// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.kms.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";

option go_package = "cloud.google.com/go/kms/apiv1/kmspb;kmspb";
option java_multiple_files = true;
option java_outer_classname = "AutokeyAdminProto";
option java_package = "com.google.cloud.kms.v1";

// Provides interfaces for managing [Cloud KMS
// Autokey](https://cloud.google.com/kms/help/autokey) folder-level or
// project-level configurations. A configuration is inherited by all descendent
// folders and projects. A configuration at a folder or project overrides any
// other configurations in its ancestry. Setting a configuration on a folder is
// a prerequisite for Cloud KMS Autokey, so that users working in a descendant
// project can request provisioned [CryptoKeys][google.cloud.kms.v1.CryptoKey],
// ready for Customer Managed Encryption Key (CMEK) use, on-demand when using
// the dedicated key project mode. This is not required when using the delegated
// key management mode for same-project keys.
service AutokeyAdmin {
  option (google.api.default_host) = "cloudkms.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform,"
      "https://www.googleapis.com/auth/cloudkms";

  // Updates the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a folder
  // or a project. The caller must have both `cloudkms.autokeyConfigs.update`
  // permission on the parent folder and `cloudkms.cryptoKeys.setIamPolicy`
  // permission on the provided key project. A
  // [KeyHandle][google.cloud.kms.v1.KeyHandle] creation in the folder's
  // descendant projects will use this configuration to determine where to
  // create the resulting [CryptoKey][google.cloud.kms.v1.CryptoKey].
  rpc UpdateAutokeyConfig(UpdateAutokeyConfigRequest) returns (AutokeyConfig) {
    option (google.api.http) = {
      patch: "/v1/{autokey_config.name=folders/*/autokeyConfig}"
      body: "autokey_config"
      additional_bindings {
        patch: "/v1/{autokey_config.name=projects/*/autokeyConfig}"
        body: "autokey_config"
      }
    };
    option (google.api.method_signature) = "autokey_config,update_mask";
  }

  // Returns the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] for a folder
  // or project.
  rpc GetAutokeyConfig(GetAutokeyConfigRequest) returns (AutokeyConfig) {
    option (google.api.http) = {
      get: "/v1/{name=folders/*/autokeyConfig}"
      additional_bindings { get: "/v1/{name=projects/*/autokeyConfig}" }
    };
    option (google.api.method_signature) = "name";
  }

  // Returns the effective Cloud KMS Autokey configuration for a given project.
  rpc ShowEffectiveAutokeyConfig(ShowEffectiveAutokeyConfigRequest)
      returns (ShowEffectiveAutokeyConfigResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*}:showEffectiveAutokeyConfig"
    };
    option (google.api.method_signature) = "parent";
  }
}

// Request message for
// [UpdateAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig].
message UpdateAutokeyConfigRequest {
  // Required. [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] with values to
  // update.
  AutokeyConfig autokey_config = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Masks which fields of the
  // [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] to update, e.g.
  // `keyProject`.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request message for
// [GetAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.GetAutokeyConfig].
message GetAutokeyConfigRequest {
  // Required. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig]
  // resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or
  // `projects/{PROJECT_NUMBER}/autokeyConfig`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/AutokeyConfig"
    }
  ];
}

// Cloud KMS Autokey configuration for a folder.
message AutokeyConfig {
  option (google.api.resource) = {
    type: "cloudkms.googleapis.com/AutokeyConfig"
    pattern: "folders/{folder}/autokeyConfig"
    pattern: "projects/{project}/autokeyConfig"
    plural: "autokeyConfigs"
    singular: "autokeyConfig"
  };

  // The states AutokeyConfig can be in.
  enum State {
    // The state of the AutokeyConfig is unspecified.
    STATE_UNSPECIFIED = 0;

    // The AutokeyConfig is currently active.
    ACTIVE = 1;

    // A previously configured key project has been deleted and the current
    // AutokeyConfig is unusable.
    KEY_PROJECT_DELETED = 2;

    // The AutokeyConfig is not yet initialized or has been reset to its default
    // uninitialized state.
    UNINITIALIZED = 3;

    // The service account lacks the necessary permissions in the key project to
    // configure Autokey.
    KEY_PROJECT_PERMISSION_DENIED = 4;
  }

  // Defines the resolution mode enum for the key project.
  // The
  // [KeyProjectResolutionMode][google.cloud.kms.v1.AutokeyConfig.KeyProjectResolutionMode]
  // determines the mechanism by which
  // [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig] identifies a
  // [key_project][google.cloud.kms.v1.AutokeyConfig.key_project] at its
  // specific configuration node. This parameter also determines if Autokey can
  // be used within this project or folder.
  enum KeyProjectResolutionMode {
    // Default value. KeyProjectResolutionMode when not specified will act as
    // `DEDICATED_KEY_PROJECT`.
    KEY_PROJECT_RESOLUTION_MODE_UNSPECIFIED = 0;

    // Keys are created in a dedicated project specified by `key_project`.
    DEDICATED_KEY_PROJECT = 1;

    // Keys are created in the same project as the resource requesting the key.
    // The `key_project` must not be set when this mode is used.
    RESOURCE_PROJECT = 2;

    // Disables the AutokeyConfig. When this mode is set, any AutokeyConfig
    // from higher levels in the resource hierarchy are ignored for this
    // resource and its descendants. This setting can be overridden
    // by a more specific configuration at a lower level. For example,
    // if Autokey is disabled on a folder, it can be re-enabled on a sub-folder
    // or project within that folder by setting a different mode (e.g.,
    // DEDICATED_KEY_PROJECT or RESOURCE_PROJECT).
    DISABLED = 3;
  }

  // Identifier. Name of the [AutokeyConfig][google.cloud.kms.v1.AutokeyConfig]
  // resource, e.g. `folders/{FOLDER_NUMBER}/autokeyConfig` or
  // `projects/{PROJECT_NUMBER}/autokeyConfig`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. Name of the key project, e.g. `projects/{PROJECT_ID}` or
  // `projects/{PROJECT_NUMBER}`, where Cloud KMS Autokey will provision a new
  // [CryptoKey][google.cloud.kms.v1.CryptoKey] when a
  // [KeyHandle][google.cloud.kms.v1.KeyHandle] is created. On
  // [UpdateAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.UpdateAutokeyConfig],
  // the caller will require `cloudkms.cryptoKeys.setIamPolicy` permission on
  // this key project. Once configured, for Cloud KMS Autokey to function
  // properly, this key project must have the Cloud KMS API activated and the
  // Cloud KMS Service Agent for this key project must be granted the
  // `cloudkms.admin` role (or pertinent permissions). A request with an empty
  // key project field will clear the configuration.
  string key_project = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The state for the AutokeyConfig.
  State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A checksum computed by the server based on the value of other
  // fields. This may be sent on update requests to ensure that the client has
  // an up-to-date value before proceeding. The request will be rejected with an
  // ABORTED error on a mismatched etag.
  string etag = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. KeyProjectResolutionMode for the AutokeyConfig.
  // Valid values are `DEDICATED_KEY_PROJECT`, `RESOURCE_PROJECT`, or
  // `DISABLED`.
  KeyProjectResolutionMode key_project_resolution_mode = 8
      [(google.api.field_behavior) = OPTIONAL];
}

// Request message for
// [ShowEffectiveAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.ShowEffectiveAutokeyConfig].
message ShowEffectiveAutokeyConfigRequest {
  // Required. Name of the resource project to the show effective Cloud KMS
  // Autokey configuration for. This may be helpful for interrogating the effect
  // of nested folder configurations on a given resource project.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudresourcemanager.googleapis.com/Project"
    }
  ];
}

// Response message for
// [ShowEffectiveAutokeyConfig][google.cloud.kms.v1.AutokeyAdmin.ShowEffectiveAutokeyConfig].
message ShowEffectiveAutokeyConfigResponse {
  // Name of the key project configured in the resource project's folder
  // ancestry.
  string key_project = 1;
}