// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1alpha1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Alpha1";
option go_package = "cloud.google.com/go/networksecurity/apiv1alpha1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "TlsInspectionPolicyProto";
option java_package = "com.google.cloud.networksecurity.v1alpha1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1alpha1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1alpha1";
option (google.api.resource_definition) = {
  type: "privateca.googleapis.com/CaPool"
  pattern: "projects/{project}/locations/{location}/caPools/{ca_pool}"
};

// The TlsInspectionPolicy resource contains references to CA pools in
// Certificate Authority Service and associated metadata.
message TlsInspectionPolicy {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/TlsInspectionPolicy"
    pattern: "projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy}"
  };

  // The minimum version of TLS protocol that can be used by clients or servers
  // to establish a connection with the TLS inspection proxy.
  enum TlsVersion {
    // Indicates no TLS version was specified.
    TLS_VERSION_UNSPECIFIED = 0;

    // TLS 1.0
    TLS_1_0 = 1;

    // TLS 1.1
    TLS_1_1 = 2;

    // TLS 1.2
    TLS_1_2 = 3;

    // TLS 1.3
    TLS_1_3 = 4;
  }

  // Profile specifies the set of TLS cipher suites (and possibly
  // other features in the future) that can be used by the firewall when
  // negotiating TLS connections with clients and servers. The meaning of these
  // fields is identical to the load balancers' SSLPolicy resource.
  enum Profile {
    // Indicates no profile was specified.
    PROFILE_UNSPECIFIED = 0;

    // Compatible profile. Allows the broadest set of clients, even those
    // which support only out-of-date SSL features to negotiate with the TLS
    // inspection proxy.
    PROFILE_COMPATIBLE = 1;

    // Modern profile. Supports a wide set of SSL features, allowing modern
    // clients to negotiate SSL with the TLS inspection proxy.
    PROFILE_MODERN = 2;

    // Restricted profile. Supports a reduced set of SSL features, intended to
    // meet stricter compliance requirements.
    PROFILE_RESTRICTED = 3;

    // Custom profile. Allow only the set of allowed SSL features specified in
    // the custom_features field of SslPolicy.
    PROFILE_CUSTOM = 4;
  }

  // Required. Name of the resource. Name is of the form
  // projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy}
  // tls_inspection_policy should match the
  // pattern:(^[a-z]([a-z0-9-]{0,61}[a-z0-9])?$).
  string name = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Free-text description of the resource.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. The timestamp when the resource was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the resource was updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. A CA pool resource used to issue interception certificates.
  // The CA pool string has a relative resource path following the form
  // "projects/{project}/locations/{location}/caPools/{ca_pool}".
  string ca_pool = 5 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "privateca.googleapis.com/CaPool"
    }
  ];

  // Optional. A TrustConfig resource used when making a connection to the TLS
  // server. This is a relative resource path following the form
  // "projects/{project}/locations/{location}/trustConfigs/{trust_config}". This
  // is necessary to intercept TLS connections to servers with certificates
  // signed by a private CA or self-signed certificates.
  // Note that Secure Web Proxy does not yet honor this field.
  string trust_config = 6 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = {
      type: "certificatemanager.googleapis.com/TrustConfig"
    }
  ];

  // Optional. If  FALSE (the default), use our default set of public CAs in
  // addition to any CAs specified in trust_config. These public CAs are
  // currently based on the Mozilla Root Program and are subject to change over
  // time. If TRUE, do not accept our default set of public CAs. Only CAs
  // specified in trust_config will be accepted. This defaults to FALSE (use
  // public CAs in addition to trust_config) for backwards compatibility, but
  // trusting public root CAs is *not recommended* unless the traffic in
  // question is outbound to public web servers. When possible, prefer setting
  // this to "false" and explicitly specifying trusted CAs and certificates in a
  // TrustConfig. Note that Secure Web Proxy does not yet honor this field.
  optional bool exclude_public_ca_set = 7
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Minimum TLS version that the firewall should use when negotiating
  // connections with both clients and servers. If this is not set, then the
  // default value is to allow the broadest set of clients and servers (TLS 1.0
  // or higher). Setting this to more restrictive values may improve security,
  // but may also prevent the firewall from connecting to some clients or
  // servers.
  // Note that Secure Web Proxy does not yet honor this field.
  TlsVersion min_tls_version = 8 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The selected Profile. If this is not set, then the default value
  // is to allow the broadest set of clients and servers ("PROFILE_COMPATIBLE").
  // Setting this to more restrictive values may improve security, but may also
  // prevent the TLS inspection proxy from connecting to some clients or
  // servers. Note that Secure Web Proxy does not yet honor this field.
  Profile tls_feature_profile = 9 [(google.api.field_behavior) = OPTIONAL];

  // Optional. List of custom TLS cipher suites selected.
  // This field is valid only if the selected tls_feature_profile is CUSTOM.
  // The [compute.SslPoliciesService.ListAvailableFeatures][] method returns the
  // set of features that can be specified in this list.
  // Note that Secure Web Proxy does not yet honor this field.
  repeated string custom_tls_features = 10
      [(google.api.field_behavior) = OPTIONAL];
}

// Request used by the CreateTlsInspectionPolicy method.
message CreateTlsInspectionPolicyRequest {
  // Required. The parent resource of the TlsInspectionPolicy. Must be in the
  // format `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/TlsInspectionPolicy"
    }
  ];

  // Required. Short name of the TlsInspectionPolicy resource to be created.
  // This value should be 1-63 characters long, containing only
  // letters, numbers, hyphens, and underscores, and should not start
  // with a number. E.g. "tls_inspection_policy1".
  string tls_inspection_policy_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. TlsInspectionPolicy resource to be created.
  TlsInspectionPolicy tls_inspection_policy = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Request used with the ListTlsInspectionPolicies method.
message ListTlsInspectionPoliciesRequest {
  // Required. The project and location from which the TlsInspectionPolicies
  // should be listed, specified in the format
  // `projects/{project}/locations/{location}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Maximum number of TlsInspectionPolicies to return per call.
  int32 page_size = 2;

  // The value returned by the last
  // 'ListTlsInspectionPoliciesResponse' Indicates that this is a
  // continuation of a prior 'ListTlsInspectionPolicies' call, and
  // that the system should return the next page of data.
  string page_token = 3;
}

// Response returned by the ListTlsInspectionPolicies method.
message ListTlsInspectionPoliciesResponse {
  // List of TlsInspectionPolicies resources.
  repeated TlsInspectionPolicy tls_inspection_policies = 1;

  // If there might be more results than those appearing in this response, then
  // 'next_page_token' is included. To get the next set of results, call this
  // method again using the value of 'next_page_token' as 'page_token'.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request used by the GetTlsInspectionPolicy method.
message GetTlsInspectionPolicyRequest {
  // Required. A name of the TlsInspectionPolicy to get. Must be in the format
  // `projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/TlsInspectionPolicy"
    }
  ];
}

// Request used by the DeleteTlsInspectionPolicy method.
message DeleteTlsInspectionPolicyRequest {
  // Required. A name of the TlsInspectionPolicy to delete. Must be in the
  // format
  // `projects/{project}/locations/{location}/tlsInspectionPolicies/{tls_inspection_policy}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/TlsInspectionPolicy"
    }
  ];

  // If set to true, any rules for this TlsInspectionPolicy will also be
  // deleted. (Otherwise, the request will only work if the TlsInspectionPolicy
  // has no rules.)
  bool force = 2;
}

// Request used by the UpdateTlsInspectionPolicy method.
message UpdateTlsInspectionPolicyRequest {
  // Optional. Field mask is used to specify the fields to be overwritten in the
  // TlsInspectionPolicy resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. Updated TlsInspectionPolicy resource.
  TlsInspectionPolicy tls_inspection_policy = 2
      [(google.api.field_behavior) = REQUIRED];
}