// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.discoveryengine.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.DiscoveryEngine.V1";
option go_package = "cloud.google.com/go/discoveryengine/apiv1/discoveryenginepb;discoveryenginepb";
option java_multiple_files = true;
option java_outer_classname = "CmekConfigServiceProto";
option java_package = "com.google.cloud.discoveryengine.v1";
option objc_class_prefix = "DISCOVERYENGINE";
option php_namespace = "Google\\Cloud\\DiscoveryEngine\\V1";
option ruby_package = "Google::Cloud::DiscoveryEngine::V1";

// Service for managing CMEK related tasks
service CmekConfigService {
  option (google.api.default_host) = "discoveryengine.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Provisions a CMEK key for use in a location of a customer's project.
  // This method will also conduct location validation on the provided
  // cmekConfig to make sure the key is valid and can be used in the
  // selected location.
  rpc UpdateCmekConfig(UpdateCmekConfigRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{config.name=projects/*/locations/*/cmekConfig}"
      body: "config"
      additional_bindings {
        patch: "/v1/{config.name=projects/*/locations/*/cmekConfigs/*}"
        body: "config"
      }
    };
    option (google.api.method_signature) = "config";
    option (google.longrunning.operation_info) = {
      response_type: "google.cloud.discoveryengine.v1.CmekConfig"
      metadata_type: "google.cloud.discoveryengine.v1.UpdateCmekConfigMetadata"
    };
  }

  // Gets the [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig].
  rpc GetCmekConfig(GetCmekConfigRequest) returns (CmekConfig) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/cmekConfig}"
      additional_bindings {
        get: "/v1/{name=projects/*/locations/*/cmekConfigs/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Lists all the [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig]s
  // with the project.
  rpc ListCmekConfigs(ListCmekConfigsRequest)
      returns (ListCmekConfigsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/cmekConfigs"
    };
    option (google.api.method_signature) = "parent";
  }

  // De-provisions a CmekConfig.
  rpc DeleteCmekConfig(DeleteCmekConfigRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/cmekConfigs/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.discoveryengine.v1.DeleteCmekConfigMetadata"
    };
  }
}

// Request message for UpdateCmekConfig method.
// rpc.
message UpdateCmekConfigRequest {
  // Required. The CmekConfig resource.
  CmekConfig config = 1 [(google.api.field_behavior) = REQUIRED];

  // Set the following CmekConfig as the default to be used for child
  // resources if one is not specified.
  bool set_default = 2;
}

// Request message for GetCmekConfigRequest method.
message GetCmekConfigRequest {
  // Required. Resource name of
  // [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig], such as
  // `projects/*/locations/*/cmekConfig` or
  // `projects/*/locations/*/cmekConfigs/*`.
  //
  // If the caller does not have permission to access the
  // [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig], regardless of
  // whether or not it exists, a PERMISSION_DENIED error is returned.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "discoveryengine.googleapis.com/CmekConfig"
    }
  ];
}

// Metadata for single-regional CMEKs.
message SingleRegionKey {
  // Required. Single-regional kms key resource name which will be used to
  // encrypt resources
  // `projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{keyId}`.
  string kms_key = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/CryptoKeys"
    }
  ];
}

// Configurations used to enable CMEK data encryption with Cloud KMS keys.
message CmekConfig {
  option (google.api.resource) = {
    type: "discoveryengine.googleapis.com/CmekConfig"
    pattern: "projects/{project}/locations/{location}/cmekConfig"
    pattern: "projects/{project}/locations/{location}/cmekConfigs/{cmek_config}"
    plural: "cmekConfigs"
    singular: "cmekConfig"
  };

  // States of the CmekConfig.
  enum State {
    // The CmekConfig state is unknown.
    STATE_UNSPECIFIED = 0;

    // The CmekConfig is creating.
    CREATING = 1;

    // The CmekConfig can be used with DataStores.
    ACTIVE = 2;

    // The CmekConfig is unavailable, most likely due to the KMS Key being
    // revoked.
    KEY_ISSUE = 3;

    // The CmekConfig is deleting.
    DELETING = 4;

    // The CmekConfig deletion process failed.
    DELETE_FAILED = 7;

    // The CmekConfig is not usable, most likely due to some internal issue.
    UNUSABLE = 5;

    // The KMS key version is being rotated.
    ACTIVE_ROTATING = 6;

    // The KMS key is soft deleted. Some cleanup policy will eventually be
    // applied.
    DELETED = 8;
  }

  // States of NotebookLM.
  enum NotebookLMState {
    // The NotebookLM state is unknown.
    NOTEBOOK_LM_STATE_UNSPECIFIED = 0;

    // The NotebookLM is not ready.
    NOTEBOOK_LM_NOT_READY = 1;

    // The NotebookLM is ready to be used.
    NOTEBOOK_LM_READY = 2;

    // The NotebookLM is not enabled.
    NOTEBOOK_LM_NOT_ENABLED = 3;
  }

  // Required. The name of the CmekConfig of the form
  // `projects/{project}/locations/{location}/cmekConfig` or
  // `projects/{project}/locations/{location}/cmekConfigs/{cmek_config}`.
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // KMS key resource name which will be used to encrypt resources
  // `projects/{project}/locations/{location}/keyRings/{keyRing}/cryptoKeys/{keyId}`.
  string kms_key = 2 [(google.api.resource_reference) = {
    type: "cloudkms.googleapis.com/CryptoKeys"
  }];

  // KMS key version resource name which will be used to encrypt resources
  // `<kms_key>/cryptoKeyVersions/{keyVersion}`.
  string kms_key_version = 6 [(google.api.resource_reference) = {
    type: "cloudkms.googleapis.com/CryptoKeyVersions"
  }];

  // Output only. The states of the CmekConfig.
  State state = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The default CmekConfig for the Customer.
  bool is_default = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp of the last key rotation.
  int64 last_rotation_timestamp_micros = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Single-regional CMEKs that are required for some VAIS features.
  repeated SingleRegionKey single_region_keys = 7
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. Whether the NotebookLM Corpus is ready to be used.
  NotebookLMState notebooklm_state = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Metadata related to the progress of the
// [CmekConfigService.UpdateCmekConfig][google.cloud.discoveryengine.v1.CmekConfigService.UpdateCmekConfig]
// operation. This will be returned by the google.longrunning.Operation.metadata
// field.
message UpdateCmekConfigMetadata {
  // Operation create time.
  google.protobuf.Timestamp create_time = 1;

  // Operation last update time. If the operation is done, this is also the
  // finish time.
  google.protobuf.Timestamp update_time = 2;
}

// Request message for
// [CmekConfigService.ListCmekConfigs][google.cloud.discoveryengine.v1.CmekConfigService.ListCmekConfigs]
// method.
message ListCmekConfigsRequest {
  // Required. The parent location resource name, such as
  // `projects/{project}/locations/{location}`.
  //
  // If the caller does not have permission to list
  // [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig]s under this
  // location, regardless of whether or not a CmekConfig exists, a
  // PERMISSION_DENIED error is returned.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "discoveryengine.googleapis.com/Location"
    }
  ];
}

// Response message for
// [CmekConfigService.ListCmekConfigs][google.cloud.discoveryengine.v1.CmekConfigService.ListCmekConfigs]
// method.
message ListCmekConfigsResponse {
  // All the customer's
  // [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig]s.
  repeated CmekConfig cmek_configs = 1;
}

// Request message for
// [CmekConfigService.DeleteCmekConfig][google.cloud.discoveryengine.v1.CmekConfigService.DeleteCmekConfig]
// method.
message DeleteCmekConfigRequest {
  // Required. The resource name of the
  // [CmekConfig][google.cloud.discoveryengine.v1.CmekConfig] to delete, such as
  // `projects/{project}/locations/{location}/cmekConfigs/{cmek_config}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "discoveryengine.googleapis.com/CmekConfig"
    }
  ];
}

// Metadata related to the progress of the
// [CmekConfigService.DeleteCmekConfig][google.cloud.discoveryengine.v1.CmekConfigService.DeleteCmekConfig]
// operation. This will be returned by the google.longrunning.Operation.metadata
// field.
message DeleteCmekConfigMetadata {
  // Operation create time.
  google.protobuf.Timestamp create_time = 1;

  // Operation last update time. If the operation is done, this is also the
  // finish time.
  google.protobuf.Timestamp update_time = 2;
}