syntax = "proto3";

package com.wixpress.authorization.abac.query;

import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "wix/api/validations.proto";
import "wix/api/annotations.proto";
import "com/wixpress/authorization/abac/management/Subject.proto";
import "com/wixpress/authorization/abac/Context.proto";
import "com/wixpress/authorization/abac/management/Policy.proto";
import "com/wixpress/authorization/abac/query/Query.proto";
import "com/wixpress/authorization/abac/common/Common.proto";
import "com/wixpress/authorization/abac/management/Conditions.proto";


// flynt-disable missing-service-entity
service AbacQueryService {
    // This service is designed to return the permissions and policies assigned to subjects in the ABAC Authorization system
    // Do not use it to make decisions in terms of whether someone is permitted to do something, just to decide on display stuff.
    // In order to authorize actions, please use AbacAuthorizationService.IsPermitted
    option (wix.api.service_exposure) = INTERNAL;

    rpc GetCurrentSubjectPermissionsOnResource (GetCurrentSubjectPermissionsOnResourceRequest) returns (GetCurrentSubjectPermissionsOnResourceResponse) {
        option (google.api.http).get = "/v1/contextAssignments";
    }

    rpc GetCurrentSubjectPermissionsOnResources (GetCurrentSubjectPermissionsOnResourcesRequest) returns (GetCurrentSubjectPermissionsOnResourcesResponse) {
        option (google.api.http).get = "/v1/contextsAssignments";
    }

    rpc GetSubjectPoliciesOnCurrentAccount (GetSubjectPoliciesOnCurrentAccountRequest) returns (GetSubjectPoliciesOnCurrentAccountResponse) {
        option (google.api.http).get = "/v1/subjectAssignments";
    }

    rpc GetPoliciesAssignedOnResource(GetPoliciesAssignedOnResourceRequest) returns (GetPoliciesAssignedOnResourceResponse) {
        option (google.api.http).get = "/v1/resourceAssignments";
    }

    rpc GetSubjectPoliciesBySubjectContext (GetSubjectPoliciesBySubjectContextRequest) returns (GetSubjectPoliciesBySubjectContextResponse);

    rpc GetBulkSubjectPoliciesBySubjectContext (GetBulkSubjectPoliciesBySubjectContextRequest) returns (GetBulkSubjectPoliciesBySubjectContextResponse);

    rpc GetSubjectPermissionsOnResource (GetSubjectPermissionsOnResourceRequest) returns (GetSubjectPermissionsOnResourceResponse);

    rpc GetPolicies (GetPoliciesRequest) returns (GetPoliciesResponse) {
        option (google.api.http).get = "/v1/policies";
    }

    rpc GetPolicy (GetPolicyRequest) returns (GetPolicyResponse) {
        option (wix.api.required) = "GetPolicyRequest.policy_id";
        option (google.api.http).get = "/query/v1/policy/{policy_id}";
    }

    rpc GetPoliciesPermissions (GetPoliciesPermissionsRequest) returns (GetPoliciesPermissionsResponse) {
        option (wix.api.required) = "GetPoliciesPermissionsRequest.policy_ids";
        option (google.api.http).get = "/query/v1/policies/permissions";
    }

    rpc GetPoliciesApplicableRestrictions(GetPoliciesApplicableRestrictionsRequest) returns (GetPoliciesApplicableRestrictionsResponse) {
        option (google.api.http).get = "/query/v1/policies/restrictions";
    }

    rpc GetContainedPolicies (GetContainedPoliciesRequest) returns (GetContainedPoliciesResponse) {
        option (google.api.http).get = "/query/v1/policies/contained";
    }

    rpc GetAssignments (GetAssignmentsRequest) returns (GetAssignmentsResponse) {
        option (google.api.http).get = "/v1/assignments/{assignment_ids}";
    }

    rpc FilterPolicies(FilterPoliciesRequest) returns (FilterPoliciesResponse) {
        option (google.api.http).get = "/query/v1/policies/filter";
    }
    // flynt-disable missing-permission
    rpc BulkIsPolicyAssigned(BulkIsPolicyAssignedRequest) returns (BulkIsPolicyAssignedResponse) {
        option (google.api.http).get = "/query/v1/policies/assigned";
    }
}

message GetPoliciesRequest {
    com.wixpress.authorization.abac.management.PolicyType type = 1;

    PermissionsFilter actions_filter = 2;

    google.protobuf.FieldMask mask = 3;
}

message GetPoliciesResponse {
    repeated com.wixpress.authorization.abac.management.Policy policies = 1;
}

message GetPolicyRequest {
    string policy_id = 1;
}

message GetPolicyResponse {
    com.wixpress.authorization.abac.management.Policy policy = 1;
}

message GetCurrentSubjectPermissionsOnResourceRequest {
    ResourceContext context = 1;
    //Optional: filter by Resource (id + type)
    Resource resource = 2;
}

message GetCurrentSubjectPermissionsOnResourceResponse {
    repeated string permissions = 1;
}

message GetSubjectPoliciesOnCurrentAccountRequest {
}

message GetSubjectPoliciesOnCurrentAccountResponse {
    repeated PolicyData policies = 1;
}

message GetCurrentSubjectPermissionsOnResourcesRequest {
    repeated ResourceWithOwner resource_with_owner = 1;

    ConsistencyLevel consistency_level = 2;
    PermissionsFilter filter = 3;
}

message PermissionsFilter {
    ByPermissions by_permissions = 1;
}

message GetCurrentSubjectPermissionsOnResourcesResponse {
    repeated ResourcePermissions resource_permissions = 1;
}

message GetSubjectPoliciesBySubjectContextRequest {
    com.wixpress.authorization.abac.management.Subject subject = 1;
}

message GetSubjectPoliciesBySubjectContextResponse {
    repeated PolicyData policies = 1;
}

message GetSubjectPermissionsOnResourceRequest {
    com.wixpress.authorization.abac.management.Subject subject = 1;
    ResourceContext context = 2;
    //Optional: filter by Resource (id + type)
    Resource resource = 3;
}

message GetSubjectPermissionsOnResourceResponse {
    repeated string permissions = 1;
}

message GetBulkSubjectPoliciesBySubjectContextRequest {
    repeated com.wixpress.authorization.abac.management.Subject subjects = 1;
}

message GetBulkSubjectPoliciesBySubjectContextResponse {
    repeated SubjectPolicies subjectPolicies = 1;
}

message GetPoliciesAssignedOnResourceRequest {
    ResourceContext resource = 1;
    GetPoliciesAssignedOnResourceFilter filter = 2;
}

message GetPoliciesAssignedOnResourceResponse {
    repeated SubjectAssignment subject_assignments = 1;
}

message GetPoliciesAssignedOnResourceFilter {
    repeated string policy_ids = 1;
}

message PolicyData {
    string policy_id = 1;
    string policy_name = 2;
    repeated string permissions = 3;
}

message ResourceWithOwner {
    string owner_id = 1;
    ResourceContext context = 2;
}

message ResourcePermissions {
    ResourceContext context = 1;
    repeated string permissions = 3;
}

message SubjectPolicies {
    com.wixpress.authorization.abac.management.Subject subject = 1;
    repeated PolicyData policies = 2;
}

message PolicyPermissions {
    string policy_id = 1;
    repeated string permissions = 2;
}

message GetPoliciesPermissionsRequest {
    repeated string policy_ids = 1;
}

message GetPoliciesPermissionsResponse {
    repeated PolicyPermissions policies_permissions = 1;
}

message GetPoliciesApplicableRestrictionsRequest {
    // The ids of the policies to find and fold the experiment on
    repeated string policy_ids = 1;
}

message GetPoliciesApplicableRestrictionsResponse {
    repeated PolicyRestrictions policy_restrictions = 1;
}

message PolicyRestrictions {
    string policy_id = 1;
    repeated com.wixpress.authorization.abac.common.ResourceType resource_types = 2;
    repeated com.wixpress.authorization.abac.common.ConditionAttributeType conditions = 3;
}

message GetContainedPoliciesRequest {
    repeated string in_policy_ids = 1;
    repeated string from_policy_ids = 2;
}

message GetContainedPoliciesResponse {
    repeated string policy_ids = 1;
}

message GetAssignmentsRequest {
    repeated string assignment_ids = 1;
}

message AssignmentData {
    com.wixpress.authorization.abac.management.Subject subject = 1;

    FullNameResource resource = 2;

    string policy_id = 3;

    com.wixpress.authorization.abac.management.PolicyCondition resource_conditions = 4;

    string assignment_id = 6;
}

message GetAssignmentsResponse {
    repeated AssignmentData assignments = 1;
}

message FilterPoliciesRequest {
    repeated string from_policy_ids = 1;

    oneof filters {
        ByPermissions by_permissions = 2;
    }
}

message FilterPoliciesResponse {
    oneof filter_result {
        PermissionsFilteredPolicies permission_filtered_policies = 1;
    }
}

message BulkIsPolicyAssignedRequest {
    // flynt-disable missing-string-validations
    repeated string policy_ids = 1 [(wix.api.minSize) = 1, (wix.api.maxSize) = 30];
}

message BulkIsPolicyAssignedResponse {
    repeated IsPolicyAssigned policies_assigned = 1;
}

message IsPolicyAssigned {
    // flynt-disable missing-string-validations
    string policy_id = 1;
    bool assigned = 2;
}

message ByPermissions {
    repeated string permission = 1;
}

message PermissionsFilteredPolicies {
    repeated PermissionPolicies permission_policies = 1;
}

message PermissionPolicies {
    string permission = 1;

    repeated string policy_ids = 2;
}
