syntax = "proto3";

package nexuscrm.runtime.v1;

import "common/v1/common.proto";

option go_package = "github.com/pingcap-inc/nexuscrm-contract/wire-go/gen/runtime/v1;runtimev1";

// PermissionAuthoringService is the single Runtime owner for the complete
// stored PermissionSet aggregate. A save is one durable command covering all
// five grant families; status reconciles an accepted command after an
// ambiguous transport outcome.
service PermissionAuthoringService {
  rpc ReadPermissionAuthoringSnapshot(ReadPermissionAuthoringSnapshotRequest) returns (ReadPermissionAuthoringSnapshotResponse);
  rpc SavePermissionAuthoring(SavePermissionAuthoringRequest) returns (SavePermissionAuthoringResponse);
  rpc GetPermissionAuthoringStatus(GetPermissionAuthoringStatusRequest) returns (GetPermissionAuthoringStatusResponse);
}

enum PermissionAuthoringTargetKind {
  PERMISSION_AUTHORING_TARGET_KIND_UNSPECIFIED = 0;
  PERMISSION_AUTHORING_TARGET_KIND_PROFILE = 1;
  PERMISSION_AUTHORING_TARGET_KIND_PERMISSION_SET = 2;
}

message PermissionAuthoringTarget {
  PermissionAuthoringTargetKind kind = 1;
  string id = 2;
}

message PermissionAuthoringSystemPermission {
  string permission_id = 1;
  string label = 2;
  string category = 3;
  string description = 4;
  string requires_permission_id = 5;
}

message PermissionAuthoringRecordType {
  string record_type_id = 1;
  string resource_type = 2;
  string stable_name = 3;
  string label = 4;
  bool active = 5;
}

message PermissionAuthoringCustomPermission {
  string permission_id = 1;
  string stable_name = 2;
  string label = 3;
}

message PermissionAuthoringCapabilityGrant {
  string capability_id = 1;
  bool enabled = 2;
}

message PermissionAuthoringObjectGrant {
  string resource_type = 1;
  bool read = 2;
  bool create = 3;
  bool edit = 4;
  bool delete = 5;
  bool view_all = 6;
  bool modify_all = 7;
}

message PermissionAuthoringFieldGrant {
  string resource_type = 1;
  string field_name = 2;
  bool read = 3;
  bool edit = 4;
}

message PermissionAuthoringRecordTypeGrant {
  string record_type_id = 1;
  bool visible = 2;
}

message PermissionAuthoringCatalog {
  repeated PermissionAuthoringSystemPermission system = 1;
  repeated PermissionAuthoringRecordType record_types = 2;
  repeated PermissionAuthoringCustomPermission custom = 3;
}

message PermissionAuthoringStoredGrants {
  repeated PermissionAuthoringCapabilityGrant system = 1;
  repeated PermissionAuthoringObjectGrant objects = 2;
  repeated PermissionAuthoringFieldGrant fields = 3;
  repeated PermissionAuthoringRecordTypeGrant record_types = 4;
  repeated PermissionAuthoringCapabilityGrant custom = 5;
}

message ReadPermissionAuthoringSnapshotRequest {
  PermissionAuthoringTarget target = 1;
  optional uint64 min_catalog_revision = 2;
}

message ReadPermissionAuthoringSnapshotResponse {
  string canonical_permission_set_id = 1;
  string authoring_token = 2;
  PermissionAuthoringCatalog catalog = 3;
  PermissionAuthoringStoredGrants grants = 4;
  nexuscrm.common.v1.ConsistencyReceipts receipts = 5;
}

message PermissionAuthoringCapabilityGrantChange {
  string capability_id = 1;
  bool enabled = 2;
}

message PermissionAuthoringObjectGrantChange {
  string resource_type = 1;
  bool read = 2;
  bool create = 3;
  bool edit = 4;
  bool delete = 5;
  bool view_all = 6;
  bool modify_all = 7;
}

message PermissionAuthoringFieldGrantChange {
  string resource_type = 1;
  string field_name = 2;
  bool read = 3;
  bool edit = 4;
}

message PermissionAuthoringRecordTypeGrantChange {
  string record_type_id = 1;
  bool visible = 2;
  string resource_type = 3;
}

message PermissionAuthoringChanges {
  repeated PermissionAuthoringCapabilityGrantChange system = 1;
  repeated PermissionAuthoringObjectGrantChange objects = 2;
  repeated PermissionAuthoringFieldGrantChange fields = 3;
  repeated PermissionAuthoringRecordTypeGrantChange record_types = 4;
  repeated PermissionAuthoringCapabilityGrantChange custom = 5;
}

message SavePermissionAuthoringRequest {
  string command_id = 1;
  PermissionAuthoringTarget target = 2;
  string expected_authoring_token = 3;
  PermissionAuthoringChanges changes = 4;
  optional uint64 min_catalog_revision = 5;
}

enum PermissionAuthoringOutcome {
  PERMISSION_AUTHORING_OUTCOME_UNSPECIFIED = 0;
  PERMISSION_AUTHORING_OUTCOME_APPLIED = 1;
  PERMISSION_AUTHORING_OUTCOME_NOOP = 2;
  PERMISSION_AUTHORING_OUTCOME_REJECTED = 3;
}

enum PermissionAuthoringRejectionCode {
  PERMISSION_AUTHORING_REJECTION_CODE_UNSPECIFIED = 0;
  PERMISSION_AUTHORING_REJECTION_CODE_DENIED = 1;
  PERMISSION_AUTHORING_REJECTION_CODE_MISSING = 2;
  PERMISSION_AUTHORING_REJECTION_CODE_STALE_AUTHORING_STATE = 3;
  PERMISSION_AUTHORING_REJECTION_CODE_INVALID_CHANGE = 4;
  PERMISSION_AUTHORING_REJECTION_CODE_CONFLICT = 5;
}

message SavePermissionAuthoringResponse {
  string command_id = 1;
  bytes semantic_sha256 = 2;
  PermissionAuthoringOutcome outcome = 3;
  PermissionAuthoringRejectionCode rejection_code = 4;
  string canonical_permission_set_id = 5;
  string authoring_token = 6;
  nexuscrm.common.v1.ConsistencyReceipts receipts = 7;
  string outcome_expires_at_utc = 8;
}

message GetPermissionAuthoringStatusRequest {
  string command_id = 1;
  bytes semantic_sha256 = 2;
}

enum PermissionAuthoringCommandState {
  PERMISSION_AUTHORING_COMMAND_STATE_UNSPECIFIED = 0;
  PERMISSION_AUTHORING_COMMAND_STATE_ACCEPTED = 1;
  PERMISSION_AUTHORING_COMMAND_STATE_EXECUTING = 2;
  PERMISSION_AUTHORING_COMMAND_STATE_COMPLETED = 3;
}

message GetPermissionAuthoringStatusResponse {
  string command_id = 1;
  bytes semantic_sha256 = 2;
  PermissionAuthoringCommandState state = 3;
  SavePermissionAuthoringResponse result = 4;
}