syntax = "proto3";

package controller.api.services.v1;

import "controller/api/resources/credentials/v1/credential.proto";
import "controller/custom_options/v1/options.proto";
import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";
option (custom_options.v1.domain) = "credential";

service CredentialService {
  // GetCredential returns a stored Credential if present.  The provided request
  // must include the Credential Store id. If missing, malformed or referencing a
  // non existing resource an error is returned.
  rpc GetCredential(GetCredentialRequest) returns (GetCredentialResponse) {
    option (google.api.http) = {
      get: "/v1/credentials/{id}"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Gets a single Credential."
    };
  }

  // ListCredentials returns a list of stored Credentials which are in the
  // provided store. The request must include the Credential Store id and if missing,
  // malformed, or referencing a non existing scope, an error is returned.
  rpc ListCredentials(ListCredentialsRequest) returns (ListCredentialsResponse) {
    option (google.api.http) = {
      get: "/v1/credentials"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Lists all Credentials."
    };
  }

  // CreateCredential creates and stores an Credential in boundary.  The
  // provided request must include the credential_store_id in which the Credential
  // will be created. If the store id is missing, malformed or referencing a
  // non existing resource an error is returned.  If a name is provided that is
  // in use in another Credential in the same store, an error is returned.
  rpc CreateCredential(CreateCredentialRequest) returns (CreateCredentialResponse) {
    option (google.api.http) = {
      post: "/v1/credentials"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Creates a single Credential."
    };
  }

  // UpdateCredential updates an existing Credential in boundary.  The provided
  // Credential must not have any read only fields set.  The update mask must be
  // included in the request and contain at least 1 mutable field.  To unset
  // a field's value, include the field in the update mask and don't set it
  // in the provided user. An error is returned if the Credential id is missing
  // or reference a non existing resource.  An error is also returned if the
  // request attempts to update the name to one that is already in use by
  // another Credential in the parent scope.
  rpc UpdateCredential(UpdateCredentialRequest) returns (UpdateCredentialResponse) {
    option (google.api.http) = {
      patch: "/v1/credentials/{id}"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Updates a Credential."
    };
  }

  // DeleteCredential removes an Credential from Boundary. If the Credential id
  // is malformed or not provided an error is returned.
  rpc DeleteCredential(DeleteCredentialRequest) returns (DeleteCredentialResponse) {
    option (google.api.http) = {
      delete: "/v1/credentials/{id}"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Deletes a Credential"
    };
  }
}

message GetCredentialRequest {
  string id = 1; // @gotags: `class:"public"`
}

message GetCredentialResponse {
  resources.credentials.v1.Credential item = 1;
}

message ListCredentialsRequest {
  string credential_store_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public"`
  string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"`
}

message ListCredentialsResponse {
  repeated resources.credentials.v1.Credential items = 1;
}

message CreateCredentialRequest {
  resources.credentials.v1.Credential item = 1;
}

message CreateCredentialResponse {
  string uri = 1; // @gotags: `class:"public"`
  resources.credentials.v1.Credential item = 2;
}

message UpdateCredentialRequest {
  string id = 1; // @gotags: `class:"public"`
  resources.credentials.v1.Credential item = 2;
  google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
}

message UpdateCredentialResponse {
  resources.credentials.v1.Credential item = 1;
}

message DeleteCredentialRequest {
  string id = 1; // @gotags: `class:"public"`
}

message DeleteCredentialResponse {}