// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/field_info.proto";
import "google/api/resource.proto";
import "google/cloud/networksecurity/v1alpha1/common.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "SSERealmProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";

// Service describing handlers for resources
service SSERealmService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists SACRealms in a given project.
  rpc ListSACRealms(ListSACRealmsRequest) returns (ListSACRealmsResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/sacRealms"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the specified realm.
  rpc GetSACRealm(GetSACRealmRequest) returns (SACRealm) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/sacRealms/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SACRealm in a given project.
  rpc CreateSACRealm(CreateSACRealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=projects/*/locations/*}/sacRealms"
      body: "sac_realm"
    };
    option (google.api.method_signature) = "parent,sac_realm,sac_realm_id";
    option (google.longrunning.operation_info) = {
      response_type: "SACRealm"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes the specified realm.
  rpc DeleteSACRealm(DeleteSACRealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=projects/*/locations/*/sacRealms/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Lists SACAttachments in a given project and location.
  rpc ListSACAttachments(ListSACAttachmentsRequest)
      returns (ListSACAttachmentsResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/sacAttachments"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the specified attachment.
  rpc GetSACAttachment(GetSACAttachmentRequest) returns (SACAttachment) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/sacAttachments/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new SACAttachment in a given project and location.
  rpc CreateSACAttachment(CreateSACAttachmentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=projects/*/locations/*}/sacAttachments"
      body: "sac_attachment"
    };
    option (google.api.method_signature) =
        "parent,sac_attachment,sac_attachment_id";
    option (google.longrunning.operation_info) = {
      response_type: "SACAttachment"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes the specified attachment.
  rpc DeleteSACAttachment(DeleteSACAttachmentRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=projects/*/locations/*/sacAttachments/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Lists PartnerSSERealms in a given project and location.
  rpc ListPartnerSSERealms(ListPartnerSSERealmsRequest)
      returns (ListPartnerSSERealmsResponse) {
    option (google.api.http) = {
      get: "/v1alpha1/{parent=projects/*/locations/*}/partnerSSERealms"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single PartnerSSERealm.
  rpc GetPartnerSSERealm(GetPartnerSSERealmRequest) returns (PartnerSSERealm) {
    option (google.api.http) = {
      get: "/v1alpha1/{name=projects/*/locations/*/partnerSSERealms/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new PartnerSSERealm in a given project and location.
  rpc CreatePartnerSSERealm(CreatePartnerSSERealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1alpha1/{parent=projects/*/locations/*}/partnerSSERealms"
      body: "partner_sse_realm"
    };
    option (google.api.method_signature) =
        "parent,partner_sse_realm,partner_sse_realm_id";
    option (google.longrunning.operation_info) = {
      response_type: "PartnerSSERealm"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }

  // Deletes a single PartnerSSERealm.
  rpc DeletePartnerSSERealm(DeletePartnerSSERealmRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1alpha1/{name=projects/*/locations/*/partnerSSERealms/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "google.cloud.networksecurity.v1alpha1.OperationMetadata"
    };
  }
}

// Represents a Secure Access Connect (SAC) realm resource.
//
// A Secure Access Connect realm establishes a connection between your Google
// Cloud project and an SSE service.
message SACRealm {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SACRealm"
    pattern: "projects/{project}/locations/{location}/sacRealms/{sac_realm}"
    plural: "sacRealms"
    singular: "sacRealm"
  };

  // Key to be shared with SSE service provider to establish global handshake.
  message PairingKey {
    // Output only. Key value.
    string key = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Timestamp in UTC of when this resource is considered
    // expired. It expires 7 days after creation.
    google.protobuf.Timestamp expire_time = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // Fields specific to realms using Symantec Cloud SWG.
  message SACRealmSymantecOptions {
    // Connection status to Symantec API.
    enum SymantecConnectionState {
      // No state specified. This should not be used.
      SYMANTEC_CONNECTION_STATE_UNSPECIFIED = 0;

      // Successfully made a request to Symantec API.
      SUCCEEDED = 1;

      // Cannot access the API key in the provided `secret_path`.
      READ_SECRET_FAILED = 2;

      // Failed to get a successful response from Symantec API due to an invalid
      // API key or Symantec API unavailability.
      REQUEST_TO_SYMANTEC_FAILED = 3;
    }

    // Output only. Symantec site IDs which the user can choose to connect to.
    repeated string available_symantec_sites = 2
        [(google.api.field_behavior) = OUTPUT_ONLY];

    // Optional. API Key used to call Symantec APIs on the user's behalf.
    // Required if using Symantec Cloud SWG.
    // P4SA account needs permissions granted to read this secret.
    //
    // A secret ID, secret name, or secret URI can be specified,
    // but it will be parsed and stored as a secret URI in the form
    // `projects/{project_number}/secrets/my-secret`.
    string secret_path = 4 [(google.api.field_behavior) = OPTIONAL];

    // Output only. Connection status to Symantec API.
    SymantecConnectionState symantec_connection_state = 5
        [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // SSE service provider
  enum SecurityService {
    // The default value. This value is used if the state is omitted.
    SECURITY_SERVICE_UNSPECIFIED = 0;

    // [Palo Alto Networks Prisma
    // Access](https://www.paloaltonetworks.com/sase/access).
    PALO_ALTO_PRISMA_ACCESS = 1;

    // Symantec Cloud SWG.
    SYMANTEC_CLOUD_SWG = 2;
  }

  // State of the realm.
  enum State {
    // No state specified. This should not be used.
    STATE_UNSPECIFIED = 0;

    // Has never been attached to a partner.
    // Used only for Prisma Access.
    PENDING_PARTNER_ATTACHMENT = 7;

    // Currently attached to a partner.
    PARTNER_ATTACHED = 1;

    // Was once attached to a partner but has been detached.
    PARTNER_DETACHED = 2;

    // Is not attached to a partner and has an expired pairing key.
    // Used only for Prisma Access.
    KEY_EXPIRED = 3;
  }

  // Identifier. Resource name, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Timestamp when the realm was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Timestamp when the realm was last updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of labels applied to the resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Immutable. SSE service provider associated with the realm.
  SecurityService security_service = 5
      [(google.api.field_behavior) = IMMUTABLE];

  // Output only. Key to be shared with SSE service provider during pairing.
  PairingKey pairing_key = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the realm.
  State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Configuration required for Symantec realms.
  SACRealmSymantecOptions symantec_options = 8
      [(google.api.field_behavior) = OPTIONAL];
}

// Request for `ListSACRealms` method.
message ListSACRealmsRequest {
  // Required. The parent, in the form `projects/{project}/locations/global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results the server should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. An expression that filters the list of results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Sort the results by a certain order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response for `ListSACRealms` method.
message ListSACRealmsResponse {
  // The list of SACRealms.
  repeated SACRealm sac_realms = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for `GetSACRealm` method.
message GetSACRealmRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACRealm"
    }
  ];
}

// Request for `CreateSACRealm` method.
message CreateSACRealmRequest {
  // Required. The parent, in the form `projects/{project}/locations/global`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Required. ID of the created realm.
  // The ID must be 1-63 characters long, and comply with
  // <a href="https://www.ietf.org/rfc/rfc1035.txt" target="_blank">RFC1035</a>.
  // Specifically, it must be 1-63 characters long and match the regular
  // expression `[a-z]([-a-z0-9]*[a-z0-9])?`
  // which means the first character must be a lowercase letter, and all
  // following characters must be a dash, lowercase letter, or digit, except
  // the last character, which cannot be a dash.
  string sac_realm_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  SACRealm sac_realm = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request for `DeleteSACRealm` method.
message DeleteSACRealmRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/global/sacRealms/{sacRealm}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACRealm"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Represents a Secure Access Connect (SAC) attachment resource.
//
// A Secure Access Connect attachment enables NCC Gateway to process traffic
// with an SSE product.
message SACAttachment {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/SACAttachment"
    pattern: "projects/{project}/locations/{location}/sacAttachments/{sac_attachment}"
    plural: "sacAttachments"
    singular: "sacAttachment"
  };

  // Fields specific to attachments associated with Symantec Cloud SWG.
  message SACAttachmentSymantecOptions {
    // Immutable. Symantec data center identifier that this attachment will
    // connect to.
    string symantec_site = 1 [(google.api.field_behavior) = IMMUTABLE];

    // Immutable. Name to be used when creating a location on the customer's
    // behalf in Symantec's Location API. Not to be confused with Google Cloud
    // locations.
    string symantec_location_name = 2 [(google.api.field_behavior) = IMMUTABLE];
  }

  // State of the attachment.
  enum State {
    // No state specified. This should not be used.
    STATE_UNSPECIFIED = 0;

    // Has never been attached to a partner.
    PENDING_PARTNER_ATTACHMENT = 1;

    // Currently attached to a partner.
    PARTNER_ATTACHED = 2;

    // Was once attached to a partner but has been detached.
    PARTNER_DETACHED = 3;
  }

  // Identifier. Resource name, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Output only. Timestamp when the attachment was created.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Timestamp when the attachment was last updated.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Optional list of labels applied to the resource.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Required. SAC Realm which owns the attachment. This can be input as an ID
  // or a full resource name. The output always has the form
  // `projects/{project_number}/locations/{location}/sacRealms/{sac_realm}`.
  string sac_realm = 5 [(google.api.field_behavior) = REQUIRED];

  // Required. NCC Gateway associated with the attachment. This can be input as
  // an ID or a full resource name. The output always has the form
  // `projects/{project_number}/locations/{location}/spokes/{ncc_gateway}`.
  string ncc_gateway = 6 [(google.api.field_behavior) = REQUIRED];

  // Optional. Case-insensitive ISO-3166 alpha-2 country code used for
  // localization. Only valid for Symantec attachments.
  string country = 7 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Case-sensitive tzinfo identifier used for localization.
  // Only valid for Symantec attachments.
  string time_zone = 8 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Configuration required for Symantec attachments.
  SACAttachmentSymantecOptions symantec_options = 9
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. State of the attachment.
  State state = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Request for `ListSACAttachments` method.
message ListSACAttachmentsRequest {
  // Required. The parent, in the form
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Optional. Requested page size. Server may return fewer items than
  // requested. If unspecified, server will pick an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A token identifying a page of results the server should return.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. An expression that filters the list of results.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Sort the results by a certain order.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response for `ListSACAttachments` method.
message ListSACAttachmentsResponse {
  // The list of SACAttachments.
  repeated SACAttachment sac_attachments = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request for `GetSACAttachment` method.
message GetSACAttachmentRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];
}

// Request for `CreateSACAttachment` method.
message CreateSACAttachmentRequest {
  // Required. The parent, in the form
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Required. ID of the created attachment.
  // The ID must be 1-63 characters long, and comply with
  // <a href="https://www.ietf.org/rfc/rfc1035.txt" target="_blank">RFC1035</a>.
  // Specifically, it must be 1-63 characters long and match the regular
  // expression `[a-z]([-a-z0-9]*[a-z0-9])?`
  // which means the first character must be a lowercase letter, and all
  // following characters must be a dash, lowercase letter, or digit, except
  // the last character, which cannot be a dash.
  string sac_attachment_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  SACAttachment sac_attachment = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Request for `DeleteSACAttachment` method.
message DeleteSACAttachmentRequest {
  // Required. Name of the resource, in the form
  // `projects/{project}/locations/{location}/sacAttachments/{sac_attachment}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/SACAttachment"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [
    (google.api.field_info).format = UUID4,
    (google.api.field_behavior) = OPTIONAL
  ];
}

// Message describing PartnerSSERealm object
message PartnerSSERealm {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/PartnerSSERealm"
    pattern: "projects/{project}/locations/{location}/partnerSSERealms/{partner_sse_realm}"
  };

  // Fields specific to PAN realms.
  message PartnerSSERealmPanOptions {
    // Optional. serial_number is provided by PAN to identify GCP customer on
    // PAN side.
    string serial_number = 1 [(google.api.field_behavior) = OPTIONAL];

    // Optional. tenant_id is provided by PAN to identify GCP customer on PAN
    // side.
    string tenant_id = 2 [(google.api.field_behavior) = OPTIONAL];
  }

  // State of the realm
  enum State {
    // The default value. This value is used if the state is omitted.
    STATE_UNSPECIFIED = 0;

    // This PartnerSSERealm is attached to a customer realm. This is the
    // default state when a PartnerSSERealm is successfully created.
    CUSTOMER_ATTACHED = 1;

    // This PartnerSSERealm is no longer attached to a customer realm. This is
    // the state when the customer realm is deleted.
    CUSTOMER_DETACHED = 2;
  }

  // name of resource
  string name = 1;

  // Output only. Create time stamp
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Labels as key value pairs
  map<string, string> labels = 4;

  // Required. value of the key to establish global handshake from SSERealm
  string pairing_key = 5 [(google.api.field_behavior) = REQUIRED];

  // Optional. VPC owned by the partner to be peered with CDEN sse_vpc in
  // sse_project This field is deprecated. Use partner_network instead.
  string partner_vpc = 6
      [deprecated = true, (google.api.field_behavior) = OPTIONAL];

  // Output only. CDEN owned VPC to be peered with partner_vpc
  // This field is deprecated. Use sse_network instead.
  string sse_vpc = 7
      [deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. CDEN owned project owning sse_vpc. It stores project id in the
  // TTM flow, but project number in the NCCGW flow. This field will be
  // deprecated after the partner migrates from using sse_project to using
  // sse_project_number.
  string sse_project = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the realm. It can be either CUSTOMER_ATTACHED or
  // CUSTOMER_DETACHED.
  State state = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Partner-owned network to be peered with CDEN's sse_network in
  // sse_project
  string partner_network = 10 [(google.api.field_behavior) = OPTIONAL];

  // Output only. CDEN-owned network to be peered with partner_network
  string sse_network = 11 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Required only for PAN.
  PartnerSSERealmPanOptions pan_options = 12
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. CDEN owned project owning sse_vpc
  int64 sse_project_number = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for requesting list of PartnerSSERealms
message ListPartnerSSERealmsRequest {
  // Required. Parent value for ListPartnerSSERealmsRequest
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/PartnerSSERealm"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filtering results
  string filter = 4;

  // Hint for how to order the results
  string order_by = 5;
}

// Message for response to listing PartnerSSERealms
message ListPartnerSSERealmsResponse {
  // The list of PartnerSSERealm
  repeated PartnerSSERealm partner_sse_realms = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Message for getting a PartnerSSERealm
message GetPartnerSSERealmRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/PartnerSSERealm"
    }
  ];
}

// Message for creating a PartnerSSERealm
message CreatePartnerSSERealmRequest {
  // Required. Value for parent.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/PartnerSSERealm"
    }
  ];

  // Required. Id of the requesting object
  // If auto-generating Id server-side, remove this field and
  // partner_sse_realm_id from the method_signature of Create RPC
  string partner_sse_realm_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created
  PartnerSSERealm partner_sse_realm = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Message for deleting a PartnerSSERealm
message DeletePartnerSSERealmRequest {
  // Required. Name of the resource
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/PartnerSSERealm"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and the
  // request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}