feat: add service tokens

docs/infrastructure/fern/GENERATING.md

@@ -0,0 +1,19 @@
+# Generating
+
+## Step 1: Cloud & build Fern
+
+```sh
+gh repo clone rivet-gg/fern
+cd fern
+yarn install
+yarn husky install
+yarn dist:cli:dev
+```
+
+## Step 2: Generate
+
+In the Rivet repo:
+
+```
+FERN_REPO_PATH=/path/to/fern ./scripts/fern/gen.sh
+```

fern/definition/cloud/games/namespaces/__package__.yml

@@ -207,6 +207,19 @@ service:
           type: uuid
       response: CreateGameNamespaceTokenPublicResponse
 
+    createGameNamespaceTokenService:
+      path: /games/{game_id}/namespaces/{namespace_id}/tokens/service
+      method: POST
+      docs: Creates a service token for the given namespace.
+      path-parameters:
+        game_id:
+          type: uuid
+        namespace_id:
+          type: uuid
+      request:
+        body: CreateGameNamespaceTokenServiceRequest
+      response: CreateGameNamespaceTokenServiceResponse
+
     updateGameNamespaceVersion:
       path: /games/{game_id}/namespaces/{namespace_id}/version
       method: PUT
@@ -373,6 +386,19 @@ types:
           JSON.
         type: string
 
+  CreateGameNamespaceTokenServiceRequest:
+    properties:
+      ttl: integer
+
+  CreateGameNamespaceTokenServiceResponse:
+    properties:
+      token:
+        docs: |-
+          A JSON Web Token.
+          Slightly modified to include a description prefix and use Protobufs of
+          JSON.
+        type: string
+
   UpdateGameNamespaceVersionRequest:
     properties:
       version_id:

lib/claims/src/lib.rs

@@ -344,6 +344,21 @@ pub mod ent {
 			Ok(ProvisionedServer {})
 		}
 	}
+
+	#[derive(Clone, Debug)]
+	pub struct GameNamespaceService {
+		pub namespace_id: Uuid,
+	}
+
+	impl TryFrom<&schema::entitlement::GameNamespaceService> for GameNamespaceService {
+		type Error = GlobalError;
+
+		fn try_from(value: &schema::entitlement::GameNamespaceService) -> GlobalResult<Self> {
+			Ok(GameNamespaceService {
+				namespace_id: unwrap!(value.namespace_id).as_uuid(),
+			})
+		}
+	}
 }
 
 pub trait ClaimsDecode {
@@ -368,6 +383,7 @@ pub trait ClaimsDecode {
 	fn as_bypass(&self) -> GlobalResult<ent::Bypass>;
 	fn as_access_token(&self) -> GlobalResult<ent::AccessToken>;
 	fn as_provisioned_server(&self) -> GlobalResult<ent::ProvisionedServer>;
+	fn as_game_namespace_service(&self) -> GlobalResult<ent::GameNamespaceService>;
 }
 
 impl ClaimsDecode for schema::Claims {
@@ -647,6 +663,22 @@ impl ClaimsDecode for schema::Claims {
 			))
 			.and_then(std::convert::identity)
 	}
+
+	fn as_game_namespace_service(&self) -> GlobalResult<ent::GameNamespaceService> {
+		self.entitlements
+			.iter()
+			.find_map(|ent| match &ent.kind {
+				Some(schema::entitlement::Kind::GameNamespaceService(ent)) => {
+					Some(ent::GameNamespaceService::try_from(ent))
+				}
+				_ => None,
+			})
+			.ok_or(err_code!(
+				CLAIMS_MISSING_ENTITLEMENT,
+				entitlements = "GameNamespaceService"
+			))
+			.and_then(std::convert::identity)
+	}
 }
 
 pub trait EntitlementTag {
@@ -674,6 +706,7 @@ impl EntitlementTag for schema::Entitlement {
 			schema::entitlement::Kind::Bypass(_) => 15,
 			schema::entitlement::Kind::AccessToken(_) => 16,
 			schema::entitlement::Kind::ProvisionedServer(_) => 17,
+			schema::entitlement::Kind::GameNamespaceService(_) => 18,
 		})
 	}
 }

proto/claims.proto

@@ -45,7 +45,7 @@ message Entitlement {
 		rivet.common.Uuid run_id = 1;
 	}
 
-	// Manage a game's cloud status.
+	// Manage a game's cloud resources.
 	message GameCloud {
 		rivet.common.Uuid game_id = 1;
 	}
@@ -110,7 +110,12 @@ message Entitlement {
 	// Issued to provisioned servers for communication with our API. This will be written to prebake servers
 	// (see /docs/packages/cluster/SERVER_PROVISIONING.md).
 	message ProvisionedServer {
+
+	}
 
+	// Token used to access Rivet via an API backend.
+	message GameNamespaceService {
+		rivet.common.Uuid namespace_id = 1;
 	}
 
 	oneof kind {
@@ -130,6 +135,7 @@ message Entitlement {
 		Bypass bypass = 15;
 		AccessToken access_token = 16;
 		ProvisionedServer provisioned_server = 17;
+		GameNamespaceService game_namespace_service = 18;
 	}
 
 	reserved 13;