponse { userinfoResponsePhoneNumberVerified, ..} ) <$> f userinfoResponsePhoneNumberVerified+{-# INLINE userinfoResponsePhoneNumberVerifiedL #-}++-- | 'userinfoResponsePicture' Lens+userinfoResponsePictureL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponsePictureL f UserinfoResponse{..} = (\userinfoResponsePicture -> UserinfoResponse { userinfoResponsePicture, ..} ) <$> f userinfoResponsePicture+{-# INLINE userinfoResponsePictureL #-}++-- | 'userinfoResponsePreferredUsername' Lens+userinfoResponsePreferredUsernameL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponsePreferredUsernameL f UserinfoResponse{..} = (\userinfoResponsePreferredUsername -> UserinfoResponse { userinfoResponsePreferredUsername, ..} ) <$> f userinfoResponsePreferredUsername+{-# INLINE userinfoResponsePreferredUsernameL #-}++-- | 'userinfoResponseProfile' Lens+userinfoResponseProfileL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseProfileL f UserinfoResponse{..} = (\userinfoResponseProfile -> UserinfoResponse { userinfoResponseProfile, ..} ) <$> f userinfoResponseProfile+{-# INLINE userinfoResponseProfileL #-}++-- | 'userinfoResponseSub' Lens+userinfoResponseSubL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseSubL f UserinfoResponse{..} = (\userinfoResponseSub -> UserinfoResponse { userinfoResponseSub, ..} ) <$> f userinfoResponseSub+{-# INLINE userinfoResponseSubL #-}++-- | 'userinfoResponseUpdatedAt' Lens+userinfoResponseUpdatedAtL :: Lens_' UserinfoResponse (Maybe Integer)+userinfoResponseUpdatedAtL f UserinfoResponse{..} = (\userinfoResponseUpdatedAt -> UserinfoResponse { userinfoResponseUpdatedAt, ..} ) <$> f userinfoResponseUpdatedAt+{-# INLINE userinfoResponseUpdatedAtL #-}++-- | 'userinfoResponseWebsite' Lens+userinfoResponseWebsiteL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseWebsiteL f UserinfoResponse{..} = (\userinfoResponseWebsite -> UserinfoResponse { userinfoResponseWebsite, ..} ) <$> f userinfoResponseWebsite+{-# INLINE userinfoResponseWebsiteL #-}++-- | 'userinfoResponseZoneinfo' Lens+userinfoResponseZoneinfoL :: Lens_' UserinfoResponse (Maybe Text)+userinfoResponseZoneinfoL f UserinfoResponse{..} = (\userinfoResponseZoneinfo -> UserinfoResponse { userinfoResponseZoneinfo, ..} ) <$> f userinfoResponseZoneinfo+{-# INLINE userinfoResponseZoneinfoL #-}++++-- * Version++-- | 'versionVersion' Lens+versionVersionL :: Lens_' Version (Maybe Text)+versionVersionL f Version{..} = (\versionVersion -> Version { versionVersion, ..} ) <$> f versionVersion+{-# INLINE versionVersionL #-}++++-- * VolumeUsageData++-- | 'volumeUsageDataRefCount' Lens+volumeUsageDataRefCountL :: Lens_' VolumeUsageData (Integer)+volumeUsageDataRefCountL f VolumeUsageData{..} = (\volumeUsageDataRefCount -> VolumeUsageData { volumeUsageDataRefCount, ..} ) <$> f volumeUsageDataRefCount+{-# INLINE volumeUsageDataRefCountL #-}++-- | 'volumeUsageDataSize' Lens+volumeUsageDataSizeL :: Lens_' VolumeUsageData (Integer)+volumeUsageDataSizeL f VolumeUsageData{..} = (\volumeUsageDataSize -> VolumeUsageData { volumeUsageDataSize, ..} ) <$> f volumeUsageDataSize+{-# INLINE volumeUsageDataSizeL #-}++++-- * WellKnown++-- | 'wellKnownAuthorizationEndpoint' Lens+wellKnownAuthorizationEndpointL :: Lens_' WellKnown (Text)+wellKnownAuthorizationEndpointL f WellKnown{..} = (\wellKnownAuthorizationEndpoint -> WellKnown { wellKnownAuthorizationEndpoint, ..} ) <$> f wellKnownAuthorizationEndpoint+{-# INLINE wellKnownAuthorizationEndpointL #-}++-- | 'wellKnownBackchannelLogoutSessionSupported' Lens+wellKnownBackchannelLogoutSessionSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownBackchannelLogoutSessionSupportedL f WellKnown{..} = (\wellKnownBackchannelLogoutSessionSupported -> WellKnown { wellKnownBackchannelLogoutSessionSupported, ..} ) <$> f wellKnownBackchannelLogoutSessionSupported+{-# INLINE wellKnownBackchannelLogoutSessionSupportedL #-}++-- | 'wellKnownBackchannelLogoutSupported' Lens+wellKnownBackchannelLogoutSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownBackchannelLogoutSupportedL f WellKnown{..} = (\wellKnownBackchannelLogoutSupported -> WellKnown { wellKnownBackchannelLogoutSupported, ..} ) <$> f wellKnownBackchannelLogoutSupported+{-# INLINE wellKnownBackchannelLogoutSupportedL #-}++-- | 'wellKnownClaimsParameterSupported' Lens+wellKnownClaimsParameterSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownClaimsParameterSupportedL f WellKnown{..} = (\wellKnownClaimsParameterSupported -> WellKnown { wellKnownClaimsParameterSupported, ..} ) <$> f wellKnownClaimsParameterSupported+{-# INLINE wellKnownClaimsParameterSupportedL #-}++-- | 'wellKnownClaimsSupported' Lens+wellKnownClaimsSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownClaimsSupportedL f WellKnown{..} = (\wellKnownClaimsSupported -> WellKnown { wellKnownClaimsSupported, ..} ) <$> f wellKnownClaimsSupported+{-# INLINE wellKnownClaimsSupportedL #-}++-- | 'wellKnownEndSessionEndpoint' Lens+wellKnownEndSessionEndpointL :: Lens_' WellKnown (Maybe Text)+wellKnownEndSessionEndpointL f WellKnown{..} = (\wellKnownEndSessionEndpoint -> WellKnown { wellKnownEndSessionEndpoint, ..} ) <$> f wellKnownEndSessionEndpoint+{-# INLINE wellKnownEndSessionEndpointL #-}++-- | 'wellKnownFrontchannelLogoutSessionSupported' Lens+wellKnownFrontchannelLogoutSessionSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownFrontchannelLogoutSessionSupportedL f WellKnown{..} = (\wellKnownFrontchannelLogoutSessionSupported -> WellKnown { wellKnownFrontchannelLogoutSessionSupported, ..} ) <$> f wellKnownFrontchannelLogoutSessionSupported+{-# INLINE wellKnownFrontchannelLogoutSessionSupportedL #-}++-- | 'wellKnownFrontchannelLogoutSupported' Lens+wellKnownFrontchannelLogoutSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownFrontchannelLogoutSupportedL f WellKnown{..} = (\wellKnownFrontchannelLogoutSupported -> WellKnown { wellKnownFrontchannelLogoutSupported, ..} ) <$> f wellKnownFrontchannelLogoutSupported+{-# INLINE wellKnownFrontchannelLogoutSupportedL #-}++-- | 'wellKnownGrantTypesSupported' Lens+wellKnownGrantTypesSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownGrantTypesSupportedL f WellKnown{..} = (\wellKnownGrantTypesSupported -> WellKnown { wellKnownGrantTypesSupported, ..} ) <$> f wellKnownGrantTypesSupported+{-# INLINE wellKnownGrantTypesSupportedL #-}++-- | 'wellKnownIdTokenSigningAlgValuesSupported' Lens+wellKnownIdTokenSigningAlgValuesSupportedL :: Lens_' WellKnown ([Text])+wellKnownIdTokenSigningAlgValuesSupportedL f WellKnown{..} = (\wellKnownIdTokenSigningAlgValuesSupported -> WellKnown { wellKnownIdTokenSigningAlgValuesSupported, ..} ) <$> f wellKnownIdTokenSigningAlgValuesSupported+{-# INLINE wellKnownIdTokenSigningAlgValuesSupportedL #-}++-- | 'wellKnownIssuer' Lens+wellKnownIssuerL :: Lens_' WellKnown (Text)+wellKnownIssuerL f WellKnown{..} = (\wellKnownIssuer -> WellKnown { wellKnownIssuer, ..} ) <$> f wellKnownIssuer+{-# INLINE wellKnownIssuerL #-}++-- | 'wellKnownJwksUri' Lens+wellKnownJwksUriL :: Lens_' WellKnown (Text)+wellKnownJwksUriL f WellKnown{..} = (\wellKnownJwksUri -> WellKnown { wellKnownJwksUri, ..} ) <$> f wellKnownJwksUri+{-# INLINE wellKnownJwksUriL #-}++-- | 'wellKnownRegistrationEndpoint' Lens+wellKnownRegistrationEndpointL :: Lens_' WellKnown (Maybe Text)+wellKnownRegistrationEndpointL f WellKnown{..} = (\wellKnownRegistrationEndpoint -> WellKnown { wellKnownRegistrationEndpoint, ..} ) <$> f wellKnownRegistrationEndpoint+{-# INLINE wellKnownRegistrationEndpointL #-}++-- | 'wellKnownRequestObjectSigningAlgValuesSupported' Lens+wellKnownRequestObjectSigningAlgValuesSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownRequestObjectSigningAlgValuesSupportedL f WellKnown{..} = (\wellKnownRequestObjectSigningAlgValuesSupported -> WellKnown { wellKnownRequestObjectSigningAlgValuesSupported, ..} ) <$> f wellKnownRequestObjectSigningAlgValuesSupported+{-# INLINE wellKnownRequestObjectSigningAlgValuesSupportedL #-}++-- | 'wellKnownRequestParameterSupported' Lens+wellKnownRequestParameterSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownRequestParameterSupportedL f WellKnown{..} = (\wellKnownRequestParameterSupported -> WellKnown { wellKnownRequestParameterSupported, ..} ) <$> f wellKnownRequestParameterSupported+{-# INLINE wellKnownRequestParameterSupportedL #-}++-- | 'wellKnownRequestUriParameterSupported' Lens+wellKnownRequestUriParameterSupportedL :: Lens_' WellKnown (Maybe Bool)+wellKnownRequestUriParameterSupportedL f WellKnown{..} = (\wellKnownRequestUriParameterSupported -> WellKnown { wellKnownRequestUriParameterSupported, ..} ) <$> f wellKnownRequestUriParameterSupported+{-# INLINE wellKnownRequestUriParameterSupportedL #-}++-- | 'wellKnownRequireRequestUriRegistration' Lens+wellKnownRequireRequestUriRegistrationL :: Lens_' WellKnown (Maybe Bool)+wellKnownRequireRequestUriRegistrationL f WellKnown{..} = (\wellKnownRequireRequestUriRegistration -> WellKnown { wellKnownRequireRequestUriRegistration, ..} ) <$> f wellKnownRequireRequestUriRegistration+{-# INLINE wellKnownRequireRequestUriRegistrationL #-}++-- | 'wellKnownResponseModesSupported' Lens+wellKnownResponseModesSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownResponseModesSupportedL f WellKnown{..} = (\wellKnownResponseModesSupported -> WellKnown { wellKnownResponseModesSupported, ..} ) <$> f wellKnownResponseModesSupported+{-# INLINE wellKnownResponseModesSupportedL #-}++-- | 'wellKnownResponseTypesSupported' Lens+wellKnownResponseTypesSupportedL :: Lens_' WellKnown ([Text])+wellKnownResponseTypesSupportedL f WellKnown{..} = (\wellKnownResponseTypesSupported -> WellKnown { wellKnownResponseTypesSupported, ..} ) <$> f wellKnownResponseTypesSupported+{-# INLINE wellKnownResponseTypesSupportedL #-}++-- | 'wellKnownRevocationEndpoint' Lens+wellKnownRevocationEndpointL :: Lens_' WellKnown (Maybe Text)+wellKnownRevocationEndpointL f WellKnown{..} = (\wellKnownRevocationEndpoint -> WellKnown { wellKnownRevocationEndpoint, ..} ) <$> f wellKnownRevocationEndpoint+{-# INLINE wellKnownRevocationEndpointL #-}++-- | 'wellKnownScopesSupported' Lens+wellKnownScopesSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownScopesSupportedL f WellKnown{..} = (\wellKnownScopesSupported -> WellKnown { wellKnownScopesSupported, ..} ) <$> f wellKnownScopesSupported+{-# INLINE wellKnownScopesSupportedL #-}++-- | 'wellKnownSubjectTypesSupported' Lens+wellKnownSubjectTypesSupportedL :: Lens_' WellKnown ([Text])+wellKnownSubjectTypesSupportedL f WellKnown{..} = (\wellKnownSubjectTypesSupported -> WellKnown { wellKnownSubjectTypesSupported, ..} ) <$> f wellKnownSubjectTypesSupported+{-# INLINE wellKnownSubjectTypesSupportedL #-}++-- | 'wellKnownTokenEndpoint' Lens+wellKnownTokenEndpointL :: Lens_' WellKnown (Text)+wellKnownTokenEndpointL f WellKnown{..} = (\wellKnownTokenEndpoint -> WellKnown { wellKnownTokenEndpoint, ..} ) <$> f wellKnownTokenEndpoint+{-# INLINE wellKnownTokenEndpointL #-}++-- | 'wellKnownTokenEndpointAuthMethodsSupported' Lens+wellKnownTokenEndpointAuthMethodsSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownTokenEndpointAuthMethodsSupportedL f WellKnown{..} = (\wellKnownTokenEndpointAuthMethodsSupported -> WellKnown { wellKnownTokenEndpointAuthMethodsSupported, ..} ) <$> f wellKnownTokenEndpointAuthMethodsSupported+{-# INLINE wellKnownTokenEndpointAuthMethodsSupportedL #-}++-- | 'wellKnownUserinfoEndpoint' Lens+wellKnownUserinfoEndpointL :: Lens_' WellKnown (Maybe Text)+wellKnownUserinfoEndpointL f WellKnown{..} = (\wellKnownUserinfoEndpoint -> WellKnown { wellKnownUserinfoEndpoint, ..} ) <$> f wellKnownUserinfoEndpoint+{-# INLINE wellKnownUserinfoEndpointL #-}++-- | 'wellKnownUserinfoSigningAlgValuesSupported' Lens+wellKnownUserinfoSigningAlgValuesSupportedL :: Lens_' WellKnown (Maybe [Text])+wellKnownUserinfoSigningAlgValuesSupportedL f WellKnown{..} = (\wellKnownUserinfoSigningAlgValuesSupported -> WellKnown { wellKnownUserinfoSigningAlgValuesSupported, ..} ) <$> f wellKnownUserinfoSigningAlgValuesSupported+{-# INLINE wellKnownUserinfoSigningAlgValuesSupportedL #-}++
+ openapi.yaml view
@@ -0,0 +1,3493 @@+openapi: 3.0.1+info:+ description: Welcome to the ORY Hydra HTTP API documentation. You will find documentation+ for all HTTP APIs here.+ title: ORY Hydra+ version: latest+servers:+- url: /+paths:+ /.well-known/jwks.json:+ get:+ description: |-+ This endpoint returns JSON Web Keys to be used as public keys for verifying OpenID Connect ID Tokens and,+ if enabled, OAuth 2.0 JWT Access Tokens. This endpoint can be used with client libraries like+ [node-jwks-rsa](https://github.com/auth0/node-jwks-rsa) among others.+ operationId: wellKnown+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ description: JSONWebKeySet+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: JSON Web Keys Discovery+ tags:+ - public+ /.well-known/openid-configuration:+ get:+ description: |-+ The well known endpoint an be used to retrieve information for OpenID Connect clients. We encourage you to not roll+ your own OpenID Connect client but to use an OpenID Connect client library instead. You can learn more on this+ flow at https://openid.net/specs/openid-connect-discovery-1_0.html .++ Popular libraries for OpenID Connect clients include oidc-client-js (JavaScript), go-oidc (Golang), and others.+ For a full list of clients go here: https://openid.net/developers/certified/+ operationId: discoverOpenIDConfiguration+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/wellKnown'+ description: wellKnown+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: OpenID Connect Discovery+ tags:+ - public+ /clients:+ get:+ description: |-+ This endpoint lists all clients in the database, and never returns client secrets. As a default it lists the first 100 clients. The `limit` parameter can be used to retrieve more clients, but it has an upper bound at 500 objects. Pagination should be used to retrieve more than 500 objects.++ OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+ The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/clients?limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'.+ Multiple links can be included in this header, and will be separated by a comma.+ operationId: listOAuth2Clients+ parameters:+ - description: The maximum amount of policies returned, upper bound is 500 policies+ in: query+ name: limit+ schema:+ format: int64+ type: integer+ - description: The offset from where to start looking.+ in: query+ name: offset+ schema:+ format: int64+ type: integer+ responses:+ "200":+ content:+ application/json:+ schema:+ items:+ $ref: '#/components/schemas/oAuth2Client'+ type: array+ description: A list of clients.+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: List OAuth 2.0 Clients+ tags:+ - admin+ post:+ description: |-+ Create a new OAuth 2.0 client If you pass `client_secret` the secret will be used, otherwise a random secret will be generated. The secret will be returned in the response and you will not be able to retrieve it later on. Write the secret down and keep it somwhere safe.++ OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+ operationId: createOAuth2Client+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2Client'+ required: true+ responses:+ "201":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2Client'+ description: oAuth2Client+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "409":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Create an OAuth 2.0 Client+ tags:+ - admin+ x-codegen-request-body-name: Body+ /clients/{id}:+ delete:+ description: |-+ Delete an existing OAuth 2.0 Client by its ID.++ OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+ operationId: deleteOAuth2Client+ parameters:+ - description: The id of the OAuth 2.0 Client.+ in: path+ name: id+ required: true+ schema:+ type: string+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Deletes an OAuth 2.0 Client+ tags:+ - admin+ get:+ description: |-+ Get an OAUth 2.0 client by its ID. This endpoint never returns passwords.++ OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+ operationId: getOAuth2Client+ parameters:+ - description: The id of the OAuth 2.0 Client.+ in: path+ name: id+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2Client'+ description: oAuth2Client+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Get an OAuth 2.0 Client.+ tags:+ - admin+ put:+ description: |-+ Update an existing OAuth 2.0 Client. If you pass `client_secret` the secret will be updated and returned via the API. This is the only time you will be able to retrieve the client secret, so write it down and keep it safe.++ OAuth 2.0 clients are used to perform OAuth 2.0 and OpenID Connect flows. Usually, OAuth 2.0 clients are generated for applications which want to consume your OAuth 2.0 or OpenID Connect capabilities. To manage ORY Hydra, you will need an OAuth 2.0 Client as well. Make sure that this endpoint is well protected and only callable by first-party components.+ operationId: updateOAuth2Client+ parameters:+ - in: path+ name: id+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2Client'+ required: true+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2Client'+ description: oAuth2Client+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Update an OAuth 2.0 Client+ tags:+ - admin+ x-codegen-request-body-name: Body+ /health/alive:+ get:+ description: |-+ This endpoint returns a 200 status code when the HTTP server is up running.+ This status does currently not include checks whether the database connection is working.++ If the service supports TLS Edge Termination, this endpoint does not require the+ `X-Forwarded-Proto` header to be set.++ Be aware that if you are running multiple nodes of this service, the health status will never+ refer to the cluster state, only to a single instance.+ operationId: isInstanceAlive+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/healthStatus'+ description: healthStatus+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Check Alive Status+ tags:+ - admin+ /health/ready:+ get:+ description: |-+ This endpoint returns a 200 status code when the HTTP server is up running and the environment dependencies (e.g.+ the database) are responsive as well.++ If the service supports TLS Edge Termination, this endpoint does not require the+ `X-Forwarded-Proto` header to be set.++ Be aware that if you are running multiple nodes of this service, the health status will never+ refer to the cluster state, only to a single instance.+ operationId: isInstanceReady+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/healthStatus'+ description: healthStatus+ "503":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/healthNotReadyStatus'+ description: healthNotReadyStatus+ summary: Check Readiness Status+ tags:+ - public+ /keys/{set}:+ delete:+ description: |-+ Use this endpoint to delete a complete JSON Web Key Set and all the keys in that set.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: deleteJsonWebKeySet+ parameters:+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Delete a JSON Web Key Set+ tags:+ - admin+ get:+ description: |-+ This endpoint can be used to retrieve JWK Sets stored in ORY Hydra.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: getJsonWebKeySet+ parameters:+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ description: JSONWebKeySet+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Retrieve a JSON Web Key Set+ tags:+ - admin+ post:+ description: |-+ This endpoint is capable of generating JSON Web Key Sets for you. There a different strategies available, such as symmetric cryptographic keys (HS256, HS512) and asymetric cryptographic keys (RS256, ECDSA). If the specified JSON Web Key Set does not exist, it will be created.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: createJsonWebKeySet+ parameters:+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/jsonWebKeySetGeneratorRequest'+ required: false+ responses:+ "201":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ description: JSONWebKeySet+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Generate a New JSON Web Key+ tags:+ - admin+ x-codegen-request-body-name: Body+ put:+ description: |-+ Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: updateJsonWebKeySet+ parameters:+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ description: JSONWebKeySet+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Update a JSON Web Key Set+ tags:+ - admin+ x-codegen-request-body-name: Body+ /keys/{set}/{kid}:+ delete:+ description: |-+ Use this endpoint to delete a single JSON Web Key.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: deleteJsonWebKey+ parameters:+ - description: The kid of the desired key+ in: path+ name: kid+ required: true+ schema:+ type: string+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Delete a JSON Web Key+ tags:+ - admin+ get:+ description: This endpoint returns a singular JSON Web Key, identified by the+ set and the specific key ID (kid).+ operationId: getJsonWebKey+ parameters:+ - description: The kid of the desired key+ in: path+ name: kid+ required: true+ schema:+ type: string+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKeySet'+ description: JSONWebKeySet+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Fetch a JSON Web Key+ tags:+ - admin+ put:+ description: |-+ Use this method if you do not want to let Hydra generate the JWKs for you, but instead save your own.++ A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. A JWK Set is a JSON data structure that represents a set of JWKs. A JSON Web Key is identified by its set and key id. ORY Hydra uses this functionality to store cryptographic keys used for TLS and JSON Web Tokens (such as OpenID Connect ID tokens), and allows storing user-defined keys as well.+ operationId: updateJsonWebKey+ parameters:+ - description: The kid of the desired key+ in: path+ name: kid+ required: true+ schema:+ type: string+ - description: The set+ in: path+ name: set+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKey'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/JSONWebKey'+ description: JSONWebKey+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "403":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Update a JSON Web Key+ tags:+ - admin+ x-codegen-request-body-name: Body+ /metrics/prometheus:+ get:+ description: |-+ If you're using k8s, you can then add annotations to your deployment like so:++ ```+ metadata:+ annotations:+ prometheus.io/port: "4445"+ prometheus.io/path: "/metrics/prometheus"+ ```++ If the service supports TLS Edge Termination, this endpoint does not require the+ `X-Forwarded-Proto` header to be set.+ operationId: prometheus+ responses:+ "200":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ summary: Get Snapshot Metrics from the Hydra Service.+ tags:+ - admin+ /oauth2/auth:+ get:+ description: |-+ This endpoint is not documented here because you should never use your own implementation to perform OAuth2 flows.+ OAuth2 is a very popular protocol and a library for your programming language will exists.++ To learn more about this flow please refer to the specification: https://tools.ietf.org/html/rfc6749+ operationId: oauthAuth+ responses:+ "302":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: The OAuth 2.0 Authorize Endpoint+ tags:+ - public+ /oauth2/auth/requests/consent:+ get:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if+ the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.++ The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to+ grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").++ The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent+ provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted+ or rejected the request.+ operationId: getConsentRequest+ parameters:+ - in: query+ name: consent_challenge+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/consentRequest'+ description: consentRequest+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "409":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Get Consent Request Information+ tags:+ - admin+ /oauth2/auth/requests/consent/accept:+ put:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if+ the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.++ The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to+ grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").++ The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent+ provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted+ or rejected the request.++ This endpoint tells ORY Hydra that the subject has authorized the OAuth 2.0 client to access resources on his/her behalf.+ The consent provider includes additional information, such as session data for access and ID tokens, and if the+ consent request should be used as basis for future requests.++ The response contains a redirect URL which the consent provider should redirect the user-agent to.+ operationId: acceptConsentRequest+ parameters:+ - in: query+ name: consent_challenge+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/acceptConsentRequest'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/completedRequest'+ description: completedRequest+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Accept a Consent Request+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/auth/requests/consent/reject:+ put:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ to authenticate the subject and then tell ORY Hydra now about it. If the subject authenticated, he/she must now be asked if+ the OAuth 2.0 Client which initiated the flow should be allowed to access the resources on the subject's behalf.++ The consent provider which handles this request and is a web app implemented and hosted by you. It shows a subject interface which asks the subject to+ grant or deny the client access to the requested scope ("Application my-dropbox-app wants write access to all your private files").++ The consent challenge is appended to the consent provider's URL to which the subject's user-agent (browser) is redirected to. The consent+ provider uses that challenge to fetch information on the OAuth2 request and then tells ORY Hydra if the subject accepted+ or rejected the request.++ This endpoint tells ORY Hydra that the subject has not authorized the OAuth 2.0 client to access resources on his/her behalf.+ The consent provider must include a reason why the consent was not granted.++ The response contains a redirect URL which the consent provider should redirect the user-agent to.+ operationId: rejectConsentRequest+ parameters:+ - in: query+ name: consent_challenge+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/rejectRequest'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/completedRequest'+ description: completedRequest+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Reject a Consent Request+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/auth/requests/login:+ get:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login+ provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")+ a subject (in OAuth2 the proper name for subject is "resource owner").++ The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login+ provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.+ operationId: getLoginRequest+ parameters:+ - in: query+ name: login_challenge+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/loginRequest'+ description: loginRequest+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "409":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Get a Login Request+ tags:+ - admin+ /oauth2/auth/requests/login/accept:+ put:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login+ provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")+ a subject (in OAuth2 the proper name for subject is "resource owner").++ The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login+ provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.++ This endpoint tells ORY Hydra that the subject has successfully authenticated and includes additional information such as+ the subject's ID and if ORY Hydra should remember the subject's subject agent for future authentication attempts by setting+ a cookie.++ The response contains a redirect URL which the login provider should redirect the user-agent to.+ operationId: acceptLoginRequest+ parameters:+ - in: query+ name: login_challenge+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/acceptLoginRequest'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/completedRequest'+ description: completedRequest+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Accept a Login Request+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/auth/requests/login/reject:+ put:+ description: |-+ When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, ORY Hydra asks the login provider+ (sometimes called "identity provider") to authenticate the subject and then tell ORY Hydra now about it. The login+ provider is an web-app you write and host, and it must be able to authenticate ("show the subject a login screen")+ a subject (in OAuth2 the proper name for subject is "resource owner").++ The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login+ provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.++ This endpoint tells ORY Hydra that the subject has not authenticated and includes a reason why the authentication+ was be denied.++ The response contains a redirect URL which the login provider should redirect the user-agent to.+ operationId: rejectLoginRequest+ parameters:+ - in: query+ name: login_challenge+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/rejectRequest'+ required: false+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/completedRequest'+ description: completedRequest+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Reject a Login Request+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/auth/requests/logout:+ get:+ description: Use this endpoint to fetch a logout request.+ operationId: getLogoutRequest+ parameters:+ - in: query+ name: logout_challenge+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/logoutRequest'+ description: logoutRequest+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Get a Logout Request+ tags:+ - admin+ /oauth2/auth/requests/logout/accept:+ put:+ description: |-+ When a user or an application requests ORY Hydra to log out a user, this endpoint is used to confirm that logout request.+ No body is required.++ The response contains a redirect URL which the consent provider should redirect the user-agent to.+ operationId: acceptLogoutRequest+ parameters:+ - in: query+ name: logout_challenge+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/completedRequest'+ description: completedRequest+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Accept a Logout Request+ tags:+ - admin+ /oauth2/auth/requests/logout/reject:+ put:+ description: |-+ When a user or an application requests ORY Hydra to log out a user, this endpoint is used to deny that logout request.+ No body is required.++ The response is empty as the logout provider has to chose what action to perform next.+ operationId: rejectLogoutRequest+ parameters:+ - in: query+ name: logout_challenge+ required: true+ schema:+ type: string+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/rejectRequest'+ application/x-www-form-urlencoded:+ schema:+ $ref: '#/components/schemas/rejectRequest'+ required: false+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Reject a Logout Request+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/auth/sessions/consent:+ delete:+ description: |-+ This endpoint revokes a subject's granted consent sessions for a specific OAuth 2.0 Client and invalidates all+ associated OAuth 2.0 Access Tokens.+ operationId: revokeConsentSessions+ parameters:+ - description: The subject (Subject) who's consent sessions should be deleted.+ in: query+ name: subject+ required: true+ schema:+ type: string+ - description: If set, deletes only those consent sessions by the Subject that+ have been granted to the specified OAuth 2.0 Client ID+ in: query+ name: client+ schema:+ type: string+ - description: If set to `?all=true`, deletes all consent sessions by the Subject+ that have been granted.+ in: query+ name: all+ schema:+ type: boolean+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Revokes Consent Sessions of a Subject for a Specific OAuth 2.0 Client+ tags:+ - admin+ get:+ description: |-+ This endpoint lists all subject's granted consent sessions, including client and granted scope.+ If the subject is unknown or has not granted any consent sessions yet, the endpoint returns an+ empty JSON array with status code 200 OK.+++ The "Link" header is also included in successful responses, which contains one or more links for pagination, formatted like so: '<https://hydra-url/admin/oauth2/auth/sessions/consent?subject={user}&limit={limit}&offset={offset}>; rel="{page}"', where page is one of the following applicable pages: 'first', 'next', 'last', and 'previous'.+ Multiple links can be included in this header, and will be separated by a comma.+ operationId: listSubjectConsentSessions+ parameters:+ - in: query+ name: subject+ required: true+ schema:+ type: string+ responses:+ "200":+ content:+ application/json:+ schema:+ items:+ $ref: '#/components/schemas/PreviousConsentSession'+ type: array+ description: A list of used consent requests.+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Lists All Consent Sessions of a Subject+ tags:+ - admin+ /oauth2/auth/sessions/login:+ delete:+ description: |-+ This endpoint invalidates a subject's authentication session. After revoking the authentication session, the subject+ has to re-authenticate at ORY Hydra. This endpoint does not invalidate any tokens and does not work with OpenID Connect+ Front- or Back-channel logout.+ operationId: revokeAuthenticationSession+ parameters:+ - in: query+ name: subject+ required: true+ schema:+ type: string+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "404":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: |-+ Invalidates All Login Sessions of a Certain User+ Invalidates a Subject's Authentication Session+ tags:+ - admin+ /oauth2/flush:+ post:+ description: |-+ This endpoint flushes expired OAuth2 access tokens from the database. You can set a time after which no tokens will be+ not be touched, in case you want to keep recent tokens for auditing. Refresh tokens can not be flushed as they are deleted+ automatically when performing the refresh flow.+ operationId: flushInactiveOAuth2Tokens+ requestBody:+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/flushInactiveOAuth2TokensRequest'+ required: false+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Flush Expired OAuth2 Access Tokens+ tags:+ - admin+ x-codegen-request-body-name: Body+ /oauth2/introspect:+ post:+ description: |-+ The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token+ is neither expired nor revoked. If a token is active, additional information on the token will be included. You can+ set additional data for a token by setting `accessTokenExtra` during the consent flow.++ For more information [read this blog post](https://www.oauth.com/oauth2-servers/token-introspection-endpoint/).+ operationId: introspectOAuth2Token+ requestBody:+ content:+ application/x-www-form-urlencoded:+ schema:+ properties:+ token:+ description: |-+ The string value of the token. For access tokens, this+ is the "access_token" value returned from the token endpoint+ defined in OAuth 2.0. For refresh tokens, this is the "refresh_token"+ value returned.+ type: string+ scope:+ description: |-+ An optional, space separated list of required scopes. If the access token was not granted one of the+ scopes, the result of active will be false.+ type: string+ required:+ - token+ required: true+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oAuth2TokenIntrospection'+ description: oAuth2TokenIntrospection+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Introspect OAuth2 Tokens+ tags:+ - admin+ /oauth2/revoke:+ post:+ description: |-+ Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no+ longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token.+ Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by+ the client the token was generated for.+ operationId: revokeOAuth2Token+ requestBody:+ content:+ application/x-www-form-urlencoded:+ schema:+ properties:+ token:+ type: string+ required:+ - token+ required: true+ responses:+ "200":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ security:+ - basic: []+ - oauth2: []+ summary: Revoke OAuth2 Tokens+ tags:+ - public+ /oauth2/sessions/logout:+ get:+ description: |-+ This endpoint initiates and completes user logout at ORY Hydra and initiates OpenID Connect Front-/Back-channel logout:++ https://openid.net/specs/openid-connect-frontchannel-1_0.html+ https://openid.net/specs/openid-connect-backchannel-1_0.html+ operationId: disconnectUser+ responses:+ "302":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ summary: OpenID Connect Front-Backchannel Enabled Logout+ tags:+ - public+ /oauth2/token:+ post:+ description: |-+ The client makes a request to the token endpoint by sending the+ following parameters using the "application/x-www-form-urlencoded" HTTP+ request entity-body.++ > Do not implement a client for this endpoint yourself. Use a library. There are many libraries+ > available for any programming language. You can find a list of libraries here: https://oauth.net/code/+ >+ > Do note that Hydra SDK does not implement this endpoint properly. Use one of the libraries listed above!+ operationId: oauth2Token+ requestBody:+ content:+ application/x-www-form-urlencoded:+ schema:+ properties:+ grant_type:+ type: string+ code:+ type: string+ refresh_token:+ type: string+ redirect_uri:+ type: string+ client_id:+ type: string+ required:+ - grant_type+ required: true+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/oauth2TokenResponse'+ description: oauth2TokenResponse+ "400":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ security:+ - basic: []+ - oauth2: []+ summary: The OAuth 2.0 Token Endpoint+ tags:+ - public+ /oauth2/tokens:+ delete:+ description: This endpoint deletes OAuth2 access tokens issued for a client+ from the database+ operationId: deleteOAuth2Token+ parameters:+ - in: query+ name: client_id+ required: true+ schema:+ type: string+ responses:+ "204":+ content: {}+ description: |-+ Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is+ typically 201.+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ summary: Delete OAuth2 Access Tokens from a Client+ tags:+ - admin+ /userinfo:+ get:+ description: |-+ This endpoint returns the payload of the ID Token, including the idTokenExtra values, of+ the provided OAuth 2.0 Access Token.++ For more information please [refer to the spec](http://openid.net/specs/openid-connect-core-1_0.html#UserInfo).+ operationId: userinfo+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/userinfoResponse'+ description: userinfoResponse+ "401":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ "500":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/genericError'+ description: genericError+ security:+ - oauth2: []+ summary: OpenID Connect Userinfo+ tags:+ - public+ /version:+ get:+ description: |-+ This endpoint returns the service version typically notated using semantic versioning.++ If the service supports TLS Edge Termination, this endpoint does not require the+ `X-Forwarded-Proto` header to be set.+ operationId: getVersion+ responses:+ "200":+ content:+ application/json:+ schema:+ $ref: '#/components/schemas/version'+ description: version+ summary: Get Service Version+ tags:+ - admin+components:+ schemas:+ ContainerWaitOKBodyError:+ description: ContainerWaitOKBodyError container waiting error, if any+ properties:+ Message:+ description: Details of an error+ type: string+ type: object+ JSONRawMessage:+ title: JSONRawMessage represents a json.RawMessage that works well with JSON,+ SQL, and Swagger.+ type: object+ JSONWebKey:+ description: |-+ It is important that this model object is named JSONWebKey for+ "swagger generate spec" to generate only on definition of a+ JSONWebKey.+ example:+ d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE+ e: AQAB+ crv: P-256+ use: sig+ kid: 1603dfe0af8f4596+ x5c:+ - x5c+ - x5c+ k: GawgguFyGrWKav7AX4VKUg+ dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0+ dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk+ n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0+ p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ+ kty: RSA+ q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ+ qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU+ x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU+ y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0+ alg: RS256+ properties:+ alg:+ description: |-+ The "alg" (algorithm) parameter identifies the algorithm intended for+ use with the key. The values used should either be registered in the+ IANA "JSON Web Signature and Encryption Algorithms" registry+ established by [JWA] or be a value that contains a Collision-+ Resistant Name.+ example: RS256+ type: string+ crv:+ example: P-256+ type: string+ d:+ example: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE+ type: string+ dp:+ example: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0+ type: string+ dq:+ example: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk+ type: string+ e:+ example: AQAB+ type: string+ k:+ example: GawgguFyGrWKav7AX4VKUg+ type: string+ kid:+ description: |-+ The "kid" (key ID) parameter is used to match a specific key. This+ is used, for instance, to choose among a set of keys within a JWK Set+ during key rollover. The structure of the "kid" value is+ unspecified. When "kid" values are used within a JWK Set, different+ keys within the JWK Set SHOULD use distinct "kid" values. (One+ example in which different keys might use the same "kid" value is if+ they have different "kty" (key type) values but are considered to be+ equivalent alternatives by the application using them.) The "kid"+ value is a case-sensitive string.+ example: 1603dfe0af8f4596+ type: string+ kty:+ description: |-+ The "kty" (key type) parameter identifies the cryptographic algorithm+ family used with the key, such as "RSA" or "EC". "kty" values should+ either be registered in the IANA "JSON Web Key Types" registry+ established by [JWA] or be a value that contains a Collision-+ Resistant Name. The "kty" value is a case-sensitive string.+ example: RSA+ type: string+ n:+ example: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0+ type: string+ p:+ example: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ+ type: string+ q:+ example: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ+ type: string+ qi:+ example: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU+ type: string+ use:+ description: |-+ Use ("public key use") identifies the intended use of+ the public key. The "use" parameter is employed to indicate whether+ a public key is used for encrypting data or verifying the signature+ on data. Values are commonly "sig" (signature) or "enc" (encryption).+ example: sig+ type: string+ x:+ example: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU+ type: string+ x5c:+ description: |-+ The "x5c" (X.509 certificate chain) parameter contains a chain of one+ or more PKIX certificates [RFC5280]. The certificate chain is+ represented as a JSON array of certificate value strings. Each+ string in the array is a base64-encoded (Section 4 of [RFC4648] --+ not base64url-encoded) DER [ITU.X690.1994] PKIX certificate value.+ The PKIX certificate containing the key value MUST be the first+ certificate.+ items:+ type: string+ type: array+ y:+ example: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0+ type: string+ required:+ - alg+ - kid+ - kty+ - use+ type: object+ JSONWebKeySet:+ description: |-+ It is important that this model object is named JSONWebKeySet for+ "swagger generate spec" to generate only on definition of a+ JSONWebKeySet. Since one with the same name is previously defined as+ client.Client.JSONWebKeys and this one is last, this one will be+ effectively written in the swagger spec.+ example:+ keys:+ - d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE+ e: AQAB+ crv: P-256+ use: sig+ kid: 1603dfe0af8f4596+ x5c:+ - x5c+ - x5c+ k: GawgguFyGrWKav7AX4VKUg+ dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0+ dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk+ n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0+ p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ+ kty: RSA+ q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ+ qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU+ x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU+ y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0+ alg: RS256+ - d: T_N8I-6He3M8a7X1vWt6TGIx4xB_GP3Mb4SsZSA4v-orvJzzRiQhLlRR81naWYxfQAYt5isDI6_C2L9bdWo4FFPjGQFvNoRX-_sBJyBI_rl-TBgsZYoUlAj3J92WmY2inbA-PwyJfsaIIDceYBC-eX-xiCu6qMqkZi3MwQAFL6bMdPEM0z4JBcwFT3VdiWAIRUuACWQwrXMq672x7fMuaIaHi7XDGgt1ith23CLfaREmJku9PQcchbt_uEY-hqrFY6ntTtS4paWWQj86xLL94S-Tf6v6xkL918PfLSOTq6XCzxvlFwzBJqApnAhbwqLjpPhgUG04EDRrqrSBc5Y1BLevn6Ip5h1AhessBp3wLkQgz_roeckt-ybvzKTjESMuagnpqLvOT7Y9veIug2MwPJZI2VjczRc1vzMs25XrFQ8DpUy-bNdp89TmvAXwctUMiJdgHloJw23Cv03gIUAkDnsTqZmkpbIf-crpgNKFmQP_EDKoe8p_PXZZgfbRri3NoEVGP7Mk6yEu8LjJhClhZaBNjuWw2-KlBfOA3g79mhfBnkInee5KO9mGR50qPk1V-MorUYNTFMZIm0kFE6eYVWFBwJHLKYhHU34DoiK1VP-svZpC2uAMFNA_UJEwM9CQ2b8qe4-5e9aywMvwcuArRkAB5mBIfOaOJao3mfukKAE+ e: AQAB+ crv: P-256+ use: sig+ kid: 1603dfe0af8f4596+ x5c:+ - x5c+ - x5c+ k: GawgguFyGrWKav7AX4VKUg+ dp: G4sPXkc6Ya9y8oJW9_ILj4xuppu0lzi_H7VTkS8xj5SdX3coE0oimYwxIi2emTAue0UOa5dpgFGyBJ4c8tQ2VF402XRugKDTP8akYhFo5tAA77Qe_NmtuYZc3C3m3I24G2GvR5sSDxUyAN2zq8Lfn9EUms6rY3Ob8YeiKkTiBj0+ dq: s9lAH9fggBsoFR8Oac2R_E2gw282rT2kGOAhvIllETE1efrA6huUUvMfBcMpn8lqeW6vzznYY5SSQF7pMdC_agI3nG8Ibp1BUb0JUiraRNqUfLhcQb_d9GF4Dh7e74WbRsobRonujTYN1xCaP6TO61jvWrX-L18txXw494Q_cgk+ n: vTqrxUyQPl_20aqf5kXHwDZrel-KovIp8s7ewJod2EXHl8tWlRB3_Rem34KwBfqlKQGp1nqah-51H4Jzruqe0cFP58hPEIt6WqrvnmJCXxnNuIB53iX_uUUXXHDHBeaPCSRoNJzNysjoJ30TIUsKBiirhBa7f235PXbKiHducLevV6PcKxJ5cY8zO286qJLBWSPm-OIevwqsIsSIH44Qtm9sioFikhkbLwoqwWORGAY0nl6XvVOlhADdLjBSqSAeT1FPuCDCnXwzCDR8N9IFB_IjdStFkC-rVt2K5BYfPd0c3yFp_vHR15eRd0zJ8XQ7woBC8Vnsac6Et1pKS59pX6256DPWu8UDdEOolKAPgcd_g2NpA76cAaF_jcT80j9KrEzw8Tv0nJBGesuCjPNjGs_KzdkWTUXt23Hn9QJsdc1MZuaW0iqXBepHYfYoqNelzVte117t4BwVp0kUM6we0IqyXClaZgOI8S-WDBw2_Ovdm8e5NmhYAblEVoygcX8Y46oH6bKiaCQfKCFDMcRgChme7AoE1yZZYsPbaG_3IjPrC4LBMHQw8rM9dWjJ8ImjicvZ1pAm0dx-KHCP3y5PVKrxBDf1zSOsBRkOSjB8TPODnJMz6-jd5hTtZxpZPwPoIdCanTZ3ZD6uRBpTmDwtpRGm63UQs1m5FWPwb0T2IF0+ p: 6NbkXwDWUhi-eR55Cgbf27FkQDDWIamOaDr0rj1q0f1fFEz1W5A_09YvG09Fiv1AO2-D8Rl8gS1Vkz2i0zCSqnyy8A025XOcRviOMK7nIxE4OH_PEsko8dtIrb3TmE2hUXvCkmzw9EsTF1LQBOGC6iusLTXepIC1x9ukCKFZQvdgtEObQ5kzd9Nhq-cdqmSeMVLoxPLd1blviVT9Vm8-y12CtYpeJHOaIDtVPLlBhJiBoPKWg3vxSm4XxIliNOefqegIlsmTIa3MpS6WWlCK3yHhat0Q-rRxDxdyiVdG_wzJvp0Iw_2wms7pe-PgNPYvUWH9JphWP5K38YqEBiJFXQ+ kty: RSA+ q: 0A1FmpOWR91_RAWpqreWSavNaZb9nXeKiBo0DQGBz32DbqKqQ8S4aBJmbRhJcctjCLjain-ivut477tAUMmzJwVJDDq2MZFwC9Q-4VYZmFU4HJityQuSzHYe64RjN-E_NQ02TWhG3QGW6roq6c57c99rrUsETwJJiwS8M5p15Miuz53DaOjv-uqqFAFfywN5WkxHbraBcjHtMiQuyQbQqkCFh-oanHkwYNeytsNhTu2mQmwR5DR2roZ2nPiFjC6nsdk-A7E3S3wMzYYFw7jvbWWoYWo9vB40_MY2Y0FYQSqcDzcBIcq_0tnnasf3VW4Fdx6m80RzOb2Fsnln7vKXAQ+ qi: GyM_p6JrXySiz1toFgKbWV-JdI3jQ4ypu9rbMWx3rQJBfmt0FoYzgUIZEVFEcOqwemRN81zoDAaa-Bk0KWNGDjJHZDdDmFhW3AN7lI-puxk_mHZGJ11rxyR8O55XLSe3SPmRfKwZI6yU24ZxvQKFYItdldUKGzO6Ia6zTKhAVRU+ x: f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU+ y: x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0+ alg: RS256+ properties:+ keys:+ description: |-+ The value of the "keys" parameter is an array of JWK values. By+ default, the order of the JWK values within the array does not imply+ an order of preference among them, although applications of JWK Sets+ can choose to assign a meaning to the order for their purposes, if+ desired.+ items:+ $ref: '#/components/schemas/JSONWebKey'+ type: array+ type: object+ JoseJSONWebKeySet:+ type: object+ NullTime:+ format: date-time+ title: NullTime implements sql.NullTime functionality.+ type: string+ PluginConfig:+ properties:+ Args:+ $ref: '#/components/schemas/PluginConfigArgs'+ Description:+ description: description+ type: string+ DockerVersion:+ description: Docker Version used to create the plugin+ type: string+ Documentation:+ description: documentation+ type: string+ Entrypoint:+ description: entrypoint+ items:+ type: string+ type: array+ Env:+ description: env+ items:+ $ref: '#/components/schemas/PluginEnv'+ type: array+ Interface:+ $ref: '#/components/schemas/PluginConfigInterface'+ IpcHost:+ description: ipc host+ type: boolean+ Linux:+ $ref: '#/components/schemas/PluginConfigLinux'+ Mounts:+ description: mounts+ items:+ $ref: '#/components/schemas/PluginMount'+ type: array+ Network:+ $ref: '#/components/schemas/PluginConfigNetwork'+ PidHost:+ description: pid host+ type: boolean+ PropagatedMount:+ description: propagated mount+ type: string+ User:+ $ref: '#/components/schemas/PluginConfigUser'+ WorkDir:+ description: work dir+ type: string+ rootfs:+ $ref: '#/components/schemas/PluginConfigRootfs'+ required:+ - Args+ - Description+ - Documentation+ - Entrypoint+ - Env+ - Interface+ - IpcHost+ - Linux+ - Mounts+ - Network+ - PidHost+ - PropagatedMount+ - WorkDir+ title: PluginConfig The config of a plugin.+ type: object+ PluginConfigArgs:+ description: PluginConfigArgs plugin config args+ properties:+ Description:+ description: description+ type: string+ Name:+ description: name+ type: string+ Settable:+ description: settable+ items:+ type: string+ type: array+ Value:+ description: value+ items:+ type: string+ type: array+ required:+ - Description+ - Name+ - Settable+ - Value+ type: object+ PluginConfigInterface:+ description: PluginConfigInterface The interface between Docker and the plugin+ properties:+ Socket:+ description: socket+ type: string+ Types:+ description: types+ items:+ $ref: '#/components/schemas/PluginInterfaceType'+ type: array+ required:+ - Socket+ - Types+ type: object+ PluginConfigLinux:+ description: PluginConfigLinux plugin config linux+ properties:+ AllowAllDevices:+ description: allow all devices+ type: boolean+ Capabilities:+ description: capabilities+ items:+ type: string+ type: array+ Devices:+ description: devices+ items:+ $ref: '#/components/schemas/PluginDevice'+ type: array+ required:+ - AllowAllDevices+ - Capabilities+ - Devices+ type: object+ PluginConfigNetwork:+ description: PluginConfigNetwork plugin config network+ properties:+ Type:+ description: type+ type: string+ required:+ - Type+ type: object+ PluginConfigRootfs:+ description: PluginConfigRootfs plugin config rootfs+ properties:+ diff_ids:+ description: diff ids+ items:+ type: string+ type: array+ type:+ description: type+ type: string+ type: object+ PluginConfigUser:+ description: PluginConfigUser plugin config user+ properties:+ GID:+ description: g ID+ format: uint32+ type: integer+ UID:+ description: UID+ format: uint32+ type: integer+ type: object+ PluginDevice:+ description: PluginDevice plugin device+ properties:+ Description:+ description: description+ type: string+ Name:+ description: name+ type: string+ Path:+ description: path+ type: string+ Settable:+ description: settable+ items:+ type: string+ type: array+ required:+ - Description+ - Name+ - Path+ - Settable+ type: object+ PluginEnv:+ description: PluginEnv plugin env+ properties:+ Description:+ description: description+ type: string+ Name:+ description: name+ type: string+ Settable:+ description: settable+ items:+ type: string+ type: array+ Value:+ description: value+ type: string+ required:+ - Description+ - Name+ - Settable+ - Value+ type: object+ PluginInterfaceType:+ description: PluginInterfaceType plugin interface type+ properties:+ Capability:+ description: capability+ type: string+ Prefix:+ description: prefix+ type: string+ Version:+ description: version+ type: string+ required:+ - Capability+ - Prefix+ - Version+ type: object+ PluginMount:+ description: PluginMount plugin mount+ properties:+ Description:+ description: description+ type: string+ Destination:+ description: destination+ type: string+ Name:+ description: name+ type: string+ Options:+ description: options+ items:+ type: string+ type: array+ Settable:+ description: settable+ items:+ type: string+ type: array+ Source:+ description: source+ type: string+ Type:+ description: type+ type: string+ required:+ - Description+ - Destination+ - Name+ - Options+ - Settable+ - Source+ - Type+ type: object+ PluginSettings:+ properties:+ Args:+ description: args+ items:+ type: string+ type: array+ Devices:+ description: devices+ items:+ $ref: '#/components/schemas/PluginDevice'+ type: array+ Env:+ description: env+ items:+ type: string+ type: array+ Mounts:+ description: mounts+ items:+ $ref: '#/components/schemas/PluginMount'+ type: array+ required:+ - Args+ - Devices+ - Env+ - Mounts+ title: PluginSettings Settings that can be modified by users.+ type: object+ PreviousConsentSession:+ description: |-+ The response used to return used consent requests+ same as HandledLoginRequest, just with consent_request exposed as json+ example:+ remember: true+ consent_request:+ requested_access_token_audience:+ - requested_access_token_audience+ - requested_access_token_audience+ acr: acr+ login_challenge: login_challenge+ subject: subject+ context: '{}'+ oidc_context:+ login_hint: login_hint+ ui_locales:+ - ui_locales+ - ui_locales+ id_token_hint_claims: '{}'+ acr_values:+ - acr_values+ - acr_values+ display: display+ challenge: challenge+ client:+ metadata: '{}'+ token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg+ client_uri: client_uri+ jwks: '{}'+ logo_uri: logo_uri+ created_at: 2000-01-23T04:56:07.000+00:00+ allowed_cors_origins:+ - allowed_cors_origins+ - allowed_cors_origins+ client_id: client_id+ token_endpoint_auth_method: token_endpoint_auth_method+ userinfo_signed_response_alg: userinfo_signed_response_alg+ updated_at: 2000-01-23T04:56:07.000+00:00+ scope: scope+ request_uris:+ - request_uris+ - request_uris+ client_secret: client_secret+ backchannel_logout_session_required: true+ backchannel_logout_uri: backchannel_logout_uri+ client_name: client_name+ policy_uri: policy_uri+ owner: owner+ audience:+ - audience+ - audience+ post_logout_redirect_uris:+ - post_logout_redirect_uris+ - post_logout_redirect_uris+ grant_types:+ - grant_types+ - grant_types+ subject_type: subject_type+ redirect_uris:+ - redirect_uris+ - redirect_uris+ sector_identifier_uri: sector_identifier_uri+ frontchannel_logout_session_required: true+ frontchannel_logout_uri: frontchannel_logout_uri+ client_secret_expires_at: 0+ jwks_uri: jwks_uri+ request_object_signing_alg: request_object_signing_alg+ tos_uri: tos_uri+ contacts:+ - contacts+ - contacts+ response_types:+ - response_types+ - response_types+ skip: true+ login_session_id: login_session_id+ request_url: request_url+ requested_scope:+ - requested_scope+ - requested_scope+ session:+ access_token: '{}'+ id_token: '{}'+ grant_access_token_audience:+ - grant_access_token_audience+ - grant_access_token_audience+ handled_at: 2000-01-23T04:56:07.000+00:00+ grant_scope:+ - grant_scope+ - grant_scope+ remember_for: 0+ properties:+ consent_request:+ $ref: '#/components/schemas/consentRequest'+ grant_access_token_audience:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ grant_scope:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ handled_at:+ format: date-time+ title: NullTime implements sql.NullTime functionality.+ type: string+ remember:+ description: |-+ Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same+ client asks the same user for the same, or a subset of, scope.+ type: boolean+ remember_for:+ description: |-+ RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the+ authorization will be remembered indefinitely.+ format: int64+ type: integer+ session:+ $ref: '#/components/schemas/consentRequestSession'+ type: object+ StringSlicePipeDelimiter:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL string.+ type: array+ VolumeUsageData:+ description: |-+ VolumeUsageData Usage details about the volume. This information is used by the+ `GET /system/df` endpoint, and omitted in other endpoints.+ properties:+ RefCount:+ description: |-+ The number of containers referencing this volume. This field+ is set to `-1` if the reference-count is not available.+ format: int64+ type: integer+ Size:+ description: |-+ Amount of disk space used by the volume (in bytes). This information+ is only available for volumes created with the `"local"` volume+ driver. For volumes created with other volume drivers, this field+ is set to `-1` ("not available")+ format: int64+ type: integer+ required:+ - RefCount+ - Size+ type: object+ acceptConsentRequest:+ properties:+ grant_access_token_audience:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ grant_scope:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ handled_at:+ format: date-time+ title: NullTime implements sql.NullTime functionality.+ type: string+ remember:+ description: |-+ Remember, if set to true, tells ORY Hydra to remember this consent authorization and reuse it if the same+ client asks the same user for the same, or a subset of, scope.+ type: boolean+ remember_for:+ description: |-+ RememberFor sets how long the consent authorization should be remembered for in seconds. If set to `0`, the+ authorization will be remembered indefinitely.+ format: int64+ type: integer+ session:+ $ref: '#/components/schemas/consentRequestSession'+ title: The request payload used to accept a consent request.+ type: object+ acceptLoginRequest:+ properties:+ acr:+ description: |-+ ACR sets the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it+ to express that, for example, a user authenticated using two factor authentication.+ type: string+ context:+ title: JSONRawMessage represents a json.RawMessage that works well with+ JSON, SQL, and Swagger.+ type: object+ force_subject_identifier:+ description: |-+ ForceSubjectIdentifier forces the "pairwise" user ID of the end-user that authenticated. The "pairwise" user ID refers to the+ (Pairwise Identifier Algorithm)[http://openid.net/specs/openid-connect-core-1_0.html#PairwiseAlg] of the OpenID+ Connect specification. It allows you to set an obfuscated subject ("user") identifier that is unique to the client.++ Please note that this changes the user ID on endpoint /userinfo and sub claim of the ID Token. It does not change the+ sub claim in the OAuth 2.0 Introspection.++ Per default, ORY Hydra handles this value with its own algorithm. In case you want to set this yourself+ you can use this field. Please note that setting this field has no effect if `pairwise` is not configured in+ ORY Hydra or the OAuth 2.0 Client does not expect a pairwise identifier (set via `subject_type` key in the client's+ configuration).++ Please also be aware that ORY Hydra is unable to properly compute this value during authentication. This implies+ that you have to compute this value on every authentication process (probably depending on the client ID or some+ other unique value).++ If you fail to compute the proper value, then authentication processes which have id_token_hint set might fail.+ type: string+ remember:+ description: |-+ Remember, if set to true, tells ORY Hydra to remember this user by telling the user agent (browser) to store+ a cookie with authentication data. If the same user performs another OAuth 2.0 Authorization Request, he/she+ will not be asked to log in again.+ type: boolean+ remember_for:+ description: |-+ RememberFor sets how long the authentication should be remembered for in seconds. If set to `0`, the+ authorization will be remembered for the duration of the browser session (using a session cookie).+ format: int64+ type: integer+ subject:+ description: Subject is the user ID of the end-user that authenticated.+ type: string+ required:+ - subject+ title: HandledLoginRequest is the request payload used to accept a login request.+ type: object+ completedRequest:+ example:+ redirect_to: redirect_to+ properties:+ redirect_to:+ description: RedirectURL is the URL which you should redirect the user to+ once the authentication process is completed.+ type: string+ required:+ - redirect_to+ title: The response payload sent when accepting or rejecting a login or consent+ request.+ type: object+ consentRequest:+ example:+ requested_access_token_audience:+ - requested_access_token_audience+ - requested_access_token_audience+ acr: acr+ login_challenge: login_challenge+ subject: subject+ context: '{}'+ oidc_context:+ login_hint: login_hint+ ui_locales:+ - ui_locales+ - ui_locales+ id_token_hint_claims: '{}'+ acr_values:+ - acr_values+ - acr_values+ display: display+ challenge: challenge+ client:+ metadata: '{}'+ token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg+ client_uri: client_uri+ jwks: '{}'+ logo_uri: logo_uri+ created_at: 2000-01-23T04:56:07.000+00:00+ allowed_cors_origins:+ - allowed_cors_origins+ - allowed_cors_origins+ client_id: client_id+ token_endpoint_auth_method: token_endpoint_auth_method+ userinfo_signed_response_alg: userinfo_signed_response_alg+ updated_at: 2000-01-23T04:56:07.000+00:00+ scope: scope+ request_uris:+ - request_uris+ - request_uris+ client_secret: client_secret+ backchannel_logout_session_required: true+ backchannel_logout_uri: backchannel_logout_uri+ client_name: client_name+ policy_uri: policy_uri+ owner: owner+ audience:+ - audience+ - audience+ post_logout_redirect_uris:+ - post_logout_redirect_uris+ - post_logout_redirect_uris+ grant_types:+ - grant_types+ - grant_types+ subject_type: subject_type+ redirect_uris:+ - redirect_uris+ - redirect_uris+ sector_identifier_uri: sector_identifier_uri+ frontchannel_logout_session_required: true+ frontchannel_logout_uri: frontchannel_logout_uri+ client_secret_expires_at: 0+ jwks_uri: jwks_uri+ request_object_signing_alg: request_object_signing_alg+ tos_uri: tos_uri+ contacts:+ - contacts+ - contacts+ response_types:+ - response_types+ - response_types+ skip: true+ login_session_id: login_session_id+ request_url: request_url+ requested_scope:+ - requested_scope+ - requested_scope+ properties:+ acr:+ description: |-+ ACR represents the Authentication AuthorizationContext Class Reference value for this authentication session. You can use it+ to express that, for example, a user authenticated using two factor authentication.+ type: string+ challenge:+ description: |-+ ID is the identifier ("authorization challenge") of the consent authorization request. It is used to+ identify the session.+ type: string+ client:+ $ref: '#/components/schemas/oAuth2Client'+ context:+ title: JSONRawMessage represents a json.RawMessage that works well with+ JSON, SQL, and Swagger.+ type: object+ login_challenge:+ description: |-+ LoginChallenge is the login challenge this consent challenge belongs to. It can be used to associate+ a login and consent request in the login & consent app.+ type: string+ login_session_id:+ description: |-+ LoginSessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)+ this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)+ this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-+ channel logout. It's value can generally be used to associate consecutive login requests by a certain user.+ type: string+ oidc_context:+ $ref: '#/components/schemas/openIDConnectContext'+ request_url:+ description: |-+ RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which+ initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but+ might come in handy if you want to deal with additional request parameters.+ type: string+ requested_access_token_audience:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ requested_scope:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ skip:+ description: |-+ Skip, if true, implies that the client has requested the same scopes from the same user previously.+ If true, you must not ask the user to grant the requested scopes. You must however either allow or deny the+ consent request using the usual API call.+ type: boolean+ subject:+ description: |-+ Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope+ requested by the OAuth 2.0 client.+ type: string+ required:+ - challenge+ title: Contains information on an ongoing consent request.+ type: object+ consentRequestSession:+ example:+ access_token: '{}'+ id_token: '{}'+ properties:+ access_token:+ description: |-+ AccessToken sets session data for the access and refresh token, as well as any future tokens issued by the+ refresh grant. Keep in mind that this data will be available to anyone performing OAuth 2.0 Challenge Introspection.+ If only your services can perform OAuth 2.0 Challenge Introspection, this is usually fine. But if third parties+ can access that endpoint as well, sensitive data from the session might be exposed to them. Use with care!+ properties: {}+ type: object+ id_token:+ description: |-+ IDToken sets session data for the OpenID Connect ID token. Keep in mind that the session'id payloads are readable+ by anyone that has access to the ID Challenge. Use with care!+ properties: {}+ type: object+ title: Used to pass session data to a consent request.+ type: object+ flushInactiveOAuth2TokensRequest:+ properties:+ notAfter:+ description: |-+ NotAfter sets after which point tokens should not be flushed. This is useful when you want to keep a history+ of recently issued tokens for auditing.+ format: date-time+ type: string+ type: object+ genericError:+ description: Error responses are sent when an error (e.g. unauthorized, bad+ request, ...) occurred.+ properties:+ debug:+ description: Debug contains debug information. This is usually not available+ and has to be enabled.+ example: The database adapter was unable to find the element+ type: string+ error:+ description: Name is the error name.+ example: The requested resource could not be found+ type: string+ error_description:+ description: Description contains further information on the nature of the+ error.+ example: Object with ID 12345 does not exist+ type: string+ status_code:+ description: Code represents the error status code (404, 403, 401, ...).+ example: 404+ format: int64+ type: integer+ required:+ - error+ title: Error response+ type: object+ healthNotReadyStatus:+ properties:+ errors:+ additionalProperties:+ type: string+ description: Errors contains a list of errors that caused the not ready+ status.+ type: object+ type: object+ healthStatus:+ example:+ status: status+ properties:+ status:+ description: Status always contains "ok".+ type: string+ type: object+ jsonWebKeySetGeneratorRequest:+ properties:+ alg:+ description: The algorithm to be used for creating the key. Supports "RS256",+ "ES512", "HS512", and "HS256"+ type: string+ kid:+ description: The kid of the key to be created+ type: string+ use:+ description: |-+ The "use" (public key use) parameter identifies the intended use of+ the public key. The "use" parameter is employed to indicate whether+ a public key is used for encrypting data or verifying the signature+ on data. Valid values are "enc" and "sig".+ type: string+ required:+ - alg+ - kid+ - use+ type: object+ loginRequest:+ example:+ requested_access_token_audience:+ - requested_access_token_audience+ - requested_access_token_audience+ subject: subject+ oidc_context:+ login_hint: login_hint+ ui_locales:+ - ui_locales+ - ui_locales+ id_token_hint_claims: '{}'+ acr_values:+ - acr_values+ - acr_values+ display: display+ challenge: challenge+ client:+ metadata: '{}'+ token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg+ client_uri: client_uri+ jwks: '{}'+ logo_uri: logo_uri+ created_at: 2000-01-23T04:56:07.000+00:00+ allowed_cors_origins:+ - allowed_cors_origins+ - allowed_cors_origins+ client_id: client_id+ token_endpoint_auth_method: token_endpoint_auth_method+ userinfo_signed_response_alg: userinfo_signed_response_alg+ updated_at: 2000-01-23T04:56:07.000+00:00+ scope: scope+ request_uris:+ - request_uris+ - request_uris+ client_secret: client_secret+ backchannel_logout_session_required: true+ backchannel_logout_uri: backchannel_logout_uri+ client_name: client_name+ policy_uri: policy_uri+ owner: owner+ audience:+ - audience+ - audience+ post_logout_redirect_uris:+ - post_logout_redirect_uris+ - post_logout_redirect_uris+ grant_types:+ - grant_types+ - grant_types+ subject_type: subject_type+ redirect_uris:+ - redirect_uris+ - redirect_uris+ sector_identifier_uri: sector_identifier_uri+ frontchannel_logout_session_required: true+ frontchannel_logout_uri: frontchannel_logout_uri+ client_secret_expires_at: 0+ jwks_uri: jwks_uri+ request_object_signing_alg: request_object_signing_alg+ tos_uri: tos_uri+ contacts:+ - contacts+ - contacts+ response_types:+ - response_types+ - response_types+ session_id: session_id+ skip: true+ request_url: request_url+ requested_scope:+ - requested_scope+ - requested_scope+ properties:+ challenge:+ description: |-+ ID is the identifier ("login challenge") of the login request. It is used to+ identify the session.+ type: string+ client:+ $ref: '#/components/schemas/oAuth2Client'+ oidc_context:+ $ref: '#/components/schemas/openIDConnectContext'+ request_url:+ description: |-+ RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which+ initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but+ might come in handy if you want to deal with additional request parameters.+ type: string+ requested_access_token_audience:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ requested_scope:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ session_id:+ description: |-+ SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag)+ this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false)+ this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back-+ channel logout. It's value can generally be used to associate consecutive login requests by a certain user.+ type: string+ skip:+ description: |-+ Skip, if true, implies that the client has requested the same scopes from the same user previously.+ If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.++ This feature allows you to update / set session information.+ type: boolean+ subject:+ description: |-+ Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope+ requested by the OAuth 2.0 client. If this value is set and `skip` is true, you MUST include this subject type+ when accepting the login request, or the request will fail.+ type: string+ required:+ - challenge+ - client+ - request_url+ - requested_access_token_audience+ - requested_scope+ - skip+ - subject+ title: Contains information on an ongoing login request.+ type: object+ logoutRequest:+ example:+ subject: subject+ rp_initiated: true+ request_url: request_url+ sid: sid+ properties:+ request_url:+ description: RequestURL is the original Logout URL requested.+ type: string+ rp_initiated:+ description: RPInitiated is set to true if the request was initiated by+ a Relying Party (RP), also known as an OAuth 2.0 Client.+ type: boolean+ sid:+ description: SessionID is the login session ID that was requested to log+ out.+ type: string+ subject:+ description: Subject is the user for whom the logout was request.+ type: string+ title: Contains information about an ongoing logout request.+ type: object+ oAuth2Client:+ example:+ metadata: '{}'+ token_endpoint_auth_signing_alg: token_endpoint_auth_signing_alg+ client_uri: client_uri+ jwks: '{}'+ logo_uri: logo_uri+ created_at: 2000-01-23T04:56:07.000+00:00+ allowed_cors_origins:+ - allowed_cors_origins+ - allowed_cors_origins+ client_id: client_id+ token_endpoint_auth_method: token_endpoint_auth_method+ userinfo_signed_response_alg: userinfo_signed_response_alg+ updated_at: 2000-01-23T04:56:07.000+00:00+ scope: scope+ request_uris:+ - request_uris+ - request_uris+ client_secret: client_secret+ backchannel_logout_session_required: true+ backchannel_logout_uri: backchannel_logout_uri+ client_name: client_name+ policy_uri: policy_uri+ owner: owner+ audience:+ - audience+ - audience+ post_logout_redirect_uris:+ - post_logout_redirect_uris+ - post_logout_redirect_uris+ grant_types:+ - grant_types+ - grant_types+ subject_type: subject_type+ redirect_uris:+ - redirect_uris+ - redirect_uris+ sector_identifier_uri: sector_identifier_uri+ frontchannel_logout_session_required: true+ frontchannel_logout_uri: frontchannel_logout_uri+ client_secret_expires_at: 0+ jwks_uri: jwks_uri+ request_object_signing_alg: request_object_signing_alg+ tos_uri: tos_uri+ contacts:+ - contacts+ - contacts+ response_types:+ - response_types+ - response_types+ properties:+ allowed_cors_origins:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ audience:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ backchannel_logout_session_required:+ description: |-+ Boolean value specifying whether the RP requires that a sid (session ID) Claim be included in the Logout+ Token to identify the RP session with the OP when the backchannel_logout_uri is used.+ If omitted, the default value is false.+ type: boolean+ backchannel_logout_uri:+ description: RP URL that will cause the RP to log itself out when sent a+ Logout Token by the OP.+ type: string+ client_id:+ description: ID is the id for this client.+ type: string+ client_name:+ description: |-+ Name is the human-readable string name of the client to be presented to the+ end-user during authorization.+ type: string+ client_secret:+ description: |-+ Secret is the client's secret. The secret will be included in the create request as cleartext, and then+ never again. The secret is stored using BCrypt so it is impossible to recover it. Tell your users+ that they need to write the secret down as it will not be made available again.+ type: string+ client_secret_expires_at:+ description: |-+ SecretExpiresAt is an integer holding the time at which the client+ secret will expire or 0 if it will not expire. The time is+ represented as the number of seconds from 1970-01-01T00:00:00Z as+ measured in UTC until the date/time of expiration.++ This feature is currently not supported and it's value will always+ be set to 0.+ format: int64+ type: integer+ client_uri:+ description: |-+ ClientURI is an URL string of a web page providing information about the client.+ If present, the server SHOULD display this URL to the end-user in+ a clickable fashion.+ type: string+ contacts:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ created_at:+ description: CreatedAt returns the timestamp of the client's creation.+ format: date-time+ type: string+ frontchannel_logout_session_required:+ description: |-+ Boolean value specifying whether the RP requires that iss (issuer) and sid (session ID) query parameters be+ included to identify the RP session with the OP when the frontchannel_logout_uri is used.+ If omitted, the default value is false.+ type: boolean+ frontchannel_logout_uri:+ description: |-+ RP URL that will cause the RP to log itself out when rendered in an iframe by the OP. An iss (issuer) query+ parameter and a sid (session ID) query parameter MAY be included by the OP to enable the RP to validate the+ request and to determine which of the potentially multiple sessions is to be logged out; if either is+ included, both MUST be.+ type: string+ grant_types:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ jwks:+ type: object+ jwks_uri:+ description: |-+ URL for the Client's JSON Web Key Set [JWK] document. If the Client signs requests to the Server, it contains+ the signing key(s) the Server uses to validate signatures from the Client. The JWK Set MAY also contain the+ Client's encryption keys(s), which are used by the Server to encrypt responses to the Client. When both signing+ and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced+ JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both+ signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used+ to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST+ match those in the certificate.+ type: string+ logo_uri:+ description: LogoURI is an URL string that references a logo for the client.+ type: string+ metadata:+ title: JSONRawMessage represents a json.RawMessage that works well with+ JSON, SQL, and Swagger.+ type: object+ owner:+ description: Owner is a string identifying the owner of the OAuth 2.0 Client.+ type: string+ policy_uri:+ description: |-+ PolicyURI is a URL string that points to a human-readable privacy policy document+ that describes how the deployment organization collects, uses,+ retains, and discloses personal data.+ type: string+ post_logout_redirect_uris:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ redirect_uris:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ request_object_signing_alg:+ description: |-+ JWS [JWS] alg algorithm [JWA] that MUST be used for signing Request Objects sent to the OP. All Request Objects+ from this Client MUST be rejected, if not signed with this algorithm.+ type: string+ request_uris:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ response_types:+ items:+ type: string+ title: StringSlicePipeDelimiter de/encodes the string slice to/from a SQL+ string.+ type: array+ scope:+ description: |-+ Scope is a string containing a space-separated list of scope values (as+ described in Section 3.3 of OAuth 2.0 [RFC6749]) that the client+ can use when requesting access tokens.+ pattern: ([a-zA-Z0-9\.\*]+\s?)++ type: string+ sector_identifier_uri:+ description: |-+ URL using the https scheme to be used in calculating Pseudonymous Identifiers by the OP. The URL references a+ file with a single JSON array of redirect_uri values.+ type: string+ subject_type:+ description: |-+ SubjectType requested for responses to this Client. The subject_types_supported Discovery parameter contains a+ list of the supported subject_type values for this server. Valid types include `pairwise` and `public`.+ type: string+ token_endpoint_auth_method:+ description: |-+ Requested Client Authentication method for the Token Endpoint. The options are client_secret_post,+ client_secret_basic, private_key_jwt, and none.+ type: string+ token_endpoint_auth_signing_alg:+ description: Requested Client Authentication signing algorithm for the Token+ Endpoint.+ type: string+ tos_uri:+ description: |-+ TermsOfServiceURI is a URL string that points to a human-readable terms of service+ document for the client that describes a contractual relationship+ between the end-user and the client that the end-user accepts when+ authorizing the client.+ type: string+ updated_at:+ description: UpdatedAt returns the timestamp of the last update.+ format: date-time+ type: string+ userinfo_signed_response_alg:+ description: |-+ JWS alg algorithm [JWA] REQUIRED for signing UserInfo Responses. If this is specified, the response will be JWT+ [JWT] serialized, and signed using JWS. The default, if omitted, is for the UserInfo Response to return the Claims+ as a UTF-8 encoded JSON object using the application/json content-type.+ type: string+ title: Client represents an OAuth 2.0 Client.+ type: object+ oAuth2TokenIntrospection:+ description: https://tools.ietf.org/html/rfc7662+ example:+ ext: '{}'+ sub: sub+ iss: iss+ active: true+ obfuscated_subject: obfuscated_subject+ token_type: token_type+ client_id: client_id+ aud:+ - aud+ - aud+ nbf: 1+ token_use: token_use+ scope: scope+ exp: 0+ iat: 6+ username: username+ properties:+ active:+ description: |-+ Active is a boolean indicator of whether or not the presented token+ is currently active. The specifics of a token's "active" state+ will vary depending on the implementation of the authorization+ server and the information it keeps about its tokens, but a "true"+ value return for the "active" property will generally indicate+ that a given token has been issued by this authorization server,+ has not been revoked by the resource owner, and is within its+ given time window of validity (e.g., after its issuance time and+ before its expiration time).+ type: boolean+ aud:+ description: Audience contains a list of the token's intended audiences.+ items:+ type: string+ type: array+ client_id:+ description: |-+ ID is aclient identifier for the OAuth 2.0 client that+ requested this token.+ type: string+ exp:+ description: |-+ Expires at is an integer timestamp, measured in the number of seconds+ since January 1 1970 UTC, indicating when this token will expire.+ format: int64+ type: integer+ ext:+ description: Extra is arbitrary data set by the session.+ properties: {}+ type: object+ iat:+ description: |-+ Issued at is an integer timestamp, measured in the number of seconds+ since January 1 1970 UTC, indicating when this token was+ originally issued.+ format: int64+ type: integer+ iss:+ description: IssuerURL is a string representing the issuer of this token+ type: string+ nbf:+ description: |-+ NotBefore is an integer timestamp, measured in the number of seconds+ since January 1 1970 UTC, indicating when this token is not to be+ used before.+ format: int64+ type: integer+ obfuscated_subject:+ description: |-+ ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization.+ It is the `sub` value of the ID Token that was issued.+ type: string+ scope:+ description: |-+ Scope is a JSON string containing a space-separated list of+ scopes associated with this token.+ type: string+ sub:+ description: |-+ Subject of the token, as defined in JWT [RFC7519].+ Usually a machine-readable identifier of the resource owner who+ authorized this token.+ type: string+ token_type:+ description: TokenType is the introspected token's type, typically `Bearer`.+ type: string+ token_use:+ description: TokenUse is the introspected token's use, for example `access_token`+ or `refresh_token`.+ type: string+ username:+ description: |-+ Username is a human-readable identifier for the resource owner who+ authorized this token.+ type: string+ required:+ - active+ title: 'Introspection contains an access token''s session data as specified+ by IETF RFC 7662, see:'+ type: object+ oauth2TokenResponse:+ description: The Access Token Response+ example:+ access_token: access_token+ refresh_token: refresh_token+ scope: scope+ id_token: id_token+ token_type: token_type+ expires_in: 0+ properties:+ access_token:+ type: string+ expires_in:+ format: int64+ type: integer+ id_token:+ type: string+ refresh_token:+ type: string+ scope:+ type: string+ token_type:+ type: string+ type: object+ openIDConnectContext:+ example:+ login_hint: login_hint+ ui_locales:+ - ui_locales+ - ui_locales+ id_token_hint_claims: '{}'+ acr_values:+ - acr_values+ - acr_values+ display: display+ properties:+ acr_values:+ description: |-+ ACRValues is the Authentication AuthorizationContext Class Reference requested in the OAuth 2.0 Authorization request.+ It is a parameter defined by OpenID Connect and expresses which level of authentication (e.g. 2FA) is required.++ OpenID Connect defines it as follows:+ > Requested Authentication AuthorizationContext Class Reference values. Space-separated string that specifies the acr values+ that the Authorization Server is being requested to use for processing this Authentication Request, with the+ values appearing in order of preference. The Authentication AuthorizationContext Class satisfied by the authentication+ performed is returned as the acr Claim Value, as specified in Section 2. The acr Claim is requested as a+ Voluntary Claim by this parameter.+ items:+ type: string+ type: array+ display:+ description: |-+ Display is a string value that specifies how the Authorization Server displays the authentication and consent user interface pages to the End-User.+ The defined values are:+ page: The Authorization Server SHOULD display the authentication and consent UI consistent with a full User Agent page view. If the display parameter is not specified, this is the default display mode.+ popup: The Authorization Server SHOULD display the authentication and consent UI consistent with a popup User Agent window. The popup User Agent window should be of an appropriate size for a login-focused dialog and should not obscure the entire window that it is popping up over.+ touch: The Authorization Server SHOULD display the authentication and consent UI consistent with a device that leverages a touch interface.+ wap: The Authorization Server SHOULD display the authentication and consent UI consistent with a "feature phone" type display.++ The Authorization Server MAY also attempt to detect the capabilities of the User Agent and present an appropriate display.+ type: string+ id_token_hint_claims:+ description: |-+ IDTokenHintClaims are the claims of the ID Token previously issued by the Authorization Server being passed as a hint about the+ End-User's current or past authenticated session with the Client.+ properties: {}+ type: object+ login_hint:+ description: |-+ LoginHint hints about the login identifier the End-User might use to log in (if necessary).+ This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier)+ and then wants to pass that value as a hint to the discovered authorization service. This value MAY also be a+ phone number in the format specified for the phone_number Claim. The use of this parameter is optional.+ type: string+ ui_locales:+ description: |-+ UILocales is the End-User'id preferred languages and scripts for the user interface, represented as a+ space-separated list of BCP47 [RFC5646] language tag values, ordered by preference. For instance, the value+ "fr-CA fr en" represents a preference for French as spoken in Canada, then French (without a region designation),+ followed by English (without a region designation). An error SHOULD NOT result if some or all of the requested+ locales are not supported by the OpenID Provider.+ items:+ type: string+ type: array+ title: Contains optional information about the OpenID Connect request.+ type: object+ rejectRequest:+ properties:+ error:+ description: |-+ The error should follow the OAuth2 error format (e.g. `invalid_request`, `login_required`).++ Defaults to `request_denied`.+ type: string+ error_debug:+ description: |-+ Debug contains information to help resolve the problem as a developer. Usually not exposed+ to the public but only in the server logs.+ type: string+ error_description:+ description: Description of the error in a human readable format.+ type: string+ error_hint:+ description: Hint to help resolve the error.+ type: string+ status_code:+ description: |-+ Represents the HTTP status code of the error (e.g. 401 or 403)++ Defaults to 400+ format: int64+ type: integer+ title: The request payload used to accept a login or consent request.+ type: object+ userinfoResponse:+ description: The userinfo response+ example:+ sub: sub+ website: website+ zoneinfo: zoneinfo+ birthdate: birthdate+ email_verified: true+ gender: gender+ profile: profile+ phone_number_verified: true+ preferred_username: preferred_username+ given_name: given_name+ locale: locale+ middle_name: middle_name+ picture: picture+ updated_at: 0+ name: name+ nickname: nickname+ phone_number: phone_number+ family_name: family_name+ email: email+ properties:+ birthdate:+ description: End-User's birthday, represented as an ISO 8601:2004 [ISO8601‑2004]+ YYYY-MM-DD format. The year MAY be 0000, indicating that it is omitted.+ To represent only the year, YYYY format is allowed. Note that depending+ on the underlying platform's date related function, providing just year+ can result in varying month and day, so the implementers need to take+ this factor into account to correctly process the dates.+ type: string+ email:+ description: End-User's preferred e-mail address. Its value MUST conform+ to the RFC 5322 [RFC5322] addr-spec syntax. The RP MUST NOT rely upon+ this value being unique, as discussed in Section 5.7.+ type: string+ email_verified:+ description: True if the End-User's e-mail address has been verified; otherwise+ false. When this Claim Value is true, this means that the OP took affirmative+ steps to ensure that this e-mail address was controlled by the End-User+ at the time the verification was performed. The means by which an e-mail+ address is verified is context-specific, and dependent upon the trust+ framework or contractual agreements within which the parties are operating.+ type: boolean+ family_name:+ description: Surname(s) or last name(s) of the End-User. Note that in some+ cultures, people can have multiple family names or no family name; all+ can be present, with the names being separated by space characters.+ type: string+ gender:+ description: End-User's gender. Values defined by this specification are+ female and male. Other values MAY be used when neither of the defined+ values are applicable.+ type: string+ given_name:+ description: Given name(s) or first name(s) of the End-User. Note that in+ some cultures, people can have multiple given names; all can be present,+ with the names being separated by space characters.+ type: string+ locale:+ description: End-User's locale, represented as a BCP47 [RFC5646] language+ tag. This is typically an ISO 639-1 Alpha-2 [ISO639‑1] language code in+ lowercase and an ISO 3166-1 Alpha-2 [ISO3166‑1] country code in uppercase,+ separated by a dash. For example, en-US or fr-CA. As a compatibility note,+ some implementations have used an underscore as the separator rather than+ a dash, for example, en_US; Relying Parties MAY choose to accept this+ locale syntax as well.+ type: string+ middle_name:+ description: Middle name(s) of the End-User. Note that in some cultures,+ people can have multiple middle names; all can be present, with the names+ being separated by space characters. Also note that in some cultures,+ middle names are not used.+ type: string+ name:+ description: End-User's full name in displayable form including all name+ parts, possibly including titles and suffixes, ordered according to the+ End-User's locale and preferences.+ type: string+ nickname:+ description: Casual name of the End-User that may or may not be the same+ as the given_name. For instance, a nickname value of Mike might be returned+ alongside a given_name value of Michael.+ type: string+ phone_number:+ description: End-User's preferred telephone number. E.164 [E.164] is RECOMMENDED+ as the format of this Claim, for example, +1 (425) 555-1212 or +56 (2)+ 687 2400. If the phone number contains an extension, it is RECOMMENDED+ that the extension be represented using the RFC 3966 [RFC3966] extension+ syntax, for example, +1 (604) 555-1234;ext=5678.+ type: string+ phone_number_verified:+ description: True if the End-User's phone number has been verified; otherwise+ false. When this Claim Value is true, this means that the OP took affirmative+ steps to ensure that this phone number was controlled by the End-User+ at the time the verification was performed. The means by which a phone+ number is verified is context-specific, and dependent upon the trust framework+ or contractual agreements within which the parties are operating. When+ true, the phone_number Claim MUST be in E.164 format and any extensions+ MUST be represented in RFC 3966 format.+ type: boolean+ picture:+ description: URL of the End-User's profile picture. This URL MUST refer+ to an image file (for example, a PNG, JPEG, or GIF image file), rather+ than to a Web page containing an image. Note that this URL SHOULD specifically+ reference a profile photo of the End-User suitable for displaying when+ describing the End-User, rather than an arbitrary photo taken by the End-User.+ type: string+ preferred_username:+ description: Non-unique shorthand name by which the End-User wishes to be+ referred to at the RP, such as janedoe or j.doe. This value MAY be any+ valid JSON string including special characters such as @, /, or whitespace.+ type: string+ profile:+ description: URL of the End-User's profile page. The contents of this Web+ page SHOULD be about the End-User.+ type: string+ sub:+ description: Subject - Identifier for the End-User at the IssuerURL.+ type: string+ updated_at:+ description: Time the End-User's information was last updated. Its value+ is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z+ as measured in UTC until the date/time.+ format: int64+ type: integer+ website:+ description: URL of the End-User's Web page or blog. This Web page SHOULD+ contain information published by the End-User or an organization that+ the End-User is affiliated with.+ type: string+ zoneinfo:+ description: String from zoneinfo [zoneinfo] time zone database representing+ the End-User's time zone. For example, Europe/Paris or America/Los_Angeles.+ type: string+ type: object+ version:+ example:+ version: version+ properties:+ version:+ description: Version is the service's version.+ type: string+ type: object+ wellKnown:+ description: |-+ It includes links to several endpoints (e.g. /oauth2/token) and exposes information on supported signature algorithms+ among others.+ example:+ request_parameter_supported: true+ claims_parameter_supported: true+ backchannel_logout_supported: true+ scopes_supported:+ - scopes_supported+ - scopes_supported+ issuer: https://playground.ory.sh/ory-hydra/public/+ authorization_endpoint: https://playground.ory.sh/ory-hydra/public/oauth2/auth+ claims_supported:+ - claims_supported+ - claims_supported+ userinfo_signing_alg_values_supported:+ - userinfo_signing_alg_values_supported+ - userinfo_signing_alg_values_supported+ token_endpoint_auth_methods_supported:+ - token_endpoint_auth_methods_supported+ - token_endpoint_auth_methods_supported+ backchannel_logout_session_supported: true+ response_modes_supported:+ - response_modes_supported+ - response_modes_supported+ token_endpoint: https://playground.ory.sh/ory-hydra/public/oauth2/token+ response_types_supported:+ - response_types_supported+ - response_types_supported+ request_uri_parameter_supported: true+ grant_types_supported:+ - grant_types_supported+ - grant_types_supported+ end_session_endpoint: end_session_endpoint+ revocation_endpoint: revocation_endpoint+ userinfo_endpoint: userinfo_endpoint+ frontchannel_logout_supported: true+ require_request_uri_registration: true+ frontchannel_logout_session_supported: true+ jwks_uri: https://playground.ory.sh/ory-hydra/public/.well-known/jwks.json+ subject_types_supported:+ - subject_types_supported+ - subject_types_supported+ id_token_signing_alg_values_supported:+ - id_token_signing_alg_values_supported+ - id_token_signing_alg_values_supported+ registration_endpoint: https://playground.ory.sh/ory-hydra/admin/client+ request_object_signing_alg_values_supported:+ - request_object_signing_alg_values_supported+ - request_object_signing_alg_values_supported+ properties:+ authorization_endpoint:+ description: URL of the OP's OAuth 2.0 Authorization Endpoint.+ example: https://playground.ory.sh/ory-hydra/public/oauth2/auth+ type: string+ backchannel_logout_session_supported:+ description: |-+ Boolean value specifying whether the OP can pass a sid (session ID) Claim in the Logout Token to identify the RP+ session with the OP. If supported, the sid Claim is also included in ID Tokens issued by the OP+ type: boolean+ backchannel_logout_supported:+ description: Boolean value specifying whether the OP supports back-channel+ logout, with true indicating support.+ type: boolean+ claims_parameter_supported:+ description: Boolean value specifying whether the OP supports use of the+ claims parameter, with true indicating support.+ type: boolean+ claims_supported:+ description: |-+ JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply+ values for. Note that for privacy or other reasons, this might not be an exhaustive list.+ items:+ type: string+ type: array+ end_session_endpoint:+ description: URL at the OP to which an RP can perform a redirect to request+ that the End-User be logged out at the OP.+ type: string+ frontchannel_logout_session_supported:+ description: |-+ Boolean value specifying whether the OP can pass iss (issuer) and sid (session ID) query parameters to identify+ the RP session with the OP when the frontchannel_logout_uri is used. If supported, the sid Claim is also+ included in ID Tokens issued by the OP.+ type: boolean+ frontchannel_logout_supported:+ description: Boolean value specifying whether the OP supports HTTP-based+ logout, with true indicating support.+ type: boolean+ grant_types_supported:+ description: JSON array containing a list of the OAuth 2.0 Grant Type values+ that this OP supports.+ items:+ type: string+ type: array+ id_token_signing_alg_values_supported:+ description: |-+ JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token+ to encode the Claims in a JWT.+ items:+ type: string+ type: array+ issuer:+ description: |-+ URL using the https scheme with no query or fragment component that the OP asserts as its IssuerURL Identifier.+ If IssuerURL discovery is supported , this value MUST be identical to the issuer value returned+ by WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this IssuerURL.+ example: https://playground.ory.sh/ory-hydra/public/+ type: string+ jwks_uri:+ description: |-+ URL of the OP's JSON Web Key Set [JWK] document. This contains the signing key(s) the RP uses to validate+ signatures from the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used by RPs+ to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key Use)+ parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage.+ Although some algorithms allow the same key to be used for both signatures and encryption, doing so is+ NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of+ keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.+ example: https://playground.ory.sh/ory-hydra/public/.well-known/jwks.json+ type: string+ registration_endpoint:+ description: URL of the OP's Dynamic Client Registration Endpoint.+ example: https://playground.ory.sh/ory-hydra/admin/client+ type: string+ request_object_signing_alg_values_supported:+ description: |-+ JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects,+ which are described in Section 6.1 of OpenID Connect Core 1.0 [OpenID.Core]. These algorithms are used both when+ the Request Object is passed by value (using the request parameter) and when it is passed by reference+ (using the request_uri parameter).+ items:+ type: string+ type: array+ request_parameter_supported:+ description: Boolean value specifying whether the OP supports use of the+ request parameter, with true indicating support.+ type: boolean+ request_uri_parameter_supported:+ description: Boolean value specifying whether the OP supports use of the+ request_uri parameter, with true indicating support.+ type: boolean+ require_request_uri_registration:+ description: |-+ Boolean value specifying whether the OP requires any request_uri values used to be pre-registered+ using the request_uris registration parameter.+ type: boolean+ response_modes_supported:+ description: JSON array containing a list of the OAuth 2.0 response_mode+ values that this OP supports.+ items:+ type: string+ type: array+ response_types_supported:+ description: |-+ JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID+ Providers MUST support the code, id_token, and the token id_token Response Type values.+ items:+ type: string+ type: array+ revocation_endpoint:+ description: URL of the authorization server's OAuth 2.0 revocation endpoint.+ type: string+ scopes_supported:+ description: |-+ SON array containing a list of the OAuth 2.0 [RFC6749] scope values that this server supports. The server MUST+ support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used+ items:+ type: string+ type: array+ subject_types_supported:+ description: |-+ JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include+ pairwise and public.+ items:+ type: string+ type: array+ token_endpoint:+ description: URL of the OP's OAuth 2.0 Token Endpoint+ example: https://playground.ory.sh/ory-hydra/public/oauth2/token+ type: string+ token_endpoint_auth_methods_supported:+ description: |-+ JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are+ client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt, as described in Section 9 of OpenID Connect Core 1.0+ items:+ type: string+ type: array+ userinfo_endpoint:+ description: URL of the OP's UserInfo Endpoint.+ type: string+ userinfo_signing_alg_values_supported:+ description: JSON array containing a list of the JWS [JWS] signing algorithms+ (alg values) [JWA] supported by the UserInfo Endpoint to encode the Claims+ in a JWT [JWT].+ items:+ type: string+ type: array+ required:+ - authorization_endpoint+ - id_token_signing_alg_values_supported+ - issuer+ - jwks_uri+ - response_types_supported+ - subject_types_supported+ - token_endpoint+ title: WellKnown represents important OpenID Connect discovery metadata+ type: object+ securitySchemes:+ basic:+ scheme: basic+ type: http+ oauth2:+ flows:+ authorizationCode:+ authorizationUrl: https://hydra.demo.ory.sh/oauth2/auth+ scopes:+ offline: A scope required when requesting refresh tokens (alias for `offline_access`)+ offline_access: A scope required when requesting refresh tokens+ openid: Request an OpenID Connect ID Token+ tokenUrl: https://hydra.demo.ory.sh/oauth2/token+ type: oauth2+x-forwarded-proto: string+x-request-id: string+x-original-swagger-version: "2.0"
+ ory-hydra-client.cabal view
@@ -0,0 +1,112 @@+name: ory-hydra-client+version: 1.9.2+synopsis: Auto-generated ory-hydra API Client+description: .+ Client library for calling the ORY Hydra API based on http-client.+ .+ host: localhost+ .+ base path: http://localhost+ .+ ORY Hydra API version: 1.9.2+ .+ OpenAPI version: 3.0.1+ .+category: Web, OAuth, Network+homepage: https://github.com/lykahb/ory-hydra+author: Boris Lykah+maintainer: lykahb@gmail.com+copyright: 2021 - Boris Lykah, Mercury+license: MIT+license-file: LICENSE+build-type: Simple+cabal-version: >= 1.10++extra-source-files:+ README.md+ openapi.yaml++Flag UseKatip+ Description: Use the katip package to provide logging (if false, use the default monad-logger package)+ Default: True+ Manual: True++library+ hs-source-dirs:+ lib+ ghc-options: -Wall -funbox-strict-fields+ build-depends:+ aeson >=1.0 && <2.0+ , base >=4.7 && <5.0+ , base64-bytestring >1.0 && <2.0+ , bytestring >=0.10.0 && <0.11+ , case-insensitive+ , containers >=0.5.0.0 && <0.8+ , deepseq >= 1.4 && <1.6+ , exceptions >= 0.4+ , http-api-data >= 0.3.4 && <0.5+ , http-client >=0.5 && <0.7+ , http-client-tls+ , http-media >= 0.4 && < 0.9+ , http-types >=0.8 && <0.13+ , iso8601-time >=0.1.3 && <0.2.0+ , microlens >= 0.4.3 && <0.5+ , mtl >=2.2.1+ , network >=2.6.2 && <3.9+ , random >=1.1+ , safe-exceptions <0.2+ , text >=0.11 && <1.3+ , time >=1.5+ , transformers >=0.4.0.0+ , unordered-containers+ , vector >=0.10.9 && <0.13+ other-modules:+ Paths_ory_hydra_client+ exposed-modules:+ ORYHydra+ ORYHydra.API.Admin+ ORYHydra.API.Public+ ORYHydra.Client+ ORYHydra.Core+ ORYHydra.Logging+ ORYHydra.MimeTypes+ ORYHydra.Model+ ORYHydra.ModelLens+ default-language: Haskell2010++ if flag(UseKatip)+ build-depends: katip >=0.8 && < 1.0+ other-modules: ORYHydra.LoggingKatip+ cpp-options: -DUSE_KATIP+ else+ build-depends: monad-logger >=0.3 && <0.4+ other-modules: ORYHydra.LoggingMonadLogger+ cpp-options: -DUSE_MONAD_LOGGER++test-suite tests+ type: exitcode-stdio-1.0+ main-is: Test.hs+ hs-source-dirs:+ tests+ ghc-options: -Wall -fno-warn-orphans+ build-depends:+ ory-hydra-client+ , QuickCheck+ , aeson+ , base >=4.7 && <5.0+ , bytestring >=0.10.0 && <0.11+ , containers+ , hspec >=1.8+ , iso8601-time+ , mtl >=2.2.1+ , semigroups+ , text+ , time+ , transformers >=0.4.0.0+ , unordered-containers+ , vector+ other-modules:+ ApproxEq+ Instances+ PropMime+ default-language: Haskell2010
+ tests/ApproxEq.hs view
@@ -0,0 +1,81 @@+{-# LANGUAGE DefaultSignatures #-}+{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE TypeOperators #-}+{-# OPTIONS_GHC -fno-warn-orphans #-}++module ApproxEq where++import Data.Text (Text)+import Data.Time.Clock+import Test.QuickCheck+import GHC.Generics as G++(==~)+ :: (ApproxEq a, Show a)+ => a -> a -> Property+a ==~ b = counterexample (show a ++ " !=~ " ++ show b) (a =~ b)++class GApproxEq f where+ gApproxEq :: f a -> f a -> Bool++instance GApproxEq U1 where+ gApproxEq U1 U1 = True++instance (GApproxEq a, GApproxEq b) =>+ GApproxEq (a :+: b) where+ gApproxEq (L1 a) (L1 b) = gApproxEq a b+ gApproxEq (R1 a) (R1 b) = gApproxEq a b+ gApproxEq _ _ = False++instance (GApproxEq a, GApproxEq b) =>+ GApproxEq (a :*: b) where+ gApproxEq (a1 :*: b1) (a2 :*: b2) = gApproxEq a1 a2 && gApproxEq b1 b2++instance (ApproxEq a) =>+ GApproxEq (K1 i a) where+ gApproxEq (K1 a) (K1 b) = a =~ b++instance (GApproxEq f) =>+ GApproxEq (M1 i t f) where+ gApproxEq (M1 a) (M1 b) = gApproxEq a b++class ApproxEq a where+ (=~) :: a -> a -> Bool+ default (=~) :: (Generic a, GApproxEq (Rep a)) => a -> a -> Bool+ a =~ b = gApproxEq (G.from a) (G.from b)++instance ApproxEq Text where+ (=~) = (==)++instance ApproxEq Char where+ (=~) = (==)++instance ApproxEq Bool where+ (=~) = (==)++instance ApproxEq Int where+ (=~) = (==)++instance ApproxEq Double where+ (=~) = (==)++instance ApproxEq a =>+ ApproxEq (Maybe a)++instance ApproxEq UTCTime where+ (=~) = (==)++instance ApproxEq a =>+ ApproxEq [a] where+ as =~ bs = and (zipWith (=~) as bs)++instance (ApproxEq l, ApproxEq r) =>+ ApproxEq (Either l r) where+ Left a =~ Left b = a =~ b+ Right a =~ Right b = a =~ b+ _ =~ _ = False++instance (ApproxEq l, ApproxEq r) =>+ ApproxEq (l, r) where+ (=~) (l1, r1) (l2, r2) = l1 =~ l2 && r1 =~ r2
+ tests/Instances.hs view
@@ -0,0 +1,607 @@+{-# OPTIONS_GHC -fno-warn-unused-imports -fno-warn-unused-matches #-}++module Instances where++import ORYHydra.Model+import ORYHydra.Core++import qualified Data.Aeson as A+import qualified Data.ByteString.Lazy as BL+import qualified Data.HashMap.Strict as HM+import qualified Data.Set as Set+import qualified Data.Text as T+import qualified Data.Time as TI+import qualified Data.Vector as V++import Control.Monad+import Data.Char (isSpace)+import Data.List (sort)+import Test.QuickCheck++import ApproxEq++instance Arbitrary T.Text where+ arbitrary = T.pack <$> arbitrary++instance Arbitrary TI.Day where+ arbitrary = TI.ModifiedJulianDay . (2000 +) <$> arbitrary+ shrink = (TI.ModifiedJulianDay <$>) . shrink . TI.toModifiedJulianDay++instance Arbitrary TI.UTCTime where+ arbitrary =+ TI.UTCTime <$> arbitrary <*> (TI.secondsToDiffTime <$> choose (0, 86401))++instance Arbitrary BL.ByteString where+ arbitrary = BL.pack <$> arbitrary+ shrink xs = BL.pack <$> shrink (BL.unpack xs)++instance Arbitrary ByteArray where+ arbitrary = ByteArray <$> arbitrary+ shrink (ByteArray xs) = ByteArray <$> shrink xs++instance Arbitrary Binary where+ arbitrary = Binary <$> arbitrary+ shrink (Binary xs) = Binary <$> shrink xs++instance Arbitrary DateTime where+ arbitrary = DateTime <$> arbitrary+ shrink (DateTime xs) = DateTime <$> shrink xs++instance Arbitrary Date where+ arbitrary = Date <$> arbitrary+ shrink (Date xs) = Date <$> shrink xs++-- | A naive Arbitrary instance for A.Value:+instance Arbitrary A.Value where+ arbitrary = frequency [(3, simpleTypes), (1, arrayTypes), (1, objectTypes)]+ where+ simpleTypes :: Gen A.Value+ simpleTypes =+ frequency+ [ (1, return A.Null)+ , (2, liftM A.Bool (arbitrary :: Gen Bool))+ , (2, liftM (A.Number . fromIntegral) (arbitrary :: Gen Int))+ , (2, liftM (A.String . T.pack) (arbitrary :: Gen String))+ ]+ mapF (k, v) = (T.pack k, v)+ simpleAndArrays = frequency [(1, sized sizedArray), (4, simpleTypes)]+ arrayTypes = sized sizedArray+ objectTypes = sized sizedObject+ sizedArray n = liftM (A.Array . V.fromList) $ replicateM n simpleTypes+ sizedObject n =+ liftM (A.object . map mapF) $+ replicateM n $ (,) <$> (arbitrary :: Gen String) <*> simpleAndArrays+ +-- | Checks if a given list has no duplicates in _O(n log n)_.+hasNoDups+ :: (Ord a)+ => [a] -> Bool+hasNoDups = go Set.empty+ where+ go _ [] = True+ go s (x:xs)+ | s' <- Set.insert x s+ , Set.size s' > Set.size s = go s' xs+ | otherwise = False++instance ApproxEq TI.Day where+ (=~) = (==)+ +arbitraryReduced :: Arbitrary a => Int -> Gen a+arbitraryReduced n = resize (n `div` 2) arbitrary++arbitraryReducedMaybe :: Arbitrary a => Int -> Gen (Maybe a)+arbitraryReducedMaybe 0 = elements [Nothing]+arbitraryReducedMaybe n = arbitraryReduced n++arbitraryReducedMaybeValue :: Int -> Gen (Maybe A.Value)+arbitraryReducedMaybeValue 0 = elements [Nothing]+arbitraryReducedMaybeValue n = do+ generated <- arbitraryReduced n+ if generated == Just A.Null+ then return Nothing+ else return generated++-- * Models+ +instance Arbitrary AcceptConsentRequest where+ arbitrary = sized genAcceptConsentRequest++genAcceptConsentRequest :: Int -> Gen AcceptConsentRequest+genAcceptConsentRequest n =+ AcceptConsentRequest+ <$> arbitraryReducedMaybe n -- acceptConsentRequestGrantAccessTokenAudience :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- acceptConsentRequestGrantScope :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- acceptConsentRequestHandledAt :: Maybe DateTime+ <*> arbitraryReducedMaybe n -- acceptConsentRequestRemember :: Maybe Bool+ <*> arbitraryReducedMaybe n -- acceptConsentRequestRememberFor :: Maybe Integer+ <*> arbitraryReducedMaybe n -- acceptConsentRequestSession :: Maybe ConsentRequestSession+ +instance Arbitrary AcceptLoginRequest where+ arbitrary = sized genAcceptLoginRequest++genAcceptLoginRequest :: Int -> Gen AcceptLoginRequest+genAcceptLoginRequest n =+ AcceptLoginRequest+ <$> arbitraryReducedMaybe n -- acceptLoginRequestAcr :: Maybe Text+ <*> arbitraryReducedMaybeValue n -- acceptLoginRequestContext :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- acceptLoginRequestForceSubjectIdentifier :: Maybe Text+ <*> arbitraryReducedMaybe n -- acceptLoginRequestRemember :: Maybe Bool+ <*> arbitraryReducedMaybe n -- acceptLoginRequestRememberFor :: Maybe Integer+ <*> arbitrary -- acceptLoginRequestSubject :: Text+ +instance Arbitrary CompletedRequest where+ arbitrary = sized genCompletedRequest++genCompletedRequest :: Int -> Gen CompletedRequest+genCompletedRequest n =+ CompletedRequest+ <$> arbitrary -- completedRequestRedirectTo :: Text+ +instance Arbitrary ConsentRequest where+ arbitrary = sized genConsentRequest++genConsentRequest :: Int -> Gen ConsentRequest+genConsentRequest n =+ ConsentRequest+ <$> arbitraryReducedMaybe n -- consentRequestAcr :: Maybe Text+ <*> arbitrary -- consentRequestChallenge :: Text+ <*> arbitraryReducedMaybe n -- consentRequestClient :: Maybe OAuth2Client+ <*> arbitraryReducedMaybeValue n -- consentRequestContext :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- consentRequestLoginChallenge :: Maybe Text+ <*> arbitraryReducedMaybe n -- consentRequestLoginSessionId :: Maybe Text+ <*> arbitraryReducedMaybe n -- consentRequestOidcContext :: Maybe OpenIDConnectContext+ <*> arbitraryReducedMaybe n -- consentRequestRequestUrl :: Maybe Text+ <*> arbitraryReducedMaybe n -- consentRequestRequestedAccessTokenAudience :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- consentRequestRequestedScope :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- consentRequestSkip :: Maybe Bool+ <*> arbitraryReducedMaybe n -- consentRequestSubject :: Maybe Text+ +instance Arbitrary ConsentRequestSession where+ arbitrary = sized genConsentRequestSession++genConsentRequestSession :: Int -> Gen ConsentRequestSession+genConsentRequestSession n =+ ConsentRequestSession+ <$> arbitraryReducedMaybeValue n -- consentRequestSessionAccessToken :: Maybe A.Value+ <*> arbitraryReducedMaybeValue n -- consentRequestSessionIdToken :: Maybe A.Value+ +instance Arbitrary ContainerWaitOKBodyError where+ arbitrary = sized genContainerWaitOKBodyError++genContainerWaitOKBodyError :: Int -> Gen ContainerWaitOKBodyError+genContainerWaitOKBodyError n =+ ContainerWaitOKBodyError+ <$> arbitraryReducedMaybe n -- containerWaitOKBodyErrorMessage :: Maybe Text+ +instance Arbitrary FlushInactiveOAuth2TokensRequest where+ arbitrary = sized genFlushInactiveOAuth2TokensRequest++genFlushInactiveOAuth2TokensRequest :: Int -> Gen FlushInactiveOAuth2TokensRequest+genFlushInactiveOAuth2TokensRequest n =+ FlushInactiveOAuth2TokensRequest+ <$> arbitraryReducedMaybe n -- flushInactiveOAuth2TokensRequestNotAfter :: Maybe DateTime+ +instance Arbitrary GenericError where+ arbitrary = sized genGenericError++genGenericError :: Int -> Gen GenericError+genGenericError n =+ GenericError+ <$> arbitraryReducedMaybe n -- genericErrorDebug :: Maybe Text+ <*> arbitrary -- genericErrorError :: Text+ <*> arbitraryReducedMaybe n -- genericErrorErrorDescription :: Maybe Text+ <*> arbitraryReducedMaybe n -- genericErrorStatusCode :: Maybe Integer+ +instance Arbitrary HealthNotReadyStatus where+ arbitrary = sized genHealthNotReadyStatus++genHealthNotReadyStatus :: Int -> Gen HealthNotReadyStatus+genHealthNotReadyStatus n =+ HealthNotReadyStatus+ <$> arbitraryReducedMaybe n -- healthNotReadyStatusErrors :: Maybe (Map.Map String Text)+ +instance Arbitrary HealthStatus where+ arbitrary = sized genHealthStatus++genHealthStatus :: Int -> Gen HealthStatus+genHealthStatus n =+ HealthStatus+ <$> arbitraryReducedMaybe n -- healthStatusStatus :: Maybe Text+ +instance Arbitrary JSONWebKey where+ arbitrary = sized genJSONWebKey++genJSONWebKey :: Int -> Gen JSONWebKey+genJSONWebKey n =+ JSONWebKey+ <$> arbitrary -- jSONWebKeyAlg :: Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyCrv :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyD :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyDp :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyDq :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyE :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyK :: Maybe Text+ <*> arbitrary -- jSONWebKeyKid :: Text+ <*> arbitrary -- jSONWebKeyKty :: Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyN :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyP :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyQ :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyQi :: Maybe Text+ <*> arbitrary -- jSONWebKeyUse :: Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyX :: Maybe Text+ <*> arbitraryReducedMaybe n -- jSONWebKeyX5c :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- jSONWebKeyY :: Maybe Text+ +instance Arbitrary JSONWebKeySet where+ arbitrary = sized genJSONWebKeySet++genJSONWebKeySet :: Int -> Gen JSONWebKeySet+genJSONWebKeySet n =+ JSONWebKeySet+ <$> arbitraryReducedMaybe n -- jSONWebKeySetKeys :: Maybe [JSONWebKey]+ +instance Arbitrary JsonWebKeySetGeneratorRequest where+ arbitrary = sized genJsonWebKeySetGeneratorRequest++genJsonWebKeySetGeneratorRequest :: Int -> Gen JsonWebKeySetGeneratorRequest+genJsonWebKeySetGeneratorRequest n =+ JsonWebKeySetGeneratorRequest+ <$> arbitrary -- jsonWebKeySetGeneratorRequestAlg :: Text+ <*> arbitrary -- jsonWebKeySetGeneratorRequestKid :: Text+ <*> arbitrary -- jsonWebKeySetGeneratorRequestUse :: Text+ +instance Arbitrary LoginRequest where+ arbitrary = sized genLoginRequest++genLoginRequest :: Int -> Gen LoginRequest+genLoginRequest n =+ LoginRequest+ <$> arbitrary -- loginRequestChallenge :: Text+ <*> arbitraryReduced n -- loginRequestClient :: OAuth2Client+ <*> arbitraryReducedMaybe n -- loginRequestOidcContext :: Maybe OpenIDConnectContext+ <*> arbitrary -- loginRequestRequestUrl :: Text+ <*> arbitrary -- loginRequestRequestedAccessTokenAudience :: [Text]+ <*> arbitrary -- loginRequestRequestedScope :: [Text]+ <*> arbitraryReducedMaybe n -- loginRequestSessionId :: Maybe Text+ <*> arbitrary -- loginRequestSkip :: Bool+ <*> arbitrary -- loginRequestSubject :: Text+ +instance Arbitrary LogoutRequest where+ arbitrary = sized genLogoutRequest++genLogoutRequest :: Int -> Gen LogoutRequest+genLogoutRequest n =+ LogoutRequest+ <$> arbitraryReducedMaybe n -- logoutRequestRequestUrl :: Maybe Text+ <*> arbitraryReducedMaybe n -- logoutRequestRpInitiated :: Maybe Bool+ <*> arbitraryReducedMaybe n -- logoutRequestSid :: Maybe Text+ <*> arbitraryReducedMaybe n -- logoutRequestSubject :: Maybe Text+ +instance Arbitrary OAuth2Client where+ arbitrary = sized genOAuth2Client++genOAuth2Client :: Int -> Gen OAuth2Client+genOAuth2Client n =+ OAuth2Client+ <$> arbitraryReducedMaybe n -- oAuth2ClientAllowedCorsOrigins :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientAudience :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientBackchannelLogoutSessionRequired :: Maybe Bool+ <*> arbitraryReducedMaybe n -- oAuth2ClientBackchannelLogoutUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientClientId :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientClientName :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientClientSecret :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientClientSecretExpiresAt :: Maybe Integer+ <*> arbitraryReducedMaybe n -- oAuth2ClientClientUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientContacts :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientCreatedAt :: Maybe DateTime+ <*> arbitraryReducedMaybe n -- oAuth2ClientFrontchannelLogoutSessionRequired :: Maybe Bool+ <*> arbitraryReducedMaybe n -- oAuth2ClientFrontchannelLogoutUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientGrantTypes :: Maybe [Text]+ <*> arbitraryReducedMaybeValue n -- oAuth2ClientJwks :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- oAuth2ClientJwksUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientLogoUri :: Maybe Text+ <*> arbitraryReducedMaybeValue n -- oAuth2ClientMetadata :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- oAuth2ClientOwner :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientPolicyUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientPostLogoutRedirectUris :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientRedirectUris :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientRequestObjectSigningAlg :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientRequestUris :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientResponseTypes :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2ClientScope :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientSectorIdentifierUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientSubjectType :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientTokenEndpointAuthMethod :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientTokenEndpointAuthSigningAlg :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientTosUri :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2ClientUpdatedAt :: Maybe DateTime+ <*> arbitraryReducedMaybe n -- oAuth2ClientUserinfoSignedResponseAlg :: Maybe Text+ +instance Arbitrary OAuth2TokenIntrospection where+ arbitrary = sized genOAuth2TokenIntrospection++genOAuth2TokenIntrospection :: Int -> Gen OAuth2TokenIntrospection+genOAuth2TokenIntrospection n =+ OAuth2TokenIntrospection+ <$> arbitrary -- oAuth2TokenIntrospectionActive :: Bool+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionAud :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionClientId :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionExp :: Maybe Integer+ <*> arbitraryReducedMaybeValue n -- oAuth2TokenIntrospectionExt :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionIat :: Maybe Integer+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionIss :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionNbf :: Maybe Integer+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionObfuscatedSubject :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionScope :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionSub :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionTokenType :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionTokenUse :: Maybe Text+ <*> arbitraryReducedMaybe n -- oAuth2TokenIntrospectionUsername :: Maybe Text+ +instance Arbitrary Oauth2TokenResponse where+ arbitrary = sized genOauth2TokenResponse++genOauth2TokenResponse :: Int -> Gen Oauth2TokenResponse+genOauth2TokenResponse n =+ Oauth2TokenResponse+ <$> arbitraryReducedMaybe n -- oauth2TokenResponseAccessToken :: Maybe Text+ <*> arbitraryReducedMaybe n -- oauth2TokenResponseExpiresIn :: Maybe Integer+ <*> arbitraryReducedMaybe n -- oauth2TokenResponseIdToken :: Maybe Text+ <*> arbitraryReducedMaybe n -- oauth2TokenResponseRefreshToken :: Maybe Text+ <*> arbitraryReducedMaybe n -- oauth2TokenResponseScope :: Maybe Text+ <*> arbitraryReducedMaybe n -- oauth2TokenResponseTokenType :: Maybe Text+ +instance Arbitrary OpenIDConnectContext where+ arbitrary = sized genOpenIDConnectContext++genOpenIDConnectContext :: Int -> Gen OpenIDConnectContext+genOpenIDConnectContext n =+ OpenIDConnectContext+ <$> arbitraryReducedMaybe n -- openIDConnectContextAcrValues :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- openIDConnectContextDisplay :: Maybe Text+ <*> arbitraryReducedMaybeValue n -- openIDConnectContextIdTokenHintClaims :: Maybe A.Value+ <*> arbitraryReducedMaybe n -- openIDConnectContextLoginHint :: Maybe Text+ <*> arbitraryReducedMaybe n -- openIDConnectContextUiLocales :: Maybe [Text]+ +instance Arbitrary PluginConfig where+ arbitrary = sized genPluginConfig++genPluginConfig :: Int -> Gen PluginConfig+genPluginConfig n =+ PluginConfig+ <$> arbitraryReduced n -- pluginConfigArgs :: PluginConfigArgs+ <*> arbitrary -- pluginConfigDescription :: Text+ <*> arbitraryReducedMaybe n -- pluginConfigDockerVersion :: Maybe Text+ <*> arbitrary -- pluginConfigDocumentation :: Text+ <*> arbitrary -- pluginConfigEntrypoint :: [Text]+ <*> arbitraryReduced n -- pluginConfigEnv :: [PluginEnv]+ <*> arbitraryReduced n -- pluginConfigInterface :: PluginConfigInterface+ <*> arbitrary -- pluginConfigIpcHost :: Bool+ <*> arbitraryReduced n -- pluginConfigLinux :: PluginConfigLinux+ <*> arbitraryReduced n -- pluginConfigMounts :: [PluginMount]+ <*> arbitraryReduced n -- pluginConfigNetwork :: PluginConfigNetwork+ <*> arbitrary -- pluginConfigPidHost :: Bool+ <*> arbitrary -- pluginConfigPropagatedMount :: Text+ <*> arbitraryReducedMaybe n -- pluginConfigUser :: Maybe PluginConfigUser+ <*> arbitrary -- pluginConfigWorkDir :: Text+ <*> arbitraryReducedMaybe n -- pluginConfigRootfs :: Maybe PluginConfigRootfs+ +instance Arbitrary PluginConfigArgs where+ arbitrary = sized genPluginConfigArgs++genPluginConfigArgs :: Int -> Gen PluginConfigArgs+genPluginConfigArgs n =+ PluginConfigArgs+ <$> arbitrary -- pluginConfigArgsDescription :: Text+ <*> arbitrary -- pluginConfigArgsName :: Text+ <*> arbitrary -- pluginConfigArgsSettable :: [Text]+ <*> arbitrary -- pluginConfigArgsValue :: [Text]+ +instance Arbitrary PluginConfigInterface where+ arbitrary = sized genPluginConfigInterface++genPluginConfigInterface :: Int -> Gen PluginConfigInterface+genPluginConfigInterface n =+ PluginConfigInterface+ <$> arbitrary -- pluginConfigInterfaceSocket :: Text+ <*> arbitraryReduced n -- pluginConfigInterfaceTypes :: [PluginInterfaceType]+ +instance Arbitrary PluginConfigLinux where+ arbitrary = sized genPluginConfigLinux++genPluginConfigLinux :: Int -> Gen PluginConfigLinux+genPluginConfigLinux n =+ PluginConfigLinux+ <$> arbitrary -- pluginConfigLinuxAllowAllDevices :: Bool+ <*> arbitrary -- pluginConfigLinuxCapabilities :: [Text]+ <*> arbitraryReduced n -- pluginConfigLinuxDevices :: [PluginDevice]+ +instance Arbitrary PluginConfigNetwork where+ arbitrary = sized genPluginConfigNetwork++genPluginConfigNetwork :: Int -> Gen PluginConfigNetwork+genPluginConfigNetwork n =+ PluginConfigNetwork+ <$> arbitrary -- pluginConfigNetworkType :: Text+ +instance Arbitrary PluginConfigRootfs where+ arbitrary = sized genPluginConfigRootfs++genPluginConfigRootfs :: Int -> Gen PluginConfigRootfs+genPluginConfigRootfs n =+ PluginConfigRootfs+ <$> arbitraryReducedMaybe n -- pluginConfigRootfsDiffIds :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- pluginConfigRootfsType :: Maybe Text+ +instance Arbitrary PluginConfigUser where+ arbitrary = sized genPluginConfigUser++genPluginConfigUser :: Int -> Gen PluginConfigUser+genPluginConfigUser n =+ PluginConfigUser+ <$> arbitraryReducedMaybe n -- pluginConfigUserGid :: Maybe Int+ <*> arbitraryReducedMaybe n -- pluginConfigUserUid :: Maybe Int+ +instance Arbitrary PluginDevice where+ arbitrary = sized genPluginDevice++genPluginDevice :: Int -> Gen PluginDevice+genPluginDevice n =+ PluginDevice+ <$> arbitrary -- pluginDeviceDescription :: Text+ <*> arbitrary -- pluginDeviceName :: Text+ <*> arbitrary -- pluginDevicePath :: Text+ <*> arbitrary -- pluginDeviceSettable :: [Text]+ +instance Arbitrary PluginEnv where+ arbitrary = sized genPluginEnv++genPluginEnv :: Int -> Gen PluginEnv+genPluginEnv n =+ PluginEnv+ <$> arbitrary -- pluginEnvDescription :: Text+ <*> arbitrary -- pluginEnvName :: Text+ <*> arbitrary -- pluginEnvSettable :: [Text]+ <*> arbitrary -- pluginEnvValue :: Text+ +instance Arbitrary PluginInterfaceType where+ arbitrary = sized genPluginInterfaceType++genPluginInterfaceType :: Int -> Gen PluginInterfaceType+genPluginInterfaceType n =+ PluginInterfaceType+ <$> arbitrary -- pluginInterfaceTypeCapability :: Text+ <*> arbitrary -- pluginInterfaceTypePrefix :: Text+ <*> arbitrary -- pluginInterfaceTypeVersion :: Text+ +instance Arbitrary PluginMount where+ arbitrary = sized genPluginMount++genPluginMount :: Int -> Gen PluginMount+genPluginMount n =+ PluginMount+ <$> arbitrary -- pluginMountDescription :: Text+ <*> arbitrary -- pluginMountDestination :: Text+ <*> arbitrary -- pluginMountName :: Text+ <*> arbitrary -- pluginMountOptions :: [Text]+ <*> arbitrary -- pluginMountSettable :: [Text]+ <*> arbitrary -- pluginMountSource :: Text+ <*> arbitrary -- pluginMountType :: Text+ +instance Arbitrary PluginSettings where+ arbitrary = sized genPluginSettings++genPluginSettings :: Int -> Gen PluginSettings+genPluginSettings n =+ PluginSettings+ <$> arbitrary -- pluginSettingsArgs :: [Text]+ <*> arbitraryReduced n -- pluginSettingsDevices :: [PluginDevice]+ <*> arbitrary -- pluginSettingsEnv :: [Text]+ <*> arbitraryReduced n -- pluginSettingsMounts :: [PluginMount]+ +instance Arbitrary PreviousConsentSession where+ arbitrary = sized genPreviousConsentSession++genPreviousConsentSession :: Int -> Gen PreviousConsentSession+genPreviousConsentSession n =+ PreviousConsentSession+ <$> arbitraryReducedMaybe n -- previousConsentSessionConsentRequest :: Maybe ConsentRequest+ <*> arbitraryReducedMaybe n -- previousConsentSessionGrantAccessTokenAudience :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- previousConsentSessionGrantScope :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- previousConsentSessionHandledAt :: Maybe DateTime+ <*> arbitraryReducedMaybe n -- previousConsentSessionRemember :: Maybe Bool+ <*> arbitraryReducedMaybe n -- previousConsentSessionRememberFor :: Maybe Integer+ <*> arbitraryReducedMaybe n -- previousConsentSessionSession :: Maybe ConsentRequestSession+ +instance Arbitrary RejectRequest where+ arbitrary = sized genRejectRequest++genRejectRequest :: Int -> Gen RejectRequest+genRejectRequest n =+ RejectRequest+ <$> arbitraryReducedMaybe n -- rejectRequestError :: Maybe Text+ <*> arbitraryReducedMaybe n -- rejectRequestErrorDebug :: Maybe Text+ <*> arbitraryReducedMaybe n -- rejectRequestErrorDescription :: Maybe Text+ <*> arbitraryReducedMaybe n -- rejectRequestErrorHint :: Maybe Text+ <*> arbitraryReducedMaybe n -- rejectRequestStatusCode :: Maybe Integer+ +instance Arbitrary UserinfoResponse where+ arbitrary = sized genUserinfoResponse++genUserinfoResponse :: Int -> Gen UserinfoResponse+genUserinfoResponse n =+ UserinfoResponse+ <$> arbitraryReducedMaybe n -- userinfoResponseBirthdate :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseEmail :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseEmailVerified :: Maybe Bool+ <*> arbitraryReducedMaybe n -- userinfoResponseFamilyName :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseGender :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseGivenName :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseLocale :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseMiddleName :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseName :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseNickname :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponsePhoneNumber :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponsePhoneNumberVerified :: Maybe Bool+ <*> arbitraryReducedMaybe n -- userinfoResponsePicture :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponsePreferredUsername :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseProfile :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseSub :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseUpdatedAt :: Maybe Integer+ <*> arbitraryReducedMaybe n -- userinfoResponseWebsite :: Maybe Text+ <*> arbitraryReducedMaybe n -- userinfoResponseZoneinfo :: Maybe Text+ +instance Arbitrary Version where+ arbitrary = sized genVersion++genVersion :: Int -> Gen Version+genVersion n =+ Version+ <$> arbitraryReducedMaybe n -- versionVersion :: Maybe Text+ +instance Arbitrary VolumeUsageData where+ arbitrary = sized genVolumeUsageData++genVolumeUsageData :: Int -> Gen VolumeUsageData+genVolumeUsageData n =+ VolumeUsageData+ <$> arbitrary -- volumeUsageDataRefCount :: Integer+ <*> arbitrary -- volumeUsageDataSize :: Integer+ +instance Arbitrary WellKnown where+ arbitrary = sized genWellKnown++genWellKnown :: Int -> Gen WellKnown+genWellKnown n =+ WellKnown+ <$> arbitrary -- wellKnownAuthorizationEndpoint :: Text+ <*> arbitraryReducedMaybe n -- wellKnownBackchannelLogoutSessionSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownBackchannelLogoutSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownClaimsParameterSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownClaimsSupported :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- wellKnownEndSessionEndpoint :: Maybe Text+ <*> arbitraryReducedMaybe n -- wellKnownFrontchannelLogoutSessionSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownFrontchannelLogoutSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownGrantTypesSupported :: Maybe [Text]+ <*> arbitrary -- wellKnownIdTokenSigningAlgValuesSupported :: [Text]+ <*> arbitrary -- wellKnownIssuer :: Text+ <*> arbitrary -- wellKnownJwksUri :: Text+ <*> arbitraryReducedMaybe n -- wellKnownRegistrationEndpoint :: Maybe Text+ <*> arbitraryReducedMaybe n -- wellKnownRequestObjectSigningAlgValuesSupported :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- wellKnownRequestParameterSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownRequestUriParameterSupported :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownRequireRequestUriRegistration :: Maybe Bool+ <*> arbitraryReducedMaybe n -- wellKnownResponseModesSupported :: Maybe [Text]+ <*> arbitrary -- wellKnownResponseTypesSupported :: [Text]+ <*> arbitraryReducedMaybe n -- wellKnownRevocationEndpoint :: Maybe Text+ <*> arbitraryReducedMaybe n -- wellKnownScopesSupported :: Maybe [Text]+ <*> arbitrary -- wellKnownSubjectTypesSupported :: [Text]+ <*> arbitrary -- wellKnownTokenEndpoint :: Text+ <*> arbitraryReducedMaybe n -- wellKnownTokenEndpointAuthMethodsSupported :: Maybe [Text]+ <*> arbitraryReducedMaybe n -- wellKnownUserinfoEndpoint :: Maybe Text+ <*> arbitraryReducedMaybe n -- wellKnownUserinfoSigningAlgValuesSupported :: Maybe [Text]+ +++
+ tests/PropMime.hs view
@@ -0,0 +1,51 @@+{-# LANGUAGE ScopedTypeVariables #-}+{-# LANGUAGE FlexibleContexts #-}+{-# LANGUAGE ConstraintKinds #-}+{-# OPTIONS_GHC -fno-warn-unused-imports #-}++module PropMime where++import Data.Aeson+import Data.Aeson.Types (parseEither)+import Data.Monoid ((<>))+import Data.Typeable (Proxy(..), typeOf, Typeable)+import qualified Data.ByteString.Lazy.Char8 as BL8+import Test.Hspec+import Test.QuickCheck+import Test.QuickCheck.Property+import Test.Hspec.QuickCheck (prop)++import ORYHydra.MimeTypes++import ApproxEq++-- * Type Aliases++type ArbitraryMime mime a = ArbitraryRoundtrip (MimeUnrender mime) (MimeRender mime) a++type ArbitraryRoundtrip from to a = (from a, to a, Arbitrary' a)++type Arbitrary' a = (Arbitrary a, Show a, Typeable a)++-- * Mime++propMime+ :: forall a b mime.+ (ArbitraryMime mime a, Testable b)+ => String -> (a -> a -> b) -> mime -> Proxy a -> Spec+propMime eqDescr eq m _ =+ prop+ (show (typeOf (undefined :: a)) <> " " <> show (typeOf (undefined :: mime)) <> " roundtrip " <> eqDescr) $+ \(x :: a) ->+ let rendered = mimeRender' m x+ actual = mimeUnrender' m rendered+ expected = Right x+ failMsg =+ "ACTUAL: " <> show actual <> "\nRENDERED: " <> BL8.unpack rendered+ in counterexample failMsg $+ either reject property (eq <$> actual <*> expected)+ where+ reject = property . const rejected++propMimeEq :: (ArbitraryMime mime a, Eq a) => mime -> Proxy a -> Spec+propMimeEq = propMime "(EQ)" (==)
+ tests/Test.hs view
@@ -0,0 +1,60 @@+{-# LANGUAGE ScopedTypeVariables #-}+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE RecordWildCards #-}+{-# LANGUAGE PartialTypeSignatures #-}++module Main where++import Data.Typeable (Proxy(..))+import Test.Hspec+import Test.Hspec.QuickCheck++import PropMime+import Instances ()++import ORYHydra.Model+import ORYHydra.MimeTypes++main :: IO ()+main =+ hspec $ modifyMaxSize (const 10) $ do+ describe "JSON instances" $ do+ pure ()+ propMimeEq MimeJSON (Proxy :: Proxy AcceptConsentRequest)+ propMimeEq MimeJSON (Proxy :: Proxy AcceptLoginRequest)+ propMimeEq MimeJSON (Proxy :: Proxy CompletedRequest)+ propMimeEq MimeJSON (Proxy :: Proxy ConsentRequest)+ propMimeEq MimeJSON (Proxy :: Proxy ConsentRequestSession)+ propMimeEq MimeJSON (Proxy :: Proxy ContainerWaitOKBodyError)+ propMimeEq MimeJSON (Proxy :: Proxy FlushInactiveOAuth2TokensRequest)+ propMimeEq MimeJSON (Proxy :: Proxy GenericError)+ propMimeEq MimeJSON (Proxy :: Proxy HealthNotReadyStatus)+ propMimeEq MimeJSON (Proxy :: Proxy HealthStatus)+ propMimeEq MimeJSON (Proxy :: Proxy JSONWebKey)+ propMimeEq MimeJSON (Proxy :: Proxy JSONWebKeySet)+ propMimeEq MimeJSON (Proxy :: Proxy JsonWebKeySetGeneratorRequest)+ propMimeEq MimeJSON (Proxy :: Proxy LoginRequest)+ propMimeEq MimeJSON (Proxy :: Proxy LogoutRequest)+ propMimeEq MimeJSON (Proxy :: Proxy OAuth2Client)+ propMimeEq MimeJSON (Proxy :: Proxy OAuth2TokenIntrospection)+ propMimeEq MimeJSON (Proxy :: Proxy Oauth2TokenResponse)+ propMimeEq MimeJSON (Proxy :: Proxy OpenIDConnectContext)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfig)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigArgs)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigInterface)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigLinux)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigNetwork)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigRootfs)+ propMimeEq MimeJSON (Proxy :: Proxy PluginConfigUser)+ propMimeEq MimeJSON (Proxy :: Proxy PluginDevice)+ propMimeEq MimeJSON (Proxy :: Proxy PluginEnv)+ propMimeEq MimeJSON (Proxy :: Proxy PluginInterfaceType)+ propMimeEq MimeJSON (Proxy :: Proxy PluginMount)+ propMimeEq MimeJSON (Proxy :: Proxy PluginSettings)+ propMimeEq MimeJSON (Proxy :: Proxy PreviousConsentSession)+ propMimeEq MimeJSON (Proxy :: Proxy RejectRequest)+ propMimeEq MimeJSON (Proxy :: Proxy UserinfoResponse)+ propMimeEq MimeJSON (Proxy :: Proxy Version)+ propMimeEq MimeJSON (Proxy :: Proxy VolumeUsageData)+ propMimeEq MimeJSON (Proxy :: Proxy WellKnown)+