// This proto file was generated from secrets-service-api.yml.
// Care should be taken while both files exist to maintain backwards compatibility with the Conjure generated code.

syntax = "proto3";

package nominal.internalsecrets.v1;

import "google/api/annotations.proto";
import "google/protobuf/timestamp.proto";
import "nominal/protos/gen/v1/alias.proto";

option java_multiple_files = true;
option java_package = "io.nominal.internalsecrets.v1";

message DecryptedSecret {
  string rid = 1 [(nominal.gen.v1.alias) = {java_name: "io.nominal.secrets.api.SecretRid"}];

  string name = 2;

  string description = 3;

  // SENSITIVE: cleartext secret. The Conjure field was `safety: do-not-log`; proto3 has no equivalent, so never log
  // this value or serialize this message into a log/error payload.
  string decrypted_value = 4;

  string created_by = 5 [(nominal.gen.v1.alias) = {java_name: "com.palantir.ri.ResourceIdentifier"}];

  map<string, string> properties = 6 [(nominal.gen.v1.alias) = {
    key_java_name: "io.nominal.api.PropertyName"
    value_java_name: "io.nominal.api.PropertyValue"
  }];

  repeated string labels = 7 [(nominal.gen.v1.alias) = {java_name: "io.nominal.api.Label"}];

  google.protobuf.Timestamp created_at = 8;

  bool is_archived = 9;
}

message GetDecryptedRequest {
  string rid = 1 [(nominal.gen.v1.alias) = {java_name: "io.nominal.secrets.api.SecretRid"}];
}

message GetDecryptedResponse {
  DecryptedSecret decrypted_secret = 1;
}

// The internal secrets service provides functionality for retrieving customer secrets where the "user" is a service.
//
// Kept in its own proto package (distinct from nominal.secrets.v1) so its gRPC/twirp routes can be matched by a
// simple `nominal.internalsecrets.*` ingress prefix, without needing a negative-lookahead to separate it from the
// public SecretService.
service InternalSecretService {
  // Get decrypted secret by rid. This is a privileged operation that is restricted to services only.
  // This endpoint must be a conjure endpoint in order to support TLS.
  rpc GetDecrypted(GetDecryptedRequest) returns (GetDecryptedResponse) {
    option (google.api.http) = {
      get: "/secrets/internal/v1/secrets/{rid}/decrypted"
      response_body: "decrypted_secret"
    };
  }
}
