syntax = "proto3";

package com.wixpress.authorization.abac;

import "wix/api/validations.proto";
import "wix/api/entity.proto";
import "wix/api/annotations.proto";
import "google/protobuf/wrappers.proto";

// The Context of the resource.
message ResourceContext {
    oneof Context {
        SiteResourceContext site_context = 1;
        AccountResourceContext account_context = 2 [deprecated = true];
        OrganizationResourceContext organization_context = 3;
        AccountResourceContextV2 account_context_v2 = 4;
    }
}

message QueryContext {
    oneof Context {
        SiteContext site_context = 1;
        AccountContext account_context = 2;
        OrganizationContext organization_context = 3;
    }
}

message SiteContext {
    string metasite_id = 1;
}

message AccountContext {
    string account_id = 1;
}

message OrganizationContext {
}

message FullNameResource {
    oneof ResourceContext {
        // Specific site details.
        SiteResourceContext site_context = 2;
        // Specific account details.
        AccountResourceContext account_context = 3;
        // Specific organization.
        OrganizationResourceContext organization_context = 4 [(wix.api.field_exposure) = INTERNAL];
    }

    // A specific resource. We will determine the resource type based on the action.
    Resource resource = 20 [(wix.api.field_exposure) = INTERNAL];
}

// A custom resource. Is used to represent some asset that is not a direct resource context (site or account), but something custom.
// For example: payment method, blog post, domain, logo.
message Resource {
    // The resource id.
    google.protobuf.StringValue id = 1;
    // The resource type
    google.protobuf.StringValue type = 2;
}

// Site resource context. It indicates that the resource is under a site (can be the site itself or some asset of a site, like a blog post)
message SiteResourceContext {
    // Site ID.
    string metasite_id = 1;
}
// Account resource contexts. It indicates that the resource is under the account (can be the account itself or some asset of an account, like a logo or a domain)
message AccountResourceContext {
    // Account ID.
    string account_id = 1;
}

// Account resource context. It indicates that the resource is under the account (can be the account itself or some asset of an account, like a logo or a domain),
// Or applies for any account
message AccountResourceContextV2 {
    oneof Context {
        // specific account
        string account_id = 1;
        // all accounts
        bool all = 2;
        // Allow all sites for a specific account
        AllSitesForAccount all_sites_for_account = 3;
    }
}

//This option will allow all sites(wildcard) for the specific account id
message AllSitesForAccount {
    string account_id = 1;
}

message OrganizationResourceContext {
}
