// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.backupdr.v1beta;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.BackupDR.V1Beta";
option go_package = "cloud.google.com/go/backupdr/apiv1beta/backupdrpb;backupdrpb";
option java_multiple_files = true;
option java_outer_classname = "AutoProtectionPolicyProto";
option java_package = "com.google.cloud.backupdr.v1beta";
option php_namespace = "Google\\Cloud\\BackupDR\\V1beta";
option ruby_package = "Google::Cloud::BackupDR::V1beta";

// An AutoprotectionPolicy is a policy resource designed to automate backup
// management, moving from manual per-resource protection to a bulk approach.
// The policy dynamically discovers and applies a specified backup plan to all
// eligible resources that match its defined scope and criteria.
message AutoProtectionPolicy {
  option (google.api.resource) = {
    type: "backupdr.googleapis.com/AutoProtectionPolicy"
    pattern: "projects/{project}/locations/{location}/autoProtectionPolicies/{auto_protection_policy}"
    plural: "autoProtectionPolicies"
    singular: "autoProtectionPolicy"
  };

  // The state of an AutoprotectionPolicy.
  enum State {
    // The state of the policy is unspecified.
    STATE_UNSPECIFIED = 0;

    // The policy is being created.
    CREATING = 1;

    // The policy is active and protecting matching resources.
    ACTIVE = 2;

    // The policy is being updated.
    UPDATING = 3;

    // The policy is being deleted.
    DELETING = 4;
  }

  // Identifier. The resource name of the AutoprotectionPolicy.
  // Format:
  // `projects/{project}/locations/{location}/autoProtectionPolicies/{auto_protection_policy}`
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. A description of the policy.
  string description = 2 [(google.api.field_behavior) = OPTIONAL];

  // Required. The backup plan details for matching resources.
  repeated BackupPlanDetail backup_plan_details = 3
      [(google.api.field_behavior) = REQUIRED];

  // Required. The criteria for matching resources.
  Criteria criteria = 4 [(google.api.field_behavior) = REQUIRED];

  // Output only. The current state of the AutoprotectionPolicy.
  State state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The etag for the policy.
  // If this is provided on update, it must match the server's etag, otherwise
  // the request will be rejected with an ABORTED error.
  string etag = 6;

  // Output only. Summary of total count of different containers covered through
  // this policy.
  BindingSummary binding_summary = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Summary of last policy application when job was run per
  // workload type.
  PolicyEvaluationSummary policy_evaluation_summary = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the policy was created.
  google.protobuf.Timestamp create_time = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The timestamp when the policy was last updated.
  google.protobuf.Timestamp update_time = 10
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// BackupPlanDetail defines configuration of protection.
message BackupPlanDetail {
  // Required. The type of resource that this policy will automatically protect.
  // For MVP, `compute.googleapis.com/Instance` and
  // `compute.googleapis.com/Disk` are supported.
  string resource_type = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource name of the BackupPlan to apply to resources that
  // match the policy's criteria. This backup plan must be in the same location
  // as AutoProtectionPolicy. Format:
  // projects/{project}/locations/{location}/backupPlans/{backupPlanId}
  string backup_plan = 2 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "backupdr.googleapis.com/BackupPlan"
    }
  ];
}

// Criteria specifies a set of criteria for matching resources.
message Criteria {
  // Required. A list of matching conditions that a resource must meet to be
  // protected by the policy.
  repeated MatchingCondition matching_conditions = 1
      [(google.api.field_behavior) = REQUIRED];
}

// MatchingCondition specifies a set of conditions for matching resources.
message MatchingCondition {
  // A condition that a resource must meet to be protected by the
  // policy.
  oneof condition {
    // Optional. A condition that matches resources based on their labels.
    // For MVP, this is limited to a single label match.
    KeyValuePair label_condition = 1 [(google.api.field_behavior) = OPTIONAL];
  }
}

// PolicyEvaluationSummary contains the summary of the last run of job that
// applies policy to matching resources.
message PolicyEvaluationSummary {
  // Output only. The number of resources that currently match the policy's
  // criteria.
  int64 matching_resource_count = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The number of matching resources that are successfully
  // protected.
  int64 protected_resource_count = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The number of matching resources whose protection failed
  // during job run.
  int64 failed_resource_count = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// BindingSummary contains count of different containers covered through this
// policy.
message BindingSummary {
  // Output only. Total count of Projects protected with this policy.
  int64 project_count = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// KeyValuePair defines a key-value pair for matching resource labels.
message KeyValuePair {
  // Required. The key of the label to match.
  // This must be in the format `{label_key}`.
  // The key must match the regex
  // Format:`[\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}`.
  string key = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The values of the label to match.
  // There will be explicit “OR” between values of array.
  // Each value must be in the format `{label_value}`.
  // The value must match the regex
  // Format: `[\\p{Ll}\\p{Lo}\\p{N}_-]{1,63}`.
  repeated string values = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request message for creating an AutoProtectionPolicy.
message CreateAutoProtectionPolicyRequest {
  // Required. The parent resource where this policy will be created.
  // Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Required. The ID to use for the policy.
  // This will become the final component of the policy's resource name.
  string auto_protection_policy_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The AutoProtectionPolicy resource to create.
  AutoProtectionPolicy auto_protection_policy = 3
      [(google.api.field_behavior) = REQUIRED];
}

// Request message for getting an AutoProtectionPolicy.
message GetAutoProtectionPolicyRequest {
  // Required. The name of the policy to retrieve.
  // Format:
  // projects/{project}/locations/{location}/autoProtectionPolicies/{auto_protection_policy}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "backupdr.googleapis.com/AutoProtectionPolicy"
    }
  ];
}

// Request message for updating an AutoProtectionPolicy.
message UpdateAutoProtectionPolicyRequest {
  // Required. The policy to update.
  AutoProtectionPolicy auto_protection_policy = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. Field mask is used to specify the fields to be overwritten in the
  // AutoProtectionPolicy resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask. If the
  // user does not provide a mask then all fields will be overwritten.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request message for deleting an AutoProtectionPolicy.
message DeleteAutoProtectionPolicyRequest {
  // Required. The name of the policy to delete.
  // Format:
  // projects/{project}/locations/{location}/autoProtectionPolicies/{auto_protection_policy}
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "backupdr.googleapis.com/AutoProtectionPolicy"
    }
  ];

  // The current etag of the AutoProtectionPolicy.
  // If an etag is provided and does not match the current etag of the
  // connection, the request will be rejected with an ABORTED error.
  string etag = 2;
}

// Request message for ListAutoProtectionPolicies.
message ListAutoProtectionPoliciesRequest {
  // Required. The project and location for which to retrieve the list of
  // policies. Format: projects/{project}/locations/{location}
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "locations.googleapis.com/Location"
    }
  ];

  // Optional. The maximum number of policies to return in a single page.
  // If unspecified, a server-default value will be used.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A page token, received from a previous
  // `ListAutoProtectionPolicies` call. Provide this to retrieve the subsequent
  // page.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. A filter expression that filters resources listed in the
  // response. The following fields are filterable:
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. An expression that sorts the results in the response. The
  // following fields are sortable:
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for ListAutoProtectionPolicies.
message ListAutoProtectionPoliciesResponse {
  // A list of the AutoProtectionPolicy resources found.
  repeated AutoProtectionPolicy auto_protection_policies = 1;

  // A token that can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}