// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1alpha1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "FirewallActivationProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";
option (google.api.resource_definition) = {
  type: "networksecurity.googleapis.com/OrganizationLocation"
  pattern: "organizations/{organization}/locations/{location}"
};

// Service for managing Firewall Endpoints and Associations.
service FirewallActivation {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists FirewallEndpoints in a given project and location.
  rpc ListFirewallEndpoints(ListFirewallEndpointsRequest)
      returns (ListFirewallEndpointsResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=organizations/*/locations/*}/firewallEndpoints"
      additional_bindings {
        get: "/v1alpha1/{parent=projects/*/locations/*}/firewallEndpoints"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single Endpoint.
  rpc GetFirewallEndpoint(GetFirewallEndpointRequest)
      returns (FirewallEndpoint) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=organizations/*/locations/*/firewallEndpoints/*}"
      additional_bindings {
        get: "/v1alpha1/{name=projects/*/locations/*/firewallEndpoints/*}"
      }
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new FirewallEndpoint in a given project and location.
  rpc CreateFirewallEndpoint(CreateFirewallEndpointRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=organizations/*/locations/*}/firewallEndpoints"
      body: "firewall_endpoint"
      additional_bindings {
        post: "/v1alpha1/{parent=projects/*/locations/*}/firewallEndpoints"
        body: "firewall_endpoint"
      }
    };
    option (google.api.method_signature) =
        "parent,firewall_endpoint,firewall_endpoint_id";
    option (google.longrunning.operation_info) = {
      response_type: "FirewallEndpoint"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes a single Endpoint.
  rpc DeleteFirewallEndpoint(DeleteFirewallEndpointRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=organizations/*/locations/*/firewallEndpoints/*}"
      additional_bindings {
        delete: "/v1alpha1/{name=projects/*/locations/*/firewallEndpoints/*}"
      }
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Update a single Endpoint.
  rpc UpdateFirewallEndpoint(UpdateFirewallEndpointRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1alpha1/{firewall_endpoint.name=organizations/*/locations/*/firewallEndpoints/*}"
      body: "firewall_endpoint"
      additional_bindings {
        patch: "/v1alpha1/{firewall_endpoint.name=projects/*/locations/*/firewallEndpoints/*}"
        body: "firewall_endpoint"
      }
    };
    option (google.api.method_signature) = "firewall_endpoint,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "FirewallEndpoint"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Lists Associations in a given project and location.
  rpc ListFirewallEndpointAssociations(ListFirewallEndpointAssociationsRequest)
      returns (ListFirewallEndpointAssociationsResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/firewallEndpointAssociations"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single FirewallEndpointAssociation.
  rpc GetFirewallEndpointAssociation(GetFirewallEndpointAssociationRequest)
      returns (FirewallEndpointAssociation) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/firewallEndpointAssociations/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new FirewallEndpointAssociation in a given project and location.
  rpc CreateFirewallEndpointAssociation(
      CreateFirewallEndpointAssociationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=projects/*/locations/*}/firewallEndpointAssociations"
      body: "firewall_endpoint_association"
    };
    option (google.api.method_signature) =
        "parent,firewall_endpoint_association,firewall_endpoint_association_id";
    option (google.longrunning.operation_info) = {
      response_type: "FirewallEndpointAssociation"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes a single FirewallEndpointAssociation.
  rpc DeleteFirewallEndpointAssociation(
      DeleteFirewallEndpointAssociationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=projects/*/locations/*/firewallEndpointAssociations/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Update a single FirewallEndpointAssociation.
  rpc UpdateFirewallEndpointAssociation(
      UpdateFirewallEndpointAssociationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1alpha1/{firewall_endpoint_association.name=projects/*/locations/*/firewallEndpointAssociations/*}"
      body: "firewall_endpoint_association"
    };
    option (google.api.method_signature) =
        "firewall_endpoint_association,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "FirewallEndpointAssociation"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }
}

// Message describing Endpoint object.
message FirewallEndpoint {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/FirewallEndpoint"
    pattern: "organizations/{organization}/locations/{location}/firewallEndpoints/{firewall_endpoint}"
    pattern: "projects/{project}/locations/{location}/firewallEndpoints/{firewall_endpoint}"
    plural: "firewallEndpoints"
    singular: "firewallEndpoint"
  };

  // This is a subset of the FirewallEndpointAssociation message, containing
  // fields to be used by the consumer.
  message AssociationReference {
    // Output only. The resource name of the FirewallEndpointAssociation.
    // Format:
    // projects/{project}/locations/{location}/firewallEndpointAssociations/{id}
    string name = 1 [
      (google.api.field_behavior) = OUTPUT_ONLY,
      (google.api.resource_reference) = {
        type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
      }
    ];

    // Output only. The VPC network associated. Format:
    // projects/{project}/global/networks/{name}.
    string network = 2 [
      (google.api.field_behavior) = OUTPUT_ONLY,
      (google.api.resource_reference) = {
        type: "compute.googleapis.com/Network"
      }
    ];
  }

  // Settings for the endpoint.
  message EndpointSettings {
    // Optional. Immutable. Indicates whether Jumbo Frames are enabled.
    // Default value is false.
    bool jumbo_frames_enabled = 1 [
      (google.api.field_behavior) = OPTIONAL,
      (google.api.field_behavior) = IMMUTABLE
    ];
  }

  // Endpoint state.
  enum State {
    // Not set.
    STATE_UNSPECIFIED = 0;

    // Being created.
    CREATING = 1;

    // Processing configuration updates.
    ACTIVE = 2;

    // Being deleted.
    DELETING = 3;

    // Down or in an error state.
    INACTIVE = 4;
  }

  // Immutable. Identifier. Name of resource.
  string name = 1 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Optional. Description of the firewall endpoint. Max length 2048
  // characters.
  string description = 9 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Create time stamp.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Current state of the endpoint.
  State state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Whether reconciling is in progress, recommended per
  // https://google.aip.dev/128.
  bool reconciling = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. List of networks that are associated with this endpoint in the
  // local zone. This is a projection of the FirewallEndpointAssociations
  // pointing at this endpoint. A network will only appear in this list after
  // traffic routing is fully configured. Format:
  // projects/{project}/global/networks/{name}.
  repeated string associated_networks = 7
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. List of FirewallEndpointAssociations that are associated to
  // this endpoint. An association will only appear in this list after traffic
  // routing is fully configured.
  repeated AssociationReference associations = 13
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output Only] Reserved for future use.
  optional bool satisfies_pzs = 14 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output Only] Reserved for future use.
  optional bool satisfies_pzi = 15 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. Project to bill on endpoint uptime usage.
  string billing_project_id = 8 [(google.api.field_behavior) = REQUIRED];

  // Optional. Settings for the endpoint.
  EndpointSettings endpoint_settings = 19
      [(google.api.field_behavior) = OPTIONAL];
}

// Message for requesting list of Endpoints
message ListFirewallEndpointsRequest {
  // Required. Parent value for ListEndpointsRequest
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/FirewallEndpoint"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Optional. Filtering results
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Hint for how to order the results
  string order_by = 5;
}

// Message for response to listing Endpoints
message ListFirewallEndpointsResponse {
  // The list of Endpoint
  repeated FirewallEndpoint firewall_endpoints = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a Endpoint
message GetFirewallEndpointRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/FirewallEndpoint"
    }
  ];
}

// Message for creating a Endpoint
message CreateFirewallEndpointRequest {
  // Required. Value for parent.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/FirewallEndpoint"
    }
  ];

  // Required. Id of the requesting object.
  // If auto-generating Id server-side, remove this field and
  // firewall_endpoint_id from the method_signature of Create RPC.
  string firewall_endpoint_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created
  FirewallEndpoint firewall_endpoint = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Message for updating a Endpoint
message UpdateFirewallEndpointRequest {
  // Required. Field mask is used to specify the fields to be overwritten in the
  // Endpoint resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being updated
  FirewallEndpoint firewall_endpoint = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Message for deleting a Endpoint
message DeleteFirewallEndpointRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/FirewallEndpoint"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Message describing Association object
message FirewallEndpointAssociation {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
    pattern: "projects/{project}/locations/{location}/firewallEndpointAssociations/{firewall_endpoint_association}"
  };

  // Association state.
  enum State {
    // Not set.
    STATE_UNSPECIFIED = 0;

    // Being created.
    CREATING = 1;

    // Active and ready for traffic.
    ACTIVE = 2;

    // Being deleted.
    DELETING = 3;

    // Down or in an error state.
    INACTIVE = 4;

    // The project that housed the association has been deleted.
    ORPHAN = 5;
  }

  // Immutable. Identifier. name of resource
  string name = 1 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Output only. Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Current state of the association.
  State state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. The URL of the network that is being associated.
  string network = 6 [(google.api.field_behavior) = REQUIRED];

  // Required. The URL of the FirewallEndpoint that is being associated.
  string firewall_endpoint = 7 [(google.api.field_behavior) = REQUIRED];

  // Optional. The URL of the TlsInspectionPolicy that is being associated.
  string tls_inspection_policy = 8 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/TlsInspectionPolicy"
    }
  ];

  // Output only. Whether reconciling is in progress, recommended per
  // https://google.aip.dev/128.
  bool reconciling = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Whether the association is disabled.
  // True indicates that traffic won't be intercepted
  bool disabled = 10 [(google.api.field_behavior) = OPTIONAL];
}

// Message for requesting list of Associations
message ListFirewallEndpointAssociationsRequest {
  // Required. Parent value for ListAssociationsRequest
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Optional. Filtering results
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Hint for how to order the results
  string order_by = 5;
}

// Message for response to listing Associations
message ListFirewallEndpointAssociationsResponse {
  // The list of Association
  repeated FirewallEndpointAssociation firewall_endpoint_associations = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a Association
message GetFirewallEndpointAssociationRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
    }
  ];
}

// Message for creating a Association
message CreateFirewallEndpointAssociationRequest {
  // Required. Value for parent.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
    }
  ];

  // Optional. Id of the requesting object.
  // If auto-generating Id server-side, remove this field and
  // firewall_endpoint_association_id from the method_signature of Create RPC.
  string firewall_endpoint_association_id = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The resource being created
  FirewallEndpointAssociation firewall_endpoint_association = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Message for deleting a Association
message DeleteFirewallEndpointAssociationRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/FirewallEndpointAssociation"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Message for updating an Association
message UpdateFirewallEndpointAssociationRequest {
  // Required. Field mask is used to specify the fields to be overwritten in the
  // Association resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being updated
  FirewallEndpointAssociation firewall_endpoint_association = 2
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}