// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.workstations.v1beta;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
import "google/rpc/status.proto";

option go_package = "cloud.google.com/go/workstations/apiv1beta/workstationspb;workstationspb";
option java_multiple_files = true;
option java_outer_classname = "WorkstationsProto";
option java_package = "com.google.cloud.workstations.v1beta";

// Service for interacting with Cloud Workstations.
service Workstations {
  option (google.api.default_host) = "workstations.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Returns the requested workstation cluster.
  rpc GetWorkstationCluster(GetWorkstationClusterRequest)
      returns (WorkstationCluster) {
    option (google.api.http) = {
      get: "/v1beta/{name=projects/*/locations/*/workstationClusters/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Returns all workstation clusters in the specified location.
  rpc ListWorkstationClusters(ListWorkstationClustersRequest)
      returns (ListWorkstationClustersResponse) {
    option (google.api.http) = {
      get: "/v1beta/{parent=projects/*/locations/*}/workstationClusters"
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates a new workstation cluster.
  rpc CreateWorkstationCluster(CreateWorkstationClusterRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1beta/{parent=projects/*/locations/*}/workstationClusters"
      body: "workstation_cluster"
    };
    option (google.api.method_signature) =
        "parent,workstation_cluster,workstation_cluster_id";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationCluster"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates an existing workstation cluster.
  rpc UpdateWorkstationCluster(UpdateWorkstationClusterRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1beta/{workstation_cluster.name=projects/*/locations/*/workstationClusters/*}"
      body: "workstation_cluster"
    };
    option (google.api.method_signature) = "workstation_cluster,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationCluster"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified workstation cluster.
  rpc DeleteWorkstationCluster(DeleteWorkstationClusterRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1beta/{name=projects/*/locations/*/workstationClusters/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationCluster"
      metadata_type: "OperationMetadata"
    };
  }

  // Returns the requested workstation configuration.
  rpc GetWorkstationConfig(GetWorkstationConfigRequest)
      returns (WorkstationConfig) {
    option (google.api.http) = {
      get: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Returns all workstation configurations in the specified cluster.
  rpc ListWorkstationConfigs(ListWorkstationConfigsRequest)
      returns (ListWorkstationConfigsResponse) {
    option (google.api.http) = {
      get: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*}/workstationConfigs"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns all workstation configurations in the specified cluster on which
  // the caller has the "workstations.workstation.create" permission.
  rpc ListUsableWorkstationConfigs(ListUsableWorkstationConfigsRequest)
      returns (ListUsableWorkstationConfigsResponse) {
    option (google.api.http) = {
      get: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*}/workstationConfigs:listUsable"
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates a new workstation configuration.
  rpc CreateWorkstationConfig(CreateWorkstationConfigRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*}/workstationConfigs"
      body: "workstation_config"
    };
    option (google.api.method_signature) =
        "parent,workstation_config,workstation_config_id";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationConfig"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates an existing workstation configuration.
  rpc UpdateWorkstationConfig(UpdateWorkstationConfigRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1beta/{workstation_config.name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}"
      body: "workstation_config"
    };
    option (google.api.method_signature) = "workstation_config,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationConfig"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified workstation configuration.
  rpc DeleteWorkstationConfig(DeleteWorkstationConfigRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "WorkstationConfig"
      metadata_type: "OperationMetadata"
    };
  }

  // Returns the requested workstation.
  rpc GetWorkstation(GetWorkstationRequest) returns (Workstation) {
    option (google.api.http) = {
      get: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Returns all Workstations using the specified workstation configuration.
  rpc ListWorkstations(ListWorkstationsRequest)
      returns (ListWorkstationsResponse) {
    option (google.api.http) = {
      get: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}/workstations"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns all workstations using the specified workstation configuration
  // on which the caller has the "workstations.workstations.use" permission.
  rpc ListUsableWorkstations(ListUsableWorkstationsRequest)
      returns (ListUsableWorkstationsResponse) {
    option (google.api.http) = {
      get: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}/workstations:listUsable"
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates a new workstation.
  rpc CreateWorkstation(CreateWorkstationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1beta/{parent=projects/*/locations/*/workstationClusters/*/workstationConfigs/*}/workstations"
      body: "workstation"
    };
    option (google.api.method_signature) = "parent,workstation,workstation_id";
    option (google.longrunning.operation_info) = {
      response_type: "Workstation"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates an existing workstation.
  rpc UpdateWorkstation(UpdateWorkstationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1beta/{workstation.name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}"
      body: "workstation"
    };
    option (google.api.method_signature) = "workstation,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Workstation"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes the specified workstation.
  rpc DeleteWorkstation(DeleteWorkstationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "Workstation"
      metadata_type: "OperationMetadata"
    };
  }

  // Starts running a workstation so that users can connect to it.
  rpc StartWorkstation(StartWorkstationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}:start"
      body: "*"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "Workstation"
      metadata_type: "OperationMetadata"
    };
  }

  // Stops running a workstation, reducing costs.
  rpc StopWorkstation(StopWorkstationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1beta/{name=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}:stop"
      body: "*"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "Workstation"
      metadata_type: "OperationMetadata"
    };
  }

  // Returns a short-lived credential that can be used to send authenticated and
  // authorized traffic to a workstation.
  rpc GenerateAccessToken(GenerateAccessTokenRequest)
      returns (GenerateAccessTokenResponse) {
    option (google.api.http) = {
      post: "/v1beta/{workstation=projects/*/locations/*/workstationClusters/*/workstationConfigs/*/workstations/*}:generateAccessToken"
      body: "*"
    };
    option (google.api.method_signature) = "workstation";
  }
}

// A grouping of workstation configurations and the associated workstations
//  in that region.
message WorkstationCluster {
  option (google.api.resource) = {
    type: "workstations.googleapis.com/WorkstationCluster"
    pattern: "projects/{project}/locations/{location}/workstationClusters/{workstation_cluster}"
    style: DECLARATIVE_FRIENDLY
  };

  // Configuration options for private clusters.
  message PrivateClusterConfig {
    // Immutable. Whether Workstations endpoint is private.
    bool enable_private_endpoint = 1 [(google.api.field_behavior) = IMMUTABLE];

    // Output only. Hostname for the workstation cluster. This field will be
    // populated only when private endpoint is enabled. To access workstations
    // in the cluster, create a new DNS zone mapping this domain name to an
    // internal IP address and a forwarding rule mapping that address to the
    // service attachment.
    string cluster_hostname = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Service attachment URI for the workstation cluster. The
    // service attachemnt is created when private endpoint is enabled. To access
    // workstations in the cluster, configure access to the managed service
    // using [Private Service
    // Connect](https://cloud.google.com/vpc/docs/configure-private-service-connect-services).
    string service_attachment_uri = 3
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Additional projects that are allowed to attach to the workstation
    // cluster's service attachment. By default, the workstation cluster's
    // project and the VPC host project (if different) are allowed.
    repeated string allowed_projects = 4;
  }

  // Full name of this resource.
  string name = 1;

  // Human-readable name for this resource.
  string display_name = 2;

  // Output only. A system-assigned unique identified for this resource.
  string uid = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Indicates whether this resource is currently being updated to
  // match its intended state.
  bool reconciling = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Client-specified annotations.
  map<string, string> annotations = 5;

  // Client-specified labels that are applied to the resource and that are also
  // propagated to the underlying Compute Engine resources.
  map<string, string> labels = 15;

  // Output only. Time when this resource was created.
  google.protobuf.Timestamp create_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was most recently updated.
  google.protobuf.Timestamp update_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was soft-deleted.
  google.protobuf.Timestamp delete_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Checksum computed by the server. May be sent on update and delete requests
  // to make sure that the client has an up-to-date value before proceeding.
  string etag = 9;

  // Immutable. Name of the Compute Engine network in which instances associated
  // with this cluster will be created.
  string network = 10 [(google.api.field_behavior) = IMMUTABLE];

  // Immutable. Name of the Compute Engine subnetwork in which instances
  // associated with this cluster will be created. Must be part of the
  // subnetwork specified for this cluster.
  string subnetwork = 11 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. The private IP address of the control plane for this cluster.
  // Workstation VMs need access to this IP address to work with the service, so
  // make sure that your firewall rules allow egress from the workstation VMs to
  // this address.
  string control_plane_ip = 16 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Configuration for private cluster.
  PrivateClusterConfig private_cluster_config = 12;

  // Output only. Whether this resource is in degraded mode, in which case it
  // may require user action to restore full functionality. Details can be found
  // in the `conditions` field.
  bool degraded = 13 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Status conditions describing the current resource state.
  repeated google.rpc.Status conditions = 14
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A set of configuration options describing how a workstation will be run.
// Workstation configurations are intended to be shared across multiple
// workstations.
message WorkstationConfig {
  option (google.api.resource) = {
    type: "workstations.googleapis.com/WorkstationConfig"
    pattern: "projects/{project}/locations/{location}/workstationClusters/{workstation_cluster}/workstationConfigs/{workstation_config}"
    style: DECLARATIVE_FRIENDLY
  };

  // Runtime host for a workstation.
  message Host {
    // A runtime using a Compute Engine instance.
    message GceInstance {
      // A set of Compute Engine Shielded instance options.
      message GceShieldedInstanceConfig {
        // Whether the instance has Secure Boot enabled.
        bool enable_secure_boot = 1;

        // Whether the instance has the vTPM enabled.
        bool enable_vtpm = 2;

        // Whether the instance has integrity monitoring enabled.
        bool enable_integrity_monitoring = 3;
      }

      // A set of Compute Engine Confidential VM instance options.
      message GceConfidentialInstanceConfig {
        // Whether the instance has confidential compute enabled.
        bool enable_confidential_compute = 1;
      }

      // An accelerator card attached to the instance.
      message Accelerator {
        // Type of accelerator resource to attach to the instance, for example,
        // "nvidia-tesla-p100".
        string type = 1;

        // Number of accelerator cards exposed to the instance.
        int32 count = 2;
      }

      // The name of a Compute Engine machine type.
      string machine_type = 1;

      // Email address of the service account used on VM instances
      // used to support this configuration. If not set, VMs run with a
      // Google-managed service account. This service account must have
      // permission to pull the specified container image; otherwise, the image
      // must be publicly accessible.
      string service_account = 2;

      // Network tags to add to the Compute Engine machines backing the
      // Workstations.
      repeated string tags = 4;

      // Number of instances to pool for faster workstation startup.
      int32 pool_size = 5;

      // Output only. Number of instances currently available in the pool for
      // faster workstation startup.
      int32 pooled_instances = 12 [(google.api.field_behavior) = OUTPUT_ONLY];

      // Whether instances have no public IP address.
      bool disable_public_ip_addresses = 6;

      // A set of Compute Engine Shielded instance options.
      GceShieldedInstanceConfig shielded_instance_config = 8;

      // A set of Compute Engine Confidential VM instance options.
      GceConfidentialInstanceConfig confidential_instance_config = 10;

      // Size of the boot disk in GB. Defaults to 50.
      int32 boot_disk_size_gb = 9;

      // A list of the type and count of accelerator cards attached to the
      // instance.
      repeated Accelerator accelerators = 11;
    }

    // Type of host that will be used for the workstation's runtime.
    oneof config {
      // Specifies a Compute Engine instance as the host.
      GceInstance gce_instance = 1;
    }
  }

  // A directory to persist across workstation sessions.
  message PersistentDirectory {
    // A PersistentDirectory backed by a Compute Engine regional persistent
    // disk.
    message GceRegionalPersistentDisk {
      // Value representing what should happen to the disk after the workstation
      // is deleted.
      enum ReclaimPolicy {
        // Do not use.
        RECLAIM_POLICY_UNSPECIFIED = 0;

        // The persistent disk will be deleted with the workstation.
        DELETE = 1;

        // The persistent disk will be remain after the workstation is deleted,
        // and the administrator must manually delete the disk.
        RETAIN = 2;
      }

      // Size of the disk in GB. Must be empty if source_snapshot is set.
      // Defaults to 200.
      int32 size_gb = 1;

      // Type of file system that the disk should be formatted with. The
      // workstation image must support this file system type. Must be empty
      // if source_snapshot is set. Defaults to ext4.
      string fs_type = 2;

      // Type of the disk to use. Defaults to pd-standard.
      string disk_type = 3;

      // Name of the snapshot to use as the source for the disk. If set,
      // size_gb and fs_type must be empty.
      string source_snapshot = 5;

      // What should happen to the disk after the workstation is deleted.
      // Defaults to DELETE.
      ReclaimPolicy reclaim_policy = 4;
    }

    // Location of this directory in the running workstation.
    string mount_path = 1;

    // How a persistent directory should be implemented.
    oneof directory_type {
      // A PersistentDirectory backed by a Compute Engine persistent disk.
      GceRegionalPersistentDisk gce_pd = 2;
    }
  }

  // A Docker container.
  message Container {
    // Docker image defining the container. This image must be accessible by the
    // service account specified in the workstation configuration.
    string image = 1;

    // If set, overrides the default ENTRYPOINT specified by the image.
    repeated string command = 2;

    // Arguments passed to the entrypoint.
    repeated string args = 3;

    // Environment variables passed to the container's entrypoint.
    map<string, string> env = 4;

    // If set, overrides the default DIR specified by the image.
    string working_dir = 5;

    // If set, overrides the USER specified in the image with the given uid.
    int32 run_as_user = 6;
  }

  // A customer-managed encryption key for the Compute Engine resources
  // of this workstation configuration.
  message CustomerEncryptionKey {
    // Immutable. The name of the Google Cloud KMS encryption key. For example,
    // `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`.
    string kms_key = 1 [(google.api.field_behavior) = IMMUTABLE];

    // Immutable. The service account to use with the specified
    // KMS key. We recommend that you use a separate service account
    // and follow KMS best practices. For more information, see
    // [Separation of
    // duties](https://cloud.google.com/kms/docs/separation-of-duties) and
    // `gcloud kms keys add-iam-policy-binding`
    // [`--member`](https://cloud.google.com/sdk/gcloud/reference/kms/keys/add-iam-policy-binding#--member).
    string kms_key_service_account = 2
        [(google.api.field_behavior) = IMMUTABLE];
  }

  // A readiness check to be performed on a workstation.
  message ReadinessCheck {
    // Path to which the request should be sent.
    string path = 1;

    // Port to which the request should be sent.
    int32 port = 2;
  }

  // Full name of this resource.
  string name = 1;

  // Human-readable name for this resource.
  string display_name = 2;

  // Output only. A system-assigned unique identified for this resource.
  string uid = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Indicates whether this resource is currently being updated to
  // match its intended state.
  bool reconciling = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Client-specified annotations.
  map<string, string> annotations = 5;

  // Client-specified labels that are applied to the resource and that are also
  // propagated to the underlying Compute Engine resources.
  map<string, string> labels = 18;

  // Output only. Time when this resource was created.
  google.protobuf.Timestamp create_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was most recently updated.
  google.protobuf.Timestamp update_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was soft-deleted.
  google.protobuf.Timestamp delete_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Checksum computed by the server. May be sent on update and delete requests
  // to make sure that the client has an up-to-date value before proceeding.
  string etag = 9;

  // How long to wait before automatically stopping an instance that hasn't
  // received any user traffic. A value of 0 indicates that this instance
  // should never time out due to idleness. Defaults to 20 minutes.
  google.protobuf.Duration idle_timeout = 10;

  // How long to wait before automatically stopping a workstation after it
  // started. A value of 0 indicates that workstations using this configuration
  // should never time out. Must be greater than 0 and less than 24 hours if
  // encryption_key is set. Defaults to 12 hours.
  google.protobuf.Duration running_timeout = 11;

  // Runtime host for the workstation.
  Host host = 12;

  // Directories to persist across workstation sessions.
  repeated PersistentDirectory persistent_directories = 13;

  // Container that will be run for each workstation using this configuration
  // when that workstation is started.
  Container container = 14;

  // Immutable. Encrypts resources of this workstation configuration using a
  // customer-managed encryption key.
  //
  // If specified, the boot disk of the Compute Engine instance and the
  // persistent disk are encrypted using this encryption key. If
  // this field is not set, the disks are encrypted using a generated
  // key. Customer-managed encryption keys do not protect disk metadata.
  //
  // If the customer-managed encryption key is rotated, when the workstation
  // instance is stopped, the system attempts to recreate the
  // persistent disk with the new version of the key. Be sure to keep
  // older versions of the key until the persistent disk is recreated.
  // Otherwise, data on the persistent disk will be lost.
  //
  // If the encryption key is revoked, the workstation session will
  // automatically be stopped within 7 hours.
  //
  // Immutable after the workstation configuration is created.
  CustomerEncryptionKey encryption_key = 17
      [(google.api.field_behavior) = IMMUTABLE];

  // Readiness checks to perform when starting a workstation using this
  // workstation configuration. Mark a workstation as running only after all
  // specified readiness checks return 200 status codes.
  repeated ReadinessCheck readiness_checks = 19;

  // Output only. Whether this resource is in degraded mode, in which case it
  // may require user action to restore full functionality. Details can be found
  // in the `conditions` field.
  bool degraded = 15 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Status conditions describing the current resource state.
  repeated google.rpc.Status conditions = 16
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Whether to enable linux auditd logging on the workstation. When enabled, a
  // service account must also be specified that has logging.buckets.write
  // permission on the project. Operating system audit logging is distinct from
  // [Cloud Audit
  // Logs](https://cloud.google.com/workstations/docs/audit-logging).
  bool enable_audit_agent = 20;
}

// A single instance of a developer workstation with its own persistent storage.
message Workstation {
  option (google.api.resource) = {
    type: "workstations.googleapis.com/Workstation"
    pattern: "projects/{project}/locations/{location}/workstationClusters/{workstation_cluster}/workstationConfigs/{workstation_config}/workstations/{workstation}"
    style: DECLARATIVE_FRIENDLY
  };

  // Whether a workstation is running and ready to receive user requests.
  enum State {
    // Do not use.
    STATE_UNSPECIFIED = 0;

    // The workstation is not yet ready to accept requests from users but will
    // be soon.
    STATE_STARTING = 1;

    // The workstation is ready to accept requests from users.
    STATE_RUNNING = 2;

    // The workstation is being stopped.
    STATE_STOPPING = 3;

    // The workstation is stopped and will not be able to receive requests until
    // it is started.
    STATE_STOPPED = 4;
  }

  // Full name of this resource.
  string name = 1;

  // Human-readable name for this resource.
  string display_name = 2;

  // Output only. A system-assigned unique identified for this resource.
  string uid = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Indicates whether this resource is currently being updated to
  // match its intended state.
  bool reconciling = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Client-specified annotations.
  map<string, string> annotations = 5;

  // Client-specified labels that are applied to the resource and that are also
  // propagated to the underlying Compute Engine resources.
  map<string, string> labels = 13;

  // Output only. Time when this resource was created.
  google.protobuf.Timestamp create_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was most recently updated.
  google.protobuf.Timestamp update_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when this resource was soft-deleted.
  google.protobuf.Timestamp delete_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Checksum computed by the server. May be sent on update and delete requests
  // to make sure that the client has an up-to-date value before proceeding.
  string etag = 9;

  // Output only. Current state of the workstation.
  State state = 10 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Host to which clients can send HTTPS traffic that will be
  // received by the workstation. Authorized traffic will be received to the
  // workstation as HTTP on port 80. To send traffic to a different port,
  // clients may prefix the host with the destination port in the format
  // `{port}-{host}`.
  string host = 11 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Environment variables passed to the workstation container's entrypoint.
  map<string, string> env = 12;
}

// Request message for GetWorkstationCluster.
message GetWorkstationClusterRequest {
  // Required. Name of the requested resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];
}

// Request message for ListWorkstationClusters.
message ListWorkstationClustersRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // Maximum number of items to return.
  int32 page_size = 2;

  // next_page_token value returned from a previous List request, if any.
  string page_token = 3;
}

// Response message for ListWorkstationClusters.
message ListWorkstationClustersResponse {
  // The requested workstation clusters.
  repeated WorkstationCluster workstation_clusters = 1;

  // Token to retrieve the next page of results, or empty if there are no more
  // results in the list.
  string next_page_token = 2;

  // Unreachable resources.
  repeated string unreachable = 3;
}

// Message for creating a CreateWorkstationCluster.
message CreateWorkstationClusterRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // Required. ID to use for the workstation cluster.
  string workstation_cluster_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Workstation cluster to create.
  WorkstationCluster workstation_cluster = 3
      [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 4;
}

// Request message for UpdateWorkstationCluster.
message UpdateWorkstationClusterRequest {
  // Required. Workstation cluster to update.
  WorkstationCluster workstation_cluster = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Mask that specifies which fields in the workstation cluster
  // should be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 3;

  // If set, and the workstation cluster is not found, a new workstation
  // cluster will be created. In this situation, update_mask is ignored.
  bool allow_missing = 4;
}

// Message for deleting a workstation cluster.
message DeleteWorkstationClusterRequest {
  // Required. Name of the workstation cluster to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // If set, validate the request and preview the review, but do not apply it.
  bool validate_only = 2;

  // If set, the request will be rejected if the latest version of the
  // workstation cluster on the server does not have this ETag.
  string etag = 3;

  // If set, any workstation configurations and workstations in the
  // workstation cluster are also deleted. Otherwise, the request only
  // works if the workstation cluster has no configurations or workstations.
  bool force = 4;
}

// Request message for GetWorkstationConfig.
message GetWorkstationConfigRequest {
  // Required. Name of the requested resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationConfig"
    }
  ];
}

// Request message for ListWorkstationConfigs.
message ListWorkstationConfigsRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // Maximum number of items to return.
  int32 page_size = 2;

  // next_page_token value returned from a previous List request, if any.
  string page_token = 3;
}

// Response message for ListWorkstationConfigs.
message ListWorkstationConfigsResponse {
  // The requested configs.
  repeated WorkstationConfig workstation_configs = 1;

  // Token to retrieve the next page of results, or empty if there are no more
  // results in the list.
  string next_page_token = 2;

  // Unreachable resources.
  repeated string unreachable = 3;
}

// Request message for ListUsableWorkstationConfigs.
message ListUsableWorkstationConfigsRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // Maximum number of items to return.
  int32 page_size = 2;

  // next_page_token value returned from a previous List request, if any.
  string page_token = 3;
}

// Response message for ListUsableWorkstationConfigs.
message ListUsableWorkstationConfigsResponse {
  // The requested configs.
  repeated WorkstationConfig workstation_configs = 1;

  // Token to retrieve the next page of results, or empty if there are no more
  // results in the list.
  string next_page_token = 2;

  // Unreachable resources.
  repeated string unreachable = 3;
}

// Message for creating a CreateWorkstationConfig.
message CreateWorkstationConfigRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationCluster"
    }
  ];

  // Required. ID to use for the workstation configuration.
  string workstation_config_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Config to create.
  WorkstationConfig workstation_config = 3
      [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 4;
}

// Request message for UpdateWorkstationConfig.
message UpdateWorkstationConfigRequest {
  // Required. Config to update.
  WorkstationConfig workstation_config = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Mask specifying which fields in the workstation configuration
  // should be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 3;

  // If set and the workstation configuration is not found, a new
  // workstation configuration will be created. In this situation,
  // update_mask is ignored.
  bool allow_missing = 4;
}

// Message for deleting a workstation configuration.
message DeleteWorkstationConfigRequest {
  // Required. Name of the workstation configuration to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationConfig"
    }
  ];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 2;

  // If set, the request is rejected if the latest version of the
  // workstation configuration on the server does not have this ETag.
  string etag = 3;

  // If set, any workstations in the workstation configuration are also deleted.
  // Otherwise, the request works only if the workstation configuration has
  // no workstations.
  bool force = 4;
}

// Request message for GetWorkstation.
message GetWorkstationRequest {
  // Required. Name of the requested resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/Workstation"
    }
  ];
}

// Request message for ListWorkstations.
message ListWorkstationsRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationConfig"
    }
  ];

  // Maximum number of items to return.
  int32 page_size = 2;

  // next_page_token value returned from a previous List request, if any.
  string page_token = 3;
}

// Response message for ListWorkstations.
message ListWorkstationsResponse {
  // The requested workstations.
  repeated Workstation workstations = 1;

  // Token to retrieve the next page of results, or empty if there are no more
  // results in the list.
  string next_page_token = 2;

  // Unreachable resources.
  repeated string unreachable = 3;
}

// Request message for ListUsableWorkstations.
message ListUsableWorkstationsRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationConfig"
    }
  ];

  // Maximum number of items to return.
  int32 page_size = 2;

  // next_page_token value returned from a previous List request, if any.
  string page_token = 3;
}

// Response message for ListUsableWorkstations.
message ListUsableWorkstationsResponse {
  // The requested workstations.
  repeated Workstation workstations = 1;

  // Token to retrieve the next page of results, or empty if there are no more
  // results in the list.
  string next_page_token = 2;

  // Unreachable resources.
  repeated string unreachable = 3;
}

// Message for creating a CreateWorkstation.
message CreateWorkstationRequest {
  // Required. Parent resource name.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/WorkstationConfig"
    }
  ];

  // Required. ID to use for the workstation.
  string workstation_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. Workstation to create.
  Workstation workstation = 3 [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 4;
}

// Request message for UpdateWorkstation.
message UpdateWorkstationRequest {
  // Required. Workstation to update.
  Workstation workstation = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Mask specifying which fields in the workstation configuration
  // should be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 3;

  // If set and the workstation configuration is not found, a new
  // workstation configuration is created. In this situation, update_mask
  // is ignored.
  bool allow_missing = 4;
}

// Request message for DeleteWorkstation.
message DeleteWorkstationRequest {
  // Required. Name of the workstation to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/Workstation"
    }
  ];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 2;

  // If set, the request will be rejected if the latest version of the
  // workstation on the server does not have this ETag.
  string etag = 3;
}

// Request message for StartWorkstation.
message StartWorkstationRequest {
  // Required. Name of the workstation to start.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/Workstation"
    }
  ];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 2;

  // If set, the request will be rejected if the latest version of the
  // workstation on the server does not have this ETag.
  string etag = 3;
}

// Request message for StopWorkstation.
message StopWorkstationRequest {
  // Required. Name of the workstation to stop.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/Workstation"
    }
  ];

  // If set, validate the request and preview the review, but do not actually
  // apply it.
  bool validate_only = 2;

  // If set, the request will be rejected if the latest version of the
  // workstation on the server does not have this ETag.
  string etag = 3;
}

// Request message for GenerateAccessToken.
message GenerateAccessTokenRequest {
  // Required. Name of the workstation for which the access token should be
  // generated.
  string workstation = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workstations.googleapis.com/Workstation"
    }
  ];

  // Desired expiration or lifetime of the access token.
  oneof expiration {
    // Desired expiration time of the access token. This value must
    // be at most 24 hours in the future. If a value is not specified, the
    // token's expiration time will be set to a default value of 1 hour in the
    // future.
    google.protobuf.Timestamp expire_time = 2;

    // Desired lifetime duration of the access token. This value must
    // be at most 24 hours. If a value is not specified, the token's lifetime
    // will be set to a default value of 1 hour.
    google.protobuf.Duration ttl = 3;
  }
}

// Response message for GenerateAccessToken.
message GenerateAccessTokenResponse {
  // The generated bearer access token. To use this token, include it in an
  // Authorization header of an HTTP request sent to the associated
  // workstation's hostname—for example, `Authorization: Bearer
  // <access_token>`.
  string access_token = 1;

  // Time at which the generated token will expire.
  google.protobuf.Timestamp expire_time = 2;
}

// Metadata for long-running operations.
message OperationMetadata {
  // Output only. Time that the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time that the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Server-defined resource path for the target of the operation.
  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Name of the verb executed by the operation.
  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Human-readable status of the operation, if any.
  string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifies whether the user has requested cancellation
  // of the operation.
  bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. API version used to start the operation.
  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}