// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.resources.credentialstores.v1;

import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
import "google/api/visibility.proto";
import "google/protobuf/struct.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/credentialstores;credentialstores";

// CredentialStore contains all fields related to an Credential Store resource
message CredentialStore {
  // Output only. The ID of the Credential Store.
  string id = 10; // @gotags: `class:"public"`

  // The ID of the Scope of which this Credential Store is a part.
  string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"`

  // Output only. Scope information for this Credential Store.
  resources.scopes.v1.ScopeInfo scope = 30;

  // Optional name for identification purposes.
  google.protobuf.StringValue name = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "name"
      that: "Name"
    }
  ]; // @gotags: `class:"public"`

  // Optional user-set description for identification purposes.
  google.protobuf.StringValue description = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "description"
      that: "Description"
    }
  ]; // @gotags: `class:"public"`

  // Output only. The time this resource was created.
  google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`

  // Output only. The time this resource was last updated.
  google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`

  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 80; // @gotags: `class:"public"`

  // The Credential Store type.
  string type = 90; // @gotags: `class:"public"`

  oneof attrs {
    // The attributes that are applicable for the specific Credential Store type.
    google.protobuf.Struct attributes = 100 [
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "default"
    ];
    VaultCredentialStoreAttributes vault_credential_store_attributes = 101 [
      (google.api.field_visibility).restriction = "INTERNAL",
      (custom_options.v1.generate_sdk_option) = true,
      (custom_options.v1.subtype) = "vault"
    ];
  }

  // Output only. The available actions on this resource for this user.
  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`

  // Output only. The authorized actions for the scope's collections.
  map<string, google.protobuf.ListValue> authorized_collection_actions = 310 [json_name = "authorized_collection_actions"]; // classified as public via taggable implementation
}

// The attributes of a vault typed Credential Store.
message VaultCredentialStoreAttributes {
  // The complete url address of vault.
  google.protobuf.StringValue address = 10 [
    json_name = "address",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.address"
      that: "VaultAddress"
    }
  ]; // @gotags: `class:"public"`

  // The namespace of vault used by this store
  google.protobuf.StringValue namespace = 20 [
    json_name = "namespace",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.namespace"
      that: "Namespace"
    }
  ]; // @gotags: `class:"public"`

  // The PEM encoded CA cert to verify the vault server's ssl certificate
  google.protobuf.StringValue ca_cert = 30 [
    json_name = "ca_cert",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.ca_cert"
      that: "CaCert"
    }
  ]; // @gotags: `class:"public"`

  // The value to use as the SNI host when connecting to vault via TLS.
  google.protobuf.StringValue tls_server_name = 40 [
    json_name = "tls_server_name",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.tls_server_name"
      that: "TlsServerName"
    }
  ]; // @gotags: `class:"public"`

  // When set to true verification of the TLS certificate is disabled.
  google.protobuf.BoolValue tls_skip_verify = 50 [
    json_name = "tls_skip_verify",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.tls_skip_verify"
      that: "TlsSkipVerify"
    }
  ]; // @gotags: `class:"public"`

  // Input only. The current vault token used by this credential store for creating new credentials.
  google.protobuf.StringValue token = 60 [
    json_name = "token",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.token"
      that: "Token"
    }
  ]; // @gotags: `class:"secret"`

  // Output only. The hmac value of the vault token used by this credential store.
  string token_hmac = 70 [json_name = "token_hmac"]; // @gotags: `class:"public"`

  // Input only. A PEM encoded client certificate for vault with an
  // optional private key included in the bundle.  It is an error to include
  // the private key in this bundle as well as setting the certificate_key
  // field.
  google.protobuf.StringValue client_certificate = 80 [
    json_name = "client_certificate",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.client_certificate"
      that: "Certificate"
    }
  ]; // @gotags: `class:"secret"`

  // Input only. A client certificate private key.
  google.protobuf.StringValue client_certificate_key = 90 [
    json_name = "client_certificate_key",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.client_certificate_key"
      that: "CertificateKey"
    }
  ]; // @gotags: `class:"secret"`

  // Output only. The hmac value of the private key used by the credential store.
  string client_certificate_key_hmac = 100 [json_name = "client_certificate_key_hmac"]; // @gotags: `class:"public"`

  // worker_filter is optional. Filters to the worker(s) who can handle Vault requests for this cred store
  google.protobuf.StringValue worker_filter = 110 [
    json_name = "worker_filter",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "attributes.worker_filter"
      that: "WorkerFilter"
    }
  ]; // @gotags: `class:"public"`

  // Output only. The status of the vault token used by this credential store (current or expired).
  string token_status = 120 [json_name = "token_status"]; // @gotags: `class:"public"`
}
