// Copyright 2022 Lightbend Inc.

// All extension points for Kalix

syntax = "proto3";

package kalix;

option go_package = "github.com/lightbend/kalix-go-sdk/kalix;kalix";
option java_multiple_files = true;
option java_outer_classname = "AclProto";
option java_package = "kalix";

// ACL configuration for a resource.
message Acl {
  // Principals that are allowed to access this resource.
  //
  // An incoming request must have at least one principal associated with it in this list to be allowed.
  repeated PrincipalMatcher allow = 1;
  // Principals that are not allowed to access this resource.
  //
  // After matching an allow rule, an incoming request that has at least one principal that matches a deny rule will
  // be denied.
  repeated PrincipalMatcher deny = 2;
  // The gRPC status code to respond with when access is denied.
  //
  // By default, this will be 7 (permission denied), but alternatives might include 16 (unauthenticated) or 5 (not
  // found). If 0, indicates that the code should be inherited from the parent (regardless of the inherit field).
  //
  // When HTTP transcoding is in use, this code will be translated to an equivalent HTTP status code.
  uint32 deny_code = 3;
}

// A principal matcher that can be used in an ACL.
//
// A principal is a very broad concept. It can correlate to a person, a system, or a more abstract concept, such as
// the internet.
//
// A single request may have multiple principals associated with it, for example, it may have come from a particular
// source system, and it may have certain credentials associated with it. When a matcher is applied to the request,
// the request is considered to match if at least one of the principals attached to the request matches.
message PrincipalMatcher {
  // This enum contains principal matchers that don't have any configuration, such as a name, associated with them,
  // for ease of reference in annotations.
  enum Principal {
    UNSPECIFIED = 0;
    // All (or no) principals. This matches all requests regardless of what principals are associated with it.
    ALL = 1;
    // The internet.
    //
    // This will match all requests that originated from the internet, and passed through the Kalix ingress via a
    // configured route.
    INTERNET = 2;
  }
  oneof matcher {
    // A principal matcher that can be specified with no additional configuration.
    Principal principal = 1;
    // Match a Kalix service principal.
    //
    // This matches a service in the same Kalix project.
    //
    // Supports glob matching, that is, * means all services in this project.
    string service = 2;
  }
}