// Copyright IBM Corp. 2020, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

// Package store provides protobufs for storing types in the storage plugin
// package.
package controller.storage.storage.plugin.store.v1;

import "controller/custom_options/v1/options.proto";
import "controller/storage/timestamp/v1/timestamp.proto";

option go_package = "github.com/hashicorp/boundary/internal/storage/plugin/store;store";

message StorageBucket {
  // public_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string public_id = 1;

  // The scope_id of the owning scope and must be set.
  // @inject_tag: `gorm:"not_null"`
  string scope_id = 2;

  // name is optional. If set, it must be globally unique.
  // @inject_tag: `gorm:"default:null"`
  string name = 3 [(custom_options.v1.mask_mapping) = {
    this: "Name"
    that: "name"
  }];

  // description is optional.
  // @inject_tag: `gorm:"default:null"`
  string description = 4 [(custom_options.v1.mask_mapping) = {
    this: "Description"
    that: "description"
  }];

  // The create_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp create_time = 5;

  // The update_time is set by the database.
  // @inject_tag: `gorm:"default:current_timestamp"`
  timestamp.v1.Timestamp update_time = 6;

  // @inject_tag: `gorm:"default:null"`
  uint32 version = 7;

  // The plugin_id is the public id of the plugin managing this storage bucket.
  // @inject_tag: `gorm:"not_null"`
  string plugin_id = 8;

  // The name of the external storage bucket (as opposed to the name within boundary)
  // @inject_tag: `gorm:"not_null"`
  string bucket_name = 9;

  // @inject_tag: `gorm:"default:null"`
  string bucket_prefix = 10;

  // A boolean expression that allows filtering the workers that can handle a storage buckets
  // @inject_tag: `gorm:"not_null"`
  string worker_filter = 11 [(custom_options.v1.mask_mapping) = {
    this: "WorkerFilter"
    that: "worker_filter"
  }];

  // attributes is a json formatted field.
  // @inject_tag: `gorm:"not_null"`
  bytes attributes = 12;

  // secrets_hmac is a sha256-hmac of the unencrypted secrets stored in the db.
  // @inject_tag: `gorm:"default:null"`
  bytes secrets_hmac = 13;

  // storage_bucket_credential_id is the private key of the storage bucket credential.
  // @inject_tag: `gorm:"default:null"`
  string storage_bucket_credential_id = 14;
}

message StorageBucketCredential {
  // private_id is a surrogate key suitable for use via API.
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 1;

  // storage_bucket_id is the public id of the storage bucket.
  // @inject_tag: `gorm:"not_null"`
  string storage_bucket_id = 2;
}

message StorageBucketCredentialEnvironmental {
  // private_id is a surrogate key suitable for use in a public API.
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 1;

  // storage_bucket_id is the public id of the storage bucket.
  // @inject_tag: `gorm:"not_null"`
  string storage_bucket_id = 2;
}

message StorageBucketCredentialManagedSecret {
  // private_id is a surrogate key suitable for use via API.
  // @inject_tag: `gorm:"primary_key"`
  string private_id = 1;

  // storage_bucket_id is the public id of the storage bucket.
  // @inject_tag: `gorm:"not_null"`
  string storage_bucket_id = 2;

  // secrets is the plain-text of the secret data. We are not storing this plain-text
  // value in the database.
  // @inject_tag: `gorm:"-" wrapping:"pt,secrets_data"`
  bytes secrets = 3;

  // ct_secrets is the ciphertext of the secret data stored in the db.
  // @inject_tag: `gorm:"column:secrets_encrypted;not_null" wrapping:"ct,secrets_data"`
  bytes ct_secrets = 4;

  // The key_id of the kms database key used for encrypting this entry.
  // It must be set.
  // @inject_tag: `gorm:"not_null"`
  string key_id = 5;
}
