syntax = "proto3";

package nominal.authentication.temporary_credentials.v1;

import "buf/validate/validate.proto";
import "google/api/annotations.proto";
import "nominal/protos/gen/v1/error.proto";

// Manages temporary Okta credentials for guest users via the Okta Management API.
service TemporaryCredentialsService {
  // Creates and activates temporary credentials for the user with the given email.
  rpc CreateTemporaryCredentials(CreateTemporaryCredentialsRequest) returns (CreateTemporaryCredentialsResponse) {
    option (google.api.http) = {
      post: "/authentication/temporary-credentials/v1/temporary-credentials"
      body: "*"
    };
  }
}

message CreateTemporaryCredentialsRequest {
  string email = 1 [(buf.validate.field).string.min_len = 1];
}

message CreateTemporaryCredentialsResponse {}

// buf:lint:ignore ENUM_ZERO_VALUE_SUFFIX
enum TemporaryCredentialsError {
  TEMPORARY_CREDENTIALS_ERROR_UNSPECIFIED = 0;
  // Okta integration is not configured on this gatekeeper instance.
  TEMPORARY_CREDENTIALS_ERROR_TEMPORARY_CREDENTIALS_UNAVAILABLE = 1 [(nominal.gen.v1.error) = {
    code: "FAILED_PRECONDITION"
    message: "TemporaryCredentialsUnavailable"
  }];
  // The guest email is not allowed to register in the caller's org.
  TEMPORARY_CREDENTIALS_ERROR_GUEST_EMAIL_NOT_ALLOWED = 2 [(nominal.gen.v1.error) = {
    code: "PERMISSION_DENIED"
    message: "GuestEmailNotAllowed"
  }];
}
