// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1alpha1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SSEGatewayProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";

// Service describing handlers for resources
service SSEGatewayService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists PartnerSSEGateways in a given project and location.
  rpc ListPartnerSSEGateways(ListPartnerSSEGatewaysRequest)
      returns (ListPartnerSSEGatewaysResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/partnerSSEGateways"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single PartnerSSEGateway.
  rpc GetPartnerSSEGateway(GetPartnerSSEGatewayRequest)
      returns (PartnerSSEGateway) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/partnerSSEGateways/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new PartnerSSEGateway in a given project and location.
  rpc CreatePartnerSSEGateway(CreatePartnerSSEGatewayRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=projects/*/locations/*}/partnerSSEGateways"
      body: "partner_sse_gateway"
    };
    option (google.api.method_signature) =
        "parent,partner_sse_gateway,partner_sse_gateway_id";
    option (google.longrunning.operation_info) = {
      response_type: "PartnerSSEGateway"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes a single PartnerSSEGateway.
  rpc DeletePartnerSSEGateway(DeletePartnerSSEGatewayRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=projects/*/locations/*/partnerSSEGateways/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Updates a single PartnerSSEGateway.
  rpc UpdatePartnerSSEGateway(UpdatePartnerSSEGatewayRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1alpha1/{partner_sse_gateway.name=projects/*/locations/*/partnerSSEGateways/*}"
      body: "partner_sse_gateway"
    };
    option (google.api.method_signature) = "partner_sse_gateway, update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "PartnerSSEGateway"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Lists SSEGatewayReferences in a given project and location.
  rpc ListSSEGatewayReferences(ListSSEGatewayReferencesRequest)
      returns (ListSSEGatewayReferencesResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/sseGatewayReferences"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single SSEGatewayReference.
  rpc GetSSEGatewayReference(GetSSEGatewayReferenceRequest)
      returns (SSEGatewayReference) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/sseGatewayReferences/*}"
    };
    option (google.api.method_signature) = "name";
  }
}

// Message describing PartnerSSEGateway object
message PartnerSSEGateway {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/PartnerSSEGateway"
    pattern: "projects/{project}/locations/{location}/partnerSSEGateways/{partner_sse_gateway}"
    plural: "partnerSSEGateways"
    singular: "partnerSSEGateway"
  };

  // Options specific to gateways connected to Symantec.
  message PartnerSSEGatewaySymantecOptions {
    // Output only. UUID of the Symantec Location created on the customer's
    // behalf.
    string symantec_location_uuid = 1
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Optional. Target for the NCGs to send traffic to on the Symantec side.
    // Only supports IP address today.
    string symantec_site_target_host = 2
        [(google.api.field_behavior) = OPTIONAL];

    // Output only. Symantec data center identifier that this SSEGW will connect
    // to. Filled from the customer SSEGateway, and only for PartnerSSEGateways
    // associated with Symantec today.
    string symantec_site = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // State of the gateway.
  enum State {
    // No state specified. This should not be used.
    STATE_UNSPECIFIED = 0;

    // Attached to a customer. This is the default state when a gateway is
    // successfully created.
    CUSTOMER_ATTACHED = 1;

    // No longer attached to a customer. This state arises when the
    // customer attachment is deleted.
    CUSTOMER_DETACHED = 2;
  }

  // Immutable. name of resource
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Subnet range of the subnet where partner traffic is routed.
  // This field is deprecated. Use sse_subnet_range instead.
  string sse_vpc_subnet_range = 5
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. This is the IP where the partner traffic should be routed to.
  // This field is deprecated. Use sse_target_ip instead.
  string sse_vpc_target_ip = 6
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Required. ID of the SSEGatewayReference that pairs with this
  // PartnerSSEGateway
  string sse_gateway_reference_id = 7 [(google.api.field_behavior) = REQUIRED];

  // Output only. IP of SSE BGP
  repeated string sse_bgp_ips = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. ASN of SSE BGP
  int32 sse_bgp_asn = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Subnet range of the partner_vpc
  // This field is deprecated. Use partner_subnet_range instead.
  string partner_vpc_subnet_range = 11
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Output only. name of PartnerSSERealm owning the PartnerSSEGateway
  string partner_sse_realm = 12 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Subnet range where SSE GW instances are deployed.
  // Default value is set to "100.88.255.0/24".
  // The CIDR suffix should be less than or equal to 25.
  string sse_subnet_range = 17 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Target IP that belongs to sse_subnet_range where partner
  // should send the traffic to reach the customer networks.
  string sse_target_ip = 18 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Subnet range of the partner-owned subnet.
  string partner_subnet_range = 19 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Virtual Network Identifier to use in NCG.
  // Today the only partner that depends on it is Symantec.
  int32 vni = 20 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Required iff Partner is Symantec.
  PartnerSSEGatewaySymantecOptions symantec_options = 21
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. The project owning partner_facing_network. Only filled for
  // PartnerSSEGateways associated with Symantec today.
  string sse_project = 22 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The ID of the network in sse_project containing
  // sse_subnet_range. This is also known as the partnerFacingNetwork. Only
  // filled for PartnerSSEGateways associated with Symantec today.
  string sse_network = 23 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Full URI of the partner environment this PartnerSSEGateway is
  // connected to. Filled from the customer SSEGateway, and only for
  // PartnerSSEGateways associated with Symantec today.
  string partner_sse_environment = 24
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. ISO-3166 alpha 2 country code used for localization.
  // Filled from the customer SSEGateway, and only for PartnerSSEGateways
  // associated with Symantec today.
  string country = 25 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. tzinfo identifier used for localization.
  // Filled from the customer SSEGateway, and only for PartnerSSEGateways
  // associated with Symantec today.
  string timezone = 26 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Copied from the associated NCC resource in Symantec NCCGW
  // flows. Used by Symantec API.
  int64 capacity_bps = 28 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the gateway.
  State state = 29 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Subnet ranges for Google-issued probe packets.
  // It's populated only for Prisma Access partners.
  repeated string prober_subnet_ranges = 30
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for requesting list of PartnerSSEGateways
message ListPartnerSSEGatewaysRequest {
  // Required. Parent value for ListPartnerSSEGatewaysRequest
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/PartnerSSEGateway"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filtering results
  string filter = 4;

  // Hint for how to order the results
  string order_by = 5;
}

// Message for response to listing PartnerSSEGateways
message ListPartnerSSEGatewaysResponse {
  // The list of PartnerSSEGateway
  repeated PartnerSSEGateway partner_sse_gateways = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a PartnerSSEGateway
message GetPartnerSSEGatewayRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/PartnerSSEGateway"
    }
  ];
}

// Message for creating a PartnerSSEGateway
message CreatePartnerSSEGatewayRequest {
  // Required. Value for parent.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/PartnerSSEGateway"
    }
  ];

  // Required. Id of the requesting object
  // If auto-generating Id server-side, remove this field and
  // partner_sse_gateway_id from the method_signature of Create RPC
  string partner_sse_gateway_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created
  PartnerSSEGateway partner_sse_gateway = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Message for deleting a PartnerSSEGateway
message DeletePartnerSSEGatewayRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/PartnerSSEGateway"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Message for deleting a PartnerSSEGateway
message UpdatePartnerSSEGatewayRequest {
  // Required. The resource being created
  PartnerSSEGateway partner_sse_gateway = 1
      [(google.api.field_behavior) = REQUIRED];

  // The list of fields to update
  google.protobuf.FieldMask update_mask = 2;

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Message describing SSEGatewayReference object
message SSEGatewayReference {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SSEGatewayReference"
    pattern: "projects/{project}/locations/{location}/sseGatewayReferences/{sse_gateway_reference}"
    plural: "sseGatewayReferences"
    singular: "sseGatewayReference"
  };

  // Immutable. name of resource
  string name = 1 [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels as key value pairs
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Output only. PartnerSSERealm owning the PartnerSSEGateway that this
  // SSEGateway intends to connect with
  string partner_sse_realm = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Subnet ranges for Google probe packets.
  repeated string prober_subnet_ranges = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for requesting list of SSEGatewayReferences
message ListSSEGatewayReferencesRequest {
  // Required. Parent value for ListSSEGatewayReferencesRequest
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SSEGatewayReference"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filtering results
  string filter = 4;

  // Hint for how to order the results
  string order_by = 5;
}

// Message for response to listing SSEGatewayReferences
message ListSSEGatewayReferencesResponse {
  // The list of SSEGatewayReference
  repeated SSEGatewayReference sse_gateway_references = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a SSEGatewayReference
message GetSSEGatewayReferenceRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SSEGatewayReference"
    }
  ];
}