syntax = "proto3";

package com.wixpress.authorization.abac.management;

import "wix/api/validations.proto";
import "google/protobuf/wrappers.proto";
import "com/wixpress/authorization/abac/management/Conditions.proto";
import "wix/api/entity.proto";

message Policy {
    option (.wix.api.entity) = {
        fqdn: "wix.identity.authorization.v1.policy"
        segment: USERS
    };
    google.protobuf.StringValue id = 1 [(wix.api.readOnly) = true];
    google.protobuf.StringValue name = 2 [(wix.api.maxLength) = 50];
    google.protobuf.StringValue description = 3 [(wix.api.maxLength) = 500];
    string status = 4 [(wix.api.readOnly) = true];
    PolicyType policy_type = 5;
    repeated PolicyStatement statements = 6;
}

message PolicyStatement {
    google.protobuf.StringValue id = 1 [(wix.api.readOnly) = true];
    repeated string permissions = 2;
    repeated string scopes = 3;
    Effect effect = 4;
    PolicyCondition condition = 5;
}

message PolicyOwner {
    PolicyOwnerType type = 1;
    string id = 2;
}

enum PolicyType {
    UNKNOWN_STATUS = 0;
    PREDEFINED = 1;
    CUSTOM = 2;
    INLINE_CUSTOM = 3;
}

enum Effect {
    UNKNOWN_EFFECT = 0;
    ALLOW = 1;
    DENY = 2;
}

enum PolicyOwnerType {
    UNKNOWN_TYPE = 0;
    WIX = 1;
    WIX_ACCOUNT = 2;
}
