syntax = "proto3";

package yandex.cloud.lockbox.v1;

import "google/api/annotations.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
import "yandex/cloud/access/access.proto";
import "yandex/cloud/api/operation.proto";
import "yandex/cloud/lockbox/v1/secret.proto";
import "yandex/cloud/operation/operation.proto";
import "yandex/cloud/validation.proto";

option go_package = "github.com/yandex-cloud/go-genproto/yandex/cloud/lockbox/v1;lockbox";
option java_package = "yandex.cloud.api.lockbox.v1";

// A set of methods for managing secrets.
service SecretService {
  // Returns the specified secret.
  //
  // To get the list of all available secrets, make a [List] request.
  // Use [PayloadService.Get] to get the payload (confidential data themselves) of the secret.
  rpc Get (GetSecretRequest) returns (Secret) {
    option (google.api.http) = { get: "/lockbox/v1/secrets/{secret_id}" };
  }

  // Retrieves the list of secrets in the specified folder.
  rpc List (ListSecretsRequest) returns (ListSecretsResponse) {
    option (google.api.http) = { get: "/lockbox/v1/secrets" };
  }

  // Creates a secret in the specified folder.
  rpc Create (CreateSecretRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "CreateSecretMetadata"
      response: "Secret"
    };
  }

  // Updates the specified secret.
  rpc Update (UpdateSecretRequest) returns (operation.Operation) {
    option (google.api.http) = { patch: "/lockbox/v1/secrets/{secret_id}" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "UpdateSecretMetadata"
      response: "Secret"
    };
  }

  // Deletes the specified secret.
  rpc Delete (DeleteSecretRequest) returns (operation.Operation) {
    option (google.api.http) = { delete: "/lockbox/v1/secrets/{secret_id}" };
    option (yandex.cloud.api.operation) = {
      metadata: "DeleteSecretMetadata"
      response: "Secret"
    };
  }

  // Activates the specified secret.
  rpc Activate (ActivateSecretRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{secret_id}:activate" };
    option (yandex.cloud.api.operation) = {
      metadata: "ActivateSecretMetadata"
      response: "Secret"
    };
  }

  // Deactivates the specified secret.
  rpc Deactivate (DeactivateSecretRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{secret_id}:deactivate" };
    option (yandex.cloud.api.operation) = {
      metadata: "DeactivateSecretMetadata"
      response: "Secret"
    };
  }

  // Retrieves the list of versions of the specified secret.
  rpc ListVersions (ListVersionsRequest) returns (ListVersionsResponse) {
    option (google.api.http) = { get: "/lockbox/v1/secrets/{secret_id}/versions" };
  }

  // Adds new version based on a previous one.
  rpc AddVersion (AddVersionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{secret_id}:addVersion" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "AddVersionMetadata"
      response: "Version"
    };
  }

  // Schedules the specified version for destruction.
  //
  // Scheduled destruction can be cancelled with the [SecretService.CancelVersionDestruction] method.
  rpc ScheduleVersionDestruction (ScheduleVersionDestructionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{secret_id}:scheduleVersionDestruction" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "ScheduleVersionDestructionMetadata"
      response: "Version"
    };
  }

  // Cancels previously scheduled version destruction, if the version hasn't been destroyed yet.
  rpc CancelVersionDestruction (CancelVersionDestructionRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{secret_id}:cancelVersionDestruction" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "CancelVersionDestructionMetadata"
      response: "Version"
    };
  }

  // Lists operations for the specified secret.
  rpc ListOperations (ListSecretOperationsRequest) returns (ListSecretOperationsResponse) {
    option (google.api.http) = { get: "/lockbox/v1/secrets/{secret_id}/operations" };
  }

  // Lists existing access bindings for the specified secret.
  rpc ListAccessBindings (access.ListAccessBindingsRequest) returns (access.ListAccessBindingsResponse) {
    option (google.api.http) = { get: "/lockbox/v1/secrets/{resource_id}:listAccessBindings" };
  }

  // Sets access bindings for the secret.
  rpc SetAccessBindings (access.SetAccessBindingsRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{resource_id}:setAccessBindings" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "access.SetAccessBindingsMetadata"
      response: "google.protobuf.Empty"
    };
  }

  // Updates access bindings for the secret.
  rpc UpdateAccessBindings (access.UpdateAccessBindingsRequest) returns (operation.Operation) {
    option (google.api.http) = { post: "/lockbox/v1/secrets/{resource_id}:updateAccessBindings" body: "*" };
    option (yandex.cloud.api.operation) = {
      metadata: "access.UpdateAccessBindingsMetadata"
      response: "google.protobuf.Empty"
    };
  }
}


message PayloadEntryChange {
  // Non-confidential key of the entry.
  string key = 1 [(required) = true, (length) = "<=256", (pattern) = "[-_./\\\\@0-9a-zA-Z]+"];

  // Confidential value of the entry.
  oneof value {
    // Use the field to set a text value.
    string text_value = 2 [(length) = "<=65536"];

    // Use the field to set a binary value.
    bytes binary_value = 3 [(length) = "<=65536"];
  }
}

message GetSecretRequest {
  // ID of the secret to return.
  //
  // To get a secret ID make a [List] request.
  string secret_id = 1 [(required) = true, (length) = "<=50"];
}

message ListSecretsRequest {
  // ID of the folder to list secrets in.
  string folder_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page to return. If the number of available
  // results is larger than `page_size`, the service returns a [ListSecretsRequest.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set `page_token` to the
  // [ListSecretsRequest.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListSecretsResponse {
  // List of secrets in the specified folder.
  repeated Secret secrets = 1;

  // This token allows you to get the next page of results for list requests. If the number
  // of results is greater than the specified [ListSecretsRequest.page_size], use
  // the `next_page_token` as the value for the [ListSecretsRequest.page_token] query parameter
  // in the next list request. Each subsequent list request will have its own
  // `next_page_token` to continue paging through the results.
  string next_page_token = 2;
}

message CreateSecretRequest {
  // ID of the folder to create a secret in.
  string folder_id = 1 [(required) = true, (length) = "<=50"];

  // Name of the secret.
  string name = 2 [(length) = "<=100"];

  // Description of the secret.
  string description = 3 [(length) = "<=1024"];

  // Custom labels for the secret as `key:value` pairs. Maximum 64 per key.
  // For example, `"project": "mvp"` or `"source": "dictionary"`.
  map<string, string> labels = 4 [(size) = "<=64", (length) = "<=63", (pattern) = "[-_0-9a-z]*", (map_key).length = "<=63", (map_key).pattern = "[a-z][-_0-9a-z]*"];

  // Optional ID of the KMS key will be used to encrypt and decrypt the secret.
  string kms_key_id = 5 [(length) = "<=50"];

  // Description of the first version.
  string version_description = 6 [(length) = "<=256"];

  // Payload entries added to the first version.
  repeated PayloadEntryChange version_payload_entries = 7 [(size) = "<=32"];

  // Flag that inhibits deletion of the secret.
  bool deletion_protection = 8;
}

message CreateSecretMetadata {
  // ID of the secret being created.
  string secret_id = 1;

  // ID of the current version of the secret being created.
  string version_id = 2;
}

message UpdateSecretRequest {
  // ID of the secret to update.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // Field mask that specifies which attributes of the secret are going to be updated.
  google.protobuf.FieldMask update_mask = 2 [(required) = true];

  // New name of the secret.
  string name = 3 [(length) = "<=100"];

  // New description of the secret.
  string description = 4 [(length) = "<=1024"];

  // Custom labels for the secret as `key:value` pairs. Maximum 64 per key.
  map<string, string> labels = 5 [(size) = "<=64", (length) = "<=63", (pattern) = "[-_0-9a-z]*", (map_key).length = "<=63", (map_key).pattern = "[a-z][-_0-9a-z]*"];

  // Flag that inhibits deletion of the secret.
  bool deletion_protection = 6;
}

message UpdateSecretMetadata {
  // ID of the secret being updated.
  string secret_id = 1 [(required) = true, (length) = "<=50"];
}

message DeleteSecretRequest {
  // ID of the secret to be deleted.
  string secret_id = 1 [(required) = true, (length) = "<=50"];
}

message DeleteSecretMetadata {
  // ID of the secret being deleted.
  string secret_id = 1;
}

message ActivateSecretRequest {
  // ID of the secret to be activated.
  string secret_id = 1 [(required) = true, (length) = "<=50"];
}

message ActivateSecretMetadata {
  // ID of the secret being activated.
  string secret_id = 1;
}

message DeactivateSecretRequest {
  // ID of the secret to be deactivated.
  string secret_id = 1 [(required) = true, (length) = "<=50"];
}

message DeactivateSecretMetadata {
  // ID of the secret being deactivated.
  string secret_id = 1;
}

message AddVersionRequest {
  // ID of the secret.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // Description of the version.
  string description = 2 [(length) = "<=1024"];

  // Describe how payload entries of the base version change in the added version.
  repeated PayloadEntryChange payload_entries = 3 [(size) = "<=32"];

  // Optional base version id. Defaults to the current version if not specified
  string base_version_id = 4 [(length) = "<=50"];
}

message AddVersionMetadata {
  // ID of the secret.
  string secret_id = 1;

  // ID of the added version.
  string version_id = 2;
}

message ListVersionsRequest {
  // ID of the secret to list versions for.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page to return. If the number of available
  // results is larger than `page_size`, the service returns a [ListVersionsRequest.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set `page_token` to the
  // [ListVersionsRequest.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListVersionsResponse {
  // List of versions for the specified secret.
  repeated Version versions = 1;

  // This token allows you to get the next page of results for list requests. If the number
  // of results is greater than the specified [ListVersionsRequest.page_size], use
  // the `next_page_token` as the value for the [ListVersionsRequest.page_token] query parameter
  // in the next list request. Each subsequent list request will have its own
  // `next_page_token` to continue paging through the results.
  string next_page_token = 2;
}

message ScheduleVersionDestructionRequest {
  // ID of the secret whose version should be scheduled for destruction.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // ID of the version to be destroyed.
  string version_id = 2 [(required) = true, (length) = "<=50"];

  // Time interval between the version destruction request and actual destruction.
  // Default value: 7 days.
  google.protobuf.Duration pending_period = 3;
}

message ScheduleVersionDestructionMetadata {
  // ID of the secret whose version is being scheduled for destruction.
  string secret_id = 1;

  // ID of the version that is being scheduled for destruction.
  string version_id = 2;

  // Destruction timestamp.
  google.protobuf.Timestamp destroy_at = 3;
}

message CancelVersionDestructionRequest {
  // ID of the secret to cancel a version's destruction for.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // ID of the secret whose scheduled destruction should be cancelled.
  string version_id = 2 [(required) = true, (length) = "<=50"];
}

message CancelVersionDestructionMetadata {
  // ID of the secret whose version's destruction is being cancelled.
  string secret_id = 1;

  // ID of the version whose scheduled destruction is being cancelled.
  string version_id = 2;
}

message ListSecretOperationsRequest {
  // ID of the secret to get operations for.
  string secret_id = 1 [(required) = true, (length) = "<=50"];

  // The maximum number of results per page that should be returned. If the number of available
  // results is larger than `page_size`, the service returns a [ListSecretOperationsRequest.next_page_token]
  // that can be used to get the next page of results in subsequent list requests.
  // Default value: 100.
  int64 page_size = 2 [(value) = "<=1000"];

  // Page token. To get the next page of results, set `page_token` to the
  // [ListSecretOperationsRequest.next_page_token] returned by a previous list request.
  string page_token = 3 [(length) = "<=100"];
}

message ListSecretOperationsResponse {
  // List of operations for the specified secret.
  repeated operation.Operation operations = 1;

  // This token allows you to get the next page of results for list requests. If the number of results
  // is larger than [ListSecretOperationsResponse.page_size], use the `next_page_token` as the value
  // for the [ListSecretOperationsResponse.page_token] query parameter in the next list request.
  // Each subsequent list request will have its own `next_page_token` to continue paging through the results.
  string next_page_token = 2;
}