syntax = "proto3";

package alien_bindings.service_account;

// ServiceAccount service for managing identity and impersonation
service ServiceAccountService {
    // Get information about the service account
    rpc GetInfo(GetInfoRequest) returns (GetInfoResponse);

    // Impersonate the service account and returns credentials as a ClientConfig
    rpc Impersonate(ImpersonateRequest) returns (ImpersonateResponse);
}

// Messages for GetInfo
message GetInfoRequest {
    // Name of the service account binding to use
    string binding_name = 1;
}

message AwsServiceAccountInfo {
    // The IAM role name
    string role_name = 1;
    // The IAM role ARN (for AssumeRole)
    string role_arn = 2;
}

message GcpServiceAccountInfo {
    // The service account email (for impersonation)
    string email = 1;
    // The service account unique ID
    string unique_id = 2;
}

message AzureServiceAccountInfo {
    // The managed identity client ID (for authentication)
    string client_id = 1;
    // The managed identity resource ID (ARM ID)
    string resource_id = 2;
    // The managed identity principal ID
    string principal_id = 3;
}

message ServiceAccountInfo {
    oneof info {
        AwsServiceAccountInfo aws = 1;
        GcpServiceAccountInfo gcp = 2;
        AzureServiceAccountInfo azure = 3;
    }
}

message GetInfoResponse {
    // Platform-specific service account information
    ServiceAccountInfo info = 1;
}

// Messages for Impersonate
message ImpersonateRequest {
    // Name of the service account binding to use
    string binding_name = 1;
    // Optional session name (AWS only)
    optional string session_name = 2;
    // Optional session duration in seconds
    optional int32 duration_seconds = 3;
    // Optional scopes (GCP only)
    repeated string scopes = 4;
}

message ImpersonateResponse {
    // Serialized ClientConfig (JSON string)
    string client_config_json = 1;
}

