// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.cloudsecuritycompliance.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/cloudsecuritycompliance/v1/common.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";

option csharp_namespace = "Google.Cloud.CloudSecurityCompliance.V1";
option go_package = "cloud.google.com/go/cloudsecuritycompliance/apiv1/cloudsecuritycompliancepb;cloudsecuritycompliancepb";
option java_multiple_files = true;
option java_outer_classname = "ConfigProto";
option java_package = "com.google.cloud.cloudsecuritycompliance.v1";
option php_namespace = "Google\\Cloud\\CloudSecurityCompliance\\V1";
option ruby_package = "Google::Cloud::CloudSecurityCompliance::V1";

// Config Service manages compliance frameworks, cloud controls, and their
// configurations.
service Config {
  option (google.api.default_host) = "cloudsecuritycompliance.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists the frameworks (both built-in and custom) that are available within
  // the parent resource. The latest major version of each framework is
  // returned.
  // This method supports pagination.
  rpc ListFrameworks(ListFrameworksRequest) returns (ListFrameworksResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/frameworks"
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*}/frameworks"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details about a framework.
  // This method retrieves the latest major version of the framework.
  //
  // To retrieve a specific major version, include `major_revision_id` in
  // the request.
  rpc GetFramework(GetFrameworkRequest) returns (Framework) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/frameworks/*}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/frameworks/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a custom framework in a given parent resource.
  // You can't create built-in frameworks because those are managed by
  // Google.
  rpc CreateFramework(CreateFrameworkRequest) returns (Framework) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/frameworks"
      body: "framework"
      additional_bindings {
        post: "/v1/{parent=projects/*/locations/*}/frameworks"
        body: "framework"
      }
    };
    option (google.api.method_signature) = "parent,framework,framework_id";
  }

  // Updates a custom framework.
  // This method allows for partial updates of a framework. Use the
  // `update_mask` to specify which fields to update. Consider the following:
  //
  // - If you provide an `update_mask`, only the fields that are specified
  // in the mask are updated.
  // - If you don't provide an `update_mask`, all the fields that are present
  // in the request's `framework` body are used to overwrite the existing
  // resource.
  //
  // You can only update frameworks with the `CUSTOM` type.
  // A successful update creates a new version of the framework.
  rpc UpdateFramework(UpdateFrameworkRequest) returns (Framework) {
    option (google.api.http) = {
      patch: "/v1/{framework.name=organizations/*/locations/*/frameworks/*}"
      body: "framework"
      additional_bindings {
        patch: "/v1/{framework.name=projects/*/locations/*/frameworks/*}"
        body: "framework"
      }
    };
    option (google.api.method_signature) = "framework,update_mask";
  }

  // Deletes a custom framework, including all its major and
  // minor revisions. Consider the following:
  //
  // - You can't delete built-in frameworks. You can only delete frameworks
  //   with type `CUSTOM`.
  // - You can't delete frameworks that are deployed to a resource.
  // - You can't restore a deleted framework. This action is permanent.
  rpc DeleteFramework(DeleteFrameworkRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/frameworks/*}"
      additional_bindings {
        delete: "/v1/{name=projects/*/locations/*/frameworks/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists the cloud controls (both built-in and custom) that are available
  // in a given parent resource. The latest major version of each cloud control
  // is returned.
  // This method supports pagination.
  rpc ListCloudControls(ListCloudControlsRequest)
      returns (ListCloudControlsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/cloudControls"
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*}/cloudControls"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details about a cloud control.
  // This method retrieves the latest major version of a cloud control that
  // you identify by name.
  //
  // By default, the latest major version of the cloud control is returned.
  // To retrieve a specific major version, include `major_revision_id` in
  // the request.
  rpc GetCloudControl(GetCloudControlRequest) returns (CloudControl) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/cloudControls/*}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/cloudControls/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a custom cloud control in a given parent
  // resource.
  // You can't create built-in cloud controls because those are managed by
  // Google.
  rpc CreateCloudControl(CreateCloudControlRequest) returns (CloudControl) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/cloudControls"
      body: "cloud_control"
      additional_bindings {
        post: "/v1/{parent=projects/*/locations/*}/cloudControls"
        body: "cloud_control"
      }
    };
    option (google.api.method_signature) =
        "parent,cloud_control,cloud_control_id";
  }

  // Updates a custom cloud control.
  // This method allows for partial updates of a cloud control. Use the
  // `update_mask` to specify which fields to update. Consider the following:
  //
  // - If you provide an `update_mask`, only the fields that are specified
  // in the mask are updated.
  // - If you don't provide an `update_mask`, all the fields that are present
  // in the request's `cloud_control` body are used to overwrite the existing
  // resource.
  //
  // You can only update cloud controls with the `CUSTOM` type.
  // A successful update creates a new version of the cloud control.
  rpc UpdateCloudControl(UpdateCloudControlRequest) returns (CloudControl) {
    option (google.api.http) = {
      patch: "/v1/{cloud_control.name=organizations/*/locations/*/cloudControls/*}"
      body: "cloud_control"
      additional_bindings {
        patch: "/v1/{cloud_control.name=projects/*/locations/*/cloudControls/*}"
        body: "cloud_control"
      }
    };
    option (google.api.method_signature) = "cloud_control,update_mask";
  }

  // Deletes a custom cloud control, including all its
  // major and minor revisions. Consider the following:
  //
  // - You can't delete built-in cloud controls. You can only delete cloud
  //   controls with type `CUSTOM`.
  // - You can't delete cloud controls if any of the versions are referenced
  //   by a framework.
  // - You can't restore a deleted cloud control. This action is permanent.
  rpc DeleteCloudControl(DeleteCloudControlRequest)
      returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/cloudControls/*}"
      additional_bindings {
        delete: "/v1/{name=projects/*/locations/*/cloudControls/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }
}

// Request message for [ListFrameworks][].
message ListFrameworksRequest {
  // Required. The parent resource name, in one of the following formats:
  // - `organizations/{organization}/locations/{location}`
  // - `projects/{project}/locations/{location}`.
  //
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/Framework"
    }
  ];

  // Optional. The maximum number of frameworks to return. The default value is
  // `500`.
  //
  // If you exceed the maximum value of `1000`, then the service uses the
  // maximum value.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A pagination token returned from a previous request to list
  // frameworks. Provide this token to retrieve the next page of results.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The response message for [ListFrameworks][].
// Returns a paginated list of Framework resources.
message ListFrameworksResponse {
  // The list of framework resources.
  repeated Framework frameworks = 1;

  // A pagination token. To retrieve the next page of results, call the method
  // again with this token.
  string next_page_token = 2;
}

// The request message for [GetFramework][].
message GetFrameworkRequest {
  // Required. The name of the framework to retrieve, in one of the following
  // formats:
  // `organizations/{organization}/locations/{location}/frameworks/{framework}`
  // or
  // `projects/{project}/locations/{location}/frameworks/{framework}`.
  //
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/Framework"
    }
  ];

  // Optional. The framework major version to retrieve. If not specified, the
  // most recently updated `revision_id` is retrieved.
  int64 major_revision_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// The request message for [CreateFramework][].
message CreateFrameworkRequest {
  // Required. The parent resource name, in one of the following formats:
  // - `organizations/{organization}/locations/{location}`
  // - `projects/{project}/locations/{location}`.
  //
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/Framework"
    }
  ];

  // Required. The identifier (ID) of the framework. The ID is not the full name
  // of the framework; it's the last part of the full name of the framework.
  string framework_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  Framework framework = 3 [(google.api.field_behavior) = REQUIRED];
}

// The request message for [UpdateFramework][].
message UpdateFrameworkRequest {
  // Optional. A field mask is used to specify the fields to be overwritten in
  // the framework resource by the update. The fields specified in the
  // `update_mask` are relative to the resource, not the full request. A field
  // is overwritten if it is in the mask. If you don't provide a mask then all
  // fields present in the request will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The resource that is being updated.
  Framework framework = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. The major version ID of the framework to update.
  int64 major_revision_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for [DeleteFramework][].
message DeleteFrameworkRequest {
  // Required. The name of the resource, in one of the following formats:
  // `organizations/{organization}/locations/{location}/frameworks/{framework}`
  // or
  // `projects/{project}/locations/{location}/frameworks/{framework}`.
  //
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/Framework"
    }
  ];
}

// Request message for [ListCloudControls][].
message ListCloudControlsRequest {
  // Required. The parent resource name, in one of the following formats:
  // - `organizations/{organization}/locations/{location}`
  // - `projects/{project}/locations/{location}`.
  //
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/CloudControl"
    }
  ];

  // Optional. The maximum number of cloud controls to return. The default value
  // is `500`.
  //
  // If you exceed the maximum value of `1000`, then the service uses the
  // maximum value.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A pagination token that's returned from a previous request to
  // list cloud controls. Provide this token to retrieve the next page of
  // results.
  //
  // When paginating, the parent that you provide to the
  // [ListCloudControls][google.cloud.cloudsecuritycompliance.v1.Config.ListCloudControls]
  // request must match the call that provided the page token.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The response message for [ListCloudControls][].
message ListCloudControlsResponse {
  // The list of CloudControl resources.
  repeated CloudControl cloud_controls = 1;

  // A pagination token. To retrieve the next page of results, call the method
  // again with this token.
  string next_page_token = 2;
}

// The request message for [GetCloudControl][].
message GetCloudControlRequest {
  // Required. The name of the cloud control to retrieve, in one of the
  // following formats:
  // `organizations/{organization}/locations/{location}/cloudControls/{cloud_control}`
  // or
  // `projects/{project}/locations/{location}/cloudControls/{cloud_control}`.
  //
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/CloudControl"
    }
  ];

  // Optional. The major version of the cloud control to retrieve. If not
  // specified, the most recently updated `revision_id` is retrieved.
  int64 major_revision_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// The request message for [CreateCloudControl][].
message CreateCloudControlRequest {
  // Required. The parent resource name, in one of the following formats:
  // - `organizations/{organization}/locations/{location}`.
  // - `projects/{project}/locations/{location}`.
  //
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/CloudControl"
    }
  ];

  // Required. The identifier for the cloud control, which is the last segment
  // of the cloud control name. The format is
  // `^[a-zA-Z][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]$`.
  string cloud_control_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The cloud control that's being created.
  CloudControl cloud_control = 3 [(google.api.field_behavior) = REQUIRED];
}

// The request message for [UpdateCloudControl][].
message UpdateCloudControlRequest {
  // Optional. Use a field mask to specify the fields to be overwritten in the
  // cloud control during the update.
  // The fields that you specify in the `update_mask` are relative to the
  // cloud control, not the full request. A field is overwritten if it is in
  // the mask. If you don't provide a mask, all fields in the request
  // are updated.
  //
  // You can update the following fields:
  //
  // - Display name
  // - Description
  // - Parameters
  // - Rules
  // - Parameter specification
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The cloud control that you're updating.
  CloudControl cloud_control = 2 [(google.api.field_behavior) = REQUIRED];
}

// The request message for [DeleteCloudControl][].
message DeleteCloudControlRequest {
  // Required. The name of the cloud control to delete, in one of the following
  // formats:
  // `organizations/{organization}/locations/{location}/CloudControls/{CloudControl}`
  // or
  // `projects/{project}/locations/{location}/CloudControls/{CloudControl}`.
  //
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/CloudControl"
    }
  ];
}