syntax = "proto3";

package tidb_cloud_open_api.nextgen.v1beta2;

import "google/api/annotations.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/timestamp.proto";
// buf:lint:ignore IMPORT_USED
import "google/rpc/status.proto"; // This is used by `responses.value.schema.json_schema.ref` in the swagger definition.
import "protoc-gen-openapiv2/options/annotations.proto";
import "tidb_cloud_open_api/common/v1beta1/region.proto";
import "tidb_cloud_open_api/common/v1beta1/service_plan.proto";

option go_package = "tidb_cloud_open_api/nextgen/v1beta2";
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  swagger: "2.0"
  host: "cloud.tidbapi.com"
  base_path: "/v1beta2"
  info: {
    version: "v1beta2"
    title: "TiDB Cloud Premium API"
    description: "TiDB Cloud Premium API"
  }
  schemes: HTTPS
  consumes: "application/json"
  produces: "application/json"

  responses: {
    key: "400"
    value: {
      description: "A request field is invalid."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "401"
    value: {
      description: "The API key cannot be authenticated."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "403"
    value: {
      description: "The API key does not have permission to access the resource."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "429"
    value: {
      description: "You have exceeded the rate limit."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
  responses: {
    key: "500"
    value: {
      description: "Internal server error."
      schema: {
        json_schema: {ref: ".google.rpc.Status"}
      }
    }
  }
};

service CustomerManagedEncryptionKeyService {
  rpc GetCmekAccessIamPrincipal(GetCmekAccessIamPrincipalRequest) returns (CmekAccessIamPrincipal) {
    option (google.api.http) = {get: "/cmeks:principal"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get CMEK IAM principal"
      description: "Retrieves the IAM principal required for customer-managed encryption key (CMEK) access. Use this to get the TiDB Cloud account information needed to configure your KMS key policy."
    };
  }

  // (-- api-linter: core::0136::http-uri-suffix=disabled
  //     aip.dev/not-precedent: for not breaking change, just keep verifyPrincipal suffix --)
  rpc VerifyCmekAccessIamPrincipal(VerifyCmekAccessIamPrincipalRequest) returns (VerifyCmekAccessIamPrincipalResponse) {
    option (google.api.http) = {
      post: "/cmeks:verifyPrincipal"
      body: "key"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Verify CMEK IAM principal"
      description: "Verifies that the CMEK IAM principal configuration is valid. Use this to validate your KMS key policy before creating a TiDB Cloud Premium instance with CMEK enabled."
    };
  }

  rpc GetCustomerManagedEncryptionKey(GetCustomerManagedEncryptionKeyRequest) returns (CustomerManagedEncryptionKey) {
    option (google.api.http) = {get: "/cmeks/{customer_managed_encryption_key_id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get a CMEK"
      description: "Retrieves details of a specific customer-managed encryption key (CMEK)."
    };
  }

  rpc ListCustomerManagedEncryptionKeys(ListCustomerManagedEncryptionKeysRequest) returns (ListCustomerManagedEncryptionKeysResponse) {
    option (google.api.http) = {get: "/cmeks"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List CMEKs"
      description: "Lists all customer-managed encryption keys (CMEKs) for the current organization."
    };
  }
}

message GetCustomerManagedEncryptionKeyRequest {
  string customer_managed_encryption_key_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message VerifyCmekAccessIamPrincipalRequest {
  CustomerManagedEncryptionKey key = 1 [(google.api.field_behavior) = REQUIRED];
  // Optional existing TiDB ID. Omit this when validating CMEK before creating
  // a TiDB; provide it when validating CMEK for an existing TiDB.
  string tidb_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

message VerifyCmekAccessIamPrincipalResponse {
  bool valid = 1;
  string fail_reason = 2;
}

message CustomerManagedEncryptionKey {
  option (google.api.resource) = {
    type: "tidb_cloud_open_api.nextgen.v1beta2/CustomerManagedEncryptionKey"
    pattern: "customerManagedEncryptionKeys/{customer_managed_encryption_key}"
    singular: "customerManagedEncryptionKey"
    plural: "customerManagedEncryptionKeys"
  };

  // The unique name of the CMEK, in the format of `cmeks/{cmek_id}`.
  string name = 1 [
    (google.api.field_behavior) = IDENTIFIER,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  // The ID of the CMEK.
  string customer_managed_encryption_key_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The region where the CMEK is located, in the format of `{cloud_provider}-{region_code}`. For example, `aws-us-west-2`.
  string region_id = 3 [(google.api.field_behavior) = REQUIRED];

  common.v1beta1.Region.CloudProvider cloud_provider = 4 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "The cloud provider where the CMEK is located.\n\n- `\"aws\"`: Amazon Web Services\n\n- `\"gcp\"`: Google Cloud (not yet supported, planned for a future release)\n\n- `\"azure\"`: Microsoft Azure (not yet supported, planned for a future release)\n\n- `\"alicloud\"`: Alibaba Cloud"}
  ];

  common.v1beta1.ServicePlan service_plan = 5 [(google.api.field_behavior) = REQUIRED];

  oneof key {
    // The configuration for AWS KMS.
    AwsKms aws_kms = 6 [(google.api.field_behavior) = OPTIONAL];
    // The configuration for Alibaba Cloud KMS.
    AliyunKms aliyun_kms = 9 [(google.api.field_behavior) = OPTIONAL];
  }

  oneof principal {
    // AWS IAM principal.
    CmekAccessIamPrincipal.AwsCmekPrincipal aws_principal = 7;
    // Alibaba Cloud RAM principal.
    CmekAccessIamPrincipal.AliyunCmekPrincipal aliyun_principal = 10;
  }

  // The timestamp when the CMEK was created, in the [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  google.protobuf.Timestamp create_time = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  message AwsKms {
    // The Amazon Resource Name (ARN) of the AWS KMS key used for encryption.
    string kms_key_arn = 1 [(google.api.field_behavior) = REQUIRED];
  }

  message AliyunKms {
    // The Alibaba Cloud KMS key ARN used for encryption, e.g.
    // `acs:kms:ap-southeast-1:5841052134823325:key/key-sgp68887a54phjt9703ut`.
    string kms_key_arn = 1 [(google.api.field_behavior) = REQUIRED];
  }
}

message GetCmekAccessIamPrincipalRequest {
  string region_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  common.v1beta1.ServicePlan service_plan = 3 [(google.api.field_behavior) = REQUIRED];
}

message CmekAccessIamPrincipal {
  string region_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  common.v1beta1.ServicePlan service_plan = 2 [(google.api.field_behavior) = REQUIRED];

  oneof principal {
    AwsCmekPrincipal aws = 3;
    AliyunCmekPrincipal aliyun = 4;
  }

  message AwsCmekPrincipal {
    // The AWS account ID of the CMEK IAM principal.
    string account_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
    // The AWS STS AssumeRole `ExternalId` that must be pinned in the KMS
    // key policy's `Condition` block when granting access to this principal.
    string external_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  message AliyunCmekPrincipal {
    // The Alibaba Cloud account ID of the CMEK IAM principal.
    string account_id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  }
}

message ListCustomerManagedEncryptionKeysRequest {
  string region_id = 1 [(google.api.field_behavior) = OPTIONAL];
  common.v1beta1.ServicePlan service_plan = 2 [(google.api.field_behavior) = OPTIONAL];
  int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];
  string page_token = 4 [(google.api.field_behavior) = OPTIONAL];
}

message ListCustomerManagedEncryptionKeysResponse {
  repeated CustomerManagedEncryptionKey customer_managed_encryption_keys = 1;
  string next_page_token = 2;
}