// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networkconnectivity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/networkconnectivity/v1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";
import "google/rpc/error_details.proto";
import "google/rpc/status.proto";

option csharp_namespace = "Google.Cloud.NetworkConnectivity.V1";
option go_package = "cloud.google.com/go/networkconnectivity/apiv1/networkconnectivitypb;networkconnectivitypb";
option java_multiple_files = true;
option java_outer_classname = "CrossNetworkAutomationProto";
option java_package = "com.google.cloud.networkconnectivity.v1";
option php_namespace = "Google\\Cloud\\NetworkConnectivity\\V1";
option ruby_package = "Google::Cloud::NetworkConnectivity::V1";
option (google.api.resource_definition) = {
  type: "compute.googleapis.com/Project"
  pattern: "projects/{project}"
};

// The service for CrossNetworkAutomation resources.
service CrossNetworkAutomationService {
  option (google.api.default_host) = "networkconnectivity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists ServiceConnectionMaps in a given project and location.
  rpc ListServiceConnectionMaps(ListServiceConnectionMapsRequest)
      returns (ListServiceConnectionMapsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionMaps"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single ServiceConnectionMap.
  rpc GetServiceConnectionMap(GetServiceConnectionMapRequest)
      returns (ServiceConnectionMap) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/serviceConnectionMaps/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new ServiceConnectionMap in a given project and location.
  rpc CreateServiceConnectionMap(CreateServiceConnectionMapRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionMaps"
      body: "service_connection_map"
    };
    option (google.api.method_signature) =
        "parent,service_connection_map,service_connection_map_id";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceConnectionMap"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of a single ServiceConnectionMap.
  rpc UpdateServiceConnectionMap(UpdateServiceConnectionMapRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{service_connection_map.name=projects/*/locations/*/serviceConnectionMaps/*}"
      body: "service_connection_map"
    };
    option (google.api.method_signature) = "service_connection_map,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceConnectionMap"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single ServiceConnectionMap.
  rpc DeleteServiceConnectionMap(DeleteServiceConnectionMapRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/serviceConnectionMaps/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists ServiceConnectionPolicies in a given project and location.
  rpc ListServiceConnectionPolicies(ListServiceConnectionPoliciesRequest)
      returns (ListServiceConnectionPoliciesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionPolicies"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single ServiceConnectionPolicy.
  rpc GetServiceConnectionPolicy(GetServiceConnectionPolicyRequest)
      returns (ServiceConnectionPolicy) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/serviceConnectionPolicies/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new ServiceConnectionPolicy in a given project and location.
  rpc CreateServiceConnectionPolicy(CreateServiceConnectionPolicyRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionPolicies"
      body: "service_connection_policy"
    };
    option (google.api.method_signature) =
        "parent,service_connection_policy,service_connection_policy_id";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceConnectionPolicy"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of a single ServiceConnectionPolicy.
  rpc UpdateServiceConnectionPolicy(UpdateServiceConnectionPolicyRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{service_connection_policy.name=projects/*/locations/*/serviceConnectionPolicies/*}"
      body: "service_connection_policy"
    };
    option (google.api.method_signature) =
        "service_connection_policy,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceConnectionPolicy"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single ServiceConnectionPolicy.
  rpc DeleteServiceConnectionPolicy(DeleteServiceConnectionPolicyRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/serviceConnectionPolicies/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists ServiceClasses in a given project and location.
  rpc ListServiceClasses(ListServiceClassesRequest)
      returns (ListServiceClassesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/serviceClasses"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single ServiceClass.
  rpc GetServiceClass(GetServiceClassRequest) returns (ServiceClass) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/serviceClasses/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates the parameters of a single ServiceClass.
  rpc UpdateServiceClass(UpdateServiceClassRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{service_class.name=projects/*/locations/*/serviceClasses/*}"
      body: "service_class"
    };
    option (google.api.method_signature) = "service_class,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceClass"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single ServiceClass.
  rpc DeleteServiceClass(DeleteServiceClassRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/serviceClasses/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Gets details of a single ServiceConnectionToken.
  rpc GetServiceConnectionToken(GetServiceConnectionTokenRequest)
      returns (ServiceConnectionToken) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/serviceConnectionTokens/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Lists ServiceConnectionTokens in a given project and location.
  rpc ListServiceConnectionTokens(ListServiceConnectionTokensRequest)
      returns (ListServiceConnectionTokensResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/serviceConnectionTokens"
    };
    option (google.api.method_signature) = "parent";
  }

  // Creates a new ServiceConnectionToken in a given project and location.
  rpc CreateServiceConnectionToken(CreateServiceConnectionTokenRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/serviceConnectionTokens"
      body: "service_connection_token"
    };
    option (google.api.method_signature) =
        "parent,service_connection_token,service_connection_token_id";
    option (google.longrunning.operation_info) = {
      response_type: "ServiceConnectionToken"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single ServiceConnectionToken.
  rpc DeleteServiceConnectionToken(DeleteServiceConnectionTokenRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/serviceConnectionTokens/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }
}

// The infrastructure used for connections between consumers/producers.
enum Infrastructure {
  // An invalid infrastructure as the default case.
  INFRASTRUCTURE_UNSPECIFIED = 0;

  // Private Service Connect is used for connections.
  PSC = 1;
}

// The error type indicates whether a connection error is consumer facing,
// producer facing or system internal.
enum ConnectionErrorType {
  // An invalid error type as the default case.
  CONNECTION_ERROR_TYPE_UNSPECIFIED = 0;

  // The error is due to Service Automation system internal.
  ERROR_INTERNAL = 1;

  // The error is due to the setup on consumer side.
  ERROR_CONSUMER_SIDE = 2;

  // The error is due to the setup on producer side.
  ERROR_PRODUCER_SIDE = 3;
}

// The requested IP version for the PSC connection.
enum IPVersion {
  // Default value. We will use IPv4 or IPv6 depending on the IP version of
  // first available subnetwork.
  IP_VERSION_UNSPECIFIED = 0;

  // Will use IPv4 only.
  IPV4 = 1;

  // Will use IPv6 only.
  IPV6 = 2;
}

// The ServiceConnectionMap resource.
message ServiceConnectionMap {
  option (google.api.resource) = {
    type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
    pattern: "projects/{project}/locations/{location}/serviceConnectionMaps/{service_connection_map}"
  };

  // The PSC configurations on producer side.
  message ProducerPscConfig {
    // The resource path of a service attachment.
    // Example:
    // projects/{projectNumOrId}/regions/{region}/serviceAttachments/{resourceId}.
    string service_attachment_uri = 1 [(google.api.resource_reference) = {
      type: "compute.googleapis.com/ServiceAttachment"
    }];
  }

  // Allow the producer to specify which consumers can connect to it.
  message ConsumerPscConfig {
    // PSC Consumer Config State.
    enum State {
      // Default state, when Connection Map is created initially.
      STATE_UNSPECIFIED = 0;

      // Set when policy and map configuration is valid,
      // and their matching can lead to allowing creation of PSC Connections
      // subject to other constraints like connections limit.
      VALID = 1;

      // No Service Connection Policy found for this network and Service
      // Class
      CONNECTION_POLICY_MISSING = 2;

      // Service Connection Policy limit reached for this network and Service
      // Class
      POLICY_LIMIT_REACHED = 3;

      // The consumer instance project is not in
      // AllowedGoogleProducersResourceHierarchyLevels of the matching
      // ServiceConnectionPolicy.
      CONSUMER_INSTANCE_PROJECT_NOT_ALLOWLISTED = 4;
    }

    // The consumer project where PSC connections are allowed to be created in.
    string project = 1;

    // The resource path of the consumer network where PSC connections are
    // allowed to be created in. Note, this network does not need be in the
    // ConsumerPscConfig.project in the case of SharedVPC.
    // Example:
    // projects/{projectNumOrId}/global/networks/{networkId}.
    string network = 2 [(google.api.resource_reference) = {
      type: "compute.googleapis.com/Network"
    }];

    // This is used in PSC consumer ForwardingRule to control whether the PSC
    // endpoint can be accessed from another region.
    bool disable_global_access = 3;

    // Output only. Overall state of PSC Connections management for this
    // consumer psc config.
    State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Immutable. Deprecated. Use producer_instance_metadata instead.
    // An immutable identifier for the producer instance.
    string producer_instance_id = 5
        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];

    // Output only. A map to store mapping between customer vip and target
    // service attachment. Only service attachment with producer specified ip
    // addresses are stored here.
    map<string, string> service_attachment_ip_address_map = 6
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Required. The project ID or project number of the consumer project. This
    // project is the one that the consumer uses to interact with the producer
    // instance. From the perspective of a consumer who's created a producer
    // instance, this is the project of the producer instance. Format:
    // 'projects/<project_id_or_number>' Eg. 'projects/consumer-project' or
    // 'projects/1234'
    string consumer_instance_project = 7 [
      (google.api.field_behavior) = REQUIRED,
      (google.api.resource_reference) = {
        type: "compute.googleapis.com/Project"
      }
    ];

    // Immutable. An immutable map for the producer instance metadata.
    map<string, string> producer_instance_metadata = 8
        [(google.api.field_behavior) = IMMUTABLE];

    // The requested IP version for the PSC connection.
    optional IPVersion ip_version = 9;
  }

  // PSC connection details on consumer side.
  message ConsumerPscConnection {
    // The state of the PSC connection.
    // We reserve the right to add more states without notice in the future.
    // Users should not use exhaustive switch statements on this enum.
    // See https://google.aip.dev/216.
    enum State {
      // An invalid state as the default case.
      STATE_UNSPECIFIED = 0;

      // The connection has been created successfully. However, for the
      // up-to-date connection status, please use the service attachment's
      // "ConnectedEndpoint.status" as the source of truth.
      ACTIVE = 1;

      // The connection is not functional since some resources on the connection
      // fail to be created.
      FAILED = 2;

      // The connection is being created.
      CREATING = 3;

      // The connection is being deleted.
      DELETING = 4;

      // The connection is being repaired to complete creation.
      CREATE_REPAIRING = 5;

      // The connection is being repaired to complete deletion.
      DELETE_REPAIRING = 6;
    }

    // The URI of a service attachment which is the target of the PSC
    // connection.
    string service_attachment_uri = 1;

    // The state of the PSC connection.
    State state = 2;

    // The consumer project whose PSC forwarding rule is connected to the
    // service attachments in this service connection map.
    string project = 3;

    // The consumer network whose PSC forwarding rule is connected to the
    // service attachments in this service connection map.
    // Note that the network could be on a different project (shared VPC).
    string network = 4;

    // The PSC connection id of the PSC forwarding rule connected
    // to the service attachments in this service connection map.
    string psc_connection_id = 5;

    // The IP literal allocated on the consumer network for the PSC forwarding
    // rule that is created to connect to the producer service attachment in
    // this service connection map.
    string ip = 6;

    // The error type indicates whether the error is consumer facing, producer
    // facing or system internal.
    ConnectionErrorType error_type = 7 [deprecated = true];

    // The most recent error during operating this connection.
    google.rpc.Status error = 8 [deprecated = true];

    // The last Compute Engine operation to setup PSC connection.
    string gce_operation = 9;

    // The URI of the consumer forwarding rule created.
    // Example:
    // projects/{projectNumOrId}/regions/us-east1/networks/{resourceId}.
    string forwarding_rule = 10;

    // Output only. The error info for the latest error during operating this
    // connection.
    google.rpc.ErrorInfo error_info = 11
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The URI of the selected subnetwork selected to allocate IP
    // address for this connection.
    string selected_subnetwork = 12 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Immutable. Deprecated. Use producer_instance_metadata instead.
    // An immutable identifier for the producer instance.
    string producer_instance_id = 13
        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];

    // Immutable. An immutable map for the producer instance metadata.
    map<string, string> producer_instance_metadata = 14
        [(google.api.field_behavior) = IMMUTABLE];

    // The requested IP version for the PSC connection.
    optional IPVersion ip_version = 15;
  }

  // Immutable. The name of a ServiceConnectionMap.
  // Format:
  // projects/{project}/locations/{location}/serviceConnectionMaps/{service_connection_map}
  // See: https://google.aip.dev/122#fields-representing-resource-names
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Time when the ServiceConnectionMap was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when the ServiceConnectionMap was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // User-defined labels.
  map<string, string> labels = 4;

  // A description of this resource.
  string description = 5;

  // The service class identifier this ServiceConnectionMap is for.
  // The user of ServiceConnectionMap create API needs to have
  // networkconnecitivty.serviceclasses.use iam permission for the service
  // class.
  string service_class = 7;

  // Output only. The service class uri this ServiceConnectionMap is for.
  string service_class_uri = 12 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The infrastructure used for connections between
  // consumers/producers.
  Infrastructure infrastructure = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The PSC configurations on producer side.
  repeated ProducerPscConfig producer_psc_configs = 9;

  // The PSC configurations on consumer side.
  repeated ConsumerPscConfig consumer_psc_configs = 10;

  // Output only. PSC connection details on consumer side.
  repeated ConsumerPscConnection consumer_psc_connections = 11
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // The token provided by the consumer. This token authenticates that the
  // consumer can create a connection within the specified project and network.
  string token = 13;

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 14 [(google.api.field_behavior) = OPTIONAL];
}

// Request for ListServiceConnectionMaps.
message ListServiceConnectionMapsRequest {
  // Required. The parent resource's name. ex. projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // The maximum number of results per page that should be returned.
  int32 page_size = 2;

  // The page token.
  string page_token = 3;

  // A filter expression that filters the results listed in the response.
  string filter = 4;

  // Sort the results by a certain order.
  string order_by = 5;
}

// Response for ListServiceConnectionMaps.
message ListServiceConnectionMapsResponse {
  // ServiceConnectionMaps to be returned.
  repeated ServiceConnectionMap service_connection_maps = 1;

  // The next pagination token in the List response. It should be used as
  // page_token for the following request. An empty value means no more result.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for GetServiceConnectionMap.
message GetServiceConnectionMapRequest {
  // Required. Name of the ServiceConnectionMap to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
    }
  ];
}

// Request for CreateServiceConnectionMap.
message CreateServiceConnectionMapRequest {
  // Required. The parent resource's name of the ServiceConnectionMap. ex.
  // projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
    }
  ];

  // Optional. Resource ID
  // (i.e. 'foo' in '[...]/projects/p/locations/l/serviceConnectionMaps/foo')
  // See https://google.aip.dev/122#resource-id-segments
  // Unique per location.
  // If one is not provided, one will be generated.
  string service_connection_map_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Required. Initial values for a new ServiceConnectionMaps
  ServiceConnectionMap service_connection_map = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request for UpdateServiceConnectionMap.
message UpdateServiceConnectionMapRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // ServiceConnectionMap resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. New values to be patched into the resource.
  ServiceConnectionMap service_connection_map = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request for DeleteServiceConnectionMap.
message DeleteServiceConnectionMapRequest {
  // Required. The name of the ServiceConnectionMap to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionMap"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The ServiceConnectionPolicy resource.
message ServiceConnectionPolicy {
  option (google.api.resource) = {
    type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
    pattern: "projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy}"
  };

  // Configuration used for Private Service Connect connections. Used when
  // Infrastructure is PSC.
  message PscConfig {
    // ProducerInstanceLocation is used to specify which authorization mechanism
    // to use to determine which projects the Producer instance can be within.
    enum ProducerInstanceLocation {
      // Producer instance location is not specified. When this option is
      // chosen, then the PSC connections created by this
      // ServiceConnectionPolicy must be within the same project as the Producer
      // instance. This is the default ProducerInstanceLocation value.
      // To allow for PSC connections from this network to other networks, use
      // the CUSTOM_RESOURCE_HIERARCHY_LEVELS option.
      PRODUCER_INSTANCE_LOCATION_UNSPECIFIED = 0;

      // Producer instance must be within one of the values provided in
      // allowed_google_producers_resource_hierarchy_level.
      CUSTOM_RESOURCE_HIERARCHY_LEVELS = 1;
    }

    // The resource paths of subnetworks to use for IP address management.
    // Example:
    // projects/{projectNumOrId}/regions/{region}/subnetworks/{resourceId}.
    repeated string subnetworks = 1 [(google.api.resource_reference) = {
      type: "compute.googleapis.com/Subnetwork"
    }];

    // Optional. Max number of PSC connections for this policy.
    optional int64 limit = 2 [(google.api.field_behavior) = OPTIONAL];

    // Required. ProducerInstanceLocation is used to specify which authorization
    // mechanism to use to determine which projects the Producer instance can be
    // within.
    ProducerInstanceLocation producer_instance_location = 3
        [(google.api.field_behavior) = REQUIRED];

    // Optional. List of Projects, Folders, or Organizations from where the
    // Producer instance can be within. For example, a network administrator can
    // provide both 'organizations/foo' and 'projects/bar' as
    // allowed_google_producers_resource_hierarchy_levels. This allowlists this
    // network to connect with any Producer instance within the 'foo'
    // organization or the 'bar' project. By default,
    // allowed_google_producers_resource_hierarchy_level is empty. The format
    // for each allowed_google_producers_resource_hierarchy_level is <resource
    // type>/<id> where <resource type> is one of 'projects', 'folders', or
    // 'organizations' and <id> is either the ID or the number of the resource
    // type. Format for each allowed_google_producers_resource_hierarchy_level
    // value: 'projects/<project_id_or_number>' or 'folders/<folder_id>' or
    // 'organizations/<organization_id>'
    // Eg. [projects/my-project-id, projects/567, folders/891,
    // organizations/123]
    repeated string allowed_google_producers_resource_hierarchy_level = 4
        [(google.api.field_behavior) = OPTIONAL];
  }

  // Information about a specific Private Service Connect connection.
  message PscConnection {
    // State of the PSC Connection
    State state = 1;

    // The resource reference of the PSC Forwarding Rule within the consumer
    // VPC.
    string consumer_forwarding_rule = 2;

    // The resource reference of the consumer address.
    string consumer_address = 3;

    // The error type indicates whether the error is consumer facing, producer
    // facing or system internal.
    ConnectionErrorType error_type = 4 [deprecated = true];

    // The most recent error during operating this connection.
    // Deprecated, please use error_info instead.
    google.rpc.Status error = 5 [deprecated = true];

    // The last Compute Engine operation to setup PSC connection.
    string gce_operation = 6;

    // The project where the PSC connection is created.
    string consumer_target_project = 7;

    // The PSC connection id of the PSC forwarding rule.
    string psc_connection_id = 8;

    // Output only. The error info for the latest error during operating this
    // connection.
    google.rpc.ErrorInfo error_info = 9
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. The URI of the subnetwork selected to allocate IP address
    // for this connection.
    string selected_subnetwork = 10 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Immutable. Deprecated. Use producer_instance_metadata instead.
    // An immutable identifier for the producer instance.
    string producer_instance_id = 11
        [deprecated = true, (google.api.field_behavior) = IMMUTABLE];

    // Immutable. An immutable map for the producer instance metadata.
    map<string, string> producer_instance_metadata = 12
        [(google.api.field_behavior) = IMMUTABLE];

    // Output only. [Output only] The service class associated with this PSC
    // Connection. The value is derived from the SCPolicy and matches the
    // service class name provided by the customer.
    string service_class = 13 [(google.api.field_behavior) = OUTPUT_ONLY];

    // The requested IP version for the PSC connection.
    optional IPVersion ip_version = 14;
  }

  // The state of the PSC connection.
  // We reserve the right to add more states without notice in the future.
  // Users should not use exhaustive switch statements on this enum.
  // See https://google.aip.dev/216.
  enum State {
    // An invalid state as the default case.
    STATE_UNSPECIFIED = 0;

    // The connection has been created successfully. However, for the
    // up-to-date connection status, please use the created forwarding rule's
    // "PscConnectionStatus" as the source of truth.
    ACTIVE = 1;

    // The connection is not functional since some resources on the connection
    // fail to be created.
    FAILED = 2;

    // The connection is being created.
    CREATING = 3;

    // The connection is being deleted.
    DELETING = 4;

    // The connection is being repaired to complete creation.
    CREATE_REPAIRING = 5;

    // The connection is being repaired to complete deletion.
    DELETE_REPAIRING = 6;
  }

  // Immutable. The name of a ServiceConnectionPolicy.
  // Format:
  // projects/{project}/locations/{location}/serviceConnectionPolicies/{service_connection_policy}
  // See: https://google.aip.dev/122#fields-representing-resource-names
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Time when the ServiceConnectionPolicy was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when the ServiceConnectionPolicy was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // User-defined labels.
  map<string, string> labels = 4;

  // A description of this resource.
  string description = 5;

  // The resource path of the consumer network.
  // Example:
  // - projects/{projectNumOrId}/global/networks/{resourceId}.
  string network = 6 [
    (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
  ];

  // The service class identifier for which this ServiceConnectionPolicy is for.
  // The service class identifier is a unique, symbolic representation of a
  // ServiceClass. It is provided by the Service Producer. Google services have
  // a prefix of gcp or google-cloud. For example, gcp-memorystore-redis or
  // google-cloud-sql. 3rd party services do not. For example,
  // test-service-a3dfcx.
  string service_class = 7;

  // Output only. The type of underlying resources used to create the
  // connection.
  Infrastructure infrastructure = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Configuration used for Private Service Connect connections. Used when
  // Infrastructure is PSC.
  PscConfig psc_config = 9;

  // Output only. [Output only] Information about each Private Service Connect
  // connection.
  repeated PscConnection psc_connections = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 11 [(google.api.field_behavior) = OPTIONAL];
}

// Request for ListServiceConnectionPolicies.
message ListServiceConnectionPoliciesRequest {
  // Required. The parent resource's name. ex. projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // The maximum number of results per page that should be returned.
  int32 page_size = 2;

  // The page token.
  string page_token = 3;

  // A filter expression that filters the results listed in the response.
  string filter = 4;

  // Sort the results by a certain order.
  string order_by = 5;
}

// Response for ListServiceConnectionPolicies.
message ListServiceConnectionPoliciesResponse {
  // ServiceConnectionPolicies to be returned.
  repeated ServiceConnectionPolicy service_connection_policies = 1;

  // The next pagination token in the List response. It should be used as
  // page_token for the following request. An empty value means no more result.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for GetServiceConnectionPolicy.
message GetServiceConnectionPolicyRequest {
  // Required. Name of the ServiceConnectionPolicy to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
    }
  ];
}

// Request for CreateServiceConnectionPolicy.
message CreateServiceConnectionPolicyRequest {
  // Required. The parent resource's name of the ServiceConnectionPolicy. ex.
  // projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
    }
  ];

  // Optional. Resource ID
  // (i.e. 'foo' in
  // '[...]/projects/p/locations/l/serviceConnectionPolicies/foo') See
  // https://google.aip.dev/122#resource-id-segments Unique per location.
  string service_connection_policy_id = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Initial values for a new ServiceConnectionPolicies
  ServiceConnectionPolicy service_connection_policy = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request for UpdateServiceConnectionPolicy.
message UpdateServiceConnectionPolicyRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // ServiceConnectionPolicy resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. New values to be patched into the resource.
  ServiceConnectionPolicy service_connection_policy = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request for DeleteServiceConnectionPolicy.
message DeleteServiceConnectionPolicyRequest {
  // Required. The name of the ServiceConnectionPolicy to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionPolicy"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The ServiceClass resource.
message ServiceClass {
  option (google.api.resource) = {
    type: "networkconnectivity.googleapis.com/ServiceClass"
    pattern: "projects/{project}/locations/{location}/serviceClasses/{service_class}"
  };

  // Immutable. The name of a ServiceClass resource.
  // Format:
  // projects/{project}/locations/{location}/serviceClasses/{service_class}
  // See: https://google.aip.dev/122#fields-representing-resource-names
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. The generated service class name. Use this name to refer to
  // the Service class in Service Connection Maps and Service Connection
  // Policies.
  string service_class = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when the ServiceClass was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when the ServiceClass was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // User-defined labels.
  map<string, string> labels = 4;

  // A description of this resource.
  string description = 5;

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 8 [(google.api.field_behavior) = OPTIONAL];
}

// Request for ListServiceClasses.
message ListServiceClassesRequest {
  // Required. The parent resource's name. ex. projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // The maximum number of results per page that should be returned.
  int32 page_size = 2;

  // The page token.
  string page_token = 3;

  // A filter expression that filters the results listed in the response.
  string filter = 4;

  // Sort the results by a certain order.
  string order_by = 5;
}

// Response for ListServiceClasses.
message ListServiceClassesResponse {
  // ServiceClasses to be returned.
  repeated ServiceClass service_classes = 1;

  // The next pagination token in the List response. It should be used as
  // page_token for the following request. An empty value means no more result.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for GetServiceClass.
message GetServiceClassRequest {
  // Required. Name of the ServiceClass to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceClass"
    }
  ];
}

// Request for UpdateServiceClass.
message UpdateServiceClassRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // ServiceClass resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. New values to be patched into the resource.
  ServiceClass service_class = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request for DeleteServiceClass.
message DeleteServiceClassRequest {
  // Required. The name of the ServiceClass to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceClass"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The ServiceConnectionToken resource.
message ServiceConnectionToken {
  option (google.api.resource) = {
    type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
    pattern: "projects/{project}/locations/{location}/serviceConnectionTokens/{service_connection_token}"
  };

  // Immutable. The name of a ServiceConnectionToken.
  // Format:
  // projects/{project}/locations/{location}/ServiceConnectionTokens/{service_connection_token}
  // See: https://google.aip.dev/122#fields-representing-resource-names
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Time when the ServiceConnectionToken was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Time when the ServiceConnectionToken was updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // User-defined labels.
  map<string, string> labels = 4;

  // A description of this resource.
  string description = 5;

  // The resource path of the network associated with this token.
  // Example:
  // projects/{projectNumOrId}/global/networks/{resourceId}.
  string network = 6 [
    (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
  ];

  // Output only. The token generated by Automation.
  string token = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time to which this token is valid.
  google.protobuf.Timestamp expire_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 9 [(google.api.field_behavior) = OPTIONAL];
}

// Request for ListServiceConnectionTokens.
message ListServiceConnectionTokensRequest {
  // Required. The parent resource's name. ex. projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // The maximum number of results per page that should be returned.
  int32 page_size = 2;

  // The page token.
  string page_token = 3;

  // A filter expression that filters the results listed in the response.
  string filter = 4;

  // Sort the results by a certain order.
  string order_by = 5;
}

// Response for ListServiceConnectionTokens.
message ListServiceConnectionTokensResponse {
  // ServiceConnectionTokens to be returned.
  repeated ServiceConnectionToken service_connection_tokens = 1;

  // The next pagination token in the List response. It should be used as
  // page_token for the following request. An empty value means no more result.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for GetServiceConnectionToken.
message GetServiceConnectionTokenRequest {
  // Required. Name of the ServiceConnectionToken to get.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
    }
  ];
}

// Request for CreateServiceConnectionToken.
message CreateServiceConnectionTokenRequest {
  // Required. The parent resource's name of the ServiceConnectionToken. ex.
  // projects/123/locations/us-east1
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
    }
  ];

  // Optional. Resource ID
  // (i.e. 'foo' in '[...]/projects/p/locations/l/ServiceConnectionTokens/foo')
  // See https://google.aip.dev/122#resource-id-segments
  // Unique per location.
  // If one is not provided, one will be generated.
  string service_connection_token_id = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Initial values for a new ServiceConnectionTokens
  ServiceConnectionToken service_connection_token = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request for DeleteServiceConnectionToken.
message DeleteServiceConnectionTokenRequest {
  // Required. The name of the ServiceConnectionToken to delete.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networkconnectivity.googleapis.com/ServiceConnectionToken"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The etag is computed by the server, and may be sent on update and
  // delete requests to ensure the client has an up-to-date value before
  // proceeding.
  optional string etag = 3 [(google.api.field_behavior) = OPTIONAL];
}