syntax = "proto3";
package confidence.iam.v1;

import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/empty.proto";
import "google/api/resource.proto";
import "google/api/annotations.proto";
import "google/api/field_behavior.proto";
import "confidence/auth/v1/auth.proto";
import "google/protobuf/field_mask.proto";
import "google/api/client.proto";
import "confidence/api/annotations.proto";

option java_package = "com.spotify.confidence.iam.v1";
option java_multiple_files = true;
option java_outer_classname = "IamProto";

// A cryptographic key that can be used by other services.
message CryptoKey {
  option (google.api.resource) = {
    type: "iam.confidence.dev/CryptoKey"
    pattern: "cryptoKeys/{crypto_key}"
    singular: "cryptoKey"
    plural: "cryptoKeys"
  };
  // The name of the crypto key.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
  // Pem encoded public key of this cryptographical key
  string public_key = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  // The kind of key. This controls the crypto used and number of bits of the key.
  Kind kind = 3 [(google.api.field_behavior) = REQUIRED];
  // The current state of the key.
  State state = 4 [(google.api.field_behavior) = REQUIRED, (google.api.field_behavior) = OUTPUT_ONLY];
  // General labels for this resource.
  map<string, string> labels = 5 [(google.api.field_behavior) = OPTIONAL];

  // Time when the crypto key was first created.
  google.protobuf.Timestamp create_time = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the crypto key was last updated.
  google.protobuf.Timestamp update_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this crypto key.
  string creator = 10 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this crypto key.
  string updater = 12 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // The different states that the key can be in.
  enum State {
    // State has not been set.
    STATE_UNSPECIFIED = 0;
    // Key is currently being created.
    CREATING = 1;
    // Key has been created.
    CREATED = 2;
    // Key has been deleted.
    DELETED = 3;
  }
  // The kind of key. This controls the crypto used and number of bits of the key.
  enum Kind {
    // Kind has not been specified.
    KIND_UNSPECIFIED = 0;
    // This crypto key can be used by Snowflake.
    SNOWFLAKE = 1;
  }
}

//Represents the currently logged in user.
message CurrentUser {
  // The permissions the user currently has.
  repeated PermissionWithScope permissions = 1 [(google.api.field_behavior) = OPTIONAL];
  // The current user
  User user = 2 [(google.api.field_behavior) = OPTIONAL];
  // List of accounts that the user is member of.
  repeated AccountMembership account_memberships = 3 [(google.api.field_behavior) = OPTIONAL];
  // The currently logged in account.
  string account = 4 [(google.api.field_behavior) = REQUIRED];
  // The OAuth2 client id for the service account used by this account.
  string service_account_oauth2_client_id = 5 [(google.api.field_behavior) = REQUIRED];

  // Represents that a user is a member of an account.
  message AccountMembership {
    // The name of the account.
    string account = 1 [(google.api.field_behavior) = REQUIRED];
    // The external id of the accounts.
    string external_id = 2 [(google.api.field_behavior) = REQUIRED];
    // The human friendly name of the account.
    string display_name = 3 [(google.api.field_behavior) = REQUIRED];
    // The string to pass when logging in.
    string login_id = 4 [(google.api.field_behavior) = REQUIRED];
  }
}

// The permission and its scope.
message PermissionWithScope {
  // Scope of the permission on the form <action>:<resource>.
  string scope = 1 [(google.api.field_behavior) = REQUIRED];

  // Permission.
  auth.v1.Permission permission = 2 [(google.api.field_behavior) = REQUIRED];
}

// An API client that can be used to programmatically access the Confidence
// APIs.
message ApiClient {
  option (google.api.resource) = {
    type: "iam.confidence.dev/ApiClient"
    pattern: "apiClients/{api_client}"
    singular: "apiClient"
    plural: "apiClients"
  };
  // Name of the API client on the form `apiClients/<id>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Human friendly name of the API client.
  string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // A description of the API client, e.g. what it is for.
  string description = 3 [(google.api.field_behavior) = OPTIONAL];

  // Id of the API client.
  string client_id = 4 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // The client secret for the client.
  string client_secret = 5 [
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Permissions that the API client has.
  repeated confidence.auth.v1.Permission permissions = 6 [(google.api.field_behavior) = OPTIONAL];

  // Roles that the API client has.
  repeated string roles = 12 [
    (google.api.resource_reference).type = "iam.confidence.dev/Role",
    (google.api.field_behavior) = OPTIONAL
  ];

  // Time when the API client was first created.
  google.protobuf.Timestamp create_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the API client was last updated.
  google.protobuf.Timestamp update_time = 8 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this API client.
  string creator = 13 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this API client.
  string updater = 14 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // General labels for this resource.
  map<string, string> labels = 11 [(google.api.field_behavior) = OPTIONAL];
}

// Represents an identity that can perform operations in the system.
// Either a user, api client or an internal service.
message Identity {
  option (google.api.resource) = {
    type: "iam.confidence.dev/Identity"
    pattern: "identities/{identity}"
    singular: "identity"
    plural: "identities"
  };
  // Name of the identity on the form `identities/<id>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // User friendly name of the identity
  string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // What kind of identity is underlying
  oneof identity_kind {
    // The actual user if any
    string user = 3 [(google.api.resource_reference).type = "iam.confidence.dev/User"];
    // If this identity is an API client
    string api_client = 4 [(google.api.resource_reference).type = "iam.confidence.dev/ApiClient"];
    // If the identity is a service
    string service = 5;
  }
  // Time when the user was first created.
  google.protobuf.Timestamp create_time = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the user was last updated.
  google.protobuf.Timestamp update_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // General labels for this resource.
  map<string, string> labels = 8 [(google.api.field_behavior) = OPTIONAL];
}
// (-- api-linter: core::0122::name-suffix=disabled
//     aip.dev/not-precedent: A name is a name is a name. --)
// A Confidence user.
message User {
  option (google.api.resource) = {
    type: "iam.confidence.dev/User"
    pattern: "users/{user}"
    singular: "user"
    plural: "users"
  };
  // Name of the user on the form `users/<id>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Full name of the user like John Doe.
  string full_name = 2 [(google.api.field_behavior) = REQUIRED];

  // E-mail of the user.
  string email = 3 [(google.api.field_behavior) = REQUIRED];

  // Profile picture URI if exists, otherwise empty.
  string picture_uri = 4;

  // Time of last login.
  google.protobuf.Timestamp last_login_time = 5 [
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Indicator of whether the user is blocked from logging in.
  bool blocked = 6 [
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the user was first created.
  google.protobuf.Timestamp create_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the user was last updated.
  google.protobuf.Timestamp update_time = 8 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // General labels for this resource.
  map<string, string> labels = 9 [(google.api.field_behavior) = OPTIONAL];
}



// An invitation for an email to join a Confidence account.
message UserInvitation {
  option (google.api.resource) = {
    type: "iam.confidence.dev/UserInvitation"
    pattern: "userInvitations/{user_invitation}"
    singular: "userInvitation"
    plural: "userInvitations"
  };
  // Name of the invitation on the form `userInvitations/<id>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // The email to the send the invitation to
  string invited_email = 2 [(google.api.field_behavior) = REQUIRED];

  // The person that initiated the invite. The email sent to `invited_email` will contain this name. If not sent and
  // the token is an end user token the name of the currently logged in user will be used.
  // Required if the token is an API client token.
  string inviter = 3 [(google.api.field_behavior) = OPTIONAL];

  // The roles that the user should get when accepting the invite. Must be at least 1 role.
  repeated string roles = 4 [
    (google.api.resource_reference).type = "iam.confidence.dev/Role",
    (google.api.field_behavior) = REQUIRED
  ];

  // The duration from create that the invite expires and is no longer valid. Defaults to 7 days if not specified.
  google.protobuf.Duration ttl = 5 [(google.api.field_behavior) = OPTIONAL];

  // The absolute time that the invite expires and is no longer valid.
  google.protobuf.Timestamp expiration_time = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // URI for accepting the invite.
  string invitation_uri = 12 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Token required to accept the invite (part of the URI).
  string invitation_token = 13 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // If true, no email will be sent with the invitation link.
  bool disable_invitation_email = 14 [(google.api.field_behavior) = OPTIONAL];

  // Time when the user invitation was first created.
  google.protobuf.Timestamp create_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the user invitation was last updated.
  google.protobuf.Timestamp update_time = 8 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this user invitation.
  string creator = 15 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this user invitation.
  string updater = 16 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // General labels for this resource.
  map<string, string> labels = 11 [(google.api.field_behavior) = OPTIONAL];
}

// (-- api-linter: core::0123::resource-singular=disabled
//     aip.dev/not-precedent: We use oauth_app. --)
// Allows users of a third party app to authenticate towards Confidence and
// get an auth token.
message OAuthApp {
  option (google.api.resource) = {
    type: "iam.confidence.dev/OAuthApp"
    pattern: "oauthApps/{oauth_app}"
    singular: "oauthApp"
    plural: "oauthApps"
  };
  // Name of the OAuthApp on the form `oauthApps/<id>`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // The name to show for the app.
  string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // The client ID to use when authenticating.
  string client_id = 3 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // The client secret to use when authenticating.
  string client_secret = 4 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Description of this oauth app.
  string description = 5 [(google.api.field_behavior) = OPTIONAL];

  // URI to a logo to show for the user while authenticating.
  string logo_uri = 6 [(google.api.field_behavior) = OPTIONAL];

  // A list of URLs that the client is allowed to specify for the callback after authenticating.
  repeated string allowed_callback_urls = 7 [(google.api.field_behavior) = OPTIONAL];

  // A list of logout URLs that the client is allowed to specify.
  repeated string allowed_logout_urls = 8 [(google.api.field_behavior) = OPTIONAL];

  // A list of allowed origins for CORS.
  repeated string allowed_web_origins = 9 [(google.api.field_behavior) = OPTIONAL];

  // Time when the OAuthApp was first created.
  google.protobuf.Timestamp create_time = 10 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the OAuthApp was last updated.
  google.protobuf.Timestamp update_time = 11 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this OAuthApp.
  string creator = 15 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this OAuthApp.
  string updater = 16 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // General labels for this resource.
  map<string, string> labels = 14 [(google.api.field_behavior) = OPTIONAL];
}

// A Client allows an app to access certain Confidence services like
// resolving flags and sending events.
message Client {
  option (google.api.resource) = {
    type: "iam.confidence.dev/Client"
    pattern: "clients/{client}"
    singular: "client"
    plural: "clients"
  };

  // The resource name of the client.
  // For example:
  // `clients/1bhq4c2zqigdzqg6ufni`
  string name = 1 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Human friendly name of the client.
  string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // The last time this client was used to resolve a flag.
  google.protobuf.Timestamp last_seen_time = 3 [
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // General set of labels for this resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Time when the client was first created.
  google.protobuf.Timestamp create_time = 5 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the client was last updated.
  google.protobuf.Timestamp update_time = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this client.
  string creator = 9 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this client.
  string updater = 10 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];
}

// The credentials required for a client to access Confidence.
message ClientCredential {
  option (google.api.resource) = {
    type: "iam.confidence.dev/ClientCredential"
    pattern: "clients/{client}/credentials/{credential}"
    singular: "clientCredential"
    plural: "clientCredentials"
  };

  // The resource name of the client.
  // For example:
  // `clients/1bhq4c2zqigdzqg6ufni/credentials/3pxcfkkmi5sppg0lfa8d`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Human friendly name of the credential.
  string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // The credential method used by this client.
  oneof credential {
    // A simple plaintext secret.
    ClientSecret client_secret = 3 [(google.api.field_behavior) = OPTIONAL];
  }

  // The last time this credential was used to resolve a flag.
  google.protobuf.Timestamp last_seen_time = 4 [
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // General set of labels for this resource.
  map<string, string> labels = 5 [(google.api.field_behavior) = OPTIONAL];

  // Time when the client was first created.
  google.protobuf.Timestamp create_time = 6 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Time when the client was last updated.
  google.protobuf.Timestamp update_time = 7 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // Reference to the identity that created this credential.
  string creator = 10 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // Reference to the identity that last updated this credential.
  string updater = 11 [
    (google.api.resource_reference).type = "iam.confidence.dev/Identity",
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.field_behavior) = REQUIRED
  ];

  // List of environments this credential is enabled for. If empty, enabled for all environments.
  repeated string environments = 16 [
    (google.api.resource_reference).type = "flags.confidence.dev/Environment",
    (google.api.field_behavior) = OPTIONAL
  ];

  // A simple plaintext secret.
  message ClientSecret {
    // The secret used to authenticate a client.
    string secret = 1 [
      (google.api.field_behavior) = OUTPUT_ONLY
    ];
  }
}
