syntax = "proto3";

package com.wixpress.authorization.abac;

import "com/wixpress/authorization/abac/AuthorizationService.proto";
import "com/wixpress/authorization/abac/management/Subject.proto";
import "wix/api/permissions.proto";
import "wix/api/annotations.proto";
import "wix/api/validations.proto";
import "google/api/annotations.proto";

// This service is aimed to provide an option to perform an explicit isPermitted for BO, being able to declare the subject you perform the authorization for
// flynt-disable missing-service-entity
service BackOfficeAuthorizationService {
    option (wix.api.service_exposure) = INTERNAL;

    rpc IsPermitted (BackOfficeIsPermitted) returns (IsPermittedResponse) {
//        option (google.api.http).post = "/v1/authorization/bo/is_permitted";
//        option (wix.api.permission).name = "USERS_AUTH.BO_IS_PERMITTED";
    }

    rpc BulkIsPermitted(BulkBackOfficeIsPermittedRequest) returns (BulkIsPermittedResponse) {
        option (google.api.http).get = "/v1/authorization/bo/bulk_is_permitted";
        option (wix.api.permission).name = "USERS_AUTH.BO_IS_PERMITTED";
        option (wix.api.required) = "BulkBackOfficeIsPermittedRequest.subject";
        option (wix.api.required) = "BulkBackOfficeIsPermittedRequest.request";
    }

    rpc BulkSubjectIsPermitted(BulkSubjectBackOfficeIsPermittedRequest) returns (BulkSubjectIsPermittedResponse) {
//        option (google.api.http).post = "/v1/authorization/bo/bulk_subject_is_permitted";
        option (wix.api.permission) = {
            name: "USERS_AUTH.BO_IS_PERMITTED"
            type: MANUAL
        };
        option (wix.api.required) = "BulkSubjectBackOfficeIsPermittedRequest.subjects";
        option (wix.api.required) = "BulkSubjectBackOfficeIsPermittedRequest.request";
    }

    // This endpoint extracts a user and a resource (for example - a site) from a signed Wix app instance, and allows to ask if the user
    // is permitted to work on the resource.
    rpc IsPermittedByAppInstance (IsPermittedByAppInstanceRequest) returns (IsPermittedResponse) {
        option (wix.api.maturity) = ALPHA;
        option (wix.api.exposure) = PUBLIC;
        option (google.api.http).get = "/v1/authorization/bo/is_permitted_by_app_instance";
        option (wix.api.permission).name = "AUTHORIZATION.IS_PERMITTED_BY_APP_INSTANCE";
        option (wix.api.required) = "IsPermittedByAppInstanceRequest.permission";
        option (wix.api.required) = "IsPermittedByAppInstanceRequest.app_instance";
    }
}

message BackOfficeIsPermitted {
    // The subject to perform the isPermitted ofr
    com.wixpress.authorization.abac.management.Subject subject = 1;

    // The request of `isPermitted` the caller wants to perform
    IsPermittedRequest request = 2;
}

message BulkBackOfficeIsPermittedRequest {
    // The subject to check the permission for
    com.wixpress.authorization.abac.management.Subject subject = 1;

    // The bulk request of `isPermitted` to be performed
    BulkIsPermittedRequest request = 2;
}

message BulkSubjectBackOfficeIsPermittedRequest {
    // The subjects to check the permission for
    repeated com.wixpress.authorization.abac.management.Subject subjects = 1 [(.wix.api.maxSize) = 50];
    // The request of `isPermitted` the caller wants to perform
    IsPermittedRequest request = 2;
}

message IsPermittedByAppInstanceRequest {
    // The permission that will be checked.
    string permission = 1;
    // A signed token of an app instance generated by Wix, representing the user and the resource context.
    string app_instance = 2;
}
