syntax = "proto3";

package global.nextgen.v1;

import "global/common/v1/resources.proto";
import "global/common/v1/service_plan.proto";
import "google/api/field_behavior.proto";
import "google/protobuf/timestamp.proto";

service CustomerManagedEncryptionKeyService {
  rpc GetCmekAccessIamPrincipal(GetCmekAccessIamPrincipalRequest) returns (CmekAccessIamPrincipal) {}

  rpc VerifyCmekAccessIamPrincipal(VerifyCmekAccessIamPrincipalRequest) returns (VerifyCmekAccessIamPrincipalResponse) {}

  rpc GetCustomerManagedEncryptionKey(GetCustomerManagedEncryptionKeyRequest) returns (CustomerManagedEncryptionKey) {}

  rpc GetCustomerManagedEncryptionKeyByClusterId(GetCustomerManagedEncryptionKeyByClusterIdRequest) returns (CustomerManagedEncryptionKey) {}

  rpc ListCustomerManagedEncryptionKeys(ListCustomerManagedEncryptionKeysRequest) returns (ListCustomerManagedEncryptionKeysResponse) {}
}

message GetCmekAccessIamPrincipalRequest {
  uint64 organization_id = 1 [(google.api.field_behavior) = REQUIRED];
  common.v1.CloudProvider.Name cloud_provider_id = 2 [(google.api.field_behavior) = REQUIRED];
  common.v1.Region.Name region_id = 3 [(google.api.field_behavior) = REQUIRED];
  common.v1.ServicePlan service_plan = 4 [(google.api.field_behavior) = REQUIRED];
}

message CmekAccessIamPrincipal {
  uint64 organization_id = 1 [(google.api.field_behavior) = REQUIRED];
  common.v1.CloudProvider.Name cloud_provider_id = 2 [(google.api.field_behavior) = REQUIRED];
  common.v1.Region.Name region_id = 3 [(google.api.field_behavior) = REQUIRED];
  common.v1.ServicePlan service_plan = 4 [(google.api.field_behavior) = REQUIRED];

  oneof principal {
    AwsCmekPrincipal aws = 5;
    AliyunCmekPrincipal aliyun = 6;
  }

  message AwsCmekPrincipal {
    string account_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
    // AWS STS AssumeRole ExternalId to be pinned in the customer's KMS key
    // policy Condition block.
    string external_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  message AliyunCmekPrincipal {
    string account_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  }
}

message VerifyCmekAccessIamPrincipalRequest {
  CustomerManagedEncryptionKey key = 1 [(google.api.field_behavior) = REQUIRED];
  // Optional existing TiDB cluster ID. When omitted, verification uses the
  // organization's default shared pool for the key region, matching cluster
  // creation behavior before a TiDB ID exists.
  uint64 cluster_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

message VerifyCmekAccessIamPrincipalResponse {
  bool valid = 1;
  string fail_reason = 2;
}

message GetCustomerManagedEncryptionKeyRequest {
  uint64 customer_managed_encryption_key_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message GetCustomerManagedEncryptionKeyByClusterIdRequest {
  uint64 cluster_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message CustomerManagedEncryptionKey {
  uint64 customer_managed_encryption_key_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  uint64 organization_id = 2 [(google.api.field_behavior) = REQUIRED];

  common.v1.CloudProvider.Name cloud_provider_id = 3 [(google.api.field_behavior) = REQUIRED];
  common.v1.Region.Name region_id = 4 [(google.api.field_behavior) = REQUIRED];
  common.v1.ServicePlan service_plan = 5 [(google.api.field_behavior) = REQUIRED];

  oneof key {
    AwsKms aws_kms = 6;
    AliyunKms aliyun_kms = 11;
  }

  oneof principal {
    CmekAccessIamPrincipal.AwsCmekPrincipal aws_principal = 7;
    CmekAccessIamPrincipal.AliyunCmekPrincipal aliyun_principal = 12;
  }

  google.protobuf.Timestamp create_time = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp update_time = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp delete_time = 10 [(google.api.field_behavior) = OUTPUT_ONLY];

  message AwsKms {
    string kms_key_arn = 1 [(google.api.field_behavior) = REQUIRED];
  }

  message AliyunKms {
    string kms_key_arn = 1 [(google.api.field_behavior) = REQUIRED];
  }
}

message ListCustomerManagedEncryptionKeysRequest {
  uint64 organization_id = 1 [(google.api.field_behavior) = REQUIRED];

  repeated uint64 customer_managed_encryption_key_ids = 2 [(google.api.field_behavior) = OPTIONAL];
  repeated common.v1.CloudProvider.Name cloud_provider_ids = 3 [(google.api.field_behavior) = OPTIONAL];
  repeated common.v1.Region.Name region_ids = 4 [(google.api.field_behavior) = OPTIONAL];
  repeated common.v1.ServicePlan service_plans = 5 [(google.api.field_behavior) = OPTIONAL];
}

message ListCustomerManagedEncryptionKeysResponse {
  repeated CustomerManagedEncryptionKey customer_managed_encryption_keys = 1;
}