// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

// Package store provides protobufs for storing types in the static
// credential package.
package controller.storage.credential.static.store.v1;

import "controller/custom_options/v1/options.proto";
import "controller/storage/timestamp/v1/timestamp.proto";

option go_package = "github.com/hashicorp/boundary/internal/credential/static/store;store";

message CredentialStore {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // The create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // The update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within project_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // The project_id of the owning scope.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string project_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;
}

message PasswordCredential {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within project_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // store_id of the owning static credential store.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string store_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // password is the plain-text of the password associated with the credential. We are
  // not storing this plain-text password in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,password_data"`
  bytes password = 8 [(custom_options.v1.mask_mapping) = {
    this: "Password"
    that: "attributes.password"
  }];

  // ct_password is the ciphertext of the password. It
  // is stored in the database.
  // @inject_tag: `gorm:"column:password_encrypted;not_null" wrapping:"ct,password_data"`
  bytes ct_password = 9;

  // password_hmac is a sha256-hmac of the unencrypted password.  It is recalculated
  // everytime the password is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes password_hmac = 10 [(custom_options.v1.mask_mapping) = {
    this: "PasswordHmac"
    that: "attributes.password_hmac"
  }];

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 11;
}

message UsernamePasswordCredential {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within project_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // store_id of the owning static credential store.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string store_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // username is the username associated with the credential.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string username = 8 [(custom_options.v1.mask_mapping) = {
    this: "Username"
    that: "attributes.username"
  }];

  // password is the plain-text of the password associated with the credential. We are
  // not storing this plain-text password in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,password_data"`
  bytes password = 9 [(custom_options.v1.mask_mapping) = {
    this: "Password"
    that: "attributes.password"
  }];

  // ct_password is the ciphertext of the password. It
  // is stored in the database.
  // @inject_tag: `gorm:"column:password_encrypted;not_null" wrapping:"ct,password_data"`
  bytes ct_password = 10;

  // password_hmac is a sha256-hmac of the unencrypted password.  It is recalculated
  // everytime the password is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes password_hmac = 11 [(custom_options.v1.mask_mapping) = {
    this: "PasswordHmac"
    that: "attributes.password_hmac"
  }];

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 12;
}

message UsernamePasswordDomainCredential {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within project_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // store_id of the owning static credential store.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string store_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // username is the username associated with the credential.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string username = 8 [(custom_options.v1.mask_mapping) = {
    this: "Username"
    that: "attributes.username"
  }];

  // password is the plain-text of the password associated with the credential. We are
  // not storing this plain-text password in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,password_data"`
  bytes password = 9 [(custom_options.v1.mask_mapping) = {
    this: "Password"
    that: "attributes.password"
  }];

  // ct_password is the ciphertext of the password. It
  // is stored in the database.
  // @inject_tag: `gorm:"column:password_encrypted;not_null" wrapping:"ct,password_data"`
  bytes ct_password = 10;

  // password_hmac is a sha256-hmac of the unencrypted password.  It is recalculated
  // everytime the password is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes password_hmac = 11 [(custom_options.v1.mask_mapping) = {
    this: "PasswordHmac"
    that: "attributes.password_hmac"
  }];

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 12;

  // Domain is the domain associated with the credential..
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string domain = 13 [(custom_options.v1.mask_mapping) = {
    this: "Domain"
    that: "attributes.domain"
  }];
}

message SshPrivateKeyCredential {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within project_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // store_id of the owning static credential store.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string store_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // username is the username associated with the credential.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string username = 8 [(custom_options.v1.mask_mapping) = {
    this: "Username"
    that: "attributes.username"
  }];

  // private_key is the plain-text of the private key associated with the
  // credential. We are not storing this plain-text private key in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,private_key"`
  bytes private_key = 9 [(custom_options.v1.mask_mapping) = {
    this: "PrivateKey"
    that: "attributes.private_key"
  }];

  // private_key_encrypted is the ciphertext of the private key. It is stored in
  // the database.
  // @inject_tag: `gorm:"column:private_key_encrypted;not_null" wrapping:"ct,private_key"`
  bytes private_key_encrypted = 10;

  // private_key_hmac is a sha256-hmac of the unencrypted private key.  It is recalculated
  // everytime the private key is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes private_key_hmac = 11 [(custom_options.v1.mask_mapping) = {
    this: "PrivateKeyHmac"
    that: "attributes.private_key_hmac"
  }];

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 12;

  // private_key_passphrase is the plain-text of the passphrase of the SSH private
  // key associated with the credential. We are not storing this plain-text
  // private key passphrase in the database.
  // @inject_tag: `gorm:"-"`
  bytes private_key_passphrase = 13 [(custom_options.v1.mask_mapping) = {
    this: "PrivateKeyPassphrase"
    that: "attributes.private_key_passphrase"
  }];

  // private_key_passphrase_encrypted is the ciphertext of the private key passphrase. It is stored in
  // the database.
  // @inject_tag: `gorm:"column:private_key_passphrase_encrypted;not_null"`
  bytes private_key_passphrase_encrypted = 14;

  // private_key_passphrase_hmac is a sha256-hmac of the unencrypted private key passphrase.  It is recalculated
  // everytime the private key passphrase is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes private_key_passphrase_hmac = 15 [(custom_options.v1.mask_mapping) = {
    this: "PrivateKeyPassphraseHmac"
    that: "attributes.private_key_passphrase_hmac"
  }];
}

message JsonCredential {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // name is optional. If set, it must be unique within scope_id.
  // @inject_tag: `gorm:"default:null"`
  string name = 4 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 5 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // store_id of the owning static credential store.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string store_id = 6;

  // version allows optimistic locking of the resource.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // object is the plain-text of the json associated with the
  // credential. We are not storing this plain-text object in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,object"`
  bytes object = 8 [(custom_options.v1.mask_mapping) = {
    this: "Object"
    that: "attributes.object"
  }];

  // object_encrypted is the ciphertext of the object. It is stored in
  // the database.
  // @inject_tag: `gorm:"column:object_encrypted;not_null" wrapping:"ct,object"`
  bytes object_encrypted = 9;

  // object_hmac is a sha256-hmac of the unencrypted object. It is recalculated
  // everytime the object is updated.
  // @inject_tag: `gorm:"not_null"`
  bytes object_hmac = 10 [(custom_options.v1.mask_mapping) = {
    this: "ObjectHmac"
    that: "attributes.object_hmac"
  }];

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 11;
}
