// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1";
option go_package = "cloud.google.com/go/networksecurity/apiv1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "AddressGroupProto";
option java_package = "com.google.cloud.networksecurity.v1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1";

// AddressGroup is a resource that manages a collection of IP or Domain Names,
// it can be used in Firewall Policy to represent allow or deny traffic from
// all the IP or Domain Names from the Address Group.
service AddressGroupService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists address groups in a given project and location.
  rpc ListAddressGroups(ListAddressGroupsRequest)
      returns (ListAddressGroupsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/addressGroups"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single address group.
  rpc GetAddressGroup(GetAddressGroupRequest) returns (AddressGroup) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/addressGroups/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new address group in a given project and location.
  rpc CreateAddressGroup(CreateAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/addressGroups"
      body: "address_group"
    };
    option (google.api.method_signature) =
        "parent,address_group,address_group_id";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates the parameters of a single address group.
  rpc UpdateAddressGroup(UpdateAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{address_group.name=projects/*/locations/*/addressGroups/*}"
      body: "address_group"
    };
    option (google.api.method_signature) = "address_group,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Adds items to an address group.
  rpc AddAddressGroupItems(AddAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=projects/*/locations/*/addressGroups/*}:addItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,items";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Removes items from an address group.
  rpc RemoveAddressGroupItems(RemoveAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=projects/*/locations/*/addressGroups/*}:removeItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,items";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Clones items from one address group to another.
  rpc CloneAddressGroupItems(CloneAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=projects/*/locations/*/addressGroups/*}:cloneItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,source_address_group";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes a single address group.
  rpc DeleteAddressGroup(DeleteAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/addressGroups/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Lists references of an address group.
  rpc ListAddressGroupReferences(ListAddressGroupReferencesRequest)
      returns (ListAddressGroupReferencesResponse) {
    option (google.api.http) = {
      get: "/v1/{address_group=projects/*/locations/*/addressGroups/*}:listReferences"
    };
    option (google.api.method_signature) = "address_group";
  }
}

// Organization AddressGroup is created under organization. Requests against
// Organization AddressGroup will use project from request credential for
// activation/quota/visibility check.
service OrganizationAddressGroupService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists address groups in a given project and location.
  rpc ListAddressGroups(ListAddressGroupsRequest)
      returns (ListAddressGroupsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/addressGroups"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single address group.
  rpc GetAddressGroup(GetAddressGroupRequest) returns (AddressGroup) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/addressGroups/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new address group in a given project and location.
  rpc CreateAddressGroup(CreateAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/addressGroups"
      body: "address_group"
    };
    option (google.api.method_signature) =
        "parent,address_group,address_group_id";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates parameters of an address group.
  rpc UpdateAddressGroup(UpdateAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{address_group.name=organizations/*/locations/*/addressGroups/*}"
      body: "address_group"
    };
    option (google.api.method_signature) = "address_group,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Adds items to an address group.
  rpc AddAddressGroupItems(AddAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=organizations/*/locations/*/addressGroups/*}:addItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,items";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Removes items from an address group.
  rpc RemoveAddressGroupItems(RemoveAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=organizations/*/locations/*/addressGroups/*}:removeItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,items";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Clones items from one address group to another.
  rpc CloneAddressGroupItems(CloneAddressGroupItemsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{address_group=organizations/*/locations/*/addressGroups/*}:cloneItems"
      body: "*"
    };
    option (google.api.method_signature) = "address_group,source_address_group";
    option (google.longrunning.operation_info) = {
      response_type: "AddressGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes an address group.
  rpc DeleteAddressGroup(DeleteAddressGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/addressGroups/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Lists references of an address group.
  rpc ListAddressGroupReferences(ListAddressGroupReferencesRequest)
      returns (ListAddressGroupReferencesResponse) {
    option (google.api.http) = {
      get: "/v1/{address_group=organizations/*/locations/*/addressGroups/*}:listReferences"
    };
    option (google.api.method_signature) = "address_group";
  }
}

// AddressGroup is a resource that specifies how a collection of IP/DNS used
// in Firewall Policy.
message AddressGroup {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/AddressGroup"
    pattern: "projects/{project}/locations/{location}/addressGroups/{address_group}"
    pattern: "organizations/{organization}/locations/{location}/addressGroups/{address_group}"
  };

  // Possible type of the Address Group.
  enum Type {
    // Default value.
    TYPE_UNSPECIFIED = 0;

    // IP v4 ranges.
    IPV4 = 1;

    // IP v6 ranges.
    IPV6 = 2;
  }

  // Purpose of the Address Group.
  enum Purpose {
    // Default value. Should never happen.
    PURPOSE_UNSPECIFIED = 0;

    // Address Group is distributed to VMC, and is usable in Firewall Policies
    // and other systems that rely on VMC.
    DEFAULT = 1;

    // Address Group is usable in Cloud Armor.
    CLOUD_ARMOR = 2;
  }

  // Required. Name of the AddressGroup resource. It matches pattern
  // `projects/*/locations/{location}/addressGroups/<address_group>`.
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Free-text description of the resource.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Set of label tags associated with the AddressGroup resource.
  map<string, string> labels = 5 [(google.api.field_behavior) = OPTIONAL];

  // Required. The type of the Address Group. Possible values are "IPv4" or
  // "IPV6".
  Type type = 6 [(google.api.field_behavior) = REQUIRED];

  // Optional. List of items.
  repeated string items = 7 [(google.api.field_behavior) = OPTIONAL];

  // Required. Capacity of the Address Group
  int32 capacity = 8 [(google.api.field_behavior) = REQUIRED];

  // Output only. Server-defined fully-qualified URL for this resource.
  string self_link = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. List of supported purposes of the Address Group.
  repeated Purpose purpose = 10 [(google.api.field_behavior) = OPTIONAL];
}

// Request used with the ListAddressGroups method.
message ListAddressGroupsRequest {
  // Required. The project and location from which the AddressGroups
  // should be listed, specified in the format
  // `projects/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Maximum number of AddressGroups to return per call.
  int32 page_size = 2;

  // The value returned by the last
  // `ListAddressGroupsResponse` Indicates that this is a
  // continuation of a prior `ListAddressGroups` call, and
  // that the system should return the next page of data.
  string page_token = 3;

  // Optional. If true, allow partial responses for multi-regional Aggregated
  // List requests.
  bool return_partial_success = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Response returned by the ListAddressGroups method.
message ListAddressGroupsResponse {
  // List of AddressGroups resources.
  repeated AddressGroup address_groups = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request used by the GetAddressGroup method.
message GetAddressGroupRequest {
  // Required. A name of the AddressGroup to get. Must be in the format
  // `projects/*/locations/{location}/addressGroups/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];
}

// Request used by the CreateAddressGroup method.
message CreateAddressGroupRequest {
  // Required. The parent resource of the AddressGroup. Must be in the
  // format `projects/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Required. Short name of the AddressGroup resource to be created.
  // This value should be 1-63 characters long, containing only
  // letters, numbers, hyphens, and underscores, and should not start
  // with a number. E.g. "authz_policy".
  string address_group_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. AddressGroup resource to be created.
  AddressGroup address_group = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the UpdateAddressGroup method.
message UpdateAddressGroupRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // AddressGroup resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Updated AddressGroup resource.
  AddressGroup address_group = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the DeleteAddressGroup method.
message DeleteAddressGroupRequest {
  // Required. A name of the AddressGroup to delete. Must be in the format
  // `projects/*/locations/{location}/addressGroups/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the AddAddressGroupItems method.
message AddAddressGroupItemsRequest {
  // Required. A name of the AddressGroup to add items to. Must be in the format
  // `projects|organization/*/locations/{location}/addressGroups/*`.
  string address_group = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Required. List of items to add.
  repeated string items = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the RemoveAddressGroupItems method.
message RemoveAddressGroupItemsRequest {
  // Required. A name of the AddressGroup to remove items from. Must be in the
  // format `projects|organization/*/locations/{location}/addressGroups/*`.
  string address_group = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Required. List of items to remove.
  repeated string items = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the CloneAddressGroupItems method.
message CloneAddressGroupItemsRequest {
  // Required. A name of the AddressGroup to clone items to. Must be in the
  // format `projects|organization/*/locations/{location}/addressGroups/*`.
  string address_group = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Required. Source address group to clone items from.
  string source_address_group = 2 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the ListAddressGroupReferences method.
message ListAddressGroupReferencesRequest {
  // Required. A name of the AddressGroup to clone items to. Must be in the
  // format `projects|organization/*/locations/{location}/addressGroups/*`.
  string address_group = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/AddressGroup"
    }
  ];

  // The maximum number of references to return.  If unspecified, server
  // will pick an appropriate default. Server may return fewer items than
  // requested. A caller should only rely on response's
  // [next_page_token][google.cloud.networksecurity.v1.ListAddressGroupReferencesResponse.next_page_token]
  // to determine if there are more AddressGroupUsers left to be queried.
  int32 page_size = 2;

  // The next_page_token value returned from a previous List request,
  // if any.
  string page_token = 3;
}

// Response of the ListAddressGroupReferences method.
message ListAddressGroupReferencesResponse {
  // The Reference of AddressGroup.
  message AddressGroupReference {
    // FirewallPolicy that is using the Address Group.
    string firewall_policy = 1;

    // Cloud Armor SecurityPolicy that is using the Address Group.
    string security_policy = 4;

    // Rule priority of the FirewallPolicy that is using the Address Group.
    int32 rule_priority = 2;
  }

  // A list of references that matches the specified filter in the request.
  repeated AddressGroupReference address_group_references = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;
}