syntax = "proto3";

package com.wixpress.authorization.abac.query;

import "google/api/annotations.proto";
import "google/protobuf/wrappers.proto";
import "wix/common/paging.proto";
import "com/wixpress/authorization/abac/management/Subject.proto";
import "com/wixpress/authorization/abac/management/Conditions.proto";
import "com/wixpress/authorization/abac/AuthorizationService.proto";
import "com/wixpress/authorization/abac/Context.proto";
import "com/wixpress/authorization/abac/query/Query.proto";
import "wix/api/permissions.proto";
import "wix/api/validations.proto";
import "wix/api/annotations.proto";

// flynt-disable missing-service-entity
service UsersAuthorizationQueryService {
    option (wix.api.service_exposure) = INTERNAL;

    // An api to get subjects by action
    rpc GetPermittedSubjectsStatements (GetPermittedSubjectsStatementsRequest) returns (GetPermittedSubjectsStatementsResponse) {
        option (google.api.http).post = "/v1/assignments/users/query";
        option (wix.api.permission).name = "USERS_AUTH.READ";
        option (wix.api.required) = "GetPermittedSubjectsStatementsRequest.full_name_resource";
    }

    // An API to get the roles of subject on a specific resource
    rpc GetPermittedSubjectsRoles(GetPermittedSubjectsRolesRequest) returns (GetPermittedSubjectsRolesResponse) {
       option (google.api.http).get = "/v2/query/resourceAssignments";
       option (wix.api.permission).name = "USERS_AUTH.GET_PERMITTED_ROLES";
       option (wix.api.required) = "GetPermittedSubjectsRolesRequest.resource";
    }

    // An API that returns the number of subjects can perform a single action on a list of resources
    rpc BulkGetPermittedSubjectsCount(BulkGetPermittedSubjectsCountRequest) returns (BulkGetPermittedSubjectsCountResponse) {
        option (google.api.http).post = "/v2/query/permitted_subjects_count";
        option (wix.api.permission).name = "USERS_AUTH.GET_PERMITTED_COUNT";
        option (wix.api.required) = "BulkGetPermittedSubjectsCountRequest.action";
    }
}

message GetAssignedSubjectsRequest {
    // The action you want to query
    string action = 1;
    // The context you want make this query, possible values: site context, account context, organization context
    QueryContext context = 2;
    // Attributes that will try to meet the current existing conditions
    map<string, AttributeValue> resource_attributes = 4;
    // Paging the subjects to be retrieved
    wix.common.Paging paging = 5;
}

message GetAssignedSubjectsResponse {
    // A list of subjects that can perform the operation on the requested resource.
    repeated SubjectView subjects = 1;
}

message SubjectView {
    // A subject That is allowed to perform the action on the requested resource
    com.wixpress.authorization.abac.management.Subject subject = 1;
    // a list of additional info specific to the assignment of the subject on the requested resource
    repeated ResourceEntity resource_entities = 2;
}

message ResourceEntity {
    // Conditions that the assignment depend on, and we couldn't meet the request resource attributes
    repeated Condition resource_conditions = 1;
}

message Condition {
    // Subject's condition that was not evaluated
    com.wixpress.authorization.abac.management.PolicyCondition condition = 2;
}

message GetPermittedSubjectsRolesRequest {
    // The full name resource you want make this query on
    FullNameResource resource = 1;
    // If you want to get the permitted users that belong to a specific account, you can use this field with the desired account id.
    google.protobuf.StringValue in_specific_account = 2;
    // A map of attributes and their values. If the subject has an assignment with a condition, you can provide here attribute values that will be calculated against the condition.
    // For example, if you have an assignment with a condition where `A` = 3, when querying with `A`= 3 you will get the resource as one of the resources you are permitted to work on, but for `A` = "Banana" you won't get it.
    map<string, AttributeValue> resource_attributes = 3;
    // An optional filter of requested subject types, If you want to get only accounts, for example, you can use this filter and avoid getting any other subject type
    SubjectTypesFilter subject_types = 4;
    // A list of policy ids to filter out from the response
    repeated string except_policies = 5;

    wix.common.Paging paging = 30;
}

message GetPermittedSubjectsRolesResponse {
    // The assignments that the subjects have on the resource
    repeated SubjectAssignment subject_assignments = 1;
}

message GetPermittedSubjectsStatementsRequest {
    // The action you want to query
    string action = 1;
    // The full name resource you want make this query on
    FullNameResource full_name_resource = 2;
    // A map of attributes and their values. If the subject has an assignment with a condition, you can provide here attribute values that will be calculated against the condition.
    // For example, if you have an assignment with a condition where `A` = 3, when querying with `A`= 3 you will get the resource as one of the resources you are permitted to work on, but for `A` = "Banana" you won't get it.
    map<string, AttributeValue> resource_attributes = 3;
    // If you want to get the permitted users that belong to a specific account, you can use this field with the desired account id.
    google.protobuf.StringValue in_specific_account = 4;
    // Paging the subjects to be retrieved
    wix.common.Paging paging = 5;
}

message GetPermittedSubjectsStatementsResponse {
    // Subject representation
    repeated SubjectView subjects = 1;
}

// No paging, we'll limit to max number of resources in request
message BulkGetPermittedSubjectsCountRequest {
    // The action you want to query
    string action = 1;
    // A list of resources you want to query on
    repeated FullNameResource full_name_resources = 2;
}

message BulkGetPermittedSubjectsCountResponse {
    // A map between a resource and the number of subjects that can perform the operation on it
    repeated ResourceContributorCount permitted_subjects_count = 1;
}

message ResourceContributorCount {
    // The specific resource
    FullNameResource resource = 1;
    // The number of subjects that can perform the operation on it
    int32 subjects = 2;
}

message SubjectTypesFilter {
    repeated com.wixpress.authorization.abac.management.SubjectType subject_types = 1;
}
