// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.ads.admanager.v1;

import "google/ads/admanager/v1/cdn_config_status_enum.proto";
import "google/ads/admanager/v1/cdn_config_type_enum.proto";
import "google/ads/admanager/v1/cdn_security_policy_enum.proto";
import "google/ads/admanager/v1/cdn_security_policy_origin_forwarding_enum.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/duration.proto";

option csharp_namespace = "Google.Ads.AdManager.V1";
option go_package = "google.golang.org/genproto/googleapis/ads/admanager/v1;admanager";
option java_multiple_files = true;
option java_outer_classname = "CdnConfigMessagesProto";
option java_package = "com.google.ads.admanager.v1";
option php_namespace = "Google\\Ads\\AdManager\\V1";
option ruby_package = "Google::Ads::AdManager::V1";

// A CdnConfig encapsulates information about where and how to ingest and
// deliver content enabled for DAI (Dynamic Ad Insertion).
message CdnConfig {
  option (google.api.resource) = {
    type: "admanager.googleapis.com/CdnConfig"
    pattern: "networks/{network_code}/cdnConfigs/{cdn_config}"
    plural: "cdnConfigs"
    singular: "cdnConfig"
  };

  // Identifier. The resource name of the `CdnConfig`.
  // Format: `networks/{network_code}/cdnConfigs/{cdn_config_id}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Required. The name of the CdnConfig. This value is required to create a CDN
  // config and has a maximum length of 255 characters.
  optional string display_name = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The type of CDN config represented by this CdnConfig.
  optional CdnConfigTypeEnum.CdnConfigType cdn_config_type = 3
      [(google.api.field_behavior) = REQUIRED];

  // Optional. Parameters about this CDN config as a source of content. This
  // facilitates fetching the original content for conditioning and delivering
  // the original content as part of a modified stream.
  SourceContentConfig source_content_config = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Config of CDN to deliver ad media.
  AdMediaDeliveryConfig ad_media_delivery_config = 6
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. The status of the CDN config.
  optional CdnConfigStatusEnum.CdnConfigStatus cdn_config_status = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A set of security requirements to authenticate against in order to access
// video content. Different locations (e.g. different CDNs) can have different
// security policies.
message CdnSecurityPolicy {
  // Required. Type of security policy. This determines which other fields
  // should be populated. This value is required for a valid security policy.
  optional CdnSecurityPolicyTypeEnum.CdnSecurityPolicyType
      security_policy_type = 1 [(google.api.field_behavior) = REQUIRED];

  // Optional. Shared security key used to generate the Akamai HMAC token for
  // authenticating requests. Only applicable when the value of
  // `CdnSecurityPolicyType` is equal to `CdnSecurityPolicyType.AKAMAI` and will
  // be set to null otherwise. Required when the `CdnConfig.cdnConfigType` is
  // equal to `CdnConfigType.LIVE_STREAM_SOURCE_CONTENT` and this
  // `CdnSecurityPolicy` is being configured for
  // `SourceContentConfig.ingestSettings`.
  optional string token_authentication_key = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Whether the segment URLs should be signed using the
  // #tokenAuthenticationKey on the server. This is only applicable for delivery
  // media locations that have token authentication enabled.
  optional bool server_side_url_signing_disabled = 3
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The type of origin forwarding used to support Akamai
  // authentication policies for the parent playlist. Not applicable to ingest
  // locations, and is only applicable to delivery media locations with the
  // `securityPolicyType` set to `CdnSecurityPolicyType.AKAMAI`. If set
  // elsewhere it will be reset to null.
  optional
      CdnSecurityPolicyOriginForwardingEnum.CdnSecurityPolicyOriginForwarding
          origin_forwarding_type = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The origin path prefix provided by the publisher for the parent
  // playlist. Only applicable for delivery media locations with the value of
  // `originForwardingType` set to
  // `CdnSecurityPolicyOriginForwarding.CONVENTIONAL`, and will be set to null
  // otherwise.
  optional string origin_path_prefix = 6
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The type of origin forwarding used to support Akamai
  // authentication policies for media playlists. This setting can only be used
  // with CDN configs with a `cdnConfigType` of
  // `CdnConfigType.LIVE_STREAM_SOURCE_CONTENT`, is not applicable to ingest
  // locations, and is only applicable to delivery media locations with the
  // `CdnSecurityPolicyType` set to `CdnSecurityPolicyType.AKAMAI`. Valid
  // options are `CdnSecurityPolicyOriginForwarding.NONE` or
  // `CdnSecurityPolicyOriginForwarding.ORIGIN_PATH`. This setting can only be
  // used with CDN configs with a `cdnConfigType` of
  // `CdnConfigType.LIVE_STREAM_SOURCE_CONTENT`.
  optional
      CdnSecurityPolicyOriginForwardingEnum.CdnSecurityPolicyOriginForwarding
          media_playlist_origin_forwarding_type = 7
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The origin path prefix provided by the publisher for the media
  // playlists. Only applicable for delivery media locations with the value of
  // `mediaPlaylistOriginForwardingType` set to
  // `CdnSecurityPolicyOriginForwarding.CONVENTIONAL`, and will be set to null
  // otherwise.
  optional string media_playlist_origin_path_prefix = 8
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. The name of the EdgeCacheKeyset on the Media CDN config that will
  // be used to validate signed requests from DAI to ingest content.
  optional string keyset = 10 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The duration for which a request signed with a short token
  // will be valid. Only required if `signedRequestMaximumExpirationTtl` has
  // been set in the Media CDN config.
  optional google.protobuf.Duration signed_request_expiration_ttl = 11
      [(google.api.field_behavior) = OPTIONAL];
}

// Parameters about this CDN config of a CDN used for delivering ad media.
message AdMediaDeliveryConfig {
  // Optional. Whether to override the default delivery CDN. If false,
  // `deliverySettings` must be null.
  optional bool override_default_delivery_settings = 4
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Config for the delivery location that will override the default.
  // From MediaLocationDto, the URL prefix field represents the hostname of the
  // external CDN and the security policy will be ignored. Null if
  // `overrideDefaultDeliverySettings` is false.
  MediaLocation delivery_settings = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. List of additional delivery locations. From MediaLocationDto, the
  // URL prefix field represents the hostname of the external CDN and the
  // security policy will be ignored. In your stream create request, you can set
  // the value of the `dai-dlid` parameter to the name of the MediaLocation you
  // want to use.
  repeated MediaLocation additional_delivery_settings = 3
      [(google.api.field_behavior) = OPTIONAL];
}

// Parameters about this CDN config as a source of content. This
// facilitates fetching the original content for conditioning and delivering the
// original content as part of a modified stream.
message SourceContentConfig {
  // Required. Config for how DAI should ingest media. At ingest time, we match
  // the URL prefix of media in a stream's playlist with an ingest location and
  // use the authentication credentials from the corresponding ingest settings
  // to download the media. This value is required for a valid source content
  // config.
  MediaLocation ingest_settings = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. Default config for how DAI should deliver the non-modified media
  // segments. At delivery time, we replace the ingest location's URL prefix
  // with the delivery location's URL prefix and use the security policy from
  // the delivery settings to determine how DAI needs to deliver the media so
  // that users can access it. This value is required for a valid source content
  // config.
  MediaLocation default_delivery_settings = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Config that associates a media location with a security policy and the
// authentication credentials needed to access the content.
message MediaLocation {
  // Output only. The name of the media location. This value is read-only and is
  // assigned by Google.
  optional string display_name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. The URL prefix of the media location. This value is required for
  // a valid media location.
  optional string url_prefix = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. The security policy and authentication credentials needed to
  // access the content in this media location. Optional; if omitted, no
  // security policy will be applied (indicating a public/unprotected location).
  // Must NOT be configured for ad media delivery locations (doing so will
  // trigger a validation error).
  CdnSecurityPolicy security_policy = 3
      [(google.api.field_behavior) = OPTIONAL];
}