// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.resources.credentiallibraries.v1;

import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
import "google/api/visibility.proto";
import "google/protobuf/struct.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentiallibraries;credentiallibraries";

// CredentialLibrary contains all fields related to an Credential Library resource
message CredentialLibrary {
  // Output only. The ID of the Credential Library.
  string id = 10; // @gotags: `class:"public"`

  // The ID of the Credential Store of which this Credential Library is a part.
  string credential_store_id = 20 [json_name = "credential_store_id"]; // @gotags: `class:"public"`

  // Output only. Scope information for this Credential Library.
  resources.scopes.v1.ScopeInfo scope = 30;

  // Optional name for identification purposes.
  google.protobuf.StringValue name = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "name"
      that: "Name"
    }
  ]; // @gotags: `class:"public"`

  // Optional user-set description for identification purposes.
  google.protobuf.StringValue description = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "description"
      that: "Description"
    }
  ]; // @gotags: `class:"public"`

  // Output only. The time this resource was created.
  google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`

  // Output only. The time this resource was last updated.
  google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`

  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 80; // @gotags: `class:"public"`

  // The Credential Library type.
  string type = 90; // @gotags: `class:"public"`

  oneof attrs {
    // The attributes that are applicable for the specific Credential Library type.
    google.protobuf.Struct attributes = 100 [
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "default"
    ];
    VaultCredentialLibraryAttributes vault_credential_library_attributes = 101 [
      (google.api.field_visibility).restriction = "INTERNAL",
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "vault"
    ];
    VaultSSHCertificateCredentialLibraryAttributes vault_ssh_certificate_credential_library_attributes = 102 [
      (google.api.field_visibility).restriction = "INTERNAL",
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "vault-ssh-certificate"
    ];
    VaultCredentialLibraryAttributes vault_generic_credential_library_attributes = 103 [
      (google.api.field_visibility).restriction = "INTERNAL",
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "vault-generic"
    ];
  }

  // Output only. The available actions on this resource for this user.
  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`

  // The type of credential this library will issue, defaults to Unspecified
  string credential_type = 310 [
    json_name = "credential_type",
    (custom_options.v1.generate_sdk_option) = true
  ]; // @gotags: `class:"public"`

  // The credential mapping overrides
  google.protobuf.Struct credential_mapping_overrides = 320 [
    json_name = "credential_mapping_overrides",
    (custom_options.v1.generate_sdk_option) = true
  ];
}

// The attributes of a vault typed Credential Library.
message VaultCredentialLibraryAttributes {
  // The path in Vault to request credentials from.
  google.protobuf.StringValue path = 10 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.path"
      that: "VaultPath"
    }
  ]; // @gotags: `class:"public"`

  // The HTTP method the library uses to communicate with Vault.
  google.protobuf.StringValue http_method = 20 [
    json_name = "http_method",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.http_method"
      that: "HttpMethod"
    }
  ]; // @gotags: `class:"public"`

  // The body of the HTTP request the library sends to vault. When set http_method must be "POST"
  google.protobuf.StringValue http_request_body = 30 [
    json_name = "http_request_body",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.http_request_body"
      that: "HttpRequestBody"
    }
  ]; // @gotags: `class:"secret"`
}

// The attributes of a vault SSH Certificate Credential Library.
message VaultSSHCertificateCredentialLibraryAttributes {
  // The path in Vault to request credentials from.
  google.protobuf.StringValue path = 10 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.path"
      that: "VaultPath"
    }
  ]; // @gotags: `class:"public"`

  // The username to use when making an SSH connection.
  google.protobuf.StringValue username = 20 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.username"
      that: "Username"
    }
  ]; // @gotags: `class:"sensitive"`

  // The key type to use when generating an SSH private key.
  google.protobuf.StringValue key_type = 30 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.key_type"
      that: "KeyType"
    }
  ]; // @gotags: `class:"public"`

  // The number of bits to use to generate an SSH private key.
  google.protobuf.UInt32Value key_bits = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.key_bits"
      that: "KeyBits"
    }
  ]; // @gotags: `class:"public"`

  // The requested time to live for the certificate.
  google.protobuf.StringValue ttl = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.ttl"
      that: "Ttl"
    }
  ]; // @gotags: `class:"public"`

  // The key id that the created certificate should have.
  google.protobuf.StringValue key_id = 60 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.key_id"
      that: "KeyId"
    }
  ]; // @gotags: `class:"public"`

  // The critical options that the certificate should be signed for.
  map<string, string> critical_options = 70 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.critical_options"
      that: "CriticalOptions"
    }
  ]; // @gotags: `class:"public"`

  // The extensions that the certificate should be signed for.
  map<string, string> extensions = 80 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.extensions"
      that: "Extensions"
    }
  ]; // @gotags: `class:"public"`

  // Principals to be signed as "valid_principles" in addition to username.
  repeated google.protobuf.StringValue additional_valid_principals = 90 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.additional_valid_principals"
      that: "AdditionalValidPrincipals"
    }
  ]; // @gotags: `class:"public"`
}