// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.marketingplatform.admin.v1alpha;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";

option csharp_namespace = "Google.Ads.MarketingPlatform.Admin.V1Alpha";
option go_package = "google.golang.org/genproto/googleapis/marketingplatform/admin/v1alpha;admin";
option java_multiple_files = true;
option java_outer_classname = "ResourcesProto";
option java_package = "com.google.ads.marketingplatform.admin.v1alpha";
option php_namespace = "Google\\Ads\\MarketingPlatform\\Admin\\V1alpha";
option ruby_package = "Google::Ads::MarketingPlatform::Admin::V1alpha";
option (google.api.resource_definition) = {
  type: "analyticsadmin.googleapis.com/Account"
  pattern: "accounts/{account}"
};

// The verification state of the link between a product account and a GMP
// organization.
enum LinkVerificationState {
  // The link state is unknown.
  LINK_VERIFICATION_STATE_UNSPECIFIED = 0;

  // The link is established.
  LINK_VERIFICATION_STATE_VERIFIED = 1;

  // The link is requested, but hasn't been approved by the product account
  // admin.
  LINK_VERIFICATION_STATE_NOT_VERIFIED = 2;
}

// Various levels of service for Google Analytics.
enum AnalyticsServiceLevel {
  // Service level unspecified.
  ANALYTICS_SERVICE_LEVEL_UNSPECIFIED = 0;

  // The standard version of Google Analytics.
  ANALYTICS_SERVICE_LEVEL_STANDARD = 1;

  // The premium version of Google Analytics.
  ANALYTICS_SERVICE_LEVEL_360 = 2;
}

// Types of the Google Analytics Property.
enum AnalyticsPropertyType {
  // Unknown or unspecified property type
  ANALYTICS_PROPERTY_TYPE_UNSPECIFIED = 0;

  // Ordinary Google Analytics property
  ANALYTICS_PROPERTY_TYPE_ORDINARY = 1;

  // Google Analytics subproperty
  ANALYTICS_PROPERTY_TYPE_SUBPROPERTY = 2;

  // Google Analytics rollup property
  ANALYTICS_PROPERTY_TYPE_ROLLUP = 3;
}

// Roles that can be assigned to a user or user group in a GMP organization.
enum OrganizationRole {
  // Unknown or unspecified organization role.
  ORGANIZATION_ROLE_UNSPECIFIED = 0;

  // Organization admin role that grants all administrative privileges.
  ORG_ADMIN_ROLE = 1;

  // User admin role that grants access to the Users section to perform various
  // user management functions.
  USER_ADMIN_ROLE = 2;

  // Billing admin role that grants access to the Billing section to perform
  // various billing-related functions.
  BILLING_ADMIN_ROLE = 3;
}

// A resource message representing a Google Marketing Platform organization.
message Organization {
  option (google.api.resource) = {
    type: "marketingplatformadmin.googleapis.com/Organization"
    pattern: "organizations/{organization}"
    plural: "organizations"
    singular: "organization"
  };

  // Identifier. The resource name of the GMP organization.
  // Format: organizations/{org_id}
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // The human-readable name for the organization.
  string display_name = 2;
}

// A resource message representing the link between a Google Analytics account
// and a Google Marketing Platform organization.
message AnalyticsAccountLink {
  option (google.api.resource) = {
    type: "marketingplatformadmin.googleapis.com/AnalyticsAccountLink"
    pattern: "organizations/{organization}/analyticsAccountLinks/{analytics_account_link}"
    plural: "analyticsAccountLinks"
    singular: "analyticsAccountLink"
  };

  // Identifier. Resource name of this AnalyticsAccountLink. Note the resource
  // ID is the same as the ID of the Analtyics account.
  //
  // Format:
  // organizations/{org_id}/analyticsAccountLinks/{analytics_account_link_id}
  // Example: "organizations/xyz/analyticsAccountLinks/1234"
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Required. Immutable. The resource name of the AnalyticsAdmin API account.
  // The account ID will be used as the ID of this AnalyticsAccountLink
  // resource, which will become the final component of the resource name.
  //
  // Format: analyticsadmin.googleapis.com/accounts/{account_id}
  string analytics_account = 2 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.resource_reference) = {
      type: "analyticsadmin.googleapis.com/Account"
    }
  ];

  // Output only. The human-readable name for the Analytics account.
  string display_name = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The verification state of the link between the Analytics
  // account and the parent organization.
  LinkVerificationState link_verification_state = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A resource message representing a user group in a GMP organization.
message UserGroup {
  option (google.api.resource) = {
    type: "marketingplatformadmin.googleapis.com/UserGroup"
    pattern: "organizations/{organization}/userGroups/{user_group}"
    plural: "userGroups"
    singular: "userGroup"
  };

  // Identifier. Resource name of this UserGroup.
  //
  // Format: organizations/{org_id}/userGroups/{user_group_id}
  // Example: "organizations/123abc/userGroups/456def"
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. The human-readable name for the user group.
  string display_name = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The description of the user group.
  string description = 3 [(google.api.field_behavior) = OPTIONAL];
}

// A resource message representing a member of a user group.
message UserGroupMember {
  option (google.api.resource) = {
    type: "marketingplatformadmin.googleapis.com/UserGroupMember"
    pattern: "organizations/{organization}/userGroups/{user_group}/members/{member}"
    plural: "userGroupMembers"
    singular: "userGroupMember"
  };

  // The role of the member in the user group.
  enum MembershipRole {
    // Unspecified membership role.
    MEMBERSHIP_ROLE_UNSPECIFIED = 0;

    // Owner role that can add and remove group members.
    MEMBERSHIP_ROLE_OWNER = 1;

    // Member role that receives all permissions assigned to the group.
    MEMBERSHIP_ROLE_MEMBER = 2;
  }

  // The member of the user group.
  oneof member {
    // Email address of the user member.
    string user_email = 2;

    // User group resource name of the group member.
    string user_group = 3;
  }

  // Identifier. The resource name of this UserGroupMember.
  //
  // Format:
  // organizations/{org_id}/userGroups/{user_group_id}/members/{member_id}
  // Example:
  // "organizations/123abc/userGroups/456def/members/789ghi"
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. The role of the member in the user group.
  MembershipRole membership_role = 4 [(google.api.field_behavior) = OPTIONAL];
}

// A resource message representing a binding to a set of roles.
message AdminAccessBinding {
  option (google.api.resource) = {
    type: "marketingplatformadmin.googleapis.com/AdminAccessBinding"
    pattern: "organizations/{organization}/adminAccessBindings/{admin_access_binding}"
    plural: "adminAccessBindings"
    singular: "adminAccessBinding"
  };

  // The entity to which the roles are granted.
  oneof access_target {
    // Email address of the user.
    string user_email = 2;

    // Resource name of the user group.
    string user_group = 3;
  }

  // Identifier. The resource name of this AdminAccessBinding.
  //
  // Format:
  // organizations/{org_id}/adminAccessBindings/{admin_access_binding_id}
  // Example: "organizations/123abc/adminAccessBindings/456def"
  string name = 1 [(google.api.field_behavior) = IDENTIFIER];

  // Optional. A list of roles granted to the parent organization.
  //
  // USER_ADMIN_ROLE and BILLING_ADMIN_ROLE will be automatically added if
  // ORG_ADMIN_ROLE is assigned.
  //
  // No roles will be assigned if no roles are specified.
  repeated OrganizationRole organization_roles = 4
      [(google.api.field_behavior) = OPTIONAL];
}