syntax = "proto3";

import "google/protobuf/wrappers.proto";
import "com/wixpress/authorization/abac/common/Common.proto";
import "policy.proto";

package com.wixpress.roles.management.api;

message PredefinedRoles {
    repeated PredefinedRole roles = 1;
}

message PredefinedRole {
    string title_key = 1;
    repeated Role roles = 2;
    google.protobuf.StringValue title = 3;
    string area_id = 4;
}

message Role {
    string id = 1;
    string deprecated_key = 2;
    string title_key = 3[deprecated = true];
    string descriptionKey = 4 [deprecated = true];
    bool deprecated = 5;
    string restrict_from_level = 6;
    repeated string experiments = 7;
    repeated string app_def_ids = 8;
    google.protobuf.StringValue title = 9;
    google.protobuf.StringValue description = 10;
    bool isCustom = 11;
    repeated string scopes = 12;
    repeated com.wixpress.authorization.abac.common.ResourceType available_resource_types = 13;
    repeated com.wixpress.authorization.abac.common.ConditionAttributeType available_conditions = 14;
    repeated string limit_to_editor_types = 15;
}

message PredefinedRolesArea {
    // The id of the area (e.g "Blog")
    string area_id = 1;
    // The translated area title, according to the request locale, or the original title if translation failed
    string title = 2;
    // The predefined roles belonging to this area
    repeated PredefinedRoleV2 roles = 3;
}

message PredefinedRoleV2 {
    // The policy id of this role
    string id = 1;
    // The title of this role, translated according to the request locale, or the original title if translation failed
    string title = 2;
    // The description of this role, translated according to the request locale, or the original description if translation failed
    string description = 3;
    // The permission-scopes this role's policy contains
    repeated string scopes = 4;
    // Indicates if the role is deprecated (shouldn't be granted, and only exists for backward compatability)
    bool deprecated = 5;
    // Indicates if this role should be restricted from assignments of a specific resource type (if RoleLevelRestriction = None, there is no restriction)
    RoleLevelRestriction restrict_from_level = 6;
    // Experiments that should be open for this role to be visible
    repeated string experiments = 7;
    // Applications that should be installed for this role to be visible
    repeated string app_def_ids = 8;
    // Editor types this role should be limited to (if empty, available in all editors)
    repeated EditorType limit_to_editor_types = 9;
    // The visibility of the role
    RoleVisibility visibility = 10;
}

message CustomRole {
    // The policy this role grants
    Policy policy = 1;
    // The visibility of the role
    RoleVisibility visibility = 2;
    // Whether this role is assigned to a subject
    google.protobuf.BoolValue assigned = 3;
}

message RoleInfo {
    // Role ID.
    string id = 1;
    // Role title, translated according to the request locale. If translation fails, the original title is returned. 
    string title = 2;
    // Role description, translated according to the request locale. If translation fails, the original description is returned.
    string description = 3;
    // Whether this role is restricted from accessing a specific resource type. Default: `NoRestriction`.
    RoleLevelRestriction restrict_from_level = 4;
}

enum RoleVisibility {
    Visible = 0; // the role should be visible to the caller
    Disabled_Dependency = 1; // the role should be disabled for the caller, because it contains permissions the caller wasn't granted on the call context (site/account)
    Disabled_Capability = 2; // the role should be disabled for the caller, because the role's capability is disabled for the caller
}

enum EditorType {
    UNINITIALIZED = 0;
    EDITORX = 1;
    BLOCKS = 2;
    STUDIO = 3;
}

enum RoleLevelRestriction {
    NoRestriction = 0;
    Site = 1;
    Account = 2;
}
