// Copyright 2025 CNCF xDS API Working Group (xDS-WG) Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// 
//     http://www.apache.org/licenses/LICENSE-2.0
// 
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// THIS FILE IS DEPRECATED
// Users should instead use the corresponding proto in the xds tree.
// No new changes will be accepted here.

syntax = "proto3";

package udpa.annotations;

import "udpa/annotations/status.proto";

import "google/protobuf/descriptor.proto";

option go_package = "github.com/cncf/xds/go/udpa/annotations";

// All annotations in this file are experimental and subject to change. Their
// only consumer today is the Envoy APIs and SecuritAnnotationValidator protoc
// plugin in this repository.
option (udpa.annotations.file_status).work_in_progress = true;

extend google.protobuf.FieldOptions {
  // Magic number is the 28 most significant bits in the sha256sum of
  // "udpa.annotations.security".
  FieldSecurityAnnotation security = 11122993;
}

// These annotations indicate metadata for the purpose of understanding the
// security significance of fields.
message FieldSecurityAnnotation {
  // Field should be set in the presence of untrusted downstreams.
  bool configure_for_untrusted_downstream = 1;

  // Field should be set in the presence of untrusted upstreams.
  bool configure_for_untrusted_upstream = 2;
}
