// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

// Package store provides protobufs for storing types in the password package.
package controller.storage.auth.password.store.v1;

import "controller/storage/timestamp/v1/timestamp.proto";

option go_package = "github.com/hashicorp/boundary/internal/auth/password/store;store";

// Argon2Configuration is a configuration for using the argon2id key
// derivation function. It is owned by an AuthMethod.
//
// Iterations, Memory, and Threads are the cost parameters. The cost
// parameters should be increased as memory latency and CPU parallelism
// increases.
//
// For a detailed specification of Argon2 see:
// https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf
message Argon2Configuration {
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 1;

  // The create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // @inject_tag: `gorm:"not_null"`
  string password_method_id = 3;

  // Iterations is the time parameter in the Argon2 specification. It
  // specifies the number of passes over the memory. Must be > 0.
  // @inject_tag: `gorm:"default:null"`
  uint32 iterations = 4;

  // Memory is the memory parameter in the Argon2 specification. It
  // specifies the size of the memory in KiB. For example Memory=32*1024
  // sets the memory cost to ~32 MB. Must be > 0.
  // @inject_tag: `gorm:"default:null"`
  uint32 memory = 5;

  // Threads is the threads parameter in the Argon2 specification. It can
  // be adjusted to the number of available CPUs. Must be > 0.
  // @inject_tag: `gorm:"default:null"`
  uint32 threads = 6;

  // SaltLength is in bytes. Must be >= 16.
  // @inject_tag: `gorm:"default:null"`
  uint32 salt_length = 7;

  // KeyLength is in bytes. Must be >= 16.
  // @inject_tag: `gorm:"default:null"`
  uint32 key_length = 8;
}

message Argon2Credential {
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 1;

  // The create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 2;

  // The update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 3;

  // @inject_tag: `gorm:"not_null"`
  string password_account_id = 4;
  // @inject_tag: `gorm:"not_null"`
  string password_conf_id = 5;
  // @inject_tag: `gorm:"not_null"`
  string password_method_id = 6;

  // ct_salt is the encrypted salt which is stored in the database.
  // @inject_tag: `gorm:"column:salt;not_null" wrapping:"ct,entry_salt"`
  bytes ct_salt = 7;

  // salt is the unencrypted salt which is not stored in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,entry_salt"`
  bytes salt = 8;

  // derived_key is the derived key produced by the Argon2id key
  // derivation function.
  // @inject_tag: `gorm:"not_null"`
  bytes derived_key = 9;

  // key_id is the key ID that was used for the encryption operation. It can be
  // used to identify a specific version of the key needed to decrypt the value,
  // which is useful for caching purposes.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 10;
}
