// Copyright 2025 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.networksecurity.v1beta1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
option go_package = "cloud.google.com/go/networksecurity/apiv1beta1/networksecuritypb;networksecuritypb";
option java_multiple_files = true;
option java_outer_classname = "DnsThreatDetectorProto";
option java_package = "com.google.cloud.networksecurity.v1beta1";
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
option (google.api.resource_definition) = {
  type: "compute.googleapis.com/Network"
  pattern: "projects/{project}/global/networks/{network}"
};

// The Network Security API for DNS Threat Detectors.
service DnsThreatDetectorService {
  option (google.api.default_host) = "networksecurity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists DnsThreatDetectors in a given project and location.
  rpc ListDnsThreatDetectors(ListDnsThreatDetectorsRequest)
      returns (ListDnsThreatDetectorsResponse) {
    option (google.api.http) = {
      get: "/v1beta1/{parent=projects/*/locations/*}/dnsThreatDetectors"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets the details of a single DnsThreatDetector.
  rpc GetDnsThreatDetector(GetDnsThreatDetectorRequest)
      returns (DnsThreatDetector) {
    option (google.api.http) = {
      get: "/v1beta1/{name=projects/*/locations/*/dnsThreatDetectors/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new DnsThreatDetector in a given project and location.
  rpc CreateDnsThreatDetector(CreateDnsThreatDetectorRequest)
      returns (DnsThreatDetector) {
    option (google.api.http) = {
      post: "/v1beta1/{parent=projects/*/locations/*}/dnsThreatDetectors"
      body: "dns_threat_detector"
    };
    option (google.api.method_signature) =
        "parent,dns_threat_detector,dns_threat_detector_id";
  }

  // Updates a single DnsThreatDetector.
  rpc UpdateDnsThreatDetector(UpdateDnsThreatDetectorRequest)
      returns (DnsThreatDetector) {
    option (google.api.http) = {
      patch: "/v1beta1/{dns_threat_detector.name=projects/*/locations/*/dnsThreatDetectors/*}"
      body: "dns_threat_detector"
    };
    option (google.api.method_signature) = "dns_threat_detector,update_mask";
  }

  // Deletes a single DnsThreatDetector.
  rpc DeleteDnsThreatDetector(DeleteDnsThreatDetectorRequest)
      returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/v1beta1/{name=projects/*/locations/*/dnsThreatDetectors/*}"
    };
    option (google.api.method_signature) = "name";
  }
}

// A DNS threat detector sends DNS query logs to a _provider_ that then
// analyzes the logs to identify threat events in the DNS queries.
// By default, all VPC networks in your projects are included. You can exclude
// specific networks by supplying `excluded_networks`.
message DnsThreatDetector {
  option (google.api.resource) = {
    type: "networksecurity.googleapis.com/DnsThreatDetector"
    pattern: "projects/{project}/locations/{location}/dnsThreatDetectors/{dns_threat_detector}"
    plural: "dnsThreatDetectors"
    singular: "dnsThreatDetector"
  };

  // Name of the provider used for DNS threat analysis.
  enum Provider {
    // An unspecified provider.
    PROVIDER_UNSPECIFIED = 0;

    // The Infoblox DNS threat detector provider.
    INFOBLOX = 1;
  }

  // Immutable. Identifier. Name of the DnsThreatDetector resource.
  string name = 1 [
    (google.api.field_behavior) = IDENTIFIER,
    (google.api.field_behavior) = IMMUTABLE
  ];

  // Output only. Create time stamp.
  google.protobuf.Timestamp create_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Update time stamp.
  google.protobuf.Timestamp update_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Any labels associated with the DnsThreatDetector, listed as key
  // value pairs.
  map<string, string> labels = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A list of network resource names which aren't monitored by this
  // DnsThreatDetector.
  //
  // Example:
  // `projects/PROJECT_ID/global/networks/NETWORK_NAME`.
  repeated string excluded_networks = 5 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = { type: "compute.googleapis.com/Network" }
  ];

  // Required. The provider used for DNS threat analysis.
  Provider provider = 6 [(google.api.field_behavior) = REQUIRED];
}

// The message for requesting a list of DnsThreatDetectors in the project.
message ListDnsThreatDetectorsRequest {
  // Required. The parent value for `ListDnsThreatDetectorsRequest`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/DnsThreatDetector"
    }
  ];

  // Optional. The requested page size. The server may return fewer items than
  // requested. If unspecified, the server picks an appropriate default.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token received from a previous
  // `ListDnsThreatDetectorsRequest` call. Provide this to retrieve the
  // subsequent page.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// The response message to requesting a list of DnsThreatDetectors.
message ListDnsThreatDetectorsResponse {
  // The list of DnsThreatDetector resources.
  repeated DnsThreatDetector dns_threat_detectors = 1;

  // A token, which can be sent as `page_token`, to retrieve the next page.
  string next_page_token = 2;

  // Unordered list. Unreachable `DnsThreatDetector` resources.
  repeated string unreachable = 3
      [(google.api.field_behavior) = UNORDERED_LIST];
}

// The message sent to get a DnsThreatDetector.
message GetDnsThreatDetectorRequest {
  // Required. Name of the DnsThreatDetector resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/DnsThreatDetector"
    }
  ];
}

// The message to create a DnsThreatDetector.
message CreateDnsThreatDetectorRequest {
  // Required. The value for the parent of the DnsThreatDetector resource.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "networksecurity.googleapis.com/DnsThreatDetector"
    }
  ];

  // Optional. The ID of the requesting DnsThreatDetector object.
  // If this field is not supplied, the service generates an identifier.
  string dns_threat_detector_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Required. The `DnsThreatDetector` resource to create.
  DnsThreatDetector dns_threat_detector = 3
      [(google.api.field_behavior) = REQUIRED];
}

// The message for updating a DnsThreatDetector.
message UpdateDnsThreatDetectorRequest {
  // Optional. The field mask is used to specify the fields to be overwritten in
  // the DnsThreatDetector resource by the update. The fields specified in the
  // update_mask are relative to the resource, not the full request. A field
  // will be overwritten if it is in the mask. If the mask is not provided then
  // all fields present in the request will be overwritten.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = OPTIONAL];

  // Required. The DnsThreatDetector resource being updated.
  DnsThreatDetector dns_threat_detector = 2
      [(google.api.field_behavior) = REQUIRED];
}

// The message for deleting a DnsThreatDetector.
message DeleteDnsThreatDetectorRequest {
  // Required. Name of the DnsThreatDetector resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "networksecurity.googleapis.com/DnsThreatDetector"
    }
  ];
}