// Copyright © 2019 The Things Network Foundation, The Things Industries B.V.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

import "github.com/gogo/protobuf/gogoproto/gogo.proto";
import "google/api/annotations.proto";
import "google/protobuf/empty.proto";
import "lorawan-stack/api/client.proto";
import "lorawan-stack/api/identifiers.proto";
import "lorawan-stack/api/rights.proto";

package ttn.lorawan.v3;

option go_package = "go.thethings.network/lorawan-stack/v3/pkg/ttnpb";

// TODO: Migrate away from GoGo Protobuf (https://github.com/TheThingsNetwork/lorawan-stack/issues/2798).
option (gogoproto.goproto_registration) = true;

// The ClientRegistry service, exposed by the Identity Server, is used to manage
// OAuth client registrations.
service ClientRegistry {
  // Create a new OAuth client. This also sets the given organization or user as
  // first collaborator with all possible rights.
  rpc Create(CreateClientRequest) returns (Client) {
    option (google.api.http) = {
      post: "/users/{collaborator.user_ids.user_id}/clients"
      body: "*"
      additional_bindings {
        post: "/organizations/{collaborator.organization_ids.organization_id}/clients"
        body: "*"
      }
    };
  };

  // Get the OAuth client with the given identifiers, selecting the fields specified
  // in the field mask.
  // More or less fields may be returned, depending on the rights of the caller.
  rpc Get(GetClientRequest) returns (Client) {
    option (google.api.http) = {
      get: "/clients/{client_ids.client_id}"
    };
  };

  // List OAuth clients where the given user or organization is a direct collaborator.
  // If no user or organization is given, this returns the OAuth clients the caller
  // has access to.
  // Similar to Get, this selects the fields specified in the field mask.
  // More or less fields may be returned, depending on the rights of the caller.
  rpc List(ListClientsRequest) returns (Clients) {
    option (google.api.http) = {
      get: "/clients"
      additional_bindings {
        get: "/users/{collaborator.user_ids.user_id}/clients"
      }
      additional_bindings {
        get: "/organizations/{collaborator.organization_ids.organization_id}/clients"
      }
    };
  };

  // Update the OAuth client, changing the fields specified by the field mask to the provided values.
  rpc Update(UpdateClientRequest) returns (Client) {
    option (google.api.http) = {
      put: "/clients/{client.ids.client_id}"
      body: "*"
    };
  };

  // Delete the OAuth client. This may not release the client ID for reuse.
  rpc Delete(ClientIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/clients/{client_id}"
    };
  };

  // Restore a recently deleted client.
  //
  // Deployment configuration may specify if, and for how long after deletion,
  // entities can be restored.
  rpc Restore(ClientIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      post: "/clients/{client_id}/restore"
    };
  };

  // Purge the client. This will release the client ID for reuse.
  rpc Purge(ClientIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/clients/{client_id}/purge"
    };
  };
}

// The ClientAcces service, exposed by the Identity Server, is used to manage
// collaborators of OAuth clients.
service ClientAccess {
  // List the rights the caller has on this application.
  rpc ListRights(ClientIdentifiers) returns (Rights) {
    option (google.api.http) = {
      get: "/clients/{client_id}/rights"
    };
  };

  // Get the rights of a collaborator (member) of the client.
  // Pseudo-rights in the response (such as the "_ALL" right) are not expanded.
  rpc GetCollaborator(GetClientCollaboratorRequest) returns (GetCollaboratorResponse) {
    option (google.api.http) = {
      additional_bindings {
        get: "/clients/{client_ids.client_id}/collaborator/user/{collaborator.user_ids.user_id}"
      }
      additional_bindings {
        get: "/clients/{client_ids.client_id}/collaborator/organization/{collaborator.organization_ids.organization_id}"
      }
    };
  }

  // Set the rights of a collaborator (member) on the OAuth client.
  // This method can also be used to delete the collaborator, by giving them no rights.
  // The caller is required to have all assigned or/and removed rights.
  rpc SetCollaborator(SetClientCollaboratorRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      put: "/clients/{client_ids.client_id}/collaborators"
      body: "*"
    };
  };

  // List the collaborators on this OAuth client.
  rpc ListCollaborators(ListClientCollaboratorsRequest) returns (Collaborators) {
    option (google.api.http) = {
      get: "/clients/{client_ids.client_id}/collaborators"
    };
  };
}
