// Copyright 2025 Envoy Project Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//     http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package envoy.extensions.filters.http.aws_lambda.v3;

import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.http.aws_lambda.v3";
option java_outer_classname = "AwsLambdaProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/aws_lambda/v3;aws_lambdav3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: AWS Lambda]
// AWS Lambda :ref:`configuration overview <config_http_filters_aws_lambda>`.
// [#extension: envoy.filters.http.aws_lambda]

// AWS Lambda filter config
// [#next-free-field: 7]
message Config {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.aws_lambda.v2alpha.Config";

  enum InvocationMode {
    // This is the more common mode of invocation, in which Lambda responds after it has completed the function. In
    // this mode the output of the Lambda function becomes the response of the HTTP request.
    SYNCHRONOUS = 0;

    // In this mode Lambda responds immediately but continues to process the function asynchronously. This mode can be
    // used to signal events for example. In this mode, Lambda responds with an acknowledgment that it received the
    // call which is translated to an HTTP 200 OK by the filter.
    ASYNCHRONOUS = 1;
  }

  // The ARN of the AWS Lambda to invoke when the filter is engaged
  // Must be in the following format:
  // arn:<partition>:lambda:<region>:<account-number>:function:<function-name>
  string arn = 1 [(validate.rules).string = {min_len: 1}];

  // Whether to transform the request (headers and body) to a JSON payload or pass it as is.
  bool payload_passthrough = 2;

  // Determines the way to invoke the Lambda function.
  InvocationMode invocation_mode = 3 [(validate.rules).enum = {defined_only: true}];

  // Indicates that before signing headers, the host header will be swapped with
  // this value. If not set or empty, the original host header value
  // will be used and no rewrite will happen.
  //
  // Note: this rewrite affects both signing and host header forwarding. However, this
  // option shouldn't be used with
  // :ref:`HCM host rewrite <envoy_v3_api_field_config.route.v3.RouteAction.host_rewrite_literal>` given that the
  // value set here would be used for signing whereas the value set in the HCM would be used
  // for host header forwarding which is not the desired outcome.
  // Changing the value of the host header can result in a different route to be selected
  // if an HTTP filter after AWS lambda re-evaluates the route (clears route cache).
  string host_rewrite = 4;

  // Specifies the credentials profile to be used from the AWS credentials file.
  // This parameter is optional. If set, it will override the value set in the AWS_PROFILE env variable and
  // the provider chain is limited to the AWS credentials file Provider.
  // If credentials configuration is provided, this configuration will be ignored.
  // If this field is provided, then the default providers chain specified in the documentation will be ignored.
  // (See :ref:`default credentials providers <config_http_filters_aws_lambda_credentials>`).
  string credentials_profile = 5;

  // Specifies the credentials to be used. This parameter is optional and if it is set,
  // it will override other providers and will take precedence over credentials_profile.
  // The provider chain is limited to the configuration credentials provider.
  // If this field is provided, then the default providers chain specified in the documentation will be ignored.
  // (See :ref:`default credentials providers <config_http_filters_aws_lambda_credentials>`).
  //
  // .. warning::
  //   Distributing the AWS credentials via this configuration should not be done in production.
  Credentials credentials = 6;
}

// AWS Lambda Credentials config.
message Credentials {
  // AWS access key id.
  string access_key_id = 1 [(validate.rules).string = {min_len: 1}];

  // AWS secret access key.
  string secret_access_key = 2 [(validate.rules).string = {min_len: 1}];

  // AWS session token.
  // This parameter is optional. If it is set to empty string it will not be consider in the request.
  // It is required if temporary security credentials retrieved directly from AWS STS operations are used.
  string session_token = 3;
}

// Per-route configuration for AWS Lambda. This can be useful when invoking a different Lambda function or a different
// version of the same Lambda depending on the route.
message PerRouteConfig {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.aws_lambda.v2alpha.PerRouteConfig";

  Config invoke_config = 1;
}
