// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.aiplatform.v1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";

option csharp_namespace = "Google.Cloud.AIPlatform.V1";
option go_package = "cloud.google.com/go/aiplatform/apiv1/aiplatformpb;aiplatformpb";
option java_multiple_files = true;
option java_outer_classname = "ServiceNetworkingProto";
option java_package = "com.google.cloud.aiplatform.v1";
option php_namespace = "Google\\Cloud\\AIPlatform\\V1";
option ruby_package = "Google::Cloud::AIPlatform::V1";
option (google.api.resource_definition) = {
  type: "compute.googleapis.com/NetworkAttachment"
  pattern: "projects/{project}/regions/{region}/networkAttachments/{networkattachment}"
};

// The state of the PSC service automation.
enum PSCAutomationState {
  // Should not be used.
  PSC_AUTOMATION_STATE_UNSPECIFIED = 0;

  // The PSC service automation is successful.
  PSC_AUTOMATION_STATE_SUCCESSFUL = 1;

  // The PSC service automation has failed.
  PSC_AUTOMATION_STATE_FAILED = 2;
}

// PSC config that is used to automatically create PSC endpoints in the user
// projects.
message PSCAutomationConfig {
  // Required. Project id used to create forwarding rule.
  string project_id = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The full name of the Google Compute Engine
  // [network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks).
  // [Format](https://cloud.google.com/compute/docs/reference/rest/v1/networks/get):
  // `projects/{project}/global/networks/{network}`.
  string network = 2 [(google.api.field_behavior) = REQUIRED];

  // Output only. IP address rule created by the PSC service automation.
  string ip_address = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Forwarding rule created by the PSC service automation.
  string forwarding_rule = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The state of the PSC service automation.
  PSCAutomationState state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Error message if the PSC service automation failed.
  string error_message = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Represents configuration for private service connect.
message PrivateServiceConnectConfig {
  // Required. If true, expose the IndexEndpoint via private service connect.
  bool enable_private_service_connect = 1
      [(google.api.field_behavior) = REQUIRED];

  // A list of Projects from which the forwarding rule will target the service
  // attachment.
  repeated string project_allowlist = 2;

  // Optional. List of projects and networks where the PSC endpoints will be
  // created. This field is used by Online Inference(Prediction) only.
  repeated PSCAutomationConfig psc_automation_configs = 3
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. The name of the generated service attachment resource.
  // This is only populated if the endpoint is deployed with
  // PrivateServiceConnect.
  string service_attachment = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// PscAutomatedEndpoints defines the output of the forwarding rule
// automatically created by each PscAutomationConfig.
message PscAutomatedEndpoints {
  // Corresponding project_id in pscAutomationConfigs
  string project_id = 1;

  // Corresponding network in pscAutomationConfigs.
  string network = 2;

  // Ip Address created by the automated forwarding rule.
  string match_address = 3;
}

// Configuration for PSC-I.
message PscInterfaceConfig {
  // Optional. The name of the Compute Engine
  // [network
  // attachment](https://cloud.google.com/vpc/docs/about-network-attachments) to
  // attach to the resource within the region and user project.
  // To specify this field, you must have already [created a network attachment]
  // (https://cloud.google.com/vpc/docs/create-manage-network-attachments#create-network-attachments).
  // This field is only used for resources using PSC-I.
  string network_attachment = 1 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "compute.googleapis.com/NetworkAttachment"
    }
  ];

  // Optional. DNS peering configurations. When specified, Vertex AI will
  // attempt to configure DNS peering zones in the tenant project VPC
  // to resolve the specified domains using the target network's Cloud DNS.
  // The user must grant the dns.peer role to the Vertex AI Service Agent
  // on the target project.
  repeated DnsPeeringConfig dns_peering_configs = 2
      [(google.api.field_behavior) = OPTIONAL];
}

// DNS peering configuration. These configurations are used to create
// DNS peering zones in the Vertex tenant project VPC, enabling resolution
// of records within the specified domain hosted in the target network's
// Cloud DNS.
message DnsPeeringConfig {
  // Required. The DNS name suffix of the zone being peered to, e.g.,
  // "my-internal-domain.corp.". Must end with a dot.
  string domain = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The project ID hosting the Cloud DNS managed zone that
  // contains the 'domain'. The Vertex AI Service Agent requires the
  // dns.peer role on this project.
  string target_project = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The VPC network name
  // in the target_project where the DNS zone specified by 'domain' is
  // visible.
  string target_network = 3 [(google.api.field_behavior) = REQUIRED];
}