syntax = "proto3";

import "google/protobuf/descriptor.proto";

package clarifai.auth.scope;

option go_package = "github.com/Clarifai/clarifai-go-grpc/proto/clarifai/auth/scope";
option java_multiple_files = true;
option java_package = "com.clarifai.grpc.auth.scope";
option objc_class_prefix = "CAIP";


message ScopeList {
  // These are the list of low-level scopes to check from the enum below.
  repeated S scopes = 1;
  // This is a list of fully qualified grpc names to check.
  repeated string endpoints = 2;
}

// Next index: 41
// NOTE: When updating the list of "clarifai_exposed" scopes, please also
// update the TestScopes function in main_key_test.go and TestGetExposedScopes function in
// scope_test.go
//
// The dependencies listed for each scope are simply recommendations so that a user
// cannot make a key that would be useless. Beyond the key creation they are not enforced
// but rather the scopes are enforce when data is accessed.
//
//
// There is the following conventions in place, make sure you add them to the scopes for all new
// resource types:
//
// 1. *_Add requires the corresponding _Get.
// 2. *_Delete requires the corresponding _Add and _Get.
// 3. *_Patch is deprecated and not check anywhere.
//
// Think of the dependencies in this file at the DB level. If you cannot make a DB call to Get, Add
// or Delete a resource without having access to another resource then you should add it here. That
// should for the most part be the same resource type. In service.proto for the API level you will
// also specify cl_depending_scopes for each API endpoint. Those cover cases where an endpoint
// might need to access more than just that one resource type in order to operate (ie. API handlers
// that make multiple DB calls of various resource types likely have more cl_depending_scopes than
// the ones listed below).
//
enum S {
  reserved 30, 31, 32, 33, 34, 125, 126;
  // introduce undef so that the zero (default/unset) value of the enum is not a real
  // permission.  undef is only present for this purpose and should not be used
  // to indicate any "real" value.
  undef = 0;

  All = 1 [(clarfai_exposed) = true];

  // Make an rpc to our prediction services.
  Predict = 2 [(clarfai_exposed) = true];

  // Write to the inputs table in the DB.
  Inputs_Add = 4 [(clarfai_exposed) = true,
                  (clarifai_depending_scopes) = Inputs_Get];
  // Read from the inputs table in the DB.
  Inputs_Get = 5 [(clarfai_exposed) = true];
  // To patch we need read/write.
  // Deprecated.
	// Optionally needs Concepts_Add.
  Inputs_Patch = 7 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Inputs_Add,
                    (clarifai_depending_scopes) = Inputs_Get,
                    deprecated = true];

  // To delete we need read/write
  Inputs_Delete = 8 [(clarfai_exposed) = true,
                     (clarifai_depending_scopes) = Inputs_Add,
                     (clarifai_depending_scopes) = Inputs_Get];
  // Deprecated.
  Outputs_Patch = 9 [(clarifai_depending_scopes) = Inputs_Get,
                     (clarifai_depending_scopes) = Predict,
                     deprecated = true];

  // Write to the concepts DB tables.
  Concepts_Add = 10 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Concepts_Get];

  // Read from the concepts DB tables.
  Concepts_Get = 11 [(clarfai_exposed) = true];

  // TODO: No concept searches scope.

  // To patch we need read/write.
  // Deprecated
  Concepts_Patch = 12 [(clarfai_exposed) = true,
                       (clarifai_depending_scopes) = Concepts_Add,
                       (clarifai_depending_scopes) = Concepts_Get,
                       deprecated = true];

  // To delete we need read/write.
  // Note: not implemented.
  Concepts_Delete = 13 [(clarifai_depending_scopes) = Concepts_Add,
                        (clarifai_depending_scopes) = Concepts_Get];

	// Write to the models DB tables.
  Models_Add = 14 [(clarfai_exposed) = true,
                   (clarifai_depending_scopes) = Models_Get];

  // Read from the models and models versions DB tables.
  Models_Get = 15 [(clarfai_exposed) = true];

  // To patch we need read/write.
  // Deprecated.
  Models_Patch = 16 [(clarfai_exposed) = true,
                     (clarifai_depending_scopes) = Models_Add,
                     (clarifai_depending_scopes) = Models_Get,
                     (clarifai_depending_scopes) = Models_Train, // because patch adds a model version.
                     deprecated = true];

  // To delete we need read/write.
  Models_Delete = 17 [(clarfai_exposed) = true,
                      (clarifai_depending_scopes) = Models_Add,
                      (clarifai_depending_scopes) = Models_Get];

  // Note: Models_Train is effectively doing POST /models/{models_id}/versions so it's treated that
  // way in terms of data access under the hood.
  // Write to the model versions DB table.
  Models_Train = 26 [(clarfai_exposed) = true,
                     (clarifai_depending_scopes) = Models_Get];

  // Internal only model syncing.
  Models_Sync = 27 [(clarifai_depending_scopes) = Models_Get];

  // To get model version export
  ModelExports_Get = 142 [(clarfai_exposed) = true];

  // To create model version export
  ModelExports_Add = 143 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = ModelExports_Get];

  // To pull the model version's image
  Models_Pull = 150 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Models_Get];

  // TODO: No model get metrics scope.

  // Write to the workflows DB table.
  Workflows_Add = 18 [(clarfai_exposed) = true,
                      (clarifai_depending_scopes) = Workflows_Get];

  // Read from the workflows DB table.
  Workflows_Get = 19 [(clarfai_exposed) = true];

  // To patch we need read/write.
  // Deprecated.
  Workflows_Patch = 20 [(clarfai_exposed) = true,
                        (clarifai_depending_scopes) = Workflows_Add,
                        (clarifai_depending_scopes) = Workflows_Get,
                        deprecated = true];

  // To delete we need read/write.
  Workflows_Delete = 21 [(clarfai_exposed) = true,
                         (clarifai_depending_scopes) = Workflows_Add,
                         (clarifai_depending_scopes) = Workflows_Get];

  WorkflowMetrics_Get = 96 [(clarfai_exposed) = true, deprecated = true];

  WorkflowMetrics_Add = 97 [(clarfai_exposed) = true,
                           (clarifai_depending_scopes) = WorkflowMetrics_Get];

  WorkflowMetrics_Delete = 98 [(clarfai_exposed) = true,
                              (clarifai_depending_scopes) = WorkflowMetrics_Add,
                              (clarifai_depending_scopes) = WorkflowMetrics_Get];

  // Write to the visualizations DB table.
  // Deprecated
  TSNEVisualizations_Add = 24 [(clarifai_depending_scopes) = TSNEVisualizations_Get,
                               deprecated = true];

  // Read from the visualizations DB table.
  // Deprecated
  TSNEVisualizations_Get = 25 [deprecated = true];

  // Write to the annotations DB table.
  Annotations_Add = 37 [(clarfai_exposed) = true,
                        (clarifai_depending_scopes) = Annotations_Get];

  // Read from the annotations DB table.
  Annotations_Get = 38 [(clarfai_exposed) = true];

  // To patch we need read/write.
  // Deprecated.
  Annotations_Patch = 39 [(clarfai_exposed) = true,
                          (clarifai_depending_scopes) = Annotations_Add,
                          (clarifai_depending_scopes) = Annotations_Get,
                          deprecated = true];

  // To delete we need read/write.
  Annotations_Delete = 40 [(clarfai_exposed) = true,
                           (clarifai_depending_scopes) = Annotations_Add,
                           (clarifai_depending_scopes) = Annotations_Get];

  // Deprecated: collectors feature has been removed.
  Collectors_Add = 41 [(clarfai_exposed) = true,
                       (clarifai_depending_scopes) = Collectors_Get,
                       deprecated = true];
  Collectors_Get = 42 [(clarfai_exposed) = true,
                       deprecated = true];
  Collectors_Delete = 43 [(clarfai_exposed) = true,
                          (clarifai_depending_scopes) = Collectors_Add,
                          (clarifai_depending_scopes) = Collectors_Get,
                          deprecated = true];

  // Write to the apps DB table.
  Apps_Add = 44 [(clarfai_exposed) = true,
                 (clarifai_depending_scopes) = Apps_Get];

  // Read from the apps DB table.
  Apps_Get = 45 [(clarfai_exposed) = true];

  // To delete we need read/write.
  Apps_Delete = 46 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Apps_Add,
                    (clarifai_depending_scopes) = Apps_Get];

  // Write to the keys DB table.
  Keys_Add = 47 [(clarfai_exposed) = true,
                 (clarifai_depending_scopes) = Keys_Get];

  // Read from the keys DB table.
  Keys_Get = 48 [(clarfai_exposed) = true];

  // To delete we need read/write.
  Keys_Delete = 49 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Keys_Add,
                    (clarifai_depending_scopes) = Keys_Get];

  // Write to the app sharing DB table
  Collaborators_Add = 51 [(clarfai_exposed) = true,
                          (clarifai_depending_scopes) = Collaborators_Get];

  // Read from the app sharing DB table
  Collaborators_Get = 50 [(clarfai_exposed) = true];

  // To delete we need read/write
  Collaborators_Delete = 52 [(clarfai_exposed) = true,
                             (clarifai_depending_scopes) = Collaborators_Add,
                             (clarifai_depending_scopes) = Collaborators_Get];

  // Write to the metrics table
  Metrics_Add = 54 [(clarfai_exposed) = true,
                          (clarifai_depending_scopes) = Metrics_Get];

  // Read from metrics table
  Metrics_Get = 53 [(clarfai_exposed) = true];

  // To delete we need read/write
  Metrics_Delete = 63 [(clarfai_exposed) = true,
                             (clarifai_depending_scopes) = Metrics_Add,
                             (clarifai_depending_scopes) = Metrics_Get];

  // Write to tasks DB table.
  Tasks_Add = 55 [(clarfai_exposed) = true,
                 (clarifai_depending_scopes) = Tasks_Get];

  // Read from the tasks DB table.
  Tasks_Get = 56 [(clarfai_exposed) = true];

  // To delete we need read/write
  Tasks_Delete = 70 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Tasks_Add,
                    (clarifai_depending_scopes) = Tasks_Get];

  // Write to the password_policies DB table
  PasswordPolicies_Add = 57 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = PasswordPolicies_Get];

  // Read from the password_policies DB table
  PasswordPolicies_Get = 58 [(clarfai_exposed) = true];

  // To delete password_policies we need read/write
  PasswordPolicies_Delete = 59 [(clarfai_exposed) = true,
       (clarifai_depending_scopes) = PasswordPolicies_Add,
       (clarifai_depending_scopes) = PasswordPolicies_Get];







  // Read from label orders table
  LabelOrders_Get = 67 [(clarfai_exposed) = true];

  // Write to label orders table
  LabelOrders_Add = 68 [(clarfai_exposed) = true,
                         (clarifai_depending_scopes) = LabelOrders_Get];

  // To delete label orders we need read/write
  LabelOrders_Delete = 69 [(clarfai_exposed) = true,
                            (clarifai_depending_scopes) = LabelOrders_Add,
                            (clarifai_depending_scopes) = LabelOrders_Get];





















  // CRUD on FindDuplicateAnnotationsJobs table
  FindDuplicateAnnotationsJobs_Add = 102 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = FindDuplicateAnnotationsJobs_Get,
    deprecated = true];
  FindDuplicateAnnotationsJobs_Get = 103 [(clarfai_exposed) = true];
  FindDuplicateAnnotationsJobs_Delete = 104 [(clarfai_exposed) = true,
        (clarifai_depending_scopes) = FindDuplicateAnnotationsJobs_Add,
        (clarifai_depending_scopes) = FindDuplicateAnnotationsJobs_Get];


  Datasets_Get = 105 [(clarfai_exposed) = true];
  Datasets_Add = 106 [(clarfai_exposed) = true,
                    (clarifai_depending_scopes) = Datasets_Get];
  Datasets_Delete = 107 [(clarfai_exposed) = true,
                       (clarifai_depending_scopes) = Datasets_Get,
                       (clarifai_depending_scopes) = Datasets_Add];

	// Write to the modules DB tables.
  Modules_Add = 108 [(clarfai_exposed) = true,
                   (clarifai_depending_scopes) = Modules_Get,
                   deprecated = true];

  // Read from the modules and modules versions DB tables.
  Modules_Get = 109 [(clarfai_exposed) = true,
                     deprecated = true];

  // To delete we need read/write.
  Modules_Delete = 110 [(clarfai_exposed) = true,
                      (clarifai_depending_scopes) = Modules_Add,
                      (clarifai_depending_scopes) = Modules_Get,
                      deprecated = true];


	// Write to the InstalledModuleVersions DB tables.
  InstalledModuleVersions_Add = 111 [(clarfai_exposed) = true,
                                     (clarifai_depending_scopes) = InstalledModuleVersions_Get,
                                     (clarifai_depending_scopes) = Modules_Get,
                                     deprecated = true];

  // Read from the InstalledModuleVersions and InstalledModuleVersions versions DB tables.
  InstalledModuleVersions_Get = 112 [(clarfai_exposed) = true,
                                     (clarifai_depending_scopes) = Modules_Get,
                                     deprecated = true];

  // To delete we need read/write.
  InstalledModuleVersions_Delete = 113 [(clarfai_exposed) = true,
                                        (clarifai_depending_scopes) = InstalledModuleVersions_Add,
                                        (clarifai_depending_scopes) = InstalledModuleVersions_Get,
                                        (clarifai_depending_scopes) = Modules_Get,
                                        deprecated = true];

  // Make an rpc to our search services.
  Search = 3 [(clarfai_exposed) = true];

  // To get a saved search.
  SavedSearch_Get = 114 [(clarfai_exposed) = true];

  // To add a saved search
  SavedSearch_Add = 115 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = SavedSearch_Get];

  // To delete a saved search
  SavedSearch_Delete=116 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = SavedSearch_Get,
    (clarifai_depending_scopes) = SavedSearch_Add];

  ModelVersionPublications_Add=117 [(clarfai_exposed) = true];
  ModelVersionPublications_Delete=118 [(clarfai_exposed) = true];

  WorkflowPublications_Add=119 [(clarfai_exposed) = true];
  WorkflowPublications_Delete=120 [(clarfai_exposed) = true];

  // To write bulk operations to the DB
  BulkOperation_Add = 121 [(clarfai_exposed) = true, (clarifai_depending_scopes) = BulkOperation_Get];

  // To Read Bulk Operations from the DB
  BulkOperation_Get = 122 [(clarfai_exposed) = true];

  // To Delete Bulk Operations from the DB
  BulkOperation_Delete = 123 [(clarfai_exposed) = true, (clarifai_depending_scopes) = BulkOperation_Add,
    (clarifai_depending_scopes) = BulkOperation_Get];

  // To read historical usage from usage.dashboard_items table
  HistoricalUsage_Get = 124;

  // To read uploaded files and archives info from Uploads endpoints
  Uploads_Get = 128 [(clarfai_exposed) = true];

  // To upload files or archives through the Uploads endpoints
  Uploads_Add = 129 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Uploads_Get];

  Uploads_Delete = 130 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Uploads_Get,
    (clarifai_depending_scopes) = Uploads_Add];

  // To control remote runners
  Runners_Get = 131 [(clarfai_exposed) = true];

  Runners_Add = 132 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Runners_Get];

  Runners_Delete = 133 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Runners_Get,
    (clarifai_depending_scopes) = Runners_Add];

  RunnerItems_Get = 134 [(clarfai_exposed) = true];

  RunnerItems_Add = 135 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = RunnerItems_Get];

  // Pools of compute resources.
  Nodepools_Get = 136 [(clarfai_exposed) = true];

  Nodepools_Add = 137 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Nodepools_Get];

  Nodepools_Delete = 138 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Nodepools_Get,
    (clarifai_depending_scopes) = Nodepools_Add];

  // Cluster of machines in a region of cloud
  ComputeClusters_Get = 139 [(clarfai_exposed) = true];

  ComputeClusters_Add = 140 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = ComputeClusters_Get];

  ComputeClusters_Delete = 141 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = ComputeClusters_Get,
    (clarifai_depending_scopes) = ComputeClusters_Add];

  // How to autoscale resources within nodepools.
  Deployments_Get = 144 [(clarfai_exposed) = true];

  Deployments_Add = 145 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Deployments_Get];

  Deployments_Delete = 146 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Deployments_Get,
    (clarifai_depending_scopes) = Deployments_Add];


  InstanceTypes_Get = 148 [(clarfai_exposed) = true];

  AuditLogs_Get = 149 [(clarfai_exposed) = true];

  LogEntries_Get = 151 [(clarfai_exposed) = true];

  WorkflowVersionEvaluations_Get = 152 [(clarfai_exposed) = true];
  WorkflowVersionEvaluations_Add = 153 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = WorkflowVersionEvaluations_Get];

  Pipelines_Get = 154 [(clarfai_exposed) = true];
  Pipelines_Add = 155 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Pipelines_Get];
  Pipelines_Delete = 156 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Pipelines_Get,
    (clarifai_depending_scopes) = Pipelines_Add
  ];

  PipelineSteps_Get = 157 [(clarfai_exposed) = true];
  PipelineSteps_Add = 158 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = PipelineSteps_Get];
  // To pull the pipeline step version's image
  PipelineSteps_Pull = 159 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = PipelineSteps_Get];

  Secrets_Get = 160 [(clarfai_exposed) = true];
  Secrets_Add = 161 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Secrets_Get];
  Secrets_Delete = 162 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Secrets_Get,
    (clarifai_depending_scopes) = Secrets_Add];

  UserMetrics_Get = 163 [(clarfai_exposed) = true];

  AnnotationTracks_Get = 166 [(clarfai_exposed) = true];
  AnnotationTracks_Add = 167 [(clarfai_exposed) = true];
  AnnotationTracks_Delete = 168 [(clarfai_exposed) = true];

  PipelineSteps_Delete = 169 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = PipelineSteps_Get,
    (clarifai_depending_scopes) = PipelineSteps_Add];

  Artifacts_Get = 170 [(clarfai_exposed) = true];
  Artifacts_Add = 171 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Artifacts_Get];
  Artifacts_Delete = 172 [(clarfai_exposed) = true,
    (clarifai_depending_scopes) = Artifacts_Get,
    (clarifai_depending_scopes) = Artifacts_Add];

  // Pipeline version run status logs (audit trail)
  PipelineVersionRunStatusLogs_Get = 173 [(clarfai_exposed) = true];
}

extend google.protobuf.EnumValueOptions {
  // indicates whether the given scope should be returned by the Get /scopes/ call
  // or any other call that returns list of available perms.
  bool clarfai_exposed = 80318;
  // TODO: We have no way of picking extension field numbers within clarifai to guarantee
  // uniqueness.  Note: 50000-99999 are for organizational use (like this)
  repeated S clarifai_depending_scopes = 80319;
}