syntax = "proto3";

package heddle.v1;

import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "heddle/v1/common.proto";

// ── Support access ────────────────────────────────────────────────────────────

message GrantSupportAccessRequest {
  // Heddle staff email — must already exist as a registered user with
  // the `staff` scope marker. The grant is attached to that subject.
  string operator_email = 1;
  // Resource the grant covers. The oneof enforces "exactly one of
  // namespace / repo" at the wire level.
  GrantTargetRef target = 2;
  // TTL in seconds. The audit row's `expires_at` is computed from this
  // at grant time. Hard-capped server-side at 7 days.
  google.protobuf.Duration ttl_seconds = 3;
  // Free-form reason (incident id, ticket link, "fix p0 in deploy
  // pipeline"). Required, non-empty. Surfaced in the audit listing.
  string reason = 4;
  string client_operation_id = 15;
}

message SupportAccessGrant {
  string id = 1;
  string operator_email = 2;
  // Resource the grant covers.
  GrantTargetRef target = 3;
  // The role materialised on the underlying `hosted_grants` row.
  // Always `admin` for support access today; carried as a string so
  // future tiers (read-only support, redacted-data support) can ride
  // the same RPC.
  HostedRole role = 4;
  string granted_by = 5;
  google.protobuf.Timestamp granted_at = 6;
  google.protobuf.Timestamp expires_at = 7;
  // 0 when the grant is still active.
  google.protobuf.Timestamp revoked_at = 8;
  string revoked_by = 9;
  string reason = 10;
}

message ListSupportAccessGrantsRequest {
  // Resource to list grants on. Caller must hold Admin on the named
  // namespace, or on the repo's parent namespace.
  GrantTargetRef target = 1;
  // When true, includes grants whose audit row has been revoked or
  // whose `expires_at` is in the past. Default is active-only.
  bool include_inactive = 2;
}

message ListSupportAccessGrantsResponse {
  repeated SupportAccessGrant grants = 1;
}

message RevokeSupportAccessRequest {
  string id = 1;
  string client_operation_id = 15;
}
