// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1/common.proto";
import "google/cloud/networksecurity/v1/security_profile_group.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1";
option go_package = "cloud.google.com/go/networksecurity/apiv1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SecurityProfileGroupServiceProto";
option java_package = "com.google.cloud.networksecurity.v1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1";

// SecurityProfileGroup is a resource that defines an action for specific threat
// signatures or severity levels.
service SecurityProfileGroupService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists SecurityProfileGroups in a given project and location.
  rpc ListSecurityProfileGroups(ListSecurityProfileGroupsRequest)
      returns (ListSecurityProfileGroupsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/securityProfileGroups"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single SecurityProfileGroup.
  rpc GetSecurityProfileGroup(GetSecurityProfileGroupRequest)
      returns (SecurityProfileGroup) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/securityProfileGroups/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SecurityProfileGroup in a given project and location.
  rpc CreateSecurityProfileGroup(CreateSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/securityProfileGroups"
      body: "security_profile_group"
    };
    option (google.api.method_signature) =
        "parent,security_profile_group,security_profile_group_id";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfileGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates the parameters of a single SecurityProfileGroup.
  rpc UpdateSecurityProfileGroup(UpdateSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{security_profile_group.name=projects/*/locations/*/securityProfileGroups/*}"
      body: "security_profile_group"
    };
    option (google.api.method_signature) = "security_profile_group,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfileGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes a single SecurityProfileGroup.
  rpc DeleteSecurityProfileGroup(DeleteSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/securityProfileGroups/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Lists SecurityProfiles in a given project and location.
  rpc ListSecurityProfiles(ListSecurityProfilesRequest)
      returns (ListSecurityProfilesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/securityProfiles"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single SecurityProfile.
  rpc GetSecurityProfile(GetSecurityProfileRequest) returns (SecurityProfile) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/securityProfiles/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SecurityProfile in a given project and location.
  rpc CreateSecurityProfile(CreateSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/securityProfiles"
      body: "security_profile"
    };
    option (google.api.method_signature) =
        "parent,security_profile,security_profile_id";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfile"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates the parameters of a single SecurityProfile.
  rpc UpdateSecurityProfile(UpdateSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{security_profile.name=projects/*/locations/*/securityProfiles/*}"
      body: "security_profile"
    };
    option (google.api.method_signature) = "security_profile,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfile"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes a single SecurityProfile.
  rpc DeleteSecurityProfile(DeleteSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/securityProfiles/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }
}

// Organization SecurityProfileGroup is created under organization.
service OrganizationSecurityProfileGroupService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists SecurityProfileGroups in a given organization and location.
  rpc ListSecurityProfileGroups(ListSecurityProfileGroupsRequest)
      returns (ListSecurityProfileGroupsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/securityProfileGroups"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single SecurityProfileGroup.
  rpc GetSecurityProfileGroup(GetSecurityProfileGroupRequest)
      returns (SecurityProfileGroup) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/securityProfileGroups/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SecurityProfileGroup in a given organization and location.
  rpc CreateSecurityProfileGroup(CreateSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/securityProfileGroups"
      body: "security_profile_group"
    };
    option (google.api.method_signature) =
        "parent,security_profile_group,security_profile_group_id";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfileGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates the parameters of a single SecurityProfileGroup.
  rpc UpdateSecurityProfileGroup(UpdateSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{security_profile_group.name=organizations/*/locations/*/securityProfileGroups/*}"
      body: "security_profile_group"
    };
    option (google.api.method_signature) = "security_profile_group,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfileGroup"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes a single SecurityProfileGroup.
  rpc DeleteSecurityProfileGroup(DeleteSecurityProfileGroupRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/securityProfileGroups/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Lists SecurityProfiles in a given organization and location.
  rpc ListSecurityProfiles(ListSecurityProfilesRequest)
      returns (ListSecurityProfilesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=organizations/*/locations/*}/securityProfiles"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single SecurityProfile.
  rpc GetSecurityProfile(GetSecurityProfileRequest) returns (SecurityProfile) {
    option (google.api.http) = {
      get: "/v1/{name=organizations/*/locations/*/securityProfiles/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SecurityProfile in a given organization and location.
  rpc CreateSecurityProfile(CreateSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=organizations/*/locations/*}/securityProfiles"
      body: "security_profile"
    };
    option (google.api.method_signature) =
        "parent,security_profile,security_profile_id";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfile"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Updates the parameters of a single SecurityProfile.
  rpc UpdateSecurityProfile(UpdateSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{security_profile.name=organizations/*/locations/*/securityProfiles/*}"
      body: "security_profile"
    };
    option (google.api.method_signature) = "security_profile,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "SecurityProfile"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes a single SecurityProfile.
  rpc DeleteSecurityProfile(DeleteSecurityProfileRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=organizations/*/locations/*/securityProfiles/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }
}

// Request used with the ListSecurityProfileGroups method.
message ListSecurityProfileGroupsRequest {
  // Required. The project or organization and location from which the
  // SecurityProfileGroups should be listed, specified in the format
  // `projects|organizations/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SecurityProfileGroup"
    }
  ];

  // Optional. Maximum number of SecurityProfileGroups to return per call.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The value returned by the last
  // `ListSecurityProfileGroupsResponse` Indicates that this is a
  // continuation of a prior `ListSecurityProfileGroups` call, and
  // that the system should return the next page of data.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response returned by the ListSecurityProfileGroups method.
message ListSecurityProfileGroupsResponse {
  // List of SecurityProfileGroups resources.
  repeated SecurityProfileGroup security_profile_groups = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;
}

// Request used by the GetSecurityProfileGroup method.
message GetSecurityProfileGroupRequest {
  // Required. A name of the SecurityProfileGroup to get. Must be in the format
  // `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfileGroup"
    }
  ];
}

// Request used by the CreateSecurityProfileGroup method.
message CreateSecurityProfileGroupRequest {
  // Required. The parent resource of the SecurityProfileGroup. Must be in the
  // format `projects|organizations/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SecurityProfileGroup"
    }
  ];

  // Required. Short name of the SecurityProfileGroup resource to be created.
  // This value should be 1-63 characters long, containing only
  // letters, numbers, hyphens, and underscores, and should not start
  // with a number. E.g. "security_profile_group1".
  string security_profile_group_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. SecurityProfileGroup resource to be created.
  SecurityProfileGroup security_profile_group = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Request used by the UpdateSecurityProfileGroup method.
message UpdateSecurityProfileGroupRequest {
  // Required. Field mask is used to specify the fields to be overwritten in the
  // SecurityProfileGroup resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Updated SecurityProfileGroup resource.
  SecurityProfileGroup security_profile_group = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request used by the DeleteSecurityProfileGroup method.
message DeleteSecurityProfileGroupRequest {
  // Required. A name of the SecurityProfileGroup to delete. Must be in the
  // format
  // `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfileGroup"
    }
  ];

  // Optional. If client provided etag is out of date, delete will return
  // FAILED_PRECONDITION error.
  string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Request used with the ListSecurityProfiles method.
message ListSecurityProfilesRequest {
  // Required. The project or organization and location from which the
  // SecurityProfiles should be listed, specified in the format
  // `projects|organizations/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Optional. Maximum number of SecurityProfiles to return per call.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The value returned by the last
  // `ListSecurityProfilesResponse` Indicates that this is a continuation of a
  // prior `ListSecurityProfiles` call, and that the system should return the
  // next page of data.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response returned by the ListSecurityProfiles method.
message ListSecurityProfilesResponse {
  // List of SecurityProfile resources.
  repeated SecurityProfile security_profiles = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;
}

// Request used by the GetSecurityProfile method.
message GetSecurityProfileRequest {
  // Required. A name of the SecurityProfile to get. Must be in the format
  // `projects|organizations/*/locations/{location}/securityProfiles/{security_profile_id}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];
}

// Request used by the CreateSecurityProfile method.
message CreateSecurityProfileRequest {
  // Required. The parent resource of the SecurityProfile. Must be in the format
  // `projects|organizations/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Required. Short name of the SecurityProfile resource to be created. This
  // value should be 1-63 characters long, containing only letters, numbers,
  // hyphens, and underscores, and should not start with a number. E.g.
  // "security_profile1".
  string security_profile_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. SecurityProfile resource to be created.
  SecurityProfile security_profile = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request used by the UpdateSecurityProfile method.
message UpdateSecurityProfileRequest {
  // Required. Field mask is used to specify the fields to be overwritten in the
  // SecurityProfile resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Updated SecurityProfile resource.
  SecurityProfile security_profile = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request used by the DeleteSecurityProfile method.
message DeleteSecurityProfileRequest {
  // Required. A name of the SecurityProfile to delete. Must be in the format
  // `projects|organizations/*/locations/{location}/securityProfiles/{security_profile_id}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Optional. If client provided etag is out of date, delete will return
  // FAILED_PRECONDITION error.
  string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}