syntax = "proto3";
package rafay.dev.sentry.rpc;

import "google/api/annotations.proto";
import "protoc-gen-openapiv2/options/annotations.proto";
import "proto/types/commonpb/v3/common.proto";
import "proto/types/sentry/sentry.proto";

option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  info : {
    title : "Sentry KubeConfig Service"
    version : "2.0"
    contact : {name : "Rafay Dev"}
  }
  schemes : HTTPS
  consumes : "application/json"
  consumes : "application/yaml"
  produces : "application/json"
  produces : "application/yaml"
  security_definitions : {
    security : {
      key : "BasicAuth"
      value : {type : TYPE_BASIC}
    }
    security : {
      key : "ApiKeyAuth"
      value : {type : TYPE_API_KEY in : IN_HEADER name : "X-RAFAY-API-KEYID"}
    }
  }
  security : {
    security_requirement : {
      key : "BasicAuth"
      value : {}
    }
    security_requirement : {
      key : "ApiKeyAuth"
      value : {}
    }
  }
  responses : {
    key : "403"
    value : {
      description : "Returned when the user does not have permission to access "
                    "the resource."
    }
  }
  responses : {
    key : "404"
    value : {
      description : "Returned when the resource does not exist."
      schema : {json_schema : {type : STRING}}
    }
  }
};

message GetForClusterRequest {
  rafay.dev.types.common.v3.QueryOptions opts = 1;
  string namespace = 2;
  bool systemUser = 3;
}

message GetForUserRequest {
  rafay.dev.types.common.v3.QueryOptions opts = 1;
  string namespace = 2;
}

message RevokeKubeconfigRequest {
	rafay.dev.types.common.v3.QueryOptions opts = 1;
}

message RevokeKubeconfigResponse {}

message UpdateKubeconfigSettingRequest {
	rafay.dev.types.common.v3.QueryOptions opts = 1;
	int64 validitySeconds = 2;
    bool enableSessionCheck = 3;
    bool enablePrivateRelay = 4;
    bool enforceOrgAdminSecretAccess = 5;
    bool disableWebKubectl = 6;
    bool disableCLIKubectl = 7;
}

message UpdateKubeconfigSettingResponse {}

message GetKubeconfigSettingRequest {
	rafay.dev.types.common.v3.QueryOptions opts = 1;
}

message GetKubeconfigSettingResponse {
	int64 validitySeconds = 1;
  bool enableSessionCheck = 2;
  bool enablePrivateRelay = 3;
  bool enforceOrgAdminSecretAccess = 4;
  bool disableWebKubectl = 5;
  bool disableCLIKubectl = 6;
}

service KubeConfig {
  rpc GetForClusterWebSession(GetForClusterRequest)
      returns (rafay.dev.types.common.v3.HttpBody) {
    option (google.api.http) = {
      get : "/v2/sentry/kubeconfig/clusterwebsession"
    };
  };

  rpc GetForClusterSystemSession(GetForClusterRequest)
      returns (rafay.dev.types.common.v3.HttpBody) {
    option (google.api.http) = {
      get : "/v2/sentry/kubeconfig/clustersystemsession"
    };
  };

  rpc GetForUser(GetForUserRequest) returns (rafay.dev.types.common.v3.HttpBody) {
    option (google.api.http) = {
      get : "/v2/sentry/kubeconfig/user"
      additional_bindings {
        get : "/v2/sentry/kubeconfig/{opts.urlScope=user/*}/download"
      }
    };
  };

  rpc RevokeKubeconfig(RevokeKubeconfigRequest) returns (RevokeKubeconfigResponse) {
    option (google.api.http) = {
      post : "/v2/sentry/kubeconfig/revoke"
      body : "*"
      additional_bindings {
        post : "/v2/sentry/kubeconfig/{opts.urlScope=user/*}/revoke"
        body : "*"
      }
    };
  };

  rpc GetOrganizationSetting(GetKubeconfigSettingRequest) returns (GetKubeconfigSettingResponse) {
    option (google.api.http) = {
        get : "/v2/sentry/kubeconfig/{opts.urlScope=organization/*}/setting"
    };
  };

  rpc GetUserSetting(GetKubeconfigSettingRequest) returns (GetKubeconfigSettingResponse) {
    option (google.api.http) = {
        get : "/v2/sentry/kubeconfig/{opts.urlScope=user/*}/setting"
    };
  };

  rpc GetSSOUserSetting(GetKubeconfigSettingRequest) returns (GetKubeconfigSettingResponse) {
    option (google.api.http) = {
        get : "/v2/sentry/kubeconfig/{opts.urlScope=ssouser/*}/setting"
    };
  };

  rpc UpdateOrganizationSetting(UpdateKubeconfigSettingRequest) returns (UpdateKubeconfigSettingResponse) {
    option (google.api.http) = {
		put : "/v2/sentry/kubeconfig/{opts.urlScope=organization/*}/setting"
		body : "*"
    };
  };

  rpc UpdateUserSetting(UpdateKubeconfigSettingRequest) returns (UpdateKubeconfigSettingResponse) {
    option (google.api.http) = {
		put : "/v2/sentry/kubeconfig/{opts.urlScope=user/*}/setting"
		body : "*"
    };
  }

  rpc UpdateSSOUserSetting(UpdateKubeconfigSettingRequest) returns (UpdateKubeconfigSettingResponse) {
    option (google.api.http) = {
		put : "/v2/sentry/kubeconfig/{opts.urlScope=ssouser/*}/setting"
		body : "*"
    };
  }
};