syntax = "proto3";

package nominal.ingest.v2.internal;

import "nominal/protos/gen/v1/alias.proto";
import "nominal/protos/ingest/v2/ingest_service.proto";

option java_multiple_files = true;
option java_package = "io.nominal.ingest.v2.internal";

message IngestShadowRequest {
  nominal.ingest.v2.IngestRequest ingest_request = 1;

  // The v1 ingest job this shadow run mirrors; recorded as shadow_to on the v2 ingest job.
  string shadows_ingest_job_rid = 2 [(nominal.gen.v1.alias) = {java_name: "io.nominal.ingest.api.IngestJobRid"}];

  // The v1 dataset file this shadow run mirrors; recorded as shadow_to on the v2 dataset file.
  string shadows_dataset_file_id = 3 [(nominal.gen.v1.alias) = {java_name: "io.nominal.datasource.DatasetFileId"}];
}

message IngestShadowResponse {
  nominal.ingest.v2.IngestResponse ingest_response = 1;
}

message IngestInternalRequest {
  nominal.ingest.v2.IngestRequest ingest_request = 1;
}

message IngestInternalResponse {
  nominal.ingest.v2.IngestResponse ingest_response = 1;

  // The dataset file created for the (single-file) ingest request, if one was created. Empty for ingest
  // requests that produce a transform rather than a dataset file directly (mcap/dataflash/containerized).
  optional string dataset_file_id = 2 [(nominal.gen.v1.alias) = {java_name: "io.nominal.datasource.DatasetFileId"}];
}

// Internal ingest service for inter-service RPCs. Uses a separate package so that
// the gRPC path (nominal.ingest.v2.internal.*) is excluded from public ingress.
//
// The shadow flag on the resulting ingest job and dataset files is a server-side
// concern: shadow rows are excluded from user-facing reads (search, list, metrics)
// and from billing/retention, so the flag must not be settable from a public API.
service InternalIngestService {
  // Submit a V2 ingest job whose ingest job and dataset files are tagged with
  // is_shadow=true. Internal-only: the gRPC path is excluded from public ingress,
  // and the caller's original auth header is forwarded so the same dataset-write
  // authorization checks apply as on the public ingest API.
  rpc IngestShadow(IngestShadowRequest) returns (IngestShadowResponse);

  // Submit a V2 ingest job (non-shadow) and return the dataset file it created. Mirrors IngestShadow but is
  // user-visible (is_shadow=false) and returns the created dataset file so callers can thread it into their
  // response. Internal-only: the gRPC path is excluded from public ingress, and the caller's original auth
  // header is forwarded so the same dataset-write authorization checks apply as on the public ingest API.
  rpc IngestInternal(IngestInternalRequest) returns (IngestInternalResponse);
}
