feat: add auth filters

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/glebarez/sqlite v1.4.3
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/hashicorp/go-bexpr v0.1.11
 	github.com/hashicorp/go-hclog v1.1.0
 	github.com/improbable-eng/grpc-web v0.15.0
 	github.com/klauspost/compress v1.15.3
@@ -64,6 +65,8 @@ require (
 	github.com/mdlayher/socket v0.2.3 // indirect
 	github.com/mholt/acmez v1.0.2 // indirect
 	github.com/miekg/dns v1.1.46 // indirect
+	github.com/mitchellh/mapstructure v1.4.3 // indirect
+	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/prometheus/client_golang v1.11.0 // indirect
 	github.com/prometheus/client_model v0.2.0 // indirect
 	github.com/prometheus/common v0.32.1 // indirect

go.sum

@@ -254,6 +254,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFb
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
 github.com/hashicorp/consul/sdk v0.3.0/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-bexpr v0.1.11 h1:6DqdA/KBjurGby9yTY0bmkathya0lfwF2SeuubCI7dY=
+github.com/hashicorp/go-bexpr v0.1.11/go.mod h1:f03lAo0duBlDIUMGCuad8oLcgejw4m7U+N8T+6Kz1AE=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-hclog v1.1.0 h1:QsGcniKx5/LuX2eYoeL+Np3UKYPNaN7YKpTh29h8rbw=
 github.com/hashicorp/go-hclog v1.1.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
@@ -378,6 +380,11 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.4.3 h1:OVowDSCllw/YjdLkam3/sm7wEtOy59d8ndGgCcyj8cs=
+github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
+github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=

internal/cmd/auth_filter.go

@@ -0,0 +1,143 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/go-bexpr"
+	"github.com/jsiebens/ionscale/pkg/gen/api"
+	"github.com/muesli/coral"
+	"github.com/rodaine/table"
+)
+
+func authFilterCommand() *coral.Command {
+	command := &coral.Command{
+		Use:   "auth-filters",
+		Short: "Manage ionscale auth filters",
+		Long: `This command allows operations on ionscale auth filter resources. Example:
+
+      $ ionscale auth-filter create`,
+	}
+
+	command.AddCommand(createAuthFilterCommand())
+	command.AddCommand(listAuthFilterCommand())
+
+	return command
+}
+
+func listAuthFilterCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "list",
+		SilenceUsage: true,
+	}
+
+	var authMethodID uint64
+
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.Flags().Uint64Var(&authMethodID, "auth-method-id", 0, "")
+
+	command.RunE = func(command *coral.Command, args []string) error {
+		client, c, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+		defer safeClose(c)
+
+		req := &api.ListAuthFiltersRequest{}
+
+		if authMethodID != 0 {
+			req.AuthMethodId = &authMethodID
+		}
+
+		resp, err := client.ListAuthFilters(context.Background(), req)
+
+		if err != nil {
+			return err
+		}
+
+		tbl := table.New("ID", "AUTH_METHOD", "TAILNET", "EXPR")
+		for _, filter := range resp.AuthFilters {
+			if filter.Tailnet != nil {
+				tbl.AddRow(filter.Id, filter.AuthMethod.Name, filter.Tailnet.Name, filter.Expr)
+			} else {
+				tbl.AddRow(filter.Id, filter.AuthMethod.Name, "", filter.Expr)
+			}
+		}
+		tbl.Print()
+
+		return nil
+	}
+
+	return command
+}
+
+func createAuthFilterCommand() *coral.Command {
+	command := &coral.Command{
+		Use:          "create",
+		SilenceUsage: true,
+	}
+
+	var expr string
+	var tailnetID uint64
+	var tailnetName string
+	var authMethodID uint64
+	var authMethodName string
+
+	var target = Target{}
+	target.prepareCommand(command)
+
+	command.Flags().StringVar(&expr, "expr", "*", "")
+	command.Flags().StringVar(&tailnetName, "tailnet", "", "")
+	command.Flags().Uint64Var(&tailnetID, "tailnet-id", 0, "")
+	command.Flags().StringVar(&authMethodName, "auth-method", "", "")
+	command.Flags().Uint64Var(&authMethodID, "auth-method-id", 0, "")
+
+	command.RunE = func(command *coral.Command, args []string) error {
+		if expr != "*" {
+			if _, err := bexpr.CreateEvaluator(expr); err != nil {
+				return fmt.Errorf("invalid expression: %v", err)
+			}
+		}
+
+		client, c, err := target.createGRPCClient()
+		if err != nil {
+			return err
+		}
+		defer safeClose(c)
+
+		tailnet, err := findTailnet(client, tailnetName, tailnetID)
+		if err != nil {
+			return err
+		}
+
+		authMethod, err := findAuthMethod(client, authMethodName, authMethodID)
+		if err != nil {
+			return err
+		}
+
+		req := &api.CreateAuthFilterRequest{
+			AuthMethodId: authMethod.Id,
+			TailnetId:    tailnet.Id,
+			Expr:         expr,
+		}
+
+		resp, err := client.CreateAuthFilter(context.Background(), req)
+
+		if err != nil {
+			return err
+		}
+
+		tbl := table.New("ID", "AUTH_METHOD", "TAILNET", "EXPR")
+		if resp.AuthFilter.Tailnet != nil {
+			tbl.AddRow(resp.AuthFilter.Id, resp.AuthFilter.AuthMethod.Name, resp.AuthFilter.Tailnet.Name, resp.AuthFilter.Expr)
+		} else {
+			tbl.AddRow(resp.AuthFilter.Id, resp.AuthFilter.AuthMethod.Name, "", resp.AuthFilter.Expr)
+		}
+		tbl.Print()
+
+		return nil
+	}
+
+	return command
+}

internal/cmd/funcs.go

@@ -26,6 +26,25 @@ func findTailnet(client api.IonscaleClient, tailnet string, tailnetID uint64) (*
 	return nil, fmt.Errorf("requested tailnet not found or you are not authorized for this tailnet")
 }
 
+func findAuthMethod(client api.IonscaleClient, authMethod string, authMethodID uint64) (*api.AuthMethod, error) {
+	if authMethodID == 0 && authMethod == "" {
+		return nil, fmt.Errorf("requested auth method not found or you are not authorized for this tailnet")
+	}
+
+	resp, err := client.ListAuthMethods(context.Background(), &api.ListAuthMethodsRequest{})
+	if err != nil {
+		return nil, err
+	}
+
+	for _, t := range resp.AuthMethods {
+		if t.Id == authMethodID || t.Name == authMethod {
+			return t, nil
+		}
+	}
+
+	return nil, fmt.Errorf("requested auth method not found or you are not authorized for this tailnet")
+}
+
 func safeClose(c io.Closer) {
 	if c != nil {
 		_ = c.Close()

internal/cmd/root.go

@@ -11,6 +11,7 @@ func Command() *coral.Command {
 	rootCmd.AddCommand(serverCommand())
 	rootCmd.AddCommand(versionCommand())
 	rootCmd.AddCommand(authMethodsCommand())
+	rootCmd.AddCommand(authFilterCommand())
 	rootCmd.AddCommand(tailnetCommand())
 	rootCmd.AddCommand(authkeysCommand())
 	rootCmd.AddCommand(machineCommands())

internal/database/database.go

@@ -46,6 +46,7 @@ func migrate(db *gorm.DB, repository domain.Repository) error {
 		&domain.Tailnet{},
 		&domain.TailnetConfig{},
 		&domain.AuthMethod{},
+		&domain.AuthFilter{},
 		&domain.Account{},
 		&domain.User{},
 		&domain.AuthKey{},

internal/domain/auth_filter.go

@@ -0,0 +1,97 @@
+package domain
+
+import (
+	"context"
+	"errors"
+	"github.com/hashicorp/go-bexpr"
+	"github.com/mitchellh/pointerstructure"
+)
+
+type AuthFilter struct {
+	ID           uint64 `gorm:"primary_key;autoIncrement:false"`
+	Expr         string
+	AuthMethodID uint64
+	AuthMethod   AuthMethod
+	TailnetID    *uint64
+	Tailnet      *Tailnet
+}
+
+type AuthFilters []AuthFilter
+
+func (f *AuthFilter) Evaluate(v interface{}) (bool, error) {
+	if f.Expr == "*" {
+		return true, nil
+	}
+
+	eval, err := bexpr.CreateEvaluator(f.Expr)
+	if err != nil {
+		return false, err
+	}
+
+	result, err := eval.Evaluate(v)
+	if err != nil && !errors.Is(err, pointerstructure.ErrNotFound) {
+		return false, err
+	}
+
+	return result, err
+}
+
+func (fs AuthFilters) Evaluate(v interface{}) []Tailnet {
+	var tailnetIDMap = make(map[uint64]bool)
+	var tailnets []Tailnet
+
+	for _, f := range fs {
+		approved, err := f.Evaluate(v)
+		if err == nil && approved {
+			if f.TailnetID != nil {
+				_, alreadyApproved := tailnetIDMap[*f.TailnetID]
+				if !alreadyApproved {
+					tailnetIDMap[*f.TailnetID] = true
+					tailnets = append(tailnets, *f.Tailnet)
+				}
+			}
+		}
+	}
+
+	return tailnets
+}
+
+func (r *repository) SaveAuthFilter(ctx context.Context, m *AuthFilter) error {
+	tx := r.withContext(ctx).Save(m)
+
+	if tx.Error != nil {
+		return tx.Error
+	}
+
+	return nil
+}
+
+func (r *repository) ListAuthFilters(ctx context.Context) (AuthFilters, error) {
+	var filters = []AuthFilter{}
+
+	tx := r.withContext(ctx).
+		Preload("Tailnet").
+		Preload("AuthMethod").
+		Find(&filters)
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return filters, nil
+}
+
+func (r *repository) ListAuthFiltersByAuthMethod(ctx context.Context, authMethodID uint64) (AuthFilters, error) {
+	var filters = []AuthFilter{}
+
+	tx := r.withContext(ctx).
+		Preload("Tailnet").
+		Preload("AuthMethod").
+		Where("auth_method_id = ?", authMethodID).Find(&filters)
+
+	if tx.Error != nil {
+		return nil, tx.Error
+	}
+
+	return filters, nil
+}

internal/domain/repository.go

@@ -18,6 +18,10 @@ type Repository interface {
 	ListAuthMethods(ctx context.Context) ([]AuthMethod, error)
 	GetAuthMethod(ctx context.Context, id uint64) (*AuthMethod, error)
 
+	SaveAuthFilter(ctx context.Context, m *AuthFilter) error
+	ListAuthFilters(ctx context.Context) (AuthFilters, error)
+	ListAuthFiltersByAuthMethod(ctx context.Context, authMethodID uint64) (AuthFilters, error)
+
 	GetAccount(ctx context.Context, accountID uint64) (*Account, error)
 	GetOrCreateAccount(ctx context.Context, authMethodID uint64, externalID, loginName string) (*Account, bool, error)
 

internal/handlers/authentication.go

@@ -124,11 +124,17 @@ func (h *AuthenticationHandlers) Callback(c echo.Context) error {
 		return err
 	}
 
-	tailnets, err := h.repository.ListTailnets(ctx)
+	filters, err := h.repository.ListAuthFiltersByAuthMethod(ctx, state.AuthMethod)
 	if err != nil {
 		return err
 	}
 
+	tailnets := filters.Evaluate(user.Attr)
+
+	if len(tailnets) == 0 {
+		return c.Redirect(http.StatusFound, "/a/error?e=ua")
+	}
+
 	account, _, err := h.repository.GetOrCreateAccount(ctx, state.AuthMethod, user.ID, user.Name)
 	if err != nil {
 		return err
@@ -157,6 +163,8 @@ func (h *AuthenticationHandlers) Error(c echo.Context) error {
 	switch e {
 	case "iak":
 		return c.Render(http.StatusForbidden, "invalidauthkey.html", nil)
+	case "ua":
+		return c.Render(http.StatusForbidden, "unauthorized.html", nil)
 	}
 	return c.Render(http.StatusOK, "error.html", nil)
 }

internal/service/auth_filters.go

@@ -0,0 +1,107 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"github.com/hashicorp/go-bexpr"
+	"github.com/jsiebens/ionscale/internal/domain"
+	"github.com/jsiebens/ionscale/internal/util"
+	"github.com/jsiebens/ionscale/pkg/gen/api"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func (s *Service) ListAuthFilters(ctx context.Context, req *api.ListAuthFiltersRequest) (*api.ListAuthFiltersResponse, error) {
+	response := &api.ListAuthFiltersResponse{AuthFilters: []*api.AuthFilter{}}
+
+	if req.AuthMethodId == nil {
+		filters, err := s.repository.ListAuthFilters(ctx)
+		if err != nil {
+			return nil, err
+		}
+		for _, filter := range filters {
+			response.AuthFilters = append(response.AuthFilters, s.mapToApi(&filter.AuthMethod, filter))
+		}
+	} else {
+		authMethod, err := s.repository.GetAuthMethod(ctx, *req.AuthMethodId)
+		if err != nil {
+			return nil, err
+		}
+		if authMethod == nil {
+			return nil, status.Error(codes.NotFound, "invalid auth method id")
+		}
+
+		filters, err := s.repository.ListAuthFiltersByAuthMethod(ctx, authMethod.ID)
+		if err != nil {
+			return nil, err
+		}
+		for _, filter := range filters {
+			response.AuthFilters = append(response.AuthFilters, s.mapToApi(&filter.AuthMethod, filter))
+		}
+	}
+
+	return response, nil
+}
+
+func (s *Service) CreateAuthFilter(ctx context.Context, req *api.CreateAuthFilterRequest) (*api.CreateAuthFilterResponse, error) {
+	authMethod, err := s.repository.GetAuthMethod(ctx, req.AuthMethodId)
+	if err != nil {
+		return nil, err
+	}
+	if authMethod == nil {
+		return nil, status.Error(codes.NotFound, "invalid auth method id")
+	}
+
+	tailnet, err := s.repository.GetTailnet(ctx, req.TailnetId)
+	if err != nil {
+		return nil, err
+	}
+
+	if tailnet == nil {
+		return nil, status.Error(codes.NotFound, "invalid tailnet id")
+	}
+
+	if req.Expr != "*" {
+		if _, err := bexpr.CreateEvaluator(req.Expr); err != nil {
+			return nil, status.Error(codes.InvalidArgument, fmt.Sprintf("invalid expression: %v", err))
+		}
+	}
+
+	authFilter := &domain.AuthFilter{
+		ID:         util.NextID(),
+		Expr:       req.Expr,
+		AuthMethod: *authMethod,
+		Tailnet:    tailnet,
+	}
+
+	if err := s.repository.SaveAuthFilter(ctx, authFilter); err != nil {
+		return nil, err
+	}
+
+	response := api.CreateAuthFilterResponse{AuthFilter: s.mapToApi(authMethod, *authFilter)}
+
+	return &response, nil
+}
+
+func (s *Service) mapToApi(authMethod *domain.AuthMethod, filter domain.AuthFilter) *api.AuthFilter {
+	result := api.AuthFilter{
+		Id:   filter.ID,
+		Expr: filter.Expr,
+		AuthMethod: &api.Ref{
+			Id:   authMethod.ID,
+			Name: authMethod.Name,
+		},
+	}
+
+	if filter.Tailnet != nil {
+		id := filter.Tailnet.ID
+		name := filter.Tailnet.Name
+
+		result.Tailnet = &api.Ref{
+			Id:   id,
+			Name: name,
+		}
+	}
+
+	return &result
+}

internal/templates/unauthorized.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <style>
+        @import url('https://fonts.googleapis.com/css2?family=Poppins:wght@200;300;400;500;600;700&display=swap');
+
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+            font-family: 'Poppins', sans-serif;
+        }
+
+        body {
+            width: 100%;
+            height: 100vh;
+            padding: 10px;
+            background: #379683;
+        }
+
+        .wrapper {
+            background: #fff;
+            max-width: 400px;
+            width: 100%;
+            margin: 120px auto;
+            padding: 25px;
+            border-radius: 5px;
+            box-shadow: 0 10px 15px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li {
+            position: relative;
+            list-style: none;
+            height: 45px;
+            line-height: 45px;
+            margin-bottom: 8px;
+            background: #f2f2f2;
+            border-radius: 3px;
+            overflow: hidden;
+            box-shadow: 0 2px 2px rgba(0, 0, 0, 0.1);
+        }
+
+        .selectionList li button {
+            margin: 0;
+            display: block;
+            width: 100%;
+            height: 100%;
+            border: none;
+        }
+    </style>
+    <title>ionscale</title>
+</head>
+<body>
+<div class="wrapper">
+    <div style="text-align: center">
+        <p><b>Authentication successful</b></p>
+        <small>but you're <b style="color: red">not</b> authorized to use any network</small>
+    </div>
+</div>
+</body>
+</html>

pkg/gen/api/auth_filter.pb.go

@@ -0,0 +1,460 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.27.1
+// 	protoc        v3.17.3
+// source: api/auth_filter.proto
+
+package api
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AuthFilter struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id         uint64 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	AuthMethod *Ref   `protobuf:"bytes,2,opt,name=auth_method,json=authMethod,proto3" json:"auth_method,omitempty"`
+	Tailnet    *Ref   `protobuf:"bytes,3,opt,name=tailnet,proto3" json:"tailnet,omitempty"`
+	Expr       string `protobuf:"bytes,4,opt,name=expr,proto3" json:"expr,omitempty"`
+}
+
+func (x *AuthFilter) Reset() {
+	*x = AuthFilter{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_auth_filter_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthFilter) ProtoMessage() {}
+
+func (x *AuthFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_api_auth_filter_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthFilter.ProtoReflect.Descriptor instead.
+func (*AuthFilter) Descriptor() ([]byte, []int) {
+	return file_api_auth_filter_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuthFilter) GetId() uint64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *AuthFilter) GetAuthMethod() *Ref {
+	if x != nil {
+		return x.AuthMethod
+	}
+	return nil
+}
+
+func (x *AuthFilter) GetTailnet() *Ref {
+	if x != nil {
+		return x.Tailnet
+	}
+	return nil
+}
+
+func (x *AuthFilter) GetExpr() string {
+	if x != nil {
+		return x.Expr
+	}
+	return ""
+}
+
+type CreateAuthFilterRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthMethodId uint64 `protobuf:"varint,1,opt,name=auth_method_id,json=authMethodId,proto3" json:"auth_method_id,omitempty"`
+	TailnetId    uint64 `protobuf:"varint,2,opt,name=tailnet_id,json=tailnetId,proto3" json:"tailnet_id,omitempty"`
+	Expr         string `protobuf:"bytes,3,opt,name=expr,proto3" json:"expr,omitempty"`
+}
+
+func (x *CreateAuthFilterRequest) Reset() {
+	*x = CreateAuthFilterRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_auth_filter_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateAuthFilterRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateAuthFilterRequest) ProtoMessage() {}
+
+func (x *CreateAuthFilterRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_auth_filter_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateAuthFilterRequest.ProtoReflect.Descriptor instead.
+func (*CreateAuthFilterRequest) Descriptor() ([]byte, []int) {
+	return file_api_auth_filter_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateAuthFilterRequest) GetAuthMethodId() uint64 {
+	if x != nil {
+		return x.AuthMethodId
+	}
+	return 0
+}
+
+func (x *CreateAuthFilterRequest) GetTailnetId() uint64 {
+	if x != nil {
+		return x.TailnetId
+	}
+	return 0
+}
+
+func (x *CreateAuthFilterRequest) GetExpr() string {
+	if x != nil {
+		return x.Expr
+	}
+	return ""
+}
+
+type CreateAuthFilterResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthFilter *AuthFilter `protobuf:"bytes,1,opt,name=auth_filter,json=authFilter,proto3" json:"auth_filter,omitempty"`
+}
+
+func (x *CreateAuthFilterResponse) Reset() {
+	*x = CreateAuthFilterResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_auth_filter_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateAuthFilterResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateAuthFilterResponse) ProtoMessage() {}
+
+func (x *CreateAuthFilterResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_auth_filter_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateAuthFilterResponse.ProtoReflect.Descriptor instead.
+func (*CreateAuthFilterResponse) Descriptor() ([]byte, []int) {
+	return file_api_auth_filter_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CreateAuthFilterResponse) GetAuthFilter() *AuthFilter {
+	if x != nil {
+		return x.AuthFilter
+	}
+	return nil
+}
+
+type ListAuthFiltersRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthMethodId *uint64 `protobuf:"varint,1,opt,name=auth_method_id,json=authMethodId,proto3,oneof" json:"auth_method_id,omitempty"`
+}
+
+func (x *ListAuthFiltersRequest) Reset() {
+	*x = ListAuthFiltersRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_auth_filter_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListAuthFiltersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthFiltersRequest) ProtoMessage() {}
+
+func (x *ListAuthFiltersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_auth_filter_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthFiltersRequest.ProtoReflect.Descriptor instead.
+func (*ListAuthFiltersRequest) Descriptor() ([]byte, []int) {
+	return file_api_auth_filter_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListAuthFiltersRequest) GetAuthMethodId() uint64 {
+	if x != nil && x.AuthMethodId != nil {
+		return *x.AuthMethodId
+	}
+	return 0
+}
+
+type ListAuthFiltersResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthFilters []*AuthFilter `protobuf:"bytes,1,rep,name=auth_filters,json=authFilters,proto3" json:"auth_filters,omitempty"`
+}
+
+func (x *ListAuthFiltersResponse) Reset() {
+	*x = ListAuthFiltersResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_auth_filter_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListAuthFiltersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListAuthFiltersResponse) ProtoMessage() {}
+
+func (x *ListAuthFiltersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_auth_filter_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListAuthFiltersResponse.ProtoReflect.Descriptor instead.
+func (*ListAuthFiltersResponse) Descriptor() ([]byte, []int) {
+	return file_api_auth_filter_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListAuthFiltersResponse) GetAuthFilters() []*AuthFilter {
+	if x != nil {
+		return x.AuthFilters
+	}
+	return nil
+}
+
+var File_api_auth_filter_proto protoreflect.FileDescriptor
+
+var file_api_auth_filter_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x0d, 0x61, 0x70,
+	0x69, 0x2f, 0x72, 0x65, 0x66, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x7f, 0x0a, 0x0a, 0x41,
+	0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0b, 0x61, 0x75, 0x74,
+	0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x12, 0x22, 0x0a, 0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x66, 0x52,
+	0x07, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x78, 0x70, 0x72,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x78, 0x70, 0x72, 0x22, 0x72, 0x0a, 0x17,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f,
+	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x65, 0x78, 0x70, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x78, 0x70, 0x72,
+	0x22, 0x4c, 0x0a, 0x18, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x30, 0x0a, 0x0b,
+	0x61, 0x75, 0x74, 0x68, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x52, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x22, 0x56,
+	0x0a, 0x16, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x48, 0x00, 0x52, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64,
+	0x88, 0x01, 0x01, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x22, 0x4d, 0x0a, 0x17, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75,
+	0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x32, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x75,
+	0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x73, 0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e,
+	0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x3b, 0x61, 0x70,
+	0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_api_auth_filter_proto_rawDescOnce sync.Once
+	file_api_auth_filter_proto_rawDescData = file_api_auth_filter_proto_rawDesc
+)
+
+func file_api_auth_filter_proto_rawDescGZIP() []byte {
+	file_api_auth_filter_proto_rawDescOnce.Do(func() {
+		file_api_auth_filter_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_auth_filter_proto_rawDescData)
+	})
+	return file_api_auth_filter_proto_rawDescData
+}
+
+var file_api_auth_filter_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_api_auth_filter_proto_goTypes = []interface{}{
+	(*AuthFilter)(nil),               // 0: api.AuthFilter
+	(*CreateAuthFilterRequest)(nil),  // 1: api.CreateAuthFilterRequest
+	(*CreateAuthFilterResponse)(nil), // 2: api.CreateAuthFilterResponse
+	(*ListAuthFiltersRequest)(nil),   // 3: api.ListAuthFiltersRequest
+	(*ListAuthFiltersResponse)(nil),  // 4: api.ListAuthFiltersResponse
+	(*Ref)(nil),                      // 5: api.Ref
+}
+var file_api_auth_filter_proto_depIdxs = []int32{
+	5, // 0: api.AuthFilter.auth_method:type_name -> api.Ref
+	5, // 1: api.AuthFilter.tailnet:type_name -> api.Ref
+	0, // 2: api.CreateAuthFilterResponse.auth_filter:type_name -> api.AuthFilter
+	0, // 3: api.ListAuthFiltersResponse.auth_filters:type_name -> api.AuthFilter
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_api_auth_filter_proto_init() }
+func file_api_auth_filter_proto_init() {
+	if File_api_auth_filter_proto != nil {
+		return
+	}
+	file_api_ref_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_api_auth_filter_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthFilter); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_auth_filter_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateAuthFilterRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_auth_filter_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateAuthFilterResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_auth_filter_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListAuthFiltersRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_auth_filter_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListAuthFiltersResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_api_auth_filter_proto_msgTypes[3].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_api_auth_filter_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_api_auth_filter_proto_goTypes,
+		DependencyIndexes: file_api_auth_filter_proto_depIdxs,
+		MessageInfos:      file_api_auth_filter_proto_msgTypes,
+	}.Build()
+	File_api_auth_filter_proto = out.File
+	file_api_auth_filter_proto_rawDesc = nil
+	file_api_auth_filter_proto_goTypes = nil
+	file_api_auth_filter_proto_depIdxs = nil
+}

pkg/gen/api/ionscale.pb.go

@@ -33,117 +33,129 @@ var file_api_ionscale_proto_rawDesc = []byte{
 	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x12, 0x61,
 	0x70, 0x69, 0x2f, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x1a, 0x16, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x61, 0x70, 0x69, 0x2f, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x12,
-	0x61, 0x70, 0x69, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x10, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x0e, 0x61, 0x70, 0x69, 0x2f, 0x64, 0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xc3, 0x0c, 0x0a, 0x08, 0x49, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x12,
-	0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x16,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74,
-	0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12,
-	0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65,
-	0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x51, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61,
+	0x6f, 0x64, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x61, 0x70, 0x69, 0x2f, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x13, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x12, 0x61, 0x70, 0x69, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x10, 0x61, 0x70, 0x69, 0x2f, 0x72,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x61, 0x70, 0x69,
+	0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0d, 0x61, 0x70, 0x69, 0x2f,
+	0x61, 0x63, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x0e, 0x61, 0x70, 0x69, 0x2f, 0x64,
+	0x65, 0x72, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x32, 0xe6, 0x0d, 0x0a, 0x08, 0x49, 0x6f,
+	0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x44, 0x45,
+	0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x44,
+	0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x53, 0x65, 0x74, 0x44,
+	0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74,
+	0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51, 0x0a, 0x10, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x1c, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4e, 0x0a, 0x0f,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12,
+	0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51, 0x0a, 0x10,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
+	0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74,
+	0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x46,
+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x4e, 0x0a, 0x0f, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x73, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74,
+	0x68, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x46, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x48, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74,
+	0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
+	0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x43, 0x0a, 0x0c, 0x4c, 0x69,
+	0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61,
 	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x16, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x43, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x73,
-	0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e,
-	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54,
-	0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61,
-	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x45, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74,
-	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a,
-	0x0c, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x18, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
-	0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43,
-	0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19,
+	0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x47, 0x65, 0x74,
+	0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x47, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x4e, 0x53,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x45, 0x0a, 0x0c, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x53, 0x65, 0x74, 0x44, 0x4e, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x41, 0x43,
+	0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
+	0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45,
+	0x0a, 0x0c, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x18,
 	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x47,
-	0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b,
-	0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x19, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
-	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53,
+	0x65, 0x74, 0x41, 0x43, 0x4c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68,
+	0x4b, 0x65, 0x79, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74,
+	0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
 	0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x45, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73,
-	0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b,
-	0x65, 0x79, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d,
-	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69,
-	0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48,
-	0x0a, 0x0d, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12,
-	0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x12, 0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
+	0x79, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75,
+	0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0c, 0x4c, 0x69,
+	0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x45, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x69,
+	0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x78, 0x70, 0x69, 0x72,
 	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x51, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74,
-	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51, 0x0a, 0x10, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
-	0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f,
-	0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61, 0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e,
-	0x3b, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x22, 0x00, 0x12, 0x48, 0x0a, 0x0d, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51, 0x0a, 0x10,
+	0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x51, 0x0a, 0x10, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75,
+	0x74, 0x65, 0x73, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x74, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x6a, 0x73, 0x69, 0x65, 0x62, 0x65, 0x6e, 0x73, 0x2f, 0x69, 0x6f, 0x6e, 0x73, 0x63, 0x61,
+	0x6c, 0x65, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x3b, 0x61, 0x70, 0x69, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_api_ionscale_proto_goTypes = []interface{}{
@@ -152,44 +164,48 @@ var file_api_ionscale_proto_goTypes = []interface{}{
 	(*SetDERPMapRequest)(nil),        // 2: api.SetDERPMapRequest
 	(*CreateAuthMethodRequest)(nil),  // 3: api.CreateAuthMethodRequest
 	(*ListAuthMethodsRequest)(nil),   // 4: api.ListAuthMethodsRequest
-	(*CreateTailnetRequest)(nil),     // 5: api.CreateTailnetRequest
-	(*GetTailnetRequest)(nil),        // 6: api.GetTailnetRequest
-	(*ListTailnetRequest)(nil),       // 7: api.ListTailnetRequest
-	(*DeleteTailnetRequest)(nil),     // 8: api.DeleteTailnetRequest
-	(*GetDNSConfigRequest)(nil),      // 9: api.GetDNSConfigRequest
-	(*SetDNSConfigRequest)(nil),      // 10: api.SetDNSConfigRequest
-	(*GetACLPolicyRequest)(nil),      // 11: api.GetACLPolicyRequest
-	(*SetACLPolicyRequest)(nil),      // 12: api.SetACLPolicyRequest
-	(*GetAuthKeyRequest)(nil),        // 13: api.GetAuthKeyRequest
-	(*CreateAuthKeyRequest)(nil),     // 14: api.CreateAuthKeyRequest
-	(*DeleteAuthKeyRequest)(nil),     // 15: api.DeleteAuthKeyRequest
-	(*ListAuthKeysRequest)(nil),      // 16: api.ListAuthKeysRequest
-	(*ListMachinesRequest)(nil),      // 17: api.ListMachinesRequest
-	(*ExpireMachineRequest)(nil),     // 18: api.ExpireMachineRequest
-	(*DeleteMachineRequest)(nil),     // 19: api.DeleteMachineRequest
-	(*GetMachineRoutesRequest)(nil),  // 20: api.GetMachineRoutesRequest
-	(*SetMachineRoutesRequest)(nil),  // 21: api.SetMachineRoutesRequest
-	(*GetVersionResponse)(nil),       // 22: api.GetVersionResponse
-	(*GetDERPMapResponse)(nil),       // 23: api.GetDERPMapResponse
-	(*SetDERPMapResponse)(nil),       // 24: api.SetDERPMapResponse
-	(*CreateAuthMethodResponse)(nil), // 25: api.CreateAuthMethodResponse
-	(*ListAuthMethodsResponse)(nil),  // 26: api.ListAuthMethodsResponse
-	(*CreateTailnetResponse)(nil),    // 27: api.CreateTailnetResponse
-	(*GetTailnetResponse)(nil),       // 28: api.GetTailnetResponse
-	(*ListTailnetResponse)(nil),      // 29: api.ListTailnetResponse
-	(*DeleteTailnetResponse)(nil),    // 30: api.DeleteTailnetResponse
-	(*GetDNSConfigResponse)(nil),     // 31: api.GetDNSConfigResponse
-	(*SetDNSConfigResponse)(nil),     // 32: api.SetDNSConfigResponse
-	(*GetACLPolicyResponse)(nil),     // 33: api.GetACLPolicyResponse
-	(*SetACLPolicyResponse)(nil),     // 34: api.SetACLPolicyResponse
-	(*GetAuthKeyResponse)(nil),       // 35: api.GetAuthKeyResponse
-	(*CreateAuthKeyResponse)(nil),    // 36: api.CreateAuthKeyResponse
-	(*DeleteAuthKeyResponse)(nil),    // 37: api.DeleteAuthKeyResponse
-	(*ListAuthKeysResponse)(nil),     // 38: api.ListAuthKeysResponse
-	(*ListMachinesResponse)(nil),     // 39: api.ListMachinesResponse
-	(*ExpireMachineResponse)(nil),    // 40: api.ExpireMachineResponse
-	(*DeleteMachineResponse)(nil),    // 41: api.DeleteMachineResponse
-	(*GetMachineRoutesResponse)(nil), // 42: api.GetMachineRoutesResponse
+	(*CreateAuthFilterRequest)(nil),  // 5: api.CreateAuthFilterRequest
+	(*ListAuthFiltersRequest)(nil),   // 6: api.ListAuthFiltersRequest
+	(*CreateTailnetRequest)(nil),     // 7: api.CreateTailnetRequest
+	(*GetTailnetRequest)(nil),        // 8: api.GetTailnetRequest
+	(*ListTailnetRequest)(nil),       // 9: api.ListTailnetRequest
+	(*DeleteTailnetRequest)(nil),     // 10: api.DeleteTailnetRequest
+	(*GetDNSConfigRequest)(nil),      // 11: api.GetDNSConfigRequest
+	(*SetDNSConfigRequest)(nil),      // 12: api.SetDNSConfigRequest
+	(*GetACLPolicyRequest)(nil),      // 13: api.GetACLPolicyRequest
+	(*SetACLPolicyRequest)(nil),      // 14: api.SetACLPolicyRequest
+	(*GetAuthKeyRequest)(nil),        // 15: api.GetAuthKeyRequest
+	(*CreateAuthKeyRequest)(nil),     // 16: api.CreateAuthKeyRequest
+	(*DeleteAuthKeyRequest)(nil),     // 17: api.DeleteAuthKeyRequest
+	(*ListAuthKeysRequest)(nil),      // 18: api.ListAuthKeysRequest
+	(*ListMachinesRequest)(nil),      // 19: api.ListMachinesRequest
+	(*ExpireMachineRequest)(nil),     // 20: api.ExpireMachineRequest
+	(*DeleteMachineRequest)(nil),     // 21: api.DeleteMachineRequest
+	(*GetMachineRoutesRequest)(nil),  // 22: api.GetMachineRoutesRequest
+	(*SetMachineRoutesRequest)(nil),  // 23: api.SetMachineRoutesRequest
+	(*GetVersionResponse)(nil),       // 24: api.GetVersionResponse
+	(*GetDERPMapResponse)(nil),       // 25: api.GetDERPMapResponse
+	(*SetDERPMapResponse)(nil),       // 26: api.SetDERPMapResponse
+	(*CreateAuthMethodResponse)(nil), // 27: api.CreateAuthMethodResponse
+	(*ListAuthMethodsResponse)(nil),  // 28: api.ListAuthMethodsResponse
+	(*CreateAuthFilterResponse)(nil), // 29: api.CreateAuthFilterResponse
+	(*ListAuthFiltersResponse)(nil),  // 30: api.ListAuthFiltersResponse
+	(*CreateTailnetResponse)(nil),    // 31: api.CreateTailnetResponse
+	(*GetTailnetResponse)(nil),       // 32: api.GetTailnetResponse
+	(*ListTailnetResponse)(nil),      // 33: api.ListTailnetResponse
+	(*DeleteTailnetResponse)(nil),    // 34: api.DeleteTailnetResponse
+	(*GetDNSConfigResponse)(nil),     // 35: api.GetDNSConfigResponse
+	(*SetDNSConfigResponse)(nil),     // 36: api.SetDNSConfigResponse
+	(*GetACLPolicyResponse)(nil),     // 37: api.GetACLPolicyResponse
+	(*SetACLPolicyResponse)(nil),     // 38: api.SetACLPolicyResponse
+	(*GetAuthKeyResponse)(nil),       // 39: api.GetAuthKeyResponse
+	(*CreateAuthKeyResponse)(nil),    // 40: api.CreateAuthKeyResponse
+	(*DeleteAuthKeyResponse)(nil),    // 41: api.DeleteAuthKeyResponse
+	(*ListAuthKeysResponse)(nil),     // 42: api.ListAuthKeysResponse
+	(*ListMachinesResponse)(nil),     // 43: api.ListMachinesResponse
+	(*ExpireMachineResponse)(nil),    // 44: api.ExpireMachineResponse
+	(*DeleteMachineResponse)(nil),    // 45: api.DeleteMachineResponse
+	(*GetMachineRoutesResponse)(nil), // 46: api.GetMachineRoutesResponse
 }
 var file_api_ionscale_proto_depIdxs = []int32{
 	0,  // 0: api.Ionscale.GetVersion:input_type -> api.GetVersionRequest
@@ -197,47 +213,51 @@ var file_api_ionscale_proto_depIdxs = []int32{
 	2,  // 2: api.Ionscale.SetDERPMap:input_type -> api.SetDERPMapRequest
 	3,  // 3: api.Ionscale.CreateAuthMethod:input_type -> api.CreateAuthMethodRequest
 	4,  // 4: api.Ionscale.ListAuthMethods:input_type -> api.ListAuthMethodsRequest
-	5,  // 5: api.Ionscale.CreateTailnet:input_type -> api.CreateTailnetRequest
-	6,  // 6: api.Ionscale.GetTailnet:input_type -> api.GetTailnetRequest
-	7,  // 7: api.Ionscale.ListTailnets:input_type -> api.ListTailnetRequest
-	8,  // 8: api.Ionscale.DeleteTailnet:input_type -> api.DeleteTailnetRequest
-	9,  // 9: api.Ionscale.GetDNSConfig:input_type -> api.GetDNSConfigRequest
-	10, // 10: api.Ionscale.SetDNSConfig:input_type -> api.SetDNSConfigRequest
-	11, // 11: api.Ionscale.GetACLPolicy:input_type -> api.GetACLPolicyRequest
-	12, // 12: api.Ionscale.SetACLPolicy:input_type -> api.SetACLPolicyRequest
-	13, // 13: api.Ionscale.GetAuthKey:input_type -> api.GetAuthKeyRequest
-	14, // 14: api.Ionscale.CreateAuthKey:input_type -> api.CreateAuthKeyRequest
-	15, // 15: api.Ionscale.DeleteAuthKey:input_type -> api.DeleteAuthKeyRequest
-	16, // 16: api.Ionscale.ListAuthKeys:input_type -> api.ListAuthKeysRequest
-	17, // 17: api.Ionscale.ListMachines:input_type -> api.ListMachinesRequest
-	18, // 18: api.Ionscale.ExpireMachine:input_type -> api.ExpireMachineRequest
-	19, // 19: api.Ionscale.DeleteMachine:input_type -> api.DeleteMachineRequest
-	20, // 20: api.Ionscale.GetMachineRoutes:input_type -> api.GetMachineRoutesRequest
-	21, // 21: api.Ionscale.SetMachineRoutes:input_type -> api.SetMachineRoutesRequest
-	22, // 22: api.Ionscale.GetVersion:output_type -> api.GetVersionResponse
-	23, // 23: api.Ionscale.GetDERPMap:output_type -> api.GetDERPMapResponse
-	24, // 24: api.Ionscale.SetDERPMap:output_type -> api.SetDERPMapResponse
-	25, // 25: api.Ionscale.CreateAuthMethod:output_type -> api.CreateAuthMethodResponse
-	26, // 26: api.Ionscale.ListAuthMethods:output_type -> api.ListAuthMethodsResponse
-	27, // 27: api.Ionscale.CreateTailnet:output_type -> api.CreateTailnetResponse
-	28, // 28: api.Ionscale.GetTailnet:output_type -> api.GetTailnetResponse
-	29, // 29: api.Ionscale.ListTailnets:output_type -> api.ListTailnetResponse
-	30, // 30: api.Ionscale.DeleteTailnet:output_type -> api.DeleteTailnetResponse
-	31, // 31: api.Ionscale.GetDNSConfig:output_type -> api.GetDNSConfigResponse
-	32, // 32: api.Ionscale.SetDNSConfig:output_type -> api.SetDNSConfigResponse
-	33, // 33: api.Ionscale.GetACLPolicy:output_type -> api.GetACLPolicyResponse
-	34, // 34: api.Ionscale.SetACLPolicy:output_type -> api.SetACLPolicyResponse
-	35, // 35: api.Ionscale.GetAuthKey:output_type -> api.GetAuthKeyResponse
-	36, // 36: api.Ionscale.CreateAuthKey:output_type -> api.CreateAuthKeyResponse
-	37, // 37: api.Ionscale.DeleteAuthKey:output_type -> api.DeleteAuthKeyResponse
-	38, // 38: api.Ionscale.ListAuthKeys:output_type -> api.ListAuthKeysResponse
-	39, // 39: api.Ionscale.ListMachines:output_type -> api.ListMachinesResponse
-	40, // 40: api.Ionscale.ExpireMachine:output_type -> api.ExpireMachineResponse
-	41, // 41: api.Ionscale.DeleteMachine:output_type -> api.DeleteMachineResponse
-	42, // 42: api.Ionscale.GetMachineRoutes:output_type -> api.GetMachineRoutesResponse
-	42, // 43: api.Ionscale.SetMachineRoutes:output_type -> api.GetMachineRoutesResponse
-	22, // [22:44] is the sub-list for method output_type
-	0,  // [0:22] is the sub-list for method input_type
+	5,  // 5: api.Ionscale.CreateAuthFilter:input_type -> api.CreateAuthFilterRequest
+	6,  // 6: api.Ionscale.ListAuthFilters:input_type -> api.ListAuthFiltersRequest
+	7,  // 7: api.Ionscale.CreateTailnet:input_type -> api.CreateTailnetRequest
+	8,  // 8: api.Ionscale.GetTailnet:input_type -> api.GetTailnetRequest
+	9,  // 9: api.Ionscale.ListTailnets:input_type -> api.ListTailnetRequest
+	10, // 10: api.Ionscale.DeleteTailnet:input_type -> api.DeleteTailnetRequest
+	11, // 11: api.Ionscale.GetDNSConfig:input_type -> api.GetDNSConfigRequest
+	12, // 12: api.Ionscale.SetDNSConfig:input_type -> api.SetDNSConfigRequest
+	13, // 13: api.Ionscale.GetACLPolicy:input_type -> api.GetACLPolicyRequest
+	14, // 14: api.Ionscale.SetACLPolicy:input_type -> api.SetACLPolicyRequest
+	15, // 15: api.Ionscale.GetAuthKey:input_type -> api.GetAuthKeyRequest
+	16, // 16: api.Ionscale.CreateAuthKey:input_type -> api.CreateAuthKeyRequest
+	17, // 17: api.Ionscale.DeleteAuthKey:input_type -> api.DeleteAuthKeyRequest
+	18, // 18: api.Ionscale.ListAuthKeys:input_type -> api.ListAuthKeysRequest
+	19, // 19: api.Ionscale.ListMachines:input_type -> api.ListMachinesRequest
+	20, // 20: api.Ionscale.ExpireMachine:input_type -> api.ExpireMachineRequest
+	21, // 21: api.Ionscale.DeleteMachine:input_type -> api.DeleteMachineRequest
+	22, // 22: api.Ionscale.GetMachineRoutes:input_type -> api.GetMachineRoutesRequest
+	23, // 23: api.Ionscale.SetMachineRoutes:input_type -> api.SetMachineRoutesRequest
+	24, // 24: api.Ionscale.GetVersion:output_type -> api.GetVersionResponse
+	25, // 25: api.Ionscale.GetDERPMap:output_type -> api.GetDERPMapResponse
+	26, // 26: api.Ionscale.SetDERPMap:output_type -> api.SetDERPMapResponse
+	27, // 27: api.Ionscale.CreateAuthMethod:output_type -> api.CreateAuthMethodResponse
+	28, // 28: api.Ionscale.ListAuthMethods:output_type -> api.ListAuthMethodsResponse
+	29, // 29: api.Ionscale.CreateAuthFilter:output_type -> api.CreateAuthFilterResponse
+	30, // 30: api.Ionscale.ListAuthFilters:output_type -> api.ListAuthFiltersResponse
+	31, // 31: api.Ionscale.CreateTailnet:output_type -> api.CreateTailnetResponse
+	32, // 32: api.Ionscale.GetTailnet:output_type -> api.GetTailnetResponse
+	33, // 33: api.Ionscale.ListTailnets:output_type -> api.ListTailnetResponse
+	34, // 34: api.Ionscale.DeleteTailnet:output_type -> api.DeleteTailnetResponse
+	35, // 35: api.Ionscale.GetDNSConfig:output_type -> api.GetDNSConfigResponse
+	36, // 36: api.Ionscale.SetDNSConfig:output_type -> api.SetDNSConfigResponse
+	37, // 37: api.Ionscale.GetACLPolicy:output_type -> api.GetACLPolicyResponse
+	38, // 38: api.Ionscale.SetACLPolicy:output_type -> api.SetACLPolicyResponse
+	39, // 39: api.Ionscale.GetAuthKey:output_type -> api.GetAuthKeyResponse
+	40, // 40: api.Ionscale.CreateAuthKey:output_type -> api.CreateAuthKeyResponse
+	41, // 41: api.Ionscale.DeleteAuthKey:output_type -> api.DeleteAuthKeyResponse
+	42, // 42: api.Ionscale.ListAuthKeys:output_type -> api.ListAuthKeysResponse
+	43, // 43: api.Ionscale.ListMachines:output_type -> api.ListMachinesResponse
+	44, // 44: api.Ionscale.ExpireMachine:output_type -> api.ExpireMachineResponse
+	45, // 45: api.Ionscale.DeleteMachine:output_type -> api.DeleteMachineResponse
+	46, // 46: api.Ionscale.GetMachineRoutes:output_type -> api.GetMachineRoutesResponse
+	46, // 47: api.Ionscale.SetMachineRoutes:output_type -> api.GetMachineRoutesResponse
+	24, // [24:48] is the sub-list for method output_type
+	0,  // [0:24] is the sub-list for method input_type
 	0,  // [0:0] is the sub-list for extension type_name
 	0,  // [0:0] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
@@ -251,6 +271,7 @@ func file_api_ionscale_proto_init() {
 	file_api_version_proto_init()
 	file_api_tailnets_proto_init()
 	file_api_auth_methods_proto_init()
+	file_api_auth_filter_proto_init()
 	file_api_auth_keys_proto_init()
 	file_api_machines_proto_init()
 	file_api_routes_proto_init()

pkg/gen/api/ionscale_grpc.pb.go

@@ -23,6 +23,8 @@ type IonscaleClient interface {
 	SetDERPMap(ctx context.Context, in *SetDERPMapRequest, opts ...grpc.CallOption) (*SetDERPMapResponse, error)
 	CreateAuthMethod(ctx context.Context, in *CreateAuthMethodRequest, opts ...grpc.CallOption) (*CreateAuthMethodResponse, error)
 	ListAuthMethods(ctx context.Context, in *ListAuthMethodsRequest, opts ...grpc.CallOption) (*ListAuthMethodsResponse, error)
+	CreateAuthFilter(ctx context.Context, in *CreateAuthFilterRequest, opts ...grpc.CallOption) (*CreateAuthFilterResponse, error)
+	ListAuthFilters(ctx context.Context, in *ListAuthFiltersRequest, opts ...grpc.CallOption) (*ListAuthFiltersResponse, error)
 	CreateTailnet(ctx context.Context, in *CreateTailnetRequest, opts ...grpc.CallOption) (*CreateTailnetResponse, error)
 	GetTailnet(ctx context.Context, in *GetTailnetRequest, opts ...grpc.CallOption) (*GetTailnetResponse, error)
 	ListTailnets(ctx context.Context, in *ListTailnetRequest, opts ...grpc.CallOption) (*ListTailnetResponse, error)
@@ -95,6 +97,24 @@ func (c *ionscaleClient) ListAuthMethods(ctx context.Context, in *ListAuthMethod
 	return out, nil
 }
 
+func (c *ionscaleClient) CreateAuthFilter(ctx context.Context, in *CreateAuthFilterRequest, opts ...grpc.CallOption) (*CreateAuthFilterResponse, error) {
+	out := new(CreateAuthFilterResponse)
+	err := c.cc.Invoke(ctx, "/api.Ionscale/CreateAuthFilter", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *ionscaleClient) ListAuthFilters(ctx context.Context, in *ListAuthFiltersRequest, opts ...grpc.CallOption) (*ListAuthFiltersResponse, error) {
+	out := new(ListAuthFiltersResponse)
+	err := c.cc.Invoke(ctx, "/api.Ionscale/ListAuthFilters", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *ionscaleClient) CreateTailnet(ctx context.Context, in *CreateTailnetRequest, opts ...grpc.CallOption) (*CreateTailnetResponse, error) {
 	out := new(CreateTailnetResponse)
 	err := c.cc.Invoke(ctx, "/api.Ionscale/CreateTailnet", in, out, opts...)
@@ -257,6 +277,8 @@ type IonscaleServer interface {
 	SetDERPMap(context.Context, *SetDERPMapRequest) (*SetDERPMapResponse, error)
 	CreateAuthMethod(context.Context, *CreateAuthMethodRequest) (*CreateAuthMethodResponse, error)
 	ListAuthMethods(context.Context, *ListAuthMethodsRequest) (*ListAuthMethodsResponse, error)
+	CreateAuthFilter(context.Context, *CreateAuthFilterRequest) (*CreateAuthFilterResponse, error)
+	ListAuthFilters(context.Context, *ListAuthFiltersRequest) (*ListAuthFiltersResponse, error)
 	CreateTailnet(context.Context, *CreateTailnetRequest) (*CreateTailnetResponse, error)
 	GetTailnet(context.Context, *GetTailnetRequest) (*GetTailnetResponse, error)
 	ListTailnets(context.Context, *ListTailnetRequest) (*ListTailnetResponse, error)
@@ -295,6 +317,12 @@ func (UnimplementedIonscaleServer) CreateAuthMethod(context.Context, *CreateAuth
 func (UnimplementedIonscaleServer) ListAuthMethods(context.Context, *ListAuthMethodsRequest) (*ListAuthMethodsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListAuthMethods not implemented")
 }
+func (UnimplementedIonscaleServer) CreateAuthFilter(context.Context, *CreateAuthFilterRequest) (*CreateAuthFilterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateAuthFilter not implemented")
+}
+func (UnimplementedIonscaleServer) ListAuthFilters(context.Context, *ListAuthFiltersRequest) (*ListAuthFiltersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListAuthFilters not implemented")
+}
 func (UnimplementedIonscaleServer) CreateTailnet(context.Context, *CreateTailnetRequest) (*CreateTailnetResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateTailnet not implemented")
 }
@@ -448,6 +476,42 @@ func _Ionscale_ListAuthMethods_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Ionscale_CreateAuthFilter_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateAuthFilterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IonscaleServer).CreateAuthFilter(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/api.Ionscale/CreateAuthFilter",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IonscaleServer).CreateAuthFilter(ctx, req.(*CreateAuthFilterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Ionscale_ListAuthFilters_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListAuthFiltersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(IonscaleServer).ListAuthFilters(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/api.Ionscale/ListAuthFilters",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(IonscaleServer).ListAuthFilters(ctx, req.(*ListAuthFiltersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Ionscale_CreateTailnet_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateTailnetRequest)
 	if err := dec(in); err != nil {
@@ -781,6 +845,14 @@ var Ionscale_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListAuthMethods",
 			Handler:    _Ionscale_ListAuthMethods_Handler,
 		},
+		{
+			MethodName: "CreateAuthFilter",
+			Handler:    _Ionscale_CreateAuthFilter_Handler,
+		},
+		{
+			MethodName: "ListAuthFilters",
+			Handler:    _Ionscale_ListAuthFilters_Handler,
+		},
 		{
 			MethodName: "CreateTailnet",
 			Handler:    _Ionscale_CreateTailnet_Handler,

proto/api/auth_filter.proto

@@ -0,0 +1,30 @@
+syntax = "proto3";
+package api;
+option go_package = "github.com/jsiebens/ionscale/pkg/gen;api";
+
+import "api/ref.proto";
+
+message AuthFilter {
+  uint64 id = 1;
+  Ref auth_method = 2;
+  Ref tailnet = 3;
+  string expr = 4;
+}
+
+message CreateAuthFilterRequest {
+  uint64 auth_method_id = 1;
+  uint64 tailnet_id = 2;
+  string expr = 3;
+}
+
+message CreateAuthFilterResponse {
+  AuthFilter auth_filter = 1;
+}
+
+message ListAuthFiltersRequest {
+  optional uint64 auth_method_id = 1;
+}
+
+message ListAuthFiltersResponse {
+  repeated AuthFilter auth_filters = 1;
+}

proto/api/ionscale.proto

@@ -8,6 +8,7 @@ import "google/protobuf/duration.proto";
 import "api/version.proto";
 import "api/tailnets.proto";
 import "api/auth_methods.proto";
+import "api/auth_filter.proto";
 import "api/auth_keys.proto";
 import "api/machines.proto";
 import "api/routes.proto";
@@ -24,6 +25,9 @@ service Ionscale {
   rpc CreateAuthMethod (CreateAuthMethodRequest) returns (CreateAuthMethodResponse) {}
   rpc ListAuthMethods (ListAuthMethodsRequest) returns (ListAuthMethodsResponse) {}
 
+  rpc CreateAuthFilter (CreateAuthFilterRequest) returns (CreateAuthFilterResponse) {}
+  rpc ListAuthFilters (ListAuthFiltersRequest) returns (ListAuthFiltersResponse) {}
+
   rpc CreateTailnet (CreateTailnetRequest) returns (CreateTailnetResponse) {}
   rpc GetTailnet (GetTailnetRequest) returns (GetTailnetResponse) {}
   rpc ListTailnets (ListTailnetRequest) returns (ListTailnetResponse) {}