syntax = "proto3";

import "proto/clarifai/auth/scope/scope.proto";
import "proto/clarifai/auth/types/types.proto";

import "google/protobuf/descriptor.proto";

package clarifai.auth.util;

option go_package = "github.com/Clarifai/clarifai-go-grpc/proto/clarifai/auth/util";
option java_multiple_files = true;
option java_package = "com.clarifai.grpc.auth.util";
option objc_class_prefix = "CAIP";

extend google.protobuf.FieldOptions {
  // indicates if this field should be private. If true, then internal use only. If False,
  // then publicly avaliable to world.
  bool cl_private_field = 80320;
}

extend google.protobuf.MethodOptions {
  // indicates if this rpc should be private. If true, then internal use only. If False,
  // then publicly available to world.
  bool cl_private_rpc = 80321;

  // For each grpc method we define a list of required low-level auth scopes that are needed
  // for the key that is issuing the request. These are checked at authorization time for the
  // request as one of the first things in the life of a request once it reaches out API
  // servers. There are additional checks for each scope when the resource is used throughout the
  // backend in order to protect that resource. For example, Inputs_Add protects the writes to the
  // inputs DB table. Since we know every PostInputs call needs to do that, we add Inputs_Add scope
  // to the cl_depending_scopes list for the PostInputs method.
  //
  // This is only checked valid when used with KeyAuth cl_auth_type.
  //
  // This should be the absolute minimum required scopes to make API calls with the method
  // that this options is used for. If there are some scopes that are needed some of the time
  // depending on the request, then leave those out as they will be checked at the tighest
  // possible portion of the codebase to protect that resource and won't effect every API call. For
  // example, the PostAnnotations call is often used to add concepts as well. If those concepts are
  // new, then the Concepts_Add scope will be needed. But since you don't always annotate with
  // concepts, it is not a hard requirements that Concepts_Add is used.
  repeated clarifai.auth.scope.S cl_depending_scopes = 80322;

  // This is the authorizer type for the endpoint our of multiple backend authorizers.
  clarifai.auth.types.AuthType cl_auth_type = 80323;
}

extend google.protobuf.MessageOptions {
  // indicates if this message should be private. If true, then internal use only. If False,
  // then publicly avaliable to world.
  bool cl_private_message = 80324;
}