// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.workloadidentity.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.WorkloadIdentity.V1";
option go_package = "cloud.google.com/go/workloadidentity/apiv1/workloadidentitypb;workloadidentitypb";
option java_multiple_files = true;
option java_outer_classname = "ServiceProto";
option java_package = "com.google.cloud.workloadidentity.v1";
option php_namespace = "Google\\Cloud\\WorkloadIdentity\\V1";
option ruby_package = "Google::Cloud::WorkloadIdentity::V1";
option (google.api.resource_definition) = {
  type: "workloadidentity.googleapis.com/ServiceProducer"
  pattern: "projects/{project}/locations/{location}/serviceProducers/{service_producer}"
  pattern: "folders/{folder}/locations/{location}/serviceProducers/{service_producer}"
  pattern: "organizations/{organization}/locations/{location}/serviceProducers/{service_producer}"
};

// Service describing handlers for resources
service WorkloadIdentity {
  option (google.api.default_host) = "workloadidentity.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Creates all service agents for a given resource, location and service
  // producer.
  rpc GenerateServiceAgents(GenerateServiceAgentsRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/serviceProducers/*}:generateServiceAgents"
      body: "*"
      additional_bindings {
        post: "/v1/{parent=folders/*/locations/*/serviceProducers/*}:generateServiceAgents"
        body: "*"
      }
      additional_bindings {
        post: "/v1/{parent=organizations/*/locations/*/serviceProducers/*}:generateServiceAgents"
        body: "*"
      }
    };
    option (google.api.method_signature) = "parent";
    option (google.longrunning.operation_info) = {
      response_type: "GenerateServiceAgentsResponse"
      metadata_type: "OperationMetadata"
    };
  }
}

// Message describing ServiceAgent object
message ServiceAgent {
  option (google.api.resource) = {
    type: "workloadidentity.googleapis.com/ServiceAgent"
    pattern: "projects/{project}/locations/{location}/serviceProducers/{service_producer}/serviceAgents/{service_agent}"
    pattern: "folders/{folder}/locations/{location}/serviceProducers/{service_producer}/serviceAgents/{service_agent}"
    pattern: "organizations/{organization}/locations/{location}/serviceProducers/{service_producer}/serviceAgents/{service_agent}"
    plural: "serviceAgents"
    singular: "serviceAgent"
  };

  // Enum for service agent `state`.
  enum State {
    // Default service agent `state`. This value is used if the
    // state is omitted.
    STATE_UNSPECIFIED = 0;

    // Indicates that the service agent has been created and can be used.
    ACTIVE = 1;

    // Indicates that the service agent was not created.
    FAILED = 2;
  }

  // Identifier. The name of the service agent resource
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. Name of the container that the service agent is associated with.
  // For example:
  // * projects/1234
  // * folders/1234
  // * organizations/2344
  string container = 5 [
    (google.api.field_behavior) = OPTIONAL,
    (google.api.resource_reference) = { type: "*" }
  ];

  // Optional. The service the agent belongs to.
  // For example, bigquery.googleapis.com
  string service_producer = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The principal identifier for the service agent. This identifier
  // is used in allow policies to grant access to the service agent.
  string principal = 7 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The role that should be granted to service agent on consumer
  // project, if any. For example, "roles/aiplatform.serviceAgent".
  string role = 9 [(google.api.field_behavior) = OPTIONAL];

  // Output only. Service agent state.
  State state = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Message for creating all ServiceAgents for a ServiceProducer in a project and
// location.
message GenerateServiceAgentsRequest {
  // Required. The parent resource. The `location` for the parent resource must
  // be `global`.
  //
  // Examples:
  //
  // - projects/1234/locations/global/serviceProducers/bigquery.googleapis.com
  // - folders/2344/locations/global/serviceProducers/vertexai.googleapis.com
  // - organizations/3344/locations/global/serviceProducers/iam.googleapis.com
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadidentity.googleapis.com/ServiceProducer"
    }
  ];
}

// Message for creating all ServiceAgents for a ServiceProducer in a project and
// location.
message GenerateServiceAgentsResponse {
  // The list of service agents
  repeated ServiceAgent service_agents = 1;
}

// Represents the metadata of the long-running operation.
message OperationMetadata {
  // Output only. The time the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Server-defined resource path for the target of the operation.
  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Name of the verb executed by the operation.
  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Human-readable status of the operation, if any.
  string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifies whether the user has requested cancellation
  // of the operation. Operations that have been cancelled successfully
  // have
  // [google.longrunning.Operation.error][google.longrunning.Operation.error]
  // value with a [google.rpc.Status.code][google.rpc.Status.code] of `1`,
  // corresponding to `Code.CANCELLED`.
  bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. API version used to start the operation.
  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}