syntax = "proto3";

package yandex.cloud.iam.v1;

import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "yandex/cloud/iam/v1/key.proto";
import "yandex/cloud/api/operation.proto";
import "yandex/cloud/operation/operation.proto";
import "yandex/cloud/validation.proto";

option go_package = "github.com/yandex-cloud/go-genproto/yandex/cloud/iam/v1;iam";
option java_package = "yandex.cloud.api.iam.v1";

// A set of methods for managing Key resources.
service KeyService {
  // Returns the specified Key resource.
  //
  // To get the list of available Key resources, make a [List] request.
  rpc Get (GetKeyRequest) returns (Key) {
    option (google.api.http) = { get: "/iam/v1/keys/{key_id}" };
  }

  // Retrieves the list of Key resources for the specified service account.
  rpc List (ListKeysRequest) returns (ListKeysResponse) {
    option (google.api.http) = { get: "/iam/v1/keys" };
  }

  // Creates a key pair for the specified service account.
  rpc Create (CreateKeyRequest) returns (CreateKeyResponse) {
    option (google.api.http) = { post: "/iam/v1/keys" body: "*" };
  }

  // Updates the specified key pair.
  rpc Update (UpdateKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { patch: "/iam/v1/keys/{key_id}" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "UpdateKeyMetadata"
      response: "Key"
    };
  }

  // Deletes the specified key pair.
  rpc Delete (DeleteKeyRequest) returns (operation.Operation) {
    option (google.api.http) = { delete: "/iam/v1/keys/{key_id}" };
    option (yandex.cloud.api.operation) = {
      metadata: "DeleteKeyMetadata"
      response: "google.protobuf.Empty"
    };
  }

  // Lists operations for the specified key.
  rpc ListOperations (ListKeyOperationsRequest) returns (ListKeyOperationsResponse) {
    option (google.api.http) = { get: "/iam/v1/keys/{key_id}/operations" };
  }
}

message GetKeyRequest {
  // ID of the Key resource to return.
  // To get the ID use a [KeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // Output format of the key.
  KeyFormat format = 2;
}

message ListKeysRequest {
  // Output format of the key.
  KeyFormat format = 1;

  // ID of the service account to list key pairs for.
  // To get the service account ID, use a [yandex.cloud.iam.v1.ServiceAccountService.List] request.
  // If not specified, it defaults to the subject that made the request.
  string service_account_id = 2 [(length) = "<=50"]; // use userAccount identity if this not set

  // The maximum number of results per page to return. If the number of available
  // results is larger than [page_size],
  // the service returns a [ListKeysResponse.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 3 [(value) = "<=1000"];

  // Page token. To get the next page of results, set [page_token] to the
  // [ListKeysResponse.next_page_token] returned by a previous list request.
  string page_token = 4 [(length) = "<=100"];
}

message ListKeysResponse {
  // List of Key resources.
  repeated Key keys = 1;

  // This token allows you to get the next page of results for list requests. If the number of results
  // is larger than [ListKeysRequest.page_size], use
  // the [next_page_token] as the value
  // for the [ListKeysRequest.page_token] query parameter
  // in the next list request. Each subsequent list request will have its own
  // [next_page_token] to continue paging through the results.
  string next_page_token = 2;
}

message CreateKeyRequest {
  // ID of the service account to create a key pair for.
  // To get the service account ID, use a [yandex.cloud.iam.v1.ServiceAccountService.List] request.
  // If not specified, it defaults to the subject that made the request.
  string service_account_id = 1 [(length) = "<=50"]; // use userAccount identity if this not set

  // Description of the key pair.
  string description = 2 [(length) = "<=256"];

  // Output format of the key.
  KeyFormat format = 3;

  // An algorithm used to generate a key pair of the Key resource.
  Key.Algorithm key_algorithm = 4;
}

message CreateKeyResponse {
  // Key resource.
  Key key = 1;

  // A private key of the Key resource.
  // This key must be stored securely.
  string private_key = 2;
}

message UpdateKeyRequest {
  // ID of the Key resource to update.
  // To get key pair ID, use a [KeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // Field mask that specifies which fields of the Key resource are going to be updated.
  google.protobuf.FieldMask update_mask = 2;

  // Description of the key pair.
  string description = 3 [(length) = "<=256"];
}

message UpdateKeyMetadata {
  // ID of the Key resource that is being updated.
  string key_id = 1;
}

message DeleteKeyRequest {
  // ID of the key to delete.
  // To get key ID use a [KeyService.List] request.
  string key_id = 1 [(required) = true, (length) = "<=50"];
}

message DeleteKeyMetadata {
  // ID of the key that is being deleted.
  string key_id = 1;
}

message ListKeyOperationsRequest {
  // ID of the key to list operations for.
  string key_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page to return. If the number of available
  // results is larger than [page_size],
  // the service returns a [ListKeyOperationsResponse.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "0-1000"];

  // Page token. To get the next page of results, set [page_token] to the
  // [ListKeyOperationsResponse.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListKeyOperationsResponse {
  // List of operations for the specified key.
  repeated operation.Operation operations = 1;

  // This token allows you to get the next page of results for list requests. If the number of results
  // is larger than [ListKeyOperationsRequest.page_size], use the [next_page_token] as the value
  // for the [ListKeyOperationsRequest.page_token] query parameter in the next list request.
  // Each subsequent list request will have its own [next_page_token] to continue paging through the results.
  string next_page_token = 2;
}

enum KeyFormat {

  // Privacy-Enhanced Mail (PEM) format. Default value.
  PEM_FILE = 0;
}