// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.services.v1;

import "controller/api/resources/credentialstores/v1/credential_store.proto";
import "controller/custom_options/v1/options.proto";
import "google/api/annotations.proto";
import "google/protobuf/field_mask.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

option go_package = "github.com/hashicorp/boundary/internal/gen/controller/api/services;services";
option (custom_options.v1.domain) = "credential";

service CredentialStoreService {
  option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_tag) = {
    name: "Credential store service"
    description:
      "A credential store is a resource that can retrieve, store, and potentially generate "
      "credentials of differing types and differing access levels. "
      "The credential store service provides endpoints for managing credential stores in Boundary. "
    external_docs: {
      url: "https://developer.hashicorp.com/boundary/docs/concepts/domain-model/credential-stores";
      description: "Read about credential stores in the Boundary domain model";
    }
  };

  // GetCredentialStore returns a stored Credential Store if present.  The provided request
  // must include the Credential Store id. If missing, malformed or referencing a
  // non existing resource an error is returned.
  rpc GetCredentialStore(GetCredentialStoreRequest) returns (GetCredentialStoreResponse) {
    option (google.api.http) = {
      get: "/v1/credential-stores/{id}"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Gets a single Credential Store."};
  }

  // ListCredentialStores returns a list of stored Credential Stores which are in the
  // provided scope. The request must include the scope id and if missing,
  // malformed, or referencing a non existing scope, an error is returned.
  rpc ListCredentialStores(ListCredentialStoresRequest) returns (ListCredentialStoresResponse) {
    option (google.api.http) = {get: "/v1/credential-stores"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Lists all Credential Stores."};
  }

  // CreateCredentialStore creates and stores an Credential Store in boundary.  The
  // provided request must include the scope in which the Credential Store will be
  // created. If the scope id is missing, malformed or referencing a
  // non existing resource an error is returned.  If a name is provided that is
  // in use in another Credential Store in the same scope, an error is returned.
  rpc CreateCredentialStore(CreateCredentialStoreRequest) returns (CreateCredentialStoreResponse) {
    option (google.api.http) = {
      post: "/v1/credential-stores"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Creates a single Credential Store."};
  }

  // UpdateCredentialStore updates an existing Credential Store in boundary.  The provided
  // Credential Store must not have any read only fields set.  The update mask must be
  // included in the request and contain at least 1 mutable field.  To unset
  // a field's value, include the field in the update mask and don't set it
  // in the provided user. An error is returned if the Credential Store id is missing
  // or reference a non existing resource.  An error is also returned if the
  // request attempts to update the name to one that is already in use by
  // another Credential Store in the parent scope.
  rpc UpdateCredentialStore(UpdateCredentialStoreRequest) returns (UpdateCredentialStoreResponse) {
    option (google.api.http) = {
      patch: "/v1/credential-stores/{id}"
      body: "item"
      response_body: "item"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Updates a Credential Store."};
  }

  // DeleteCredentialStore removes a Credential Store from Boundary. If the Credential Store id
  // is malformed or not provided an error is returned.
  rpc DeleteCredentialStore(DeleteCredentialStoreRequest) returns (DeleteCredentialStoreResponse) {
    option (google.api.http) = {delete: "/v1/credential-stores/{id}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Deletes a CredentialStore"};
  }
}

message GetCredentialStoreRequest {
  string id = 1; // @gotags: `class:"public"`
}

message GetCredentialStoreResponse {
  resources.credentialstores.v1.CredentialStore item = 1;
}

message ListCredentialStoresRequest {
  string scope_id = 1 [json_name = "scope_id"]; // @gotags: `class:"public"`
  bool recursive = 20 [json_name = "recursive"]; // @gotags: `class:"public"`
  // You can specify that the filter should only return items that match.
  // Refer to [filter expressions](https://developer.hashicorp.com/boundary/docs/concepts/filtering) for more information.
  string filter = 30 [json_name = "filter"]; // @gotags: `class:"public"`
  // An opaque token that Boundary uses to continue an existing iteration or
  // request updated items. If you do not specify a token, pagination
  // starts from the beginning. To learn more about list pagination
  // in Boundary, refer to [list pagination](https://developer.hashicorp.com/boundary/docs/api-clients/api/pagination).
  string list_token = 40 [json_name = "list_token"]; // @gotags: `class:"public"`
  // The maximum size of a page in this iteration.
  // If you do not set a page size, Boundary uses the configured default page size.
  // If the page_size is greater than the default page size configured,
  // Boundary truncates the page size to this number.
  uint32 page_size = 50 [json_name = "page_size"]; // @gotags: `class:"public"`
}

message ListCredentialStoresResponse {
  // The items returned in this page.
  repeated resources.credentialstores.v1.CredentialStore items = 1;
  // The type of response, either "delta" or "complete".
  // Delta signifies that this is part of a paginated result
  // or an update to a previously completed pagination.
  // Complete signifies that it is the last page.
  string response_type = 2 [json_name = "response_type"]; // @gotags: `class:"public"`
  // An opaque token used to continue an existing pagination or
  // request updated items. Use this token in the next list request
  // to request the next page.
  string list_token = 3 [json_name = "list_token"]; // @gotags: `class:"public"`
  // The name of the field which the items are sorted by.
  string sort_by = 4 [json_name = "sort_by"]; // @gotags: `class:"public"`
  // The direction of the sort, either "asc" or "desc".
  string sort_dir = 5 [json_name = "sort_dir"]; // @gotags: `class:"public"`
  // A list of item IDs that have been removed since they were returned
  // as part of a pagination. They should be dropped from any client cache.
  // This may contain items that are not known to the cache, if they were
  // created and deleted between listings.
  repeated string removed_ids = 6 [json_name = "removed_ids"]; // @gotags: `class:"public"`
  // An estimate at the total items available. This may change during pagination.
  uint32 est_item_count = 7 [json_name = "est_item_count"]; // @gotags: `class:"public"`
}

message CreateCredentialStoreRequest {
  resources.credentialstores.v1.CredentialStore item = 1;
}

message CreateCredentialStoreResponse {
  string uri = 1; // @gotags: `class:"public"`
  resources.credentialstores.v1.CredentialStore item = 2;
}

message UpdateCredentialStoreRequest {
  string id = 1; // @gotags: `class:"public"`
  resources.credentialstores.v1.CredentialStore item = 2;
  google.protobuf.FieldMask update_mask = 3 [json_name = "update_mask"];
}

message UpdateCredentialStoreResponse {
  resources.credentialstores.v1.CredentialStore item = 1;
}

message DeleteCredentialStoreRequest {
  string id = 1; // @gotags: `class:"public"`
}

message DeleteCredentialStoreResponse {}
