// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

package controller.storage.kms.store.v1;

import "controller/storage/timestamp/v1/timestamp.proto";

option go_package = "github.com/hashicorp/boundary/internal/kms/store;store";

message RootKey {
  // private_id is used to access the root key via an API
  // @inject_tag: gorm:"primary_key"
  string private_id = 1;

  // scope id for the root key
  // @inject_tag: `gorm:"default:null"`
  string scope_id = 2;

  // create_time from the RDBMS
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 3;
}

message RootKeyVersion {
  // private_id is used to access the root key version via an API
  // @inject_tag: gorm:"primary_key"
  string private_id = 1;

  // scope id for the root key version
  // @inject_tag: `gorm:"default:null"`
  string root_key_id = 2;

  // plain-text of the key data.  we are NOT storing this plain-text key
  // in the db.
  // @inject_tag: `gorm:"-" wrapping:"pt,key_data"`
  bytes key = 3;

  // ciphertext key data stored in the database
  // @inject_tag: `gorm:"column:key;not_null" wrapping:"ct,key_data"`
  bytes ct_key = 4;

  // version of the key data.  This is not used for optimistic locking, since
  // key versions are immutable.  It's just the version of the key.
  // @inject_tag: `gorm:"default:null"`
  uint32 version = 5;

  // create_time from the RDBMS
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 7;
}
