syntax = "proto3";

package iam_pb;

option go_package = "github.com/seaweedfs/seaweedfs/weed/pb/iam_pb";
option java_package = "seaweedfs.client";
option java_outer_classname = "IamProto";

//////////////////////////////////////////////////

service SeaweedIdentityAccessManagement {
    rpc CreateIdentity(CreateIdentityRequest) returns (CreateIdentityResponse);
    rpc UpdatesIdentity(UpdateIdentityRequest) returns (UpdateIdentityResponse);
    rpc GetIdentity(GetIdentityRequest) returns (GetIdentityResponse);
    rpc DeleteIdentity(DeleteIdentityRequest) returns (DeleteIdentityResponse);
    rpc ListIdentities(ListIdentitiesRequest) returns (ListIdentitiesResponse);

    rpc CreatePolicy(CreatePolicyRequest) returns (CreatePolicyResponse);
    rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);
    rpc DeletePolicy(DeletePolicyRequest) returns (DeletePolicyResponse);
    rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse);
}

message CreateIdentityRequest {
    Identity identity = 1;
}

message CreateIdentityResponse {
}

message UpdateIdentityRequest {
    Identity identity = 1;
}

message UpdateIdentityResponse {
}

message GetIdentityRequest {
    string name = 1;
}

message GetIdentityResponse {
    Identity identity = 1;
}

message DeleteIdentityRequest {
    string name = 1;
}

message DeleteIdentityResponse {
}

message ListIdentitiesRequest {
    int32 limit = 1;
    string offset = 2;
}

message ListIdentitiesResponse {
    repeated Identity identities = 1;
    bool is_truncated = 2;
    string next_offset = 3;
}

message CreatePolicyRequest {
    Policy policy = 1;
}

message CreatePolicyResponse {
}

message GetPolicyRequest {
    string name = 1;
}

message GetPolicyResponse {
    Policy policy = 1;
}

message DeletePolicyRequest {
    string name = 1;
}

message DeletePolicyResponse {
}

message ListPoliciesRequest {
    int32 limit = 1;
    string offset = 2;
}

message ListPoliciesResponse {
    repeated Policy policies = 1;
    bool is_truncated = 2;
    string next_offset = 3;
}

//////////////////////////////////////////////////

message S3ApiConfiguration {
    repeated Identity identities = 1;
}

message Identity {
    string name = 1;
    repeated Credential credentials = 2;
    repeated string actions = 3;
    Account account = 4;
}

message Credential {
    string access_key = 1;
    string secret_key = 2;
}

message Account {
    string id = 1;
    string display_name = 2;
    string email_address = 3;
}

// Policy constants
message Policy {
    string name = 1;
    string version = 2;
    string id = 3;
    repeated Statement statements = 4;
}

message Statement {
    string sid = 1;
    string effect = 2;
    repeated string action = 3;
    repeated string not_action = 4;
    repeated string resource = 5;
    repeated string not_resource = 6;
    // Condition is a map of string to map of string to string
    // This is a simplified representation, actual policy engine supports more complex structures
    // but for proto we can start with bytes or string logic
    // map<string, map<string, string>> condition = 7;
    // or store as json string
    string condition_json = 7;
}

/*
message Action {
    string action = 1;
}
message Resource {
    string bucket = 1;
    // string path = 2;
}
*/