// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1alpha1/security_profile_group_intercept.proto";
import "google/cloud/networksecurity/v1alpha1/security_profile_group_mirroring.proto";
import "google/cloud/networksecurity/v1alpha1/security_profile_group_threatprevention.proto";
import "google/cloud/networksecurity/v1alpha1/security_profile_group_urlfiltering.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SecurityProfileGroupProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";

// SecurityProfileGroup is a resource that defines the behavior for various
// ProfileTypes.
message SecurityProfileGroup {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SecurityProfileGroup"
    pattern: "organizations/{organization}/locations/{location}/securityProfileGroups/{security_profile_group}"
    pattern: "projects/{project}/locations/{location}/securityProfileGroups/{security_profile_group}"
  };

  // Immutable. Identifier. Name of the SecurityProfileGroup resource. It
  // matches pattern
  // `projects|organizations/*/locations/{location}/securityProfileGroups/{security_profile_group}`.
  string name = 1 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Optional. An optional description of the profile group. Max length 2048
  // characters.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Resource creation timestamp.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Last resource update timestamp.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. This checksum is computed by the server based on the value of
  // other fields, and may be sent on update and delete requests to ensure the
  // client has an up-to-date value before proceeding.
  string etag = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifier used by the data-path. Unique within {container,
  // location}.
  uint64 data_path_id = 12 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs.
  map<string, string> labels = 7 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Reference to a SecurityProfile with the ThreatPrevention
  // configuration.
  string threat_prevention_profile = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Optional. Reference to a SecurityProfile with the CustomMirroring
  // configuration.
  string custom_mirroring_profile = 8 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Optional. Reference to a SecurityProfile with the CustomIntercept
  // configuration.
  string custom_intercept_profile = 9 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];

  // Optional. Reference to a SecurityProfile with the UrlFiltering
  // configuration.
  string url_filtering_profile = 11 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SecurityProfile"
    }
  ];
}

// SecurityProfile is a resource that defines the behavior for one of many
// ProfileTypes.
message SecurityProfile {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SecurityProfile"
    pattern: "organizations/{organization}/locations/{location}/securityProfiles/{security_profile}"
    pattern: "projects/{project}/locations/{location}/securityProfiles/{security_profile}"
  };

  // The possible types that the SecurityProfile resource can configure.
  enum ProfileType {
    // Profile type not specified.
    PROFILE_TYPE_UNSPECIFIED = 0;

    // Profile type for threat prevention.
    THREAT_PREVENTION = 1;

    // Profile type for packet mirroring v2
    CUSTOM_MIRRORING = 2;

    // Profile type for TPPI.
    CUSTOM_INTERCEPT = 3;

    // Profile type for URL filtering.
    URL_FILTERING = 5;
  }

  // The behavior for the ProfileType that the SecurityProfile resource is meant
  // to configure. This field must correspond to the ProfileType of the
  // SecurityProfile.
  oneof profile {
    // The threat prevention configuration for the SecurityProfile.
    ThreatPreventionProfile threat_prevention_profile = 7;

    // The custom Packet Mirroring v2 configuration for the SecurityProfile.
    CustomMirroringProfile custom_mirroring_profile = 9;

    // The custom TPPI configuration for the SecurityProfile.
    CustomInterceptProfile custom_intercept_profile = 10;

    // The URL filtering configuration for the SecurityProfile.
    UrlFilteringProfile url_filtering_profile = 12;
  }

  // Immutable. Identifier. Name of the SecurityProfile resource. It matches
  // pattern
  // `projects|organizations/*/locations/{location}/securityProfiles/{security_profile}`.
  string name = 1 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.field_behavior) = IDENTIFIER
  ];

  // Optional. An optional description of the profile. Max length 512
  // characters.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Resource creation timestamp.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Last resource update timestamp.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. This checksum is computed by the server based on the value of
  // other fields, and may be sent on update and delete requests to ensure the
  // client has an up-to-date value before proceeding.
  string etag = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs.
  map<string, string> labels = 8 [(google.api.field_behavior) = OPTIONAL];

  // Immutable. The single ProfileType that the SecurityProfile resource
  // configures.
  ProfileType type = 6 [(google.api.field_behavior) = IMMUTABLE];
}