// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.cloudsecuritycompliance.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";

option csharp_namespace = "Google.Cloud.CloudSecurityCompliance.V1";
option go_package = "cloud.google.com/go/cloudsecuritycompliance/apiv1/cloudsecuritycompliancepb;cloudsecuritycompliancepb";
option java_multiple_files = true;
option java_outer_classname = "CmEnrollmentServiceProto";
option java_package = "com.google.cloud.cloudsecuritycompliance.v1";
option php_namespace = "Google\\Cloud\\CloudSecurityCompliance\\V1";
option ruby_package = "Google::Cloud::CloudSecurityCompliance::V1";

// Service describing CmEnrollment related RPCs for
// complianceManager.
service CmEnrollmentService {
  option (google.api.default_host) = "cloudsecuritycompliance.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Updates the Compliance Manager enrollment for a resource to facilitate
  // an audit.
  // Use this method to enroll a resource in Compliance Manager or to
  // create or update feature-specific configurations.
  rpc UpdateCmEnrollment(UpdateCmEnrollmentRequest) returns (CmEnrollment) {
    option (google.api.http) = {
      patch: "/v1/{cm_enrollment.name=organizations/*/locations/*/cmEnrollment}"
      body: "cm_enrollment"
      additional_bindings {
        patch: "/v1/{cm_enrollment.name=folders/*/locations/*/cmEnrollment}"
        body: "cm_enrollment"
      }
      additional_bindings {
        patch: "/v1/{cm_enrollment.name=projects/*/locations/*/cmEnrollment}"
        body: "cm_enrollment"
      }
    };
    option (google.api.method_signature) = "cm_enrollment,update_mask";
  }

  // Calculates the effective Compliance Manager enrollment for a resource.
  // An effective enrollment is either a direct enrollment of a
  // resource (if it exists), or an enrollment of the closest parent of a
  // resource that's enrolled in Compliance Manager.
  rpc CalculateEffectiveCmEnrollment(CalculateEffectiveCmEnrollmentRequest)
      returns (CalculateEffectiveCmEnrollmentResponse) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/cmEnrollment}:calculate"
      additional_bindings {
        get: "/v1/{name=folders/*/locations/*/cmEnrollment}:calculate"
      }
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/cmEnrollment}:calculate"
      }
    };
    option (google.api.method_signature) = "name";
  }
}

// The request message for [UpdateCmEnrollment][].
message UpdateCmEnrollmentRequest {
  // Required. The Compliance Manager enrollment to update.
  // The `name` field is used to identify the settings that you want to update.
  CmEnrollment cm_enrollment = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. The list of fields that you want to update.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = OPTIONAL];
}

// The request message for [CalculateEffectiveCmEnrollment][].
message CalculateEffectiveCmEnrollmentRequest {
  // Required. The name of the Compliance Manager enrollment to calculate.
  //
  // Supported formats are the following:
  //
  // * `organizations/{organization_id}/locations/{location}/cmEnrollment`
  // * `folders/{folder_id}/locations/{location}/cmEnrollment`
  // * `projects/{project_id}/locations/{location}/cmEnrollment`
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/CmEnrollment"
    }
  ];
}

// The settings for Compliance Manager at a specific resource scope.=
message CmEnrollment {
  option (google.api.resource) = {
    type: "cloudsecuritycompliance.googleapis.com/CmEnrollment"
    pattern: "organizations/{organization}/locations/{location}/cmEnrollment"
    pattern: "projects/{project}/locations/{location}/cmEnrollment"
    plural: "cmEnrollments"
    singular: "cmEnrollment"
  };

  // Identifier. The name of the Compliance Manager enrollment.
  //
  // Supported formats are the following:
  //
  // * `organizations/{organization_id}/locations/{location}/cmEnrollment`
  // * `folders/{folder_id}/locations/{location}/cmEnrollment`
  // * `projects/{project_id}/locations/{location}/cmEnrollment`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. Whether the resource is enrolled in Compliance Manager.
  // This setting is inherited by all descendants.
  bool enrolled = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The audit configuration for Compliance Manager.
  // If set at a scope, this configuration overrides any inherited audit
  // configuration.
  AuditConfig audit_config = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The response message for [CalculateEffectiveCmEnrollment][].
message CalculateEffectiveCmEnrollmentResponse {
  // The effective Compliance Manager enrollment for the resource.
  CmEnrollment cm_enrollment = 1;
}

// The audit configuration for Compliance Manager.
message AuditConfig {
  // The destination details where audit reports are
  // uploaded.
  message CmEligibleDestination {
    // Set of options for the report destination location.
    oneof cm_eligible_destinations {
      // The Cloud Storage bucket where audit reports and evidences can be
      // uploaded. The format is `gs://{bucket_name}`.
      string gcs_bucket = 1;
    }
  }

  // Required. The list of destinations that can be selected for uploading audit
  // reports to.
  repeated CmEligibleDestination destinations = 1
      [(google.api.field_behavior) = REQUIRED];
}