syntax = "proto3";

package nominal.authorization.permissions.v1;

import "buf/validate/validate.proto";
import "google/api/annotations.proto";
import "nominal/protos/gen/v1/alias.proto";

// A permission is the declaration of an action that can be performed on a resource.
message CheckPermissionRequest {
  string action = 1 [(buf.validate.field) = {required: true}];
  string resource = 2 [
    (nominal.gen.v1.alias) = {java_name: "com.palantir.ri.ResourceIdentifier"},
    (buf.validate.field) = {required: true},
    // Regex taken from https://github.com/palantir/resource-identifier?tab=readme-ov-file#format
    (buf.validate.field).string.pattern = "^ri\\.[a-z][a-z0-9\\-]*\\.([a-z0-9][a-z0-9\\-]*)?\\.[a-z][a-z0-9\\-]*\\.[a-zA-Z0-9\\-\\._]+$"
  ];
}

message CheckPermissionsRequest {
  repeated CheckPermissionRequest requests = 1;
}

message CheckPermissionResponse {
  bool is_authorized = 1 [(buf.validate.field) = {required: true}];
  CheckPermissionRequest requested_permission = 2 [(buf.validate.field) = {required: true}];
}

message CheckPermissionsResponse {
  repeated CheckPermissionResponse responses = 1;
}

// The PermissionService provides an interface for checking permissions for a user, where
// a permission is an action that is performed on a resource.
service PermissionService {
  // Checks a list of permissions for the calling user and returns results in the same order.
  rpc CheckPermissions(CheckPermissionsRequest) returns (CheckPermissionsResponse) {
    option (google.api.http) = {
      post: "/authorization/permissions/v1/check"
      body: "*"
    };
  }
}
