syntax = "proto3";

package com.wixpress.authorization.abac.management.typed;

import "google/protobuf/wrappers.proto";
import "google/api/annotations.proto";
import "wix/api/validations.proto";
import "wix/api/annotations.proto";
import "com/wixpress/authorization/abac/management/Conditions.proto";
import "com/wixpress/authorization/abac/management/Policy.proto";
import "com/wixpress/authorization/abac/management/Subject.proto";
import "com/wixpress/authorization/abac/management/ManagementService.proto";
import "com/wixpress/authorization/abac/Context.proto";
import "wix/api/permissions.proto";
import "wix/api/entity.proto";
import "wix/common/bulk.proto";


service AccountPoliciesManagement {
    option (wix.api.service_entity).message = "com.wixpress.authorization.abac.management.typed.AccountPolicyAssignment";
    option (wix.api.service_exposure) = INTERNAL;

    rpc AssignPoliciesToTeamMember (AssignPoliciesToTeamMemberRequest) returns (AssignPoliciesToTeamMemberResponse) {
        option (wix.api.required) = "AssignPoliciesToTeamMemberRequest.user_id";
        option (wix.api.required) = "AssignPoliciesToTeamMemberRequest.team_account_id";
        option (google.api.http).post = "/v1/users/{user_id}/policies";
    }

    rpc ClearTeamMemberPolicies (ClearTeamMemberPoliciesRequest) returns (ClearTeamMemberPoliciesResponse) {
        option (wix.api.required) = "ClearTeamMemberPoliciesRequest.user_id";
        option (wix.api.required) = "ClearTeamMemberPoliciesRequest.team_account_id";
        option (google.api.http).delete = "/v1/users/{user_id}/policies";
    }

    rpc ReplaceAllTeamMemberPolicies (ReplaceAllTeamMemberPoliciesRequest) returns (ReplaceAllTeamMemberPoliciesResponse) {
        option (wix.api.required) = "ReplaceAllTeamMemberPoliciesRequest.user_id";
        option (wix.api.required) = "ReplaceAllTeamMemberPoliciesRequest.team_account_id";
        option (google.api.http).put = "/v1/users/{user_id}/policies";
    }

    // Replaces current policies assigned to a specific user with the given new policies.
    rpc ReplaceTeamMemberPolicies (ReplaceTeamMemberPoliciesRequest) returns (ReplaceTeamMemberPoliciesResponse) {
        option (wix.api.required) = "ReplaceTeamMemberPoliciesRequest.user_id";
        option (wix.api.required) = "ReplaceTeamMemberPoliciesRequest.team_account_id";
        option (wix.api.required) = "ReplaceTeamMemberPoliciesRequest.assignment_ids_to_replace";
        option (google.api.http).put = "/v1/users/{user_id}/replace/policies";
        option (wix.api.permission).name = "team.manage-team-member-roles";
    }

    rpc DeleteTeamMemberAssignments (DeleteTeamMemberAssignmentsRequest) returns (DeleteTeamMemberAssignmentsResponse) {
        option (wix.api.required) = "DeleteTeamMemberAssignmentsRequest.assignment_ids";
        option (google.api.http).delete = "/v1/users/assignments";
    }

    rpc CreatePolicy (CreatePolicyRequest) returns (CreatePolicyResponse) {
        option (wix.api.required) = "CreatePolicyRequest.policy";
        option (wix.api.required) = "CreatePolicyRequest.policy.name";
        option (google.api.http).post = "/v1/policies";
    }

    rpc UpdatePolicyAuthorizationData (UpdatePolicyAuthorizationDataRequest) returns (UpdatePolicyResponse) {
        option (wix.api.required) = "UpdatePolicyAuthorizationDataRequest.policy_id";
        option (google.api.http).put = "/v1/policies/{policy_id}/authorization-data";
    }

    rpc UpdatePolicyMetadata (UpdatePolicyMetadataRequest) returns (UpdatePolicyResponse) {
        option (wix.api.required) = "UpdatePolicyMetadataRequest.policy_id";
        option (google.api.http).patch = "/v1/policies/{policy_id}/metadata";
    }

    rpc DeletePolicy (DeletePolicyRequest) returns (DeletePolicyResponse) {
        option (wix.api.required) = "DeletePolicyRequest.policy_id";
        option (google.api.http).delete = "/v1/policies/{policy_id}";
    }

    // Override current policies assigned to a specific subject with the given new policies.
    rpc BulkOverrideSubjectPolicies (BulkOverrideSubjectPoliciesRequest) returns (BulkOverrideSubjectPoliciesResponse) {
        option (google.api.http).post = "/v1/bulk/subjects/policies/override";
    }
}

message AssignPoliciesToTeamMemberRequest {
    string user_id = 1;
    string team_account_id = 2;
    repeated AccountPolicyAssignment assignments = 3;
}

message AssignPoliciesToTeamMemberResponse {
    repeated AccountPolicyAssignment assignments = 1;
}

message ClearTeamMemberPoliciesRequest {
    string user_id = 1;
    string team_account_id = 2;
}

message ClearTeamMemberPoliciesResponse {
    int32 assignments_count = 1;
}

message ReplaceAllTeamMemberPoliciesRequest {
    string user_id = 1;
    string team_account_id = 2;
    repeated AccountPolicyAssignment new_assignments = 3;
}

message ReplaceAllTeamMemberPoliciesResponse {
    repeated AccountPolicyAssignment created_assignments = 1;
}

message ReplaceTeamMemberPoliciesRequest {
    // The user which will be assigned with the new policies and unassigned the specified old ones.
    string user_id = 1;
    // The ID of the account in which the user has a role in.
    string team_account_id = 2;
    // An array of assignments to be assigned for the user in the context of the account.
    repeated AccountPolicyAssignment new_assignments = 3;
    // An array of existing assignment IDs to be replaced as part of the operation.
    repeated string assignment_ids_to_replace = 4;
}

message ReplaceTeamMemberPoliciesResponse {
    // The new assignments created for the given user.
    repeated AccountPolicyAssignment created_assignments = 1;
}

message AccountPolicyAssignment {
    option (.wix.api.entity) = {
        fqdn: "wix.identity.authorization.v1.account_policy_assignment"
        segment: USERS
    };
    // The assignment ID created internally.
    string assignment_id = 1 [(wix.api.readOnly) = true];
    // The policy which holds scopes and actions.
    string policy_id = 2;
    // A custom condition on the resource attributes.
    PolicyCondition condition = 3;
    google.protobuf.StringValue site = 4[deprecated=true];
    // Optional: Restrict the assignment to a specific site context.
    // Adding such restriction means that the permissions that are included in the policy, will only be permitted for
    // this specific site context.
    Site site_restriction = 5 ;
}

message DeleteTeamMemberAssignmentsRequest {
    repeated string assignment_ids = 1;
}

message DeleteTeamMemberAssignmentsResponse {
    int32 assignments_count = 1;
}

message Site {
    // The meta site ID.
    string id = 1;
    // An optional specific resource within the site context (e.g. page).
    Resource resource = 2;
}

message SubjectAssignments {
    Subject subject = 1;
    repeated AccountPolicyAssignment assignments = 2;
}

message BulkOverrideSubjectPoliciesRequest {
    // List of subjects with assignments to override with
    repeated SubjectAssignments subject_assignments = 1 [(.wix.api.maxSize) = 100];
}

message BulkSubjectPoliciesResult {
    wix.common.ItemMetadata item_metadata = 1;
    // List of subjects with the updated assignments
    SubjectAssignments subject_assignments = 2;
}
message BulkOverrideSubjectPoliciesResponse {
    repeated BulkSubjectPoliciesResult results = 1;
    wix.common.BulkActionMetadata bulk_action_metadata = 2;
}

