syntax = "proto3";

package pipeline.v1beta;

// Google API
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
// Protocol Buffers Well-Known Types
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

// API secrets allow users to make requests to the Instill AI API.
// Field ordering follows AIP standard: name(1), id(2), display_name(3), slug(4), aliases(5), description(6)
message Secret {
  option (google.api.resource) = {pattern: "namespaces/{namespace}/secrets/{secret}"};

  // ===== Standard AIP fields 1-6 (ALL resources must follow this order) =====

  // Field 1: Canonical resource name.
  // Format: `namespaces/{namespace}/secrets/{secret}`.
  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Field 2: Immutable canonical resource ID (80-96 bits entropy, base62).
  // Example: "sec-8f3a2k9E7c1"
  string id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Field 3: Human-readable display name for UI.
  string display_name = 3 [(google.api.field_behavior) = REQUIRED];

  // Field 4: URL-friendly slug (NO prefix).
  // If omitted, server generates from display_name.
  // If provided, server validates and persists it.
  // Slug is NOT part of resource identity.
  // Example: "openai-api-key"
  string slug = 4 [(google.api.field_behavior) = OPTIONAL];

  // Field 5: Previous slugs for backward compatibility.
  // When display_name changes, a new slug is generated and old slugs are stored here.
  repeated string aliases = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Field 6: Optional description.
  string description = 6 [(google.api.field_behavior) = OPTIONAL];

  // ===== Timestamps (common to all resources) =====

  // Field 7: Creation time.
  google.protobuf.Timestamp create_time = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Field 8: Last update time.
  google.protobuf.Timestamp update_time = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  // ===== Resource-specific fields start from field 9+ =====

  // Field 9: The value of the secret, which is input-only and will never be returned in API responses.
  optional string value = 9 [(google.api.field_behavior) = INPUT_ONLY];
}

// CreateNamespaceSecretRequest represents a request to create a secret.
// Follows AIP-133: https://google.aip.dev/133
message CreateNamespaceSecretRequest {
  // The parent resource name.
  // Format: `namespaces/{namespace}`
  string parent = 1 [(google.api.field_behavior) = REQUIRED];
  // The properties of the secret to be created.
  Secret secret = 2;
}

// CreateNamespaceSecretResponse contains the created secret.
message CreateNamespaceSecretResponse {
  // The created secret resource.
  Secret secret = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// ListNamespaceSecretsRequest represents a request to list the secrets of a namespace.
// Follows AIP-132: https://google.aip.dev/132
message ListNamespaceSecretsRequest {
  // The parent resource name.
  // Format: `namespaces/{namespace}`
  string parent = 1 [(google.api.field_behavior) = REQUIRED];
  // The maximum number of secrets to return. If this parameter is unspecified,
  // at most 10 pipelines will be returned. The cap value for this parameter is
  // 100 (i.e. any value above that will be coerced to 100).
  optional int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
  // Page token.
  optional string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// ListNamespaceSecretsResponse contains a list of secrets.
message ListNamespaceSecretsResponse {
  // A list of secret resources.
  repeated Secret secrets = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  // Next page token.
  string next_page_token = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
  // Total number of secret resources.
  int32 total_size = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// GetNamespaceSecretRequest represents a request to fetch the details of a secret.
// Follows AIP-131: https://google.aip.dev/131
message GetNamespaceSecretRequest {
  // The resource name of the secret.
  // Format: `namespaces/{namespace}/secrets/{secret}`
  string name = 1 [(google.api.field_behavior) = REQUIRED];
}

// GetNamespaceSecretResponse contains the requested secret.
message GetNamespaceSecretResponse {
  // The secret resource.
  Secret secret = 1;
}

// UpdateNamespaceSecretRequest represents a request to update a namespace secret.
// Follows AIP-134: https://google.aip.dev/134
message UpdateNamespaceSecretRequest {
  // The secret resource to update. The secret's `name` field identifies
  // the resource. Format: `namespaces/{namespace}/secrets/{secret}`
  Secret secret = 1 [(google.api.field_behavior) = REQUIRED];
  // The update mask specifies the subset of fields that should be modified.
  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
}

// UpdateNamespaceSecretResponse contains the updated secret.
message UpdateNamespaceSecretResponse {
  // The updated secret resource.
  Secret secret = 1;
}

// DeleteNamespaceSecretRequest represents a request to delete a secret resource.
// Follows AIP-135: https://google.aip.dev/135
message DeleteNamespaceSecretRequest {
  // The resource name of the secret to delete.
  // Format: `namespaces/{namespace}/secrets/{secret}`
  string name = 1 [(google.api.field_behavior) = REQUIRED];
}

// DeleteNamespaceSecretResponse is an empty response.
message DeleteNamespaceSecretResponse {}