Move SSO clients from config to database

- Add sso_clients table (migration 000010) with client_id, redirect_uri, tags (JSON), enabled flag, and audit timestamps - Add SSOClient model struct and audit events - Implement DB CRUD with 10 unit tests - Add REST API: GET/POST/PATCH/DELETE /v1/sso/clients (policy-gated) - Add gRPC SSOClientService with 5 RPCs (admin-only) - Add mciasctl sso list/create/get/update/delete commands - Add web UI admin page at /sso-clients with HTMX create/toggle/delete - Migrate handleSSOAuthorize and handleSSOTokenExchange to use DB - Remove SSOConfig, SSOClient struct, lookup methods from config - Simplify: client_id = service_name for policy evaluation Security: - SSO client CRUD is admin-only (policy-gated REST, requireAdmin gRPC) - redirect_uri must use https:// (validated at DB layer) - Disabled clients are rejected at both authorize and token exchange - All mutations write audit events Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 23:47:53 -07:00
parent 4430ce38a4
commit df7773229c
24 changed files with 2284 additions and 217 deletions
--- a/gen/mcias/v1/sso_client.pb.go
+++ b/gen/mcias/v1/sso_client.pb.go
@@ -0,0 +1,703 @@
+// SSOClientService: CRUD management of SSO client registrations.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.32.1
+// source: mcias/v1/sso_client.proto
+
+package mciasv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// SSOClient is the wire representation of an SSO client registration.
+type SSOClient struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	RedirectUri   string                 `protobuf:"bytes,2,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
+	Tags          []string               `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"`
+	Enabled       bool                   `protobuf:"varint,4,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	CreatedAt     string                 `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"` // RFC3339
+	UpdatedAt     string                 `protobuf:"bytes,6,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"` // RFC3339
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SSOClient) Reset() {
+	*x = SSOClient{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SSOClient) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SSOClient) ProtoMessage() {}
+
+func (x *SSOClient) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SSOClient.ProtoReflect.Descriptor instead.
+func (*SSOClient) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *SSOClient) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *SSOClient) GetRedirectUri() string {
+	if x != nil {
+		return x.RedirectUri
+	}
+	return ""
+}
+
+func (x *SSOClient) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *SSOClient) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *SSOClient) GetCreatedAt() string {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return ""
+}
+
+func (x *SSOClient) GetUpdatedAt() string {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return ""
+}
+
+type ListSSOClientsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListSSOClientsRequest) Reset() {
+	*x = ListSSOClientsRequest{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListSSOClientsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListSSOClientsRequest) ProtoMessage() {}
+
+func (x *ListSSOClientsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListSSOClientsRequest.ProtoReflect.Descriptor instead.
+func (*ListSSOClientsRequest) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{1}
+}
+
+type ListSSOClientsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Clients       []*SSOClient           `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListSSOClientsResponse) Reset() {
+	*x = ListSSOClientsResponse{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListSSOClientsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListSSOClientsResponse) ProtoMessage() {}
+
+func (x *ListSSOClientsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListSSOClientsResponse.ProtoReflect.Descriptor instead.
+func (*ListSSOClientsResponse) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListSSOClientsResponse) GetClients() []*SSOClient {
+	if x != nil {
+		return x.Clients
+	}
+	return nil
+}
+
+type CreateSSOClientRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	RedirectUri   string                 `protobuf:"bytes,2,opt,name=redirect_uri,json=redirectUri,proto3" json:"redirect_uri,omitempty"`
+	Tags          []string               `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSSOClientRequest) Reset() {
+	*x = CreateSSOClientRequest{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSSOClientRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSSOClientRequest) ProtoMessage() {}
+
+func (x *CreateSSOClientRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSSOClientRequest.ProtoReflect.Descriptor instead.
+func (*CreateSSOClientRequest) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CreateSSOClientRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *CreateSSOClientRequest) GetRedirectUri() string {
+	if x != nil {
+		return x.RedirectUri
+	}
+	return ""
+}
+
+func (x *CreateSSOClientRequest) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+type CreateSSOClientResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *SSOClient             `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSSOClientResponse) Reset() {
+	*x = CreateSSOClientResponse{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSSOClientResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSSOClientResponse) ProtoMessage() {}
+
+func (x *CreateSSOClientResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSSOClientResponse.ProtoReflect.Descriptor instead.
+func (*CreateSSOClientResponse) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CreateSSOClientResponse) GetClient() *SSOClient {
+	if x != nil {
+		return x.Client
+	}
+	return nil
+}
+
+type GetSSOClientRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSSOClientRequest) Reset() {
+	*x = GetSSOClientRequest{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSSOClientRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSSOClientRequest) ProtoMessage() {}
+
+func (x *GetSSOClientRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSSOClientRequest.ProtoReflect.Descriptor instead.
+func (*GetSSOClientRequest) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *GetSSOClientRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+type GetSSOClientResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *SSOClient             `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetSSOClientResponse) Reset() {
+	*x = GetSSOClientResponse{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetSSOClientResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetSSOClientResponse) ProtoMessage() {}
+
+func (x *GetSSOClientResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetSSOClientResponse.ProtoReflect.Descriptor instead.
+func (*GetSSOClientResponse) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *GetSSOClientResponse) GetClient() *SSOClient {
+	if x != nil {
+		return x.Client
+	}
+	return nil
+}
+
+type UpdateSSOClientRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	RedirectUri   *string                `protobuf:"bytes,2,opt,name=redirect_uri,json=redirectUri,proto3,oneof" json:"redirect_uri,omitempty"`
+	Tags          []string               `protobuf:"bytes,3,rep,name=tags,proto3" json:"tags,omitempty"`
+	Enabled       *bool                  `protobuf:"varint,4,opt,name=enabled,proto3,oneof" json:"enabled,omitempty"`
+	UpdateTags    bool                   `protobuf:"varint,5,opt,name=update_tags,json=updateTags,proto3" json:"update_tags,omitempty"` // when true, tags field is applied (allows clearing)
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateSSOClientRequest) Reset() {
+	*x = UpdateSSOClientRequest{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateSSOClientRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateSSOClientRequest) ProtoMessage() {}
+
+func (x *UpdateSSOClientRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateSSOClientRequest.ProtoReflect.Descriptor instead.
+func (*UpdateSSOClientRequest) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateSSOClientRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *UpdateSSOClientRequest) GetRedirectUri() string {
+	if x != nil && x.RedirectUri != nil {
+		return *x.RedirectUri
+	}
+	return ""
+}
+
+func (x *UpdateSSOClientRequest) GetTags() []string {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *UpdateSSOClientRequest) GetEnabled() bool {
+	if x != nil && x.Enabled != nil {
+		return *x.Enabled
+	}
+	return false
+}
+
+func (x *UpdateSSOClientRequest) GetUpdateTags() bool {
+	if x != nil {
+		return x.UpdateTags
+	}
+	return false
+}
+
+type UpdateSSOClientResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Client        *SSOClient             `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateSSOClientResponse) Reset() {
+	*x = UpdateSSOClientResponse{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateSSOClientResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateSSOClientResponse) ProtoMessage() {}
+
+func (x *UpdateSSOClientResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateSSOClientResponse.ProtoReflect.Descriptor instead.
+func (*UpdateSSOClientResponse) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *UpdateSSOClientResponse) GetClient() *SSOClient {
+	if x != nil {
+		return x.Client
+	}
+	return nil
+}
+
+type DeleteSSOClientRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClientId      string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteSSOClientRequest) Reset() {
+	*x = DeleteSSOClientRequest{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteSSOClientRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteSSOClientRequest) ProtoMessage() {}
+
+func (x *DeleteSSOClientRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteSSOClientRequest.ProtoReflect.Descriptor instead.
+func (*DeleteSSOClientRequest) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DeleteSSOClientRequest) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+type DeleteSSOClientResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteSSOClientResponse) Reset() {
+	*x = DeleteSSOClientResponse{}
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteSSOClientResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteSSOClientResponse) ProtoMessage() {}
+
+func (x *DeleteSSOClientResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_mcias_v1_sso_client_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteSSOClientResponse.ProtoReflect.Descriptor instead.
+func (*DeleteSSOClientResponse) Descriptor() ([]byte, []int) {
+	return file_mcias_v1_sso_client_proto_rawDescGZIP(), []int{10}
+}
+
+var File_mcias_v1_sso_client_proto protoreflect.FileDescriptor
+
+const file_mcias_v1_sso_client_proto_rawDesc = "" +
+	"\n" +
+	"\x19mcias/v1/sso_client.proto\x12\bmcias.v1\"\xb7\x01\n" +
+	"\tSSOClient\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12!\n" +
+	"\fredirect_uri\x18\x02 \x01(\tR\vredirectUri\x12\x12\n" +
+	"\x04tags\x18\x03 \x03(\tR\x04tags\x12\x18\n" +
+	"\aenabled\x18\x04 \x01(\bR\aenabled\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\x06 \x01(\tR\tupdatedAt\"\x17\n" +
+	"\x15ListSSOClientsRequest\"G\n" +
+	"\x16ListSSOClientsResponse\x12-\n" +
+	"\aclients\x18\x01 \x03(\v2\x13.mcias.v1.SSOClientR\aclients\"l\n" +
+	"\x16CreateSSOClientRequest\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12!\n" +
+	"\fredirect_uri\x18\x02 \x01(\tR\vredirectUri\x12\x12\n" +
+	"\x04tags\x18\x03 \x03(\tR\x04tags\"F\n" +
+	"\x17CreateSSOClientResponse\x12+\n" +
+	"\x06client\x18\x01 \x01(\v2\x13.mcias.v1.SSOClientR\x06client\"2\n" +
+	"\x13GetSSOClientRequest\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\"C\n" +
+	"\x14GetSSOClientResponse\x12+\n" +
+	"\x06client\x18\x01 \x01(\v2\x13.mcias.v1.SSOClientR\x06client\"\xce\x01\n" +
+	"\x16UpdateSSOClientRequest\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\x12&\n" +
+	"\fredirect_uri\x18\x02 \x01(\tH\x00R\vredirectUri\x88\x01\x01\x12\x12\n" +
+	"\x04tags\x18\x03 \x03(\tR\x04tags\x12\x1d\n" +
+	"\aenabled\x18\x04 \x01(\bH\x01R\aenabled\x88\x01\x01\x12\x1f\n" +
+	"\vupdate_tags\x18\x05 \x01(\bR\n" +
+	"updateTagsB\x0f\n" +
+	"\r_redirect_uriB\n" +
+	"\n" +
+	"\b_enabled\"F\n" +
+	"\x17UpdateSSOClientResponse\x12+\n" +
+	"\x06client\x18\x01 \x01(\v2\x13.mcias.v1.SSOClientR\x06client\"5\n" +
+	"\x16DeleteSSOClientRequest\x12\x1b\n" +
+	"\tclient_id\x18\x01 \x01(\tR\bclientId\"\x19\n" +
+	"\x17DeleteSSOClientResponse2\xbe\x03\n" +
+	"\x10SSOClientService\x12S\n" +
+	"\x0eListSSOClients\x12\x1f.mcias.v1.ListSSOClientsRequest\x1a .mcias.v1.ListSSOClientsResponse\x12V\n" +
+	"\x0fCreateSSOClient\x12 .mcias.v1.CreateSSOClientRequest\x1a!.mcias.v1.CreateSSOClientResponse\x12M\n" +
+	"\fGetSSOClient\x12\x1d.mcias.v1.GetSSOClientRequest\x1a\x1e.mcias.v1.GetSSOClientResponse\x12V\n" +
+	"\x0fUpdateSSOClient\x12 .mcias.v1.UpdateSSOClientRequest\x1a!.mcias.v1.UpdateSSOClientResponse\x12V\n" +
+	"\x0fDeleteSSOClient\x12 .mcias.v1.DeleteSSOClientRequest\x1a!.mcias.v1.DeleteSSOClientResponseB0Z.git.wntrmute.dev/mc/mcias/gen/mcias/v1;mciasv1b\x06proto3"
+
+var (
+	file_mcias_v1_sso_client_proto_rawDescOnce sync.Once
+	file_mcias_v1_sso_client_proto_rawDescData []byte
+)
+
+func file_mcias_v1_sso_client_proto_rawDescGZIP() []byte {
+	file_mcias_v1_sso_client_proto_rawDescOnce.Do(func() {
+		file_mcias_v1_sso_client_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_mcias_v1_sso_client_proto_rawDesc), len(file_mcias_v1_sso_client_proto_rawDesc)))
+	})
+	return file_mcias_v1_sso_client_proto_rawDescData
+}
+
+var file_mcias_v1_sso_client_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_mcias_v1_sso_client_proto_goTypes = []any{
+	(*SSOClient)(nil),               // 0: mcias.v1.SSOClient
+	(*ListSSOClientsRequest)(nil),   // 1: mcias.v1.ListSSOClientsRequest
+	(*ListSSOClientsResponse)(nil),  // 2: mcias.v1.ListSSOClientsResponse
+	(*CreateSSOClientRequest)(nil),  // 3: mcias.v1.CreateSSOClientRequest
+	(*CreateSSOClientResponse)(nil), // 4: mcias.v1.CreateSSOClientResponse
+	(*GetSSOClientRequest)(nil),     // 5: mcias.v1.GetSSOClientRequest
+	(*GetSSOClientResponse)(nil),    // 6: mcias.v1.GetSSOClientResponse
+	(*UpdateSSOClientRequest)(nil),  // 7: mcias.v1.UpdateSSOClientRequest
+	(*UpdateSSOClientResponse)(nil), // 8: mcias.v1.UpdateSSOClientResponse
+	(*DeleteSSOClientRequest)(nil),  // 9: mcias.v1.DeleteSSOClientRequest
+	(*DeleteSSOClientResponse)(nil), // 10: mcias.v1.DeleteSSOClientResponse
+}
+var file_mcias_v1_sso_client_proto_depIdxs = []int32{
+	0,  // 0: mcias.v1.ListSSOClientsResponse.clients:type_name -> mcias.v1.SSOClient
+	0,  // 1: mcias.v1.CreateSSOClientResponse.client:type_name -> mcias.v1.SSOClient
+	0,  // 2: mcias.v1.GetSSOClientResponse.client:type_name -> mcias.v1.SSOClient
+	0,  // 3: mcias.v1.UpdateSSOClientResponse.client:type_name -> mcias.v1.SSOClient
+	1,  // 4: mcias.v1.SSOClientService.ListSSOClients:input_type -> mcias.v1.ListSSOClientsRequest
+	3,  // 5: mcias.v1.SSOClientService.CreateSSOClient:input_type -> mcias.v1.CreateSSOClientRequest
+	5,  // 6: mcias.v1.SSOClientService.GetSSOClient:input_type -> mcias.v1.GetSSOClientRequest
+	7,  // 7: mcias.v1.SSOClientService.UpdateSSOClient:input_type -> mcias.v1.UpdateSSOClientRequest
+	9,  // 8: mcias.v1.SSOClientService.DeleteSSOClient:input_type -> mcias.v1.DeleteSSOClientRequest
+	2,  // 9: mcias.v1.SSOClientService.ListSSOClients:output_type -> mcias.v1.ListSSOClientsResponse
+	4,  // 10: mcias.v1.SSOClientService.CreateSSOClient:output_type -> mcias.v1.CreateSSOClientResponse
+	6,  // 11: mcias.v1.SSOClientService.GetSSOClient:output_type -> mcias.v1.GetSSOClientResponse
+	8,  // 12: mcias.v1.SSOClientService.UpdateSSOClient:output_type -> mcias.v1.UpdateSSOClientResponse
+	10, // 13: mcias.v1.SSOClientService.DeleteSSOClient:output_type -> mcias.v1.DeleteSSOClientResponse
+	9,  // [9:14] is the sub-list for method output_type
+	4,  // [4:9] is the sub-list for method input_type
+	4,  // [4:4] is the sub-list for extension type_name
+	4,  // [4:4] is the sub-list for extension extendee
+	0,  // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_mcias_v1_sso_client_proto_init() }
+func file_mcias_v1_sso_client_proto_init() {
+	if File_mcias_v1_sso_client_proto != nil {
+		return
+	}
+	file_mcias_v1_sso_client_proto_msgTypes[7].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_mcias_v1_sso_client_proto_rawDesc), len(file_mcias_v1_sso_client_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   11,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_mcias_v1_sso_client_proto_goTypes,
+		DependencyIndexes: file_mcias_v1_sso_client_proto_depIdxs,
+		MessageInfos:      file_mcias_v1_sso_client_proto_msgTypes,
+	}.Build()
+	File_mcias_v1_sso_client_proto = out.File
+	file_mcias_v1_sso_client_proto_goTypes = nil
+	file_mcias_v1_sso_client_proto_depIdxs = nil
+}
--- a/gen/mcias/v1/sso_client_grpc.pb.go
+++ b/gen/mcias/v1/sso_client_grpc.pb.go
@@ -0,0 +1,289 @@
+// SSOClientService: CRUD management of SSO client registrations.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v6.32.1
+// source: mcias/v1/sso_client.proto
+
+package mciasv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	SSOClientService_ListSSOClients_FullMethodName  = "/mcias.v1.SSOClientService/ListSSOClients"
+	SSOClientService_CreateSSOClient_FullMethodName = "/mcias.v1.SSOClientService/CreateSSOClient"
+	SSOClientService_GetSSOClient_FullMethodName    = "/mcias.v1.SSOClientService/GetSSOClient"
+	SSOClientService_UpdateSSOClient_FullMethodName = "/mcias.v1.SSOClientService/UpdateSSOClient"
+	SSOClientService_DeleteSSOClient_FullMethodName = "/mcias.v1.SSOClientService/DeleteSSOClient"
+)
+
+// SSOClientServiceClient is the client API for SSOClientService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SSOClientService manages SSO client registrations (admin only).
+type SSOClientServiceClient interface {
+	// ListSSOClients returns all registered SSO clients.
+	ListSSOClients(ctx context.Context, in *ListSSOClientsRequest, opts ...grpc.CallOption) (*ListSSOClientsResponse, error)
+	// CreateSSOClient registers a new SSO client.
+	CreateSSOClient(ctx context.Context, in *CreateSSOClientRequest, opts ...grpc.CallOption) (*CreateSSOClientResponse, error)
+	// GetSSOClient returns a single SSO client by client_id.
+	GetSSOClient(ctx context.Context, in *GetSSOClientRequest, opts ...grpc.CallOption) (*GetSSOClientResponse, error)
+	// UpdateSSOClient applies a partial update to an SSO client.
+	UpdateSSOClient(ctx context.Context, in *UpdateSSOClientRequest, opts ...grpc.CallOption) (*UpdateSSOClientResponse, error)
+	// DeleteSSOClient removes an SSO client registration.
+	DeleteSSOClient(ctx context.Context, in *DeleteSSOClientRequest, opts ...grpc.CallOption) (*DeleteSSOClientResponse, error)
+}
+
+type sSOClientServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewSSOClientServiceClient(cc grpc.ClientConnInterface) SSOClientServiceClient {
+	return &sSOClientServiceClient{cc}
+}
+
+func (c *sSOClientServiceClient) ListSSOClients(ctx context.Context, in *ListSSOClientsRequest, opts ...grpc.CallOption) (*ListSSOClientsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListSSOClientsResponse)
+	err := c.cc.Invoke(ctx, SSOClientService_ListSSOClients_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sSOClientServiceClient) CreateSSOClient(ctx context.Context, in *CreateSSOClientRequest, opts ...grpc.CallOption) (*CreateSSOClientResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateSSOClientResponse)
+	err := c.cc.Invoke(ctx, SSOClientService_CreateSSOClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sSOClientServiceClient) GetSSOClient(ctx context.Context, in *GetSSOClientRequest, opts ...grpc.CallOption) (*GetSSOClientResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetSSOClientResponse)
+	err := c.cc.Invoke(ctx, SSOClientService_GetSSOClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sSOClientServiceClient) UpdateSSOClient(ctx context.Context, in *UpdateSSOClientRequest, opts ...grpc.CallOption) (*UpdateSSOClientResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateSSOClientResponse)
+	err := c.cc.Invoke(ctx, SSOClientService_UpdateSSOClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *sSOClientServiceClient) DeleteSSOClient(ctx context.Context, in *DeleteSSOClientRequest, opts ...grpc.CallOption) (*DeleteSSOClientResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteSSOClientResponse)
+	err := c.cc.Invoke(ctx, SSOClientService_DeleteSSOClient_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// SSOClientServiceServer is the server API for SSOClientService service.
+// All implementations must embed UnimplementedSSOClientServiceServer
+// for forward compatibility.
+//
+// SSOClientService manages SSO client registrations (admin only).
+type SSOClientServiceServer interface {
+	// ListSSOClients returns all registered SSO clients.
+	ListSSOClients(context.Context, *ListSSOClientsRequest) (*ListSSOClientsResponse, error)
+	// CreateSSOClient registers a new SSO client.
+	CreateSSOClient(context.Context, *CreateSSOClientRequest) (*CreateSSOClientResponse, error)
+	// GetSSOClient returns a single SSO client by client_id.
+	GetSSOClient(context.Context, *GetSSOClientRequest) (*GetSSOClientResponse, error)
+	// UpdateSSOClient applies a partial update to an SSO client.
+	UpdateSSOClient(context.Context, *UpdateSSOClientRequest) (*UpdateSSOClientResponse, error)
+	// DeleteSSOClient removes an SSO client registration.
+	DeleteSSOClient(context.Context, *DeleteSSOClientRequest) (*DeleteSSOClientResponse, error)
+	mustEmbedUnimplementedSSOClientServiceServer()
+}
+
+// UnimplementedSSOClientServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSSOClientServiceServer struct{}
+
+func (UnimplementedSSOClientServiceServer) ListSSOClients(context.Context, *ListSSOClientsRequest) (*ListSSOClientsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListSSOClients not implemented")
+}
+func (UnimplementedSSOClientServiceServer) CreateSSOClient(context.Context, *CreateSSOClientRequest) (*CreateSSOClientResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateSSOClient not implemented")
+}
+func (UnimplementedSSOClientServiceServer) GetSSOClient(context.Context, *GetSSOClientRequest) (*GetSSOClientResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetSSOClient not implemented")
+}
+func (UnimplementedSSOClientServiceServer) UpdateSSOClient(context.Context, *UpdateSSOClientRequest) (*UpdateSSOClientResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateSSOClient not implemented")
+}
+func (UnimplementedSSOClientServiceServer) DeleteSSOClient(context.Context, *DeleteSSOClientRequest) (*DeleteSSOClientResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DeleteSSOClient not implemented")
+}
+func (UnimplementedSSOClientServiceServer) mustEmbedUnimplementedSSOClientServiceServer() {}
+func (UnimplementedSSOClientServiceServer) testEmbeddedByValue()                          {}
+
+// UnsafeSSOClientServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to SSOClientServiceServer will
+// result in compilation errors.
+type UnsafeSSOClientServiceServer interface {
+	mustEmbedUnimplementedSSOClientServiceServer()
+}
+
+func RegisterSSOClientServiceServer(s grpc.ServiceRegistrar, srv SSOClientServiceServer) {
+	// If the following call panics, it indicates UnimplementedSSOClientServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&SSOClientService_ServiceDesc, srv)
+}
+
+func _SSOClientService_ListSSOClients_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListSSOClientsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SSOClientServiceServer).ListSSOClients(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SSOClientService_ListSSOClients_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SSOClientServiceServer).ListSSOClients(ctx, req.(*ListSSOClientsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SSOClientService_CreateSSOClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateSSOClientRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SSOClientServiceServer).CreateSSOClient(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SSOClientService_CreateSSOClient_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SSOClientServiceServer).CreateSSOClient(ctx, req.(*CreateSSOClientRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SSOClientService_GetSSOClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetSSOClientRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SSOClientServiceServer).GetSSOClient(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SSOClientService_GetSSOClient_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SSOClientServiceServer).GetSSOClient(ctx, req.(*GetSSOClientRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SSOClientService_UpdateSSOClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateSSOClientRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SSOClientServiceServer).UpdateSSOClient(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SSOClientService_UpdateSSOClient_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SSOClientServiceServer).UpdateSSOClient(ctx, req.(*UpdateSSOClientRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SSOClientService_DeleteSSOClient_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteSSOClientRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SSOClientServiceServer).DeleteSSOClient(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SSOClientService_DeleteSSOClient_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SSOClientServiceServer).DeleteSSOClient(ctx, req.(*DeleteSSOClientRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// SSOClientService_ServiceDesc is the grpc.ServiceDesc for SSOClientService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var SSOClientService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "mcias.v1.SSOClientService",
+	HandlerType: (*SSOClientServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListSSOClients",
+			Handler:    _SSOClientService_ListSSOClients_Handler,
+		},
+		{
+			MethodName: "CreateSSOClient",
+			Handler:    _SSOClientService_CreateSSOClient_Handler,
+		},
+		{
+			MethodName: "GetSSOClient",
+			Handler:    _SSOClientService_GetSSOClient_Handler,
+		},
+		{
+			MethodName: "UpdateSSOClient",
+			Handler:    _SSOClientService_UpdateSSOClient_Handler,
+		},
+		{
+			MethodName: "DeleteSSOClient",
+			Handler:    _SSOClientService_DeleteSSOClient_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "mcias/v1/sso_client.proto",
+}