// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1";
option go_package = "cloud.google.com/go/networksecurity/apiv1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SSERealmProto";
option java_package = "com.google.cloud.networksecurity.v1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1";

// Service describing handlers for resources
service SSERealmService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists SACRealms in a given project.
  rpc ListSACRealms(ListSACRealmsRequest) returns (ListSACRealmsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/sacRealms"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the specified realm.
  rpc GetSACRealm(GetSACRealmRequest) returns (SACRealm) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/sacRealms/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SACRealm in a given project.
  rpc CreateSACRealm(CreateSACRealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/sacRealms"
      body: "sac_realm"
    };
    option (google.api.method_signature) = "parent,sac_realm,sac_realm_id";
    option (google.longrunning.operation_info) = {
      response_type: "SACRealm"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes the specified realm.
  rpc DeleteSACRealm(DeleteSACRealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/sacRealms/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Lists SACAttachments in a given project and location.
  rpc ListSACAttachments(ListSACAttachmentsRequest)
      returns (ListSACAttachmentsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/sacAttachments"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the specified attachment.
  rpc GetSACAttachment(GetSACAttachmentRequest) returns (SACAttachment) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/sacAttachments/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SACAttachment in a given project and location.
  rpc CreateSACAttachment(CreateSACAttachmentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/sacAttachments"
      body: "sac_attachment"
    };
    option (google.api.method_signature) =
        "parent,sac_attachment,sac_attachment_id";
    option (google.longrunning.operation_info) = {
      response_type: "SACAttachment"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }

  // Deletes the specified attachment.
  rpc DeleteSACAttachment(DeleteSACAttachmentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/sacAttachments/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
    };
  }
}

// Represents a Secure Access Connect (SAC) realm resource.
//
// A Secure Access Connect realm establishes a connection between your Google
// Cloud project and an SSE service.
message SACRealm {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SACRealm"
    pattern: "projects/{project}/locations/{location}/sacRealms/{sac_realm}"
    plural: "sacRealms"
    singular: "sacRealm"
  };

  // Key to be shared with SSE service provider to establish global handshake.
  message PairingKey {
    // Output only. Key value.
    string key = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Timestamp in UTC of when this resource is considered
    // expired. It expires 7 days after creation.
    google.protobuf.Timestamp expire_time = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // SSE service provider
  enum SecurityService {
    // The default value. This value is used if the state is omitted.
    SECURITY_SERVICE_UNSPECIFIED = 0;

    // [Palo Alto Networks Prisma
    // Access](https://www.paloaltonetworks.com/sase/access).
    PALO_ALTO_PRISMA_ACCESS = 1;
  }

  // State of the realm.
  enum State {
    // No state specified. This should not be used.
    STATE_UNSPECIFIED = 0;

    // Has never been attached to a partner.
    // Used only for Prisma Access.
    PENDING_PARTNER_ATTACHMENT = 7;

    // Currently attached to a partner.
    PARTNER_ATTACHED = 1;

    // Was once attached to a partner but has been detached.
    PARTNER_DETACHED = 2;

    // Is not attached to a partner and has an expired pairing key.
    // Used only for Prisma Access.
    KEY_EXPIRED = 3;
  }

  // Identifier. Resource name, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Timestamp when the realm was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Timestamp when the realm was last updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of labels applied to the resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Immutable. SSE service provider associated with the realm.
  SecurityService security_service = 5
      [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Key to be shared with SSE service provider during pairing.
  PairingKey pairing_key = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the realm.
  State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request for `ListSACRealms` method.
message ListSACRealmsRequest {
  // Required. The parent, in the form `projects/{project}/locations/global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results the server should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. An expression that filters the list of results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Sort the results by a certain order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response for `ListSACRealms` method.
message ListSACRealmsResponse {
  // The list of SACRealms.
  repeated SACRealm sac_realms = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for `GetSACRealm` method.
message GetSACRealmRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACRealm"
    }
  ];
}

// Request for `CreateSACRealm` method.
message CreateSACRealmRequest {
  // Required. The parent, in the form `projects/{project}/locations/global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Required. ID of the created realm.
  // The ID must be 1-63 characters long, and comply with
  // <a href="https://www.ietf.org/rfc/rfc1035.txt" target="_blank">RFC1035</a>.
  // Specifically, it must be 1-63 characters long and match the regular
  // expression `[a-z]([-a-z0-9]*[a-z0-9])?`
  // which means the first character must be a lowercase letter, and all
  // following characters must be a dash, lowercase letter, or digit, except
  // the last character, which cannot be a dash.
  string sac_realm_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  SACRealm sac_realm = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request for `DeleteSACRealm` method.
message DeleteSACRealmRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Represents a Secure Access Connect (SAC) attachment resource.
//
// A Secure Access Connect attachment enables NCC Gateway to process traffic
// with an SSE product.
message SACAttachment {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SACAttachment"
    pattern: "projects/{project}/locations/{location}/sacAttachments/{sac_attachment}"
    plural: "sacAttachments"
    singular: "sacAttachment"
  };

  // State of the attachment.
  enum State {
    // No state specified. This should not be used.
    STATE_UNSPECIFIED = 0;

    // Has never been attached to a partner.
    PENDING_PARTNER_ATTACHMENT = 1;

    // Currently attached to a partner.
    PARTNER_ATTACHED = 2;

    // Was once attached to a partner but has been detached.
    PARTNER_DETACHED = 3;
  }

  // Identifier. Resource name, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Timestamp when the attachment was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Timestamp when the attachment was last updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of labels applied to the resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. SAC Realm which owns the attachment. This can be input as an ID
  // or a full resource name. The output always has the form
  // `projects/{project_number}/locations/{location}/sacRealms/{sac_realm}`.
  string sac_realm = 5 [(google.api.field_behavior) = REQUIRED];

  // Required. NCC Gateway associated with the attachment. This can be input as
  // an ID or a full resource name. The output always has the form
  // `projects/{project_number}/locations/{location}/spokes/{ncc_gateway}`.
  string ncc_gateway = 6 [(google.api.field_behavior) = REQUIRED];

  // Output only. State of the attachment.
  State state = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request for `ListSACAttachments` method.
message ListSACAttachmentsRequest {
  // Required. The parent, in the form
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results the server should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. An expression that filters the list of results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Sort the results by a certain order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response for `ListSACAttachments` method.
message ListSACAttachmentsResponse {
  // The list of SACAttachments.
  repeated SACAttachment sac_attachments = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for `GetSACAttachment` method.
message GetSACAttachmentRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];
}

// Request for `CreateSACAttachment` method.
message CreateSACAttachmentRequest {
  // Required. The parent, in the form
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Required. ID of the created attachment.
  // The ID must be 1-63 characters long, and comply with
  // <a href="https://www.ietf.org/rfc/rfc1035.txt" target="_blank">RFC1035</a>.
  // Specifically, it must be 1-63 characters long and match the regular
  // expression `[a-z]([-a-z0-9]*[a-z0-9])?`
  // which means the first character must be a lowercase letter, and all
  // following characters must be a dash, lowercase letter, or digit, except
  // the last character, which cannot be a dash.
  string sac_attachment_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  SACAttachment sac_attachment = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request for `DeleteSACAttachment` method.
message DeleteSACAttachmentRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}