// Copyright © 2019 The Things Network Foundation, The Things Industries B.V.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

import "github.com/gogo/protobuf/gogoproto/gogo.proto";
import "google/api/annotations.proto";
import "google/protobuf/empty.proto";
import "lorawan-stack/api/oauth.proto";

package ttn.lorawan.v3;

option go_package = "go.thethings.network/lorawan-stack/v3/pkg/ttnpb";

// TODO: Migrate away from GoGo Protobuf (https://github.com/TheThingsNetwork/lorawan-stack/issues/2798).
option (gogoproto.goproto_registration) = true;

// The OAuthAuthorizationRegistry service, exposed by the Identity Server,
// is used to manage OAuth client authorizations for users.
service OAuthAuthorizationRegistry {
  // List OAuth clients that are authorized by the user.
  rpc List(ListOAuthClientAuthorizationsRequest) returns (OAuthClientAuthorizations) {
    option (google.api.http) = {
      get: "/users/{user_ids.user_id}/authorizations"
    };
  }
  // List OAuth access tokens issued to the OAuth client on behalf of the user.
  rpc ListTokens(ListOAuthAccessTokensRequest) returns (OAuthAccessTokens) {
    option (google.api.http) = {
      get: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}/tokens"
    };
  }
  // Delete (de-authorize) an OAuth client for the user.
  rpc Delete(OAuthClientAuthorizationIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}"
    };
  }
  // Delete (invalidate) an OAuth access token.
  rpc DeleteToken(OAuthAccessTokenIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}/tokens/{id}"
    };
  }
}
