// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.resources.roles.v1;

import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/roles;roles";

message Principal {
  // Output only. The ID of the principal.
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The type of the principal.
  string type = 2; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The Scope of the principal.
  string scope_id = 3 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`
}

message GrantJson {
  // Output only. The ID, if set.
  // Deprecated: use "ids" instead.
  string id = 1 [deprecated = true]; // @gotags: `class:"public"`

  // Output only. The IDs, if set.
  repeated string ids = 4; // @gotags: `class:"public"`

  // Output only. The type, if set.
  string type = 2; // @gotags: `class:"public"`

  // Output only. The actions.
  repeated string actions = 3; // @gotags: `class:"public"`
}

message Grant {
  // Output only. The original user-supplied string.
  string raw = 1; // @gotags: `class:"public"`

  // Output only. The canonically-formatted string.
  string canonical = 2; // @gotags: `class:"public"`

  // Output only. The JSON representation of the grant.
  GrantJson json = 3;
}

// Role contains all fields related to a Role resource
message Role {
  // Used to be "grant_scope_id", replaced with "grant_scope_ids".
  reserved 90;
  reserved "grant_scope_id";

  // Output only. The ID of the Role.
  string id = 10; // @gotags: `class:"public" eventstream:"observation"`

  // The ID of the Scope containing this Role.
  string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. Scope information for this resource.
  resources.scopes.v1.ScopeInfo scope = 30;

  // Optional name for identification purposes.
  google.protobuf.StringValue name = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "name"
      that: "name"
    }
  ]; // @gotags: `class:"public"`

  // Optional user-set description for identification purposes.
  google.protobuf.StringValue description = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "description"
      that: "description"
    }
  ]; // @gotags: `class:"public"`

  // Output only. The time this resource was created.
  google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The time this resource was last updated.
  google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public" eventstream:"observation"`

  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 80; // @gotags: `class:"public"`

  // Output only. The IDs of Scopes the grants will apply to. This can include
  // the role's own scope ID, or "this" for the same behavior; specific IDs of
  // scopes that are children of the role's scope; the value "children" to match
  // all direct child scopes of the role's scope; or the value "descendants" to
  // match all descendant scopes (e.g. child scopes, children of child scopes;
  // only valid at "global" scope since it is the only one with children of
  // children).
  repeated string grant_scope_ids = 91 [json_name = "grant_scope_ids"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The IDs (only) of principals that are assigned to this role.
  repeated string principal_ids = 100 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The principals that are assigned to this role.
  repeated Principal principals = 110;

  // Output only. The grants that this role provides for its principals.
  repeated string grant_strings = 120 [json_name = "grant_strings"]; // @gotags: `class:"public"`

  // Output only. The parsed grant information.
  repeated Grant grants = 130;

  // Output only. The available actions on this resource for this user.
  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
}