// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "BackendAuthenticationConfigProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";
option (google.api.resource_definition) = {
  type: "certificatemanager.googleapis.com/Certificate"
  pattern: "projects/{project}/locations/{location}/certificates/{certificate}"
};
option (google.api.resource_definition) = {
  type: "certificatemanager.googleapis.com/TrustConfig"
  pattern: "projects/{project}/locations/{location}/trustConfigs/{trust_config}"
};

// BackendAuthenticationConfig message groups the TrustConfig together with
// other settings that control how the load balancer authenticates, and
// expresses its identity to, the backend:
//
// * `trustConfig` is the attached TrustConfig.
//
// * `wellKnownRoots` indicates whether the load balance should trust backend
// server certificates that are issued by public certificate authorities, in
// addition to certificates trusted by the TrustConfig.
//
// * `clientCertificate` is a client certificate that the load balancer uses to
// express its identity to the backend, if the connection to the backend uses
// mTLS.
//
// You can attach the BackendAuthenticationConfig to the load balancer's
// BackendService directly determining how that BackendService negotiates TLS.
message BackendAuthenticationConfig {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/BackendAuthenticationConfig"
    pattern: "projects/{project}/locations/{location}/backendAuthenticationConfigs/{backend_authentication_config}"
  };

  // Enum to specify the well known roots to use for server certificate
  // validation.
  enum WellKnownRoots {
    // Equivalent to NONE.
    WELL_KNOWN_ROOTS_UNSPECIFIED = 0;

    // The BackendService will only validate server certificates against roots
    // specified in TrustConfig.
    NONE = 1;

    // The BackendService uses a set of well-known public roots, in addition to
    // any roots specified in the trustConfig field, when validating the server
    // certificates presented by the backend. Validation with these roots is
    // only considered when the TlsSettings.sni field in the BackendService is
    // set.
    //
    // The well-known roots are a set of root CAs managed by Google. CAs in this
    // set can be added or removed without notice.
    PUBLIC_ROOTS = 2;
  }

  // Required. Name of the BackendAuthenticationConfig resource. It matches the
  // pattern
  // `projects/*/locations/{location}/backendAuthenticationConfigs/{backend_authentication_config}`
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Free-text description of the resource.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Set of label tags associated with the resource.
  map<string, string> labels = 5;

  // Optional. A reference to a certificatemanager.googleapis.com.Certificate
  // resource. This is a relative resource path following the form
  // "projects/{project}/locations/{location}/certificates/{certificate}".
  //
  // Used by a BackendService to negotiate mTLS when the backend connection uses
  // TLS and the backend requests a client certificate. Must have a CLIENT_AUTH
  // scope.
  string client_certificate = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "certificatemanager.googleapis.com/Certificate"
    }
  ];

  // Optional. A reference to a TrustConfig resource from the
  // certificatemanager.googleapis.com namespace. This is a relative resource
  // path following the form
  // "projects/{project}/locations/{location}/trustConfigs/{trust_config}".
  //
  // A BackendService uses the chain of trust represented by this TrustConfig,
  // if specified, to validate the server certificates presented by the backend.
  // Required unless wellKnownRoots is set to PUBLIC_ROOTS.
  string trust_config = 7 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "certificatemanager.googleapis.com/TrustConfig"
    }
  ];

  // Well known roots to use for server certificate validation.
  WellKnownRoots well_known_roots = 8;

  // Output only. Etag of the resource.
  string etag = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request used by the ListBackendAuthenticationConfigs method.
message ListBackendAuthenticationConfigsRequest {
  // Required. The project and location from which the
  // BackendAuthenticationConfigs should be listed, specified in the format
  // `projects/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Maximum number of BackendAuthenticationConfigs to return per call.
  int32 page_size = 2;

  // The value returned by the last `ListBackendAuthenticationConfigsResponse`
  // Indicates that this is a continuation of a prior
  // `ListBackendAuthenticationConfigs` call, and that the system
  // should return the next page of data.
  string page_token = 3;
}

// Response returned by the ListBackendAuthenticationConfigs method.
message ListBackendAuthenticationConfigsResponse {
  // List of BackendAuthenticationConfig resources.
  repeated BackendAuthenticationConfig backend_authentication_configs = 1;

  // If there might be more results than those appearing in this response, then
  // `next_page_token` is included. To get the next set of results, call this
  // method again using the value of `next_page_token` as `page_token`.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request used by the GetBackendAuthenticationConfig method.
message GetBackendAuthenticationConfigRequest {
  // Required. A name of the BackendAuthenticationConfig to get. Must be in the
  // format `projects/*/locations/{location}/backendAuthenticationConfigs/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/BackendAuthenticationConfig"
    }
  ];
}

// Request used by the CreateBackendAuthenticationConfig method.
message CreateBackendAuthenticationConfigRequest {
  // Required. The parent resource of the BackendAuthenticationConfig. Must be
  // in the format `projects/*/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/BackendAuthenticationConfig"
    }
  ];

  // Required. Short name of the BackendAuthenticationConfig resource to be
  // created. This value should be 1-63 characters long, containing only
  // letters, numbers, hyphens, and underscores, and should not start with a
  // number. E.g. "backend-auth-config".
  string backend_authentication_config_id = 2
      [(google.api.field_behavior) = REQUIRED];

  // Required. BackendAuthenticationConfig resource to be created.
  BackendAuthenticationConfig backend_authentication_config = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Request used by UpdateBackendAuthenticationConfig method.
message UpdateBackendAuthenticationConfigRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // BackendAuthenticationConfig resource by the update.  The fields
  // specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the
  // mask. If the user does not provide a mask then all fields will be
  // overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Updated BackendAuthenticationConfig resource.
  BackendAuthenticationConfig backend_authentication_config = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request used by the DeleteBackendAuthenticationConfig method.
message DeleteBackendAuthenticationConfigRequest {
  // Required. A name of the BackendAuthenticationConfig to delete. Must be in
  // the format
  // `projects/*/locations/{location}/backendAuthenticationConfigs/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/BackendAuthenticationConfig"
    }
  ];

  // Optional. Etag of the resource.
  // If this is provided, it must match the server's etag.
  string etag = 2 [(google.api.field_behavior) = OPTIONAL];
}