// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.cloudsecuritycompliance.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/cloudsecuritycompliance/v1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.CloudSecurityCompliance.V1";
option go_package = "cloud.google.com/go/cloudsecuritycompliance/apiv1/cloudsecuritycompliancepb;cloudsecuritycompliancepb";
option java_multiple_files = true;
option java_outer_classname = "DeploymentProto";
option java_package = "com.google.cloud.cloudsecuritycompliance.v1";
option php_namespace = "Google\\Cloud\\CloudSecurityCompliance\\V1";
option ruby_package = "Google::Cloud::CloudSecurityCompliance::V1";

// Deployment service allows users to manage deployments of Frameworks and
// Cloud Controls on a target resource.
service Deployment {
  option (google.api.default_host) = "cloudsecuritycompliance.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Creates a framework deployment in a given parent resource. A
  // framework deployment lets you assign a particular framework version to an
  // organization, folder, or project so that you can control and monitor
  // those resources using the framework's cloud controls.
  rpc CreateFrameworkDeployment(CreateFrameworkDeploymentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/frameworkDeployments"
      body: "framework_deployment"
      additional_bindings {
        post: "/v1/{parent=projects/*/locations/*}/frameworkDeployments"
        body: "framework_deployment"
      }
    };
    option (google.api.method_signature) =
        "parent,framework_deployment,framework_deployment_id";
    option (google.longrunning.operation_info) = {
      response_type: "FrameworkDeployment"
      metadata_type: "google.cloud.cloudsecuritycompliance.v1.OperationMetadata"
    };
  }

  // Deletes a framework deployment.
  rpc DeleteFrameworkDeployment(DeleteFrameworkDeploymentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/frameworkDeployments/*}"
      additional_bindings {
        delete: "/v1/{name=projects/*/locations/*/frameworkDeployments/*}"
      }
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.cloudsecuritycompliance.v1.OperationMetadata"
    };
  }

  // Gets details about a framework deployment.
  rpc GetFrameworkDeployment(GetFrameworkDeploymentRequest)
      returns (FrameworkDeployment) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/frameworkDeployments/*}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/frameworkDeployments/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists the framework deployments in a given parent resource.
  rpc ListFrameworkDeployments(ListFrameworkDeploymentsRequest)
      returns (ListFrameworkDeploymentsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/frameworkDeployments"
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*}/frameworkDeployments"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details about a cloud control deployment.
  rpc GetCloudControlDeployment(GetCloudControlDeploymentRequest)
      returns (CloudControlDeployment) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/cloudControlDeployments/*}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/cloudControlDeployments/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists the cloud conrol deployments in a given parent resource.
  rpc ListCloudControlDeployments(ListCloudControlDeploymentsRequest)
      returns (ListCloudControlDeploymentsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/cloudControlDeployments"
      additional_bindings {
        get: "/v1/{parent=projects/*/locations/*}/cloudControlDeployments"
      }
    };
    option (google.api.method_signature) = "parent";
  }
}

// The state of the deployment resource.
enum DeploymentState {
  // Default value. This value is unused.
  DEPLOYMENT_STATE_UNSPECIFIED = 0;

  // Validating the deployment.
  DEPLOYMENT_STATE_VALIDATING = 1;

  // Deployment is being created.
  DEPLOYMENT_STATE_CREATING = 2;

  // Deployment is being deleted.
  DEPLOYMENT_STATE_DELETING = 3;

  // Deployment is being updated.
  DEPLOYMENT_STATE_UPDATING = 8;

  // Deployment has failed. All the changes made by the deployment were
  // successfully rolled back. You can retry or delete a deployment that's
  // in this state.
  DEPLOYMENT_STATE_FAILED = 4;

  // Deployment is successful and ready to use.
  DEPLOYMENT_STATE_READY = 5;

  // Deployment is partially deployed. All the cloud controls weren't deployed
  // successfully. Retrying the operation resumes from the first failed
  // step.
  DEPLOYMENT_STATE_PARTIALLY_DEPLOYED = 6;

  // Deployment is partially deleted. All the cloud control deployments weren't
  // deleted successfully. Retrying the operation resumes from the first
  // failed step.
  DEPLOYMENT_STATE_PARTIALLY_DELETED = 7;
}

// Framework deployments represent the assignment of a framework to a target
// resource. Supported target resources are organizations, folders, and
// projects.
message FrameworkDeployment {
  option (google.api.resource) = {
    type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    pattern: "organizations/{organization}/locations/{location}/frameworkDeployments/{framework_deployment}"
    pattern: "projects/{project}/locations/{location}/frameworkDeployments/{framework_deployment}"
    plural: "frameworkDeployments"
    singular: "frameworkDeployment"
  };

  // Identifier. The name of the framework deployment, in the format
  // `organizations/{organization}/locations/{location}/frameworkDeployments/{framework_deployment}`
  // or
  // `projects/{project}/locations/{location}/frameworkDeployments/{framework_deployment}`.
  // The only supported location is `global`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Required. The details of the target resource that you want to deploy the
  // framework to. You can specify an existing resource, or create a new one.
  TargetResourceConfig target_resource_config = 2
      [(google.api.field_behavior) = REQUIRED];

  // Output only. The target resource to deploy the framework to, in one  the
  // following formats:
  //
  // - `organizations/{organizationID}`
  // - `folders/{folderID}`
  // - `projects/{projectID}`
  string computed_target_resource = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. A reference to the framework that you're deploying.
  FrameworkReference framework = 4 [(google.api.field_behavior) = REQUIRED];

  // Optional. A user-provided description of the framework deployment.
  string description = 5 [(google.api.field_behavior) = OPTIONAL];

  // Required. The deployment mode and parameters for each of the cloud controls
  // in the framework. Every cloud control in the framework includes metadata.
  repeated CloudControlMetadata cloud_control_metadata = 6
      [(google.api.field_behavior) = REQUIRED];

  // Output only. The state for the framework deployment.
  DeploymentState deployment_state = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the resource was created.
  google.protobuf.Timestamp create_time = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time at which the resource last updated.
  google.protobuf.Timestamp update_time = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. To prevent concurrent updates from overwriting each other, always
  // provide the `etag` when you update a framework deployment. You can also
  // provide the `etag` when you delete a framework deployment, to help
  // ensure that you're deleting the intended version of the
  // framework deployment.
  string etag = 11 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The display name of the target resource.
  string target_resource_display_name = 13
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The references to the cloud control deployments. The reference
  // includes all the cloud control deployments that are in the framework or in
  // a cloud control group.
  //
  // For example, if a framework deployment deploys two
  // cloud controls, `cc-deployment-1` and `cc-deployment-2`, then the
  // references are:
  //
  // ```
  // {
  //  cloud_control_deployment_reference: {
  //    cloud_control_deployment:
  //    "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-1"
  //  },
  //  cloud_control_deployment_reference: {
  //   cloud_control_deployment:
  //   "organizations/{organization}/locations/{location}/cloudControlDeployments/cc-deployment-2"
  //  }
  // ```
  repeated CloudControlDeploymentReference cloud_control_deployment_references =
      14 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A cloud control deployment represents the deployment of a particular cloud
// control on a target resource. Supported target resources are
// `organizations/{organizationID}`, `folders/{folderID}`, and
// `projects/{projectID}`.
message CloudControlDeployment {
  option (google.api.resource) = {
    type: "cloudsecuritycompliance.googleapis.com/CloudControlDeployment"
    pattern: "organizations/{organization}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}"
    pattern: "projects/{project}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}"
    plural: "cloudControlDeployments"
    singular: "cloudControlDeployment"
  };

  // Identifier. The name for the cloud control deployment, in the format
  // `organizations/{organization}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`
  // or
  // `projects/{project}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`.
  // The only supported location is `global`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Required. The details of the target resource that the cloud control is
  // deployed You can use an existing target resource or create a new target.
  TargetResourceConfig target_resource_config = 2
      [(google.api.field_behavior) = REQUIRED];

  // Output only. The resource that the cloud control is deployed on, in one of
  // the following formats:
  //
  // - `organizations/{organizationID}`
  // - `folders/{folderID}`
  // - `projects/{projectID}`
  string target_resource = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. The deployment mode and parameters for the cloud control.
  CloudControlMetadata cloud_control_metadata = 4
      [(google.api.field_behavior) = REQUIRED];

  // Optional. A friendly description for the cloud control deployment.
  string description = 5 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The state of the cloud control deployment.
  DeploymentState deployment_state = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time when the resource was created.
  google.protobuf.Timestamp create_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time when the resource was last updated.
  google.protobuf.Timestamp update_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. To prevent concurrent updates from overwriting each other,
  // provide the `etag` when you update a cloud control deployment. You can also
  // provide the `etag` when you delete a cloud control deployment to help
  // ensure that you're deleting the intended version of the
  // deployment.
  string etag = 9 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The cloud control after the given parameters are substituted.
  CloudControl parameter_substituted_cloud_control = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The references to the framework deployments that this cloud
  // control deployment is part of. A cloud control deployment can be part of
  // multiple framework deployments.
  repeated FrameworkDeploymentReference framework_deployment_references = 11
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The display name of the target resource.
  string target_resource_display_name = 12
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// The name of the target resource or the configuration that's required to
// create a new target resource.
message TargetResourceConfig {
  // The resource configuration for the target resource.
  oneof resource_config {
    // Optional. The resource hierarchy node, in one of the following formats:
    //
    // - `organizations/{organizationID}`
    // - `folders/{folderID}`
    // - `projects/{projectID}`
    string existing_target_resource = 1
        [(google.api.field_behavior) = OPTIONAL];

    // Optional. The details that are required to create a resource and use
    // that resource as the target resource for deployment.
    TargetResourceCreationConfig target_resource_creation_config = 2
        [(google.api.field_behavior) = OPTIONAL];
  }
}

// The configuration that's required to create a target resource.
message TargetResourceCreationConfig {
  // The configuration that's required to create the target resource.
  oneof resource_creation_config {
    // Optional. The configuration that's required to create a folder.
    FolderCreationConfig folder_creation_config = 1
        [(google.api.field_behavior) = OPTIONAL];

    // Optional. The configuration that's required to create a project.
    ProjectCreationConfig project_creation_config = 2
        [(google.api.field_behavior) = OPTIONAL];
  }
}

// The configuration that's required to create a folder to be used
// as the target resource for a deployment.
message FolderCreationConfig {
  // Required. The parent of the folder, in the format
  // `organizations/{organizationID}` or `folders/{folderID}`.
  string parent = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The display name of the folder.
  string folder_display_name = 2 [(google.api.field_behavior) = REQUIRED];
}

// The configuration that's required to create a project to be used
// as the target resource of a deployment.
message ProjectCreationConfig {
  // Required. The parent of the project, in the format
  // `organizations/{organizationID}` or `folders/{folderID}`.
  string parent = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The display name of the project.
  string project_display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The billing account ID for the project.
  string billing_account_id = 3 [(google.api.field_behavior) = REQUIRED];
}

// The enforcement mode and parameters of a cloud
// control deployment.
message CloudControlMetadata {
  // Required. The cloud control name and parameters.
  CloudControlDetails cloud_control_details = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The enforcement mode of the cloud control.
  EnforcementMode enforcement_mode = 2 [(google.api.field_behavior) = REQUIRED];
}

// The request message for [CreateFrameworkDeployment][].
message CreateFrameworkDeploymentRequest {
  // Required. The parent resource of the framework deployment in the format
  // `organizations/{organization}/locations/{location}`
  // or
  // `projects/{project}/locations/{location}`.
  // Only the global location is supported.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    }
  ];

  // Optional. An identifier for the framework deployment that's unique in scope
  // of the parent. If you don't specify a value, then a random UUID is
  // generated.
  string framework_deployment_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Required. The framework deployment that you're creating.
  FrameworkDeployment framework_deployment = 3
      [(google.api.field_behavior) = REQUIRED];
}

// The request message for [DeleteFrameworkDeployment][].
message DeleteFrameworkDeploymentRequest {
  // Required. The name of the framework deployment that you want to delete,
  // in the format
  // `organizations/{organization}/locations/{location}/frameworkDeployments/{framework_deployment}`
  // or
  // `projects/{project}/locations/{location}/frameworkDeployments/{framework_deployment}`.
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    }
  ];

  // Optional. An opaque identifier for the current version of the resource.
  //
  // If you provide this value, then it must match the existing value. If the
  // values don't match, then the request fails with an
  // [`ABORTED`][google.rpc.Code.ABORTED] error.
  //
  // If you omit this value, then the resource is deleted regardless of its
  // current `etag` value.
  string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}

// The request message for [GetFrameworkDeployment][].
message GetFrameworkDeploymentRequest {
  // Required. The name of the framework deployment, in the format
  // `organizations/{organization}/locations/{location}/frameworkDeployments/{framework_deployment}`
  // or
  // `projects/{project}/locations/{location}/frameworkDeployments/{framework_deployment}`.
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    }
  ];
}

// The request message for [ListFrameworkDeployments][].
message ListFrameworkDeploymentsRequest {
  // Required. The parent resource of the framework deployment, in the format
  // `organizations/{organization}/locations/{location}`
  // or
  // `projects/{project}/locations/{location}`.
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    }
  ];

  // Optional. The requested page size. The server might return fewer items than
  // requested.
  // If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token that identifies a page of results the server should
  // return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The filter to be applied on the resource, as defined by
  // [AIP-160: Filtering](https://google.aip.dev/160).
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The sort order for the results. The following values are
  // supported:
  //
  // * `name`
  // * `name desc`
  //
  // If you do not specify a value, then the results are not sorted.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// The response message for [ListFrameworkDeployments][].
message ListFrameworkDeploymentsResponse {
  // The list of framework deployments.
  repeated FrameworkDeployment framework_deployments = 1;

  // A token that identifies the next page of results that the server
  // should return.
  string next_page_token = 2;
}

// The request message for [GetCloudControlDeployment][].
message GetCloudControlDeploymentRequest {
  // Required. The name for the cloud control deployment, in the format
  // `organizations/{organization}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`
  // or
  // `projects/{project}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`.
  // The only supported location is `global`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/CloudControlDeployment"
    }
  ];
}

// The request message for [ListCloudControlDeployments][].
message ListCloudControlDeploymentsRequest {
  // Required. The parent resource for the cloud control deployment, in the
  // format `organizations/{organization}/locations/{location}` or
  // `projects/{project}/locations/{location}`.
  // The only supported location is `global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "cloudsecuritycompliance.googleapis.com/CloudControlDeployment"
    }
  ];

  // Optional. The requested page size. The server might return fewer items than
  // you requested.
  // If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token that identifies the page of results that the server
  // should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The filter to apply on the resource, as defined by
  // [AIP-160: Filtering](https://google.aip.dev/160).
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The sort order for the results. The following values are
  // supported:
  //
  // * `name`
  // * `name desc`
  //
  // If you do not specify a value, then the results are not sorted.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// The response message for [ListCloudControlDeployments][].
message ListCloudControlDeploymentsResponse {
  // The list of cloud control deployments.
  repeated CloudControlDeployment cloud_control_deployments = 1;

  // A token that identifies the next page of results that the server
  // should return.
  string next_page_token = 2;
}

// The reference to a cloud control deployment.
message CloudControlDeploymentReference {
  // Output only. The name of the CloudControlDeployment. The format is
  // `organizations/{organization}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`
  // or
  // `projects/{project}/locations/{location}/cloudControlDeployments/{cloud_control_deployment}`.
  // The only supported location is `global`.
  string cloud_control_deployment = 1 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/CloudControlDeployment"
    }
  ];
}

// The reference to a framework deployment.
message FrameworkDeploymentReference {
  // Output only. The name of the framework deployment, in the format
  // `organizations/{organization}/locations/{location}/frameworkDeployments/{framework_deployment}`
  // or
  // `projects/{project}/locations/{location}/frameworkDeployments/{framework_deployment}`.
  // The only supported location is `global`.
  string framework_deployment = 1 [
    (google.api.field_behavior) = OUTPUT_ONLY,
    (google.api.resource_reference) = {
      type: "cloudsecuritycompliance.googleapis.com/FrameworkDeployment"
    }
  ];

  // Optional. The reference to the framework that this deployment is for.
  // For example:
  //
  // ```
  // {
  //   framework:
  //   "organizations/{organization}/locations/{location}/frameworks/{framework}",
  //   major_revision_id: 1
  // }
  // ```
  //
  // The only supported location is `global`.
  FrameworkReference framework_reference = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The display name of the framework that this framework deployment
  // is for.
  string framework_display_name = 3 [(google.api.field_behavior) = OPTIONAL];
}