syntax = "proto3";

package tidb_mgmt_service.v1;

import "google/api/annotations.proto";
import "google/api/field_behavior.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

/**
   All APIs here are for global control plane **internal** use only.
*/

option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  swagger: "2.0"
  host: ""
  base_path: "/inner/mgmt/v1"
  info: {
    version: "v1"
    title: "Control Plane Internal API"
    description: "Control Plane Internal API."
  }
  schemes: HTTPS
};

service CmekService {
  rpc GetCustomerManagedEncryptionKey(GetCustomerManagedEncryptionKeyRequest) returns (CustomerManagedEncryptionKey) {
    option (google.api.http) = {get: "/cmeks/{customer_managed_encryption_key_id}"};
  }
  rpc ListCustomerManagedEncryptionKeys(ListCustomerManagedEncryptionKeysRequest) returns (ListCustomerManagedEncryptionKeysResponse) {
    option (google.api.http) = {get: "/cmeks"};
  }
}

message GetCustomerManagedEncryptionKeyRequest {
  string customer_managed_encryption_key_id = 1 [(google.api.field_behavior) = REQUIRED];
}

message CustomerManagedEncryptionKey {
  string name = 1 [
    (google.api.field_behavior) = IDENTIFIER,
    (google.api.field_behavior) = OUTPUT_ONLY
  ];

  string customer_managed_encryption_key_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  string cloud_provider = 3 [(google.api.field_behavior) = REQUIRED];

  string region_id = 4 [(google.api.field_behavior) = REQUIRED];

  string project_id = 5 [(google.api.field_behavior) = REQUIRED];

  oneof key {
    AwsKms aws_kms = 6 [(google.api.field_behavior) = OPTIONAL];
    AzureKeyVault azure_key_vault = 7 [(google.api.field_behavior) = OPTIONAL];
  }
}

message AwsKms {
  string kms_key_arn = 1;
}

message AzureKeyVault {
  string key_vault_key = 1;
  string key_vault_name = 2;
  AzureAppRegistration app_registration = 3;
}

message AzureAppRegistration {
  string app_registration_id = 1;
  string app_registration_umi = 2;
  string app_registration_name = 3;
}

message ListCustomerManagedEncryptionKeysRequest {
  string project_id = 1 [(google.api.field_behavior) = OPTIONAL];

  string cloud_provider = 2 [(google.api.field_behavior) = OPTIONAL];

  string region_id = 3 [(google.api.field_behavior) = OPTIONAL];

  int32 page_size = 100 [(google.api.field_behavior) = OPTIONAL];

  string page_token = 101 [(google.api.field_behavior) = OPTIONAL];

  // The number of individual resources to skip before starting to return results.
  // If the skip value causes the cursor to move past the end of the collection,
  // the response will be 200 OK with an empty result set and no next_page_token.
  int32 skip = 102 [(.google.api.field_behavior) = OPTIONAL];
}

message ListCustomerManagedEncryptionKeysResponse {
  repeated CustomerManagedEncryptionKey cmeks = 1;

  int32 total_size = 100;

  string next_page_token = 101;
}