// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.services.v1;

import "controller/api/resources/roles/v1/role.proto";
import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";

service RoleService {
  option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_tag) = {
    name: "Role service"
    description:
      "A role represents a collection of permissions that define what actions a user or service account can perform within the system. "
      "The role service provides endpoints that let you manage roles in Boundary."
    external_docs: {
      url: "https://developer.hashicorp.com/boundary/docs/concepts/domain-model/roles";
      description: "Read about roles in the Boundary domain model";
    }
  };

  // GetRole returns a stored Role if present. The provided request must include
  // the Role ID for the Role being retrieved. If the ID is missing, malformed
  // or reference a non-existing resource an error is returned.
  rpc GetRole(GetRoleRequest) returns (GetRoleResponse) {
    option (google.api.http) = {
      get: "/v1/roles/{id}"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Gets a single Role."};
  }

  // ListRoles returns a list of stored Roles which exist inside the scope
  // referenced inside the request. The request must include the scope ID for
  // the Roles being retrieved. If the scope ID is missing, malformed, or
  // reference a non-existing scope, an error is returned.
  rpc ListRoles(ListRolesRequest) returns (ListRolesResponse) {
    option (google.api.http) = {get: "/v1/roles"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Lists all Roles."};
  }

  // CreateRole creates and stores a Role. The provided request must include the
  // scope ID in which the Role will be created. If the scope ID is missing,
  // malformed, or references a non-existing scope, an error is returned. If a
  // name is provided that is in use in another Role in the same scope, an error
  // is returned.
  rpc CreateRole(CreateRoleRequest) returns (CreateRoleResponse) {
    option (google.api.http) = {
      post: "/v1/roles"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Creates a single Role."};
  }

  // UpdateRole updates an existing Role in boundary.  The provided
  // Role must not have any read-only fields set. The update mask must be
  // included in the request and contain at least 1 mutable field. To unset
  // a field's value, include the field in the update mask and don't set it
  // in the provided Role. An error is returned if either the scope
  // or Role IDs are missing or reference a non-existing resource. An error
  // is also returned if the request attempts to update the name to one that is
  // already in use in the same scope.
  rpc UpdateRole(UpdateRoleRequest) returns (UpdateRoleResponse) {
    option (google.api.http) = {
      patch: "/v1/roles/{id}"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Updates a Role."};
  }

  // DeleteRole removes a Role from Boundary. If the provided scope or Role IDs
  // are malformed, or not provided an error is returned.
  rpc DeleteRole(DeleteRoleRequest) returns (DeleteRoleResponse) {
    option (google.api.http) = {delete: "/v1/roles/{id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Deletes a Role."};
  }

  // AddRolePrincipals adds users and/or groups to a Role. The provided request
  // must include the Role ID to which the users and/or groups will be added.
  // If the Role ID is missing, malformed, or reference non-existing resources,
  // an error is returned.  An error is also returned if the request attempts to
  // add a principal that is already part of the role.
  rpc AddRolePrincipals(AddRolePrincipalsRequest) returns (AddRolePrincipalsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:add-principals"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Adds Users and/or Groups to a Role."};
  }

  // SetRolePrincipals sets the Role's users and/or groups. Any existing
  // principals on the Role are deleted if they are not included in this
  // request. The provided request must include the Role ID on
  // which the users and/or groups will be set. If the Role ID is
  // missing, malformed, or referencing a non-existing resource, an error is
  // returned.
  rpc SetRolePrincipals(SetRolePrincipalsRequest) returns (SetRolePrincipalsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:set-principals"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Set Users and/or Groups to a Role, removing any principals that are not specified in the request."};
  }

  // RemoveRolePrincipals removes the users and/or groups from the specified
  // Role. The provided request must include the Role ID from
  // which the users and/or groups will be removed. If that ID is missing,
  // malformed, or reference a non-existing resource, an error is returned.
  // An error is returned if a remove is called for a principal that is not
  // part of the role.
  rpc RemoveRolePrincipals(RemoveRolePrincipalsRequest) returns (RemoveRolePrincipalsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:remove-principals"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Removes the specified Users and/or Groups from a Role."};
  }

  // AddRoleGrants adds grants to a Role. The provided request must include
  // the Role id which the grants will be added to. An error is returned
  // if the provided id is malformed or references a non-existing resource.
  rpc AddRoleGrants(AddRoleGrantsRequest) returns (AddRoleGrantsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:add-grants"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Adds grants to a Role"};
  }

  // SetRoleGrants sets the Role's grants. Any existing grants on the Role are
  // deleted if they are not included in this request. The provided request must
  // include the Role ID on which the grants will be set. If missing, malformed,
  // or referencing a non-existing resource, an error is returned.
  rpc SetRoleGrants(SetRoleGrantsRequest) returns (SetRoleGrantsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:set-grants"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Set grants for a Role, removing any grants that are not specified in the request."};
  }

  // RemoveRoleGrants removes the grants from the specified Role.
  // The provided request must include the Role IDs from which the
  // grants will be removed. If missing, malformed, or references a non-existing
  // resource, an error is returned.
  rpc RemoveRoleGrants(RemoveRoleGrantsRequest) returns (RemoveRoleGrantsResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:remove-grants"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Removes grants from a Role."};
  }

  // AddRoleGrantScopes adds grants scopes to a Role. The provided request must
  // include the Role id which the grant scopes will be added to. An error is
  // returned if the provided id is malformed or references a non-existing
  // resource.
  rpc AddRoleGrantScopes(AddRoleGrantScopesRequest) returns (AddRoleGrantScopesResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:add-grant-scopes"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Adds grant scopes to a Role"};
  }

  // SetRoleGrants sets the Role's grant scopes. Any existing grant scopes on
  // the Role are deleted if they are not included in this request. The provided
  // request must include the Role ID on which the grants will be set. If
  // missing, malformed, or referencing a non-existing resource, an error is
  // returned.
  rpc SetRoleGrantScopes(SetRoleGrantScopesRequest) returns (SetRoleGrantScopesResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:set-grant-scopes"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Set grant scopes for a Role, removing any grant scopes that are not specified in the request."};
  }

  // RemoveRoleGrantScopes removes the grant scopes from the specified Role. The
  // provided request must include the Role IDs from which the grants will be
  // removed. If missing, malformed, or references a non-existing resource, an
  // error is returned.
  rpc RemoveRoleGrantScopes(RemoveRoleGrantScopesRequest) returns (RemoveRoleGrantScopesResponse) {
    option (google.api.http) = {
      post: "/v1/roles/{id}:remove-grant-scopes"
      body: "*"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Removes grant scopes from a Role."};
  }
}

message GetRoleRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
}

message GetRoleResponse {
  resources.roles.v1.Role item = 1;
}

message ListRolesRequest {
  string scope_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`
  bool recursive = 20 [json_name = "recursive"]; // @gotags: `class:"public" eventstream:"observation"`
  // You can specify that the filter should only return items that match.
  // Refer to [filter expressions](https://developer.hashicorp.com/boundary/docs/concepts/filtering) for more information.
  string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"`

  // An opaque token that Boundary uses to continue an existing iteration or
  // request updated items. If you do not specify a token, pagination
  // starts from the beginning. To learn more about list pagination
  // in Boundary, refer to [list pagination](https://developer.hashicorp.com/boundary/docs/api-clients/api/pagination).
  string list_token = 40 [json_name = "list_token"]; // @gotags: `class:"public"`

  // The maximum size of a page in this iteration.
  // If unset, the default page size configured will be used.
  // If the page_size is greater than the default page configured,
  // the page size will be truncated to this number..
  uint32 page_size = 50 [json_name = "page_size"]; // @gotags: `class:"public"`
}

message ListRolesResponse {
  repeated resources.roles.v1.Role items = 1;

  // The type of response, either "delta" or "complete".
  // Delta signifies that this is part of a paginated result
  // or an update to a previously completed pagination.
  // Complete signifies that it is the last page.
  string response_type = 2 [json_name = "response_type"]; // @gotags: `class:"public"`

  // An opaque token used to continue an existing pagination or
  // request updated items. Use this token in the next list request
  // to request the next page.
  string list_token = 3 [json_name = "list_token"]; // @gotags: `class:"public"`

  // The name of the field which the items are sorted by.
  string sort_by = 4 [json_name = "sort_by"]; // @gotags: `class:"public"`

  // The direction of the sort, either "asc" or "desc".
  string sort_dir = 5 [json_name = "sort_dir"]; // @gotags: `class:"public"`

  // A list of item IDs that have been removed since they were returned
  // as part of a pagination. They should be dropped from any client cache.
  // This may contain items that are not known to the cache, if they were
  // created and deleted between listings.
  repeated string removed_ids = 6 [json_name = "removed_ids"]; // @gotags: `class:"public"`

  // An estimate at the total items available. This may change during pagination.
  uint32 est_item_count = 7 [json_name = "est_item_count"]; // @gotags: `class:"public"`
}

message CreateRoleRequest {
  resources.roles.v1.Role item = 1;
}

message CreateRoleResponse {
  string uri = 1;
  resources.roles.v1.Role item = 2;
}

message UpdateRoleRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
  resources.roles.v1.Role item = 2;
  google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
}

message UpdateRoleResponse {
  resources.roles.v1.Role item = 1;
}

message DeleteRoleRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
}

message DeleteRoleResponse {}

message AddRolePrincipalsRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string principal_ids = 3 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`
}

message AddRolePrincipalsResponse {
  resources.roles.v1.Role item = 1;
}

message SetRolePrincipalsRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string principal_ids = 3 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`
}

message SetRolePrincipalsResponse {
  resources.roles.v1.Role item = 1;
}

message RemoveRolePrincipalsRequest {
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string principal_ids = 3 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`
}

message RemoveRolePrincipalsResponse {
  resources.roles.v1.Role item = 1;
}

message AddRoleGrantsRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_strings = 3 [json_name = "grant_strings"]; // @gotags: `class:"public"`
}

message AddRoleGrantsResponse {
  resources.roles.v1.Role item = 1;
}

message SetRoleGrantsRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_strings = 3 [json_name = "grant_strings"]; // @gotags: `class:"public"`
}

message SetRoleGrantsResponse {
  resources.roles.v1.Role item = 1;
}

message RemoveRoleGrantsRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_strings = 3 [json_name = "grant_strings"]; // @gotags: `class:"public"`
}

message RemoveRoleGrantsResponse {
  resources.roles.v1.Role item = 1;
}

message AddRoleGrantScopesRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
}

message AddRoleGrantScopesResponse {
  resources.roles.v1.Role item = 1;
}

message SetRoleGrantScopesRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
}

message SetRoleGrantScopesResponse {
  resources.roles.v1.Role item = 1;
}

message RemoveRoleGrantScopesRequest {
  string id = 1; // @gotags: `class:"public"`
  // Version is used to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 2; // @gotags: `class:"public"`
  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
}

message RemoveRoleGrantScopesResponse {
  resources.roles.v1.Role item = 1;
}