syntax = "proto3";

package global.nextgen.v1;

import "google/api/field_behavior.proto";
import "google/protobuf/empty.proto";

service DatabaseAuditLogService {
  rpc GetAuditLogSetting(GetAuditLogSettingRequest) returns (AuditLogSetting) {}
  rpc UpdateAuditLogSetting(UpdateAuditLogSettingRequest) returns (AuditLogSetting) {}

  rpc ListAuditLogFilterRules(ListAuditLogFilterRulesRequest) returns (ListAuditLogFilterRulesResponse) {}
  rpc CreateAuditLogFilterRule(CreateAuditLogFilterRuleRequest) returns (AuditLogFilterRule) {}
  rpc DeleteAuditLogFilterRule(DeleteAuditLogFilterRuleRequest) returns (google.protobuf.Empty) {}
  rpc UpdateAuditLogFilterRule(UpdateAuditLogFilterRuleRequest) returns (AuditLogFilterRule) {}
}

message AuditLogSetting {
  uint64 id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  uint64 cluster_id = 2 [(google.api.field_behavior) = REQUIRED];

  string bucket_url = 3 [(google.api.field_behavior) = REQUIRED];

  // Required on AWS and GCP.
  string region = 4 [(google.api.field_behavior) = OPTIONAL];

  // aws role arn, gcp serviceaccount, or azure SAS token.
  // Leave empty on Azure to use the kubelet identity instead of SAS token auth.
  optional string cloud_role_identity = 5 [(google.api.field_behavior) = OPTIONAL];

  // external id is the external id of the cloud role identity.
  string external_id = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Default is redacted.
  optional bool unredacted = 7 [(google.api.field_behavior) = OPTIONAL];

  // If unset, default to TEXT.
  string format = 8 [(google.api.field_behavior) = OPTIONAL];

  // Set the file size limitation for audit logs. A log rotation is triggered if the log file exceeds this limitation.
  // In the current version, If you set this variable to 0, TiDB automatically changes it to 10.
  int32 max_size_mib = 9 [(google.api.field_behavior) = OPTIONAL];

  // Set the time limitation for audit logs. A log rotation is triggered if the log file exceeds this limitation.
  // Setting this variable to 0 means to disable automatic log rotation by time.
  optional int32 max_age_second = 10 [(google.api.field_behavior) = OPTIONAL];

  // Default is disabled.
  optional bool enabled = 11 [(google.api.field_behavior) = OPTIONAL];
}

message AuditLogFilterRule {
  // For audit log v2, id is the pk in management service db.
  uint64 id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  uint64 cluster_id = 2 [(google.api.field_behavior) = REQUIRED];

  // For audit log v2, default is enabled.
  bool disabled = 3 [(google.api.field_behavior) = OPTIONAL];

  // For audit log v2, user_expr is required.
  string user_expr = 4 [(google.api.field_behavior) = REQUIRED];

  // For audit log v2, if event_types is empty, it means all events.
  repeated string event_types = 5 [(google.api.field_behavior) = OPTIONAL];

  // For audit log v2, if tables is empty, it means all tables.
  repeated string tables = 6 [(google.api.field_behavior) = OPTIONAL];

  // For audit log v2, if status_codes is empty, it means all events no matter success or failure.
  repeated int32 status_codes = 7 [(google.api.field_behavior) = OPTIONAL];

  // For audit log v2, default to `user_expr`.
  string display_name = 8 [(google.api.field_behavior) = OPTIONAL];
}

message GetAuditLogSettingRequest {
  uint64 cluster_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message UpdateAuditLogSettingRequest {
  AuditLogSetting audit_log_setting = 2 [(google.api.field_behavior) = REQUIRED];
  bool validate_only = 3 [(google.api.field_behavior) = OPTIONAL];
}

message ListAuditLogFilterRulesRequest {
  uint64 cluster_id = 1 [(google.api.field_behavior) = REQUIRED];
  uint64 audit_log_filter_rule_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

message ListAuditLogFilterRulesResponse {
  repeated AuditLogFilterRule audit_log_filter_rules = 1;
}

message CreateAuditLogFilterRuleRequest {
  AuditLogFilterRule audit_log_filter_rule = 1 [(google.api.field_behavior) = REQUIRED];
  bool validate_only = 2 [(google.api.field_behavior) = OPTIONAL];
}

message DeleteAuditLogFilterRuleRequest {
  uint64 audit_log_filter_rule_id = 1 [(google.api.field_behavior) = REQUIRED];
  uint64 cluster_id = 2 [(google.api.field_behavior) = REQUIRED];
}

message UpdateAuditLogFilterRuleRequest {
  AuditLogFilterRule audit_log_filter_rule = 1 [(google.api.field_behavior) = REQUIRED];
  uint64 cluster_id = 2 [(google.api.field_behavior) = REQUIRED];
  bool validate_only = 3 [(google.api.field_behavior) = OPTIONAL];
}