// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.resources.storagebuckets.v1;

import "controller/api/resources/plugins/v1/plugin.proto";
import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
import "google/protobuf/struct.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/storagebuckets;storagebuckets";

// StorageBucket manages external object stores
message StorageBucket {
  // Output only. The ID of the storage bucket.
  string id = 10; // @gotags: `class:"public" eventstream:"observation"`

  // The ID of the Scope of which this storage bucket is a part.
  string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. Scope information for this resource.
  resources.scopes.v1.ScopeInfo scope = 30;

  // The ID of the plugin of which this storage bucket is created.
  string plugin_id = 34 [
    json_name = "plugin_id",
    (custom_options.v1.generate_sdk_option) = true
  ]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. Plugin information for this resource.
  resources.plugins.v1.PluginInfo plugin = 35;

  // Optional name for identification purposes.
  google.protobuf.StringValue name = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "name"
      that: "Name"
    }
  ]; // @gotags: `class:"public"`

  // Optional user-set description for identification purposes.
  google.protobuf.StringValue description = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "description"
      that: "Description"
    }
  ]; // @gotags: `class:"public"`

  // The name of the bucket within the external object store service.
  string bucket_name = 60 [
    json_name = "bucket_name",
    (custom_options.v1.generate_sdk_option) = true
  ]; // @gotags: `class:"public"`

  // The prefix used to organize the data held within the external object store.
  string bucket_prefix = 70 [
    json_name = "bucket_prefix",
    (custom_options.v1.generate_sdk_option) = true
  ]; // @gotags: `class:"public"`

  // Output only. The time this resource was created.
  google.protobuf.Timestamp created_time = 80 [json_name = "created_time"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The time this resource was last updated.
  google.protobuf.Timestamp updated_time = 90 [json_name = "updated_time"]; // @gotags: `class:"secret"`

  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 100; // @gotags: `class:"public"`

  // The type of Storage Bucket (currently only plugin).
  string type = 110; // @gotags: `class:"public" eventstream:"observation"`

  // Attributes specific to the catalog type.
  google.protobuf.Struct attributes = 120 [(custom_options.v1.generate_sdk_option) = true]; // @gotags: `class:"public"`

  // Secrets specific to the storage bucket type. These are never output.
  google.protobuf.Struct secrets = 130 [(custom_options.v1.generate_sdk_option) = true]; // @gotags: `class:"public"`

  // Output only. The HMAC of the last secrets supplied via the API, if any.
  string secrets_hmac = 140; // @gotags: `class:"public"`

  // Filters to the worker(s) that can handle requests for this storage bucket
  string worker_filter = 150 [
    json_name = "worker_filter",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "worker_filter"
      that: "WorkerFilter"
    }
  ]; // @gotags: `class:"public"`

  // Internal use only. The storage bucket credential id for this storage bucket.
  string storage_bucket_credential_id = 160; // @gotags: `class:"public"`

  // Output only. The available actions on this resource for this user.
  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
}

// StorageBucketPersisted is data that the plugin can read from and write
// to that will always be provided by the host.
message StorageBucketPersisted {
  // Data has no explicit structure other than valid json.
  // Data may contain sensitive information, such as
  // credentials, rotated secrets, or configuration data.
  // Data can be anything that may need to be provided to
  // a series of different method calls.
  // Data is encrypted at-rest by Boundary.
  // Data is never returned to the end user.
  google.protobuf.Struct data = 10;
}
