// Copyright 2023 Styra, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";
package eopa.policy.v1;

import "google/protobuf/any.proto";

// Policy is a thin wrapper type around a Rego policy.
message Policy {
  string path = 1;
  string text = 2;
}

// ListPoliciesRequest is used to start a ListPolicy operation.
message ListPoliciesRequest {}

// ListPoliciesResponse contains the list of all policies enumerated by a
// ListPolicy operation.
message ListPoliciesResponse {
  repeated Policy results = 1;
}

// CreatePolicyRequest provides the policy and path to insert it at for a
// CreatePolicy operation.
message CreatePolicyRequest {
  Policy policy = 1; // Rego module.
}

// CreatePolicyResponse is an empty confirmation message type.
message CreatePolicyResponse {}

// GetPolicyRequest requires the path of the policy to fetch.
message GetPolicyRequest {
  string path = 1;
}

// GetPolicyResponse contains the retrieved Rego module from a GetPolicy
// operation.
message GetPolicyResponse {
  Policy result = 2; // Rego module.
}

// UpdatePolicyRequest provides the policy and path to update for an
// UpdatePolicy operation.
message UpdatePolicyRequest {
  Policy policy = 2; // Rego module.
}

// UpdatePolicyResponse is an empty confirmation message type.
message UpdatePolicyResponse {}

// DeletePolicyRequest specifies which path to delete a policy from.
message DeletePolicyRequest {
  string path = 1;
}

// DeletePolicyResponse is an empty confirmation message type.
message DeletePolicyResponse {}

// StreamingPolicyRequest provides a way to send PolicyService requests over
// gRPC streams. Limited batching support is provided via the
// `writes`/`reads` fields. As in the BulkRW API, if a write operation
// fails, the entire request will be aborted. Writes are done as a single
// transaction, reads are done in parallel.
message StreamingPolicyRWRequest {
  // WritePolicyRequest provides a union of possible Policy request types.
  // This allows creating arbitrary sequences of Policy store operations.
  message WriteRequest {
    oneof req {
      CreatePolicyRequest create = 1;
      UpdatePolicyRequest update = 2;
      DeletePolicyRequest delete = 3;
    }
  }
  // ReadRequest is currently a simple wrapper over the GetPolicy
  // request type.
  message ReadRequest {
    GetPolicyRequest get = 1;
  }
  // writes provides a sequence of WritePolicy requests.
  repeated WriteRequest writes = 1;
  // reads provides a sequence of ReadPolicy requests.
  repeated ReadRequest reads = 2;
}

// StreamingPolicyRWResponse contains lists of the appropriate response types
// for each operation in the StreamingPolicyRWRequest.
message StreamingPolicyRWResponse {
  // WriteResponse provides a union of possible Policy request types.
  // This allows creating arbitrary sequences of Policy store operations.
  message WriteResponse {
    oneof resp {
      CreatePolicyResponse create = 1;
      UpdatePolicyResponse update = 2;
      DeletePolicyResponse delete = 3;
    }
  }
  // ReadResponse is currently a simple wrapper over the GetPolicy
  // request type.
  message ReadResponse {
    GetPolicyResponse get = 1;
    ErrorList errors = 2;
  }
  // writes provides a sequence of WritePolicy results.
  repeated WriteResponse writes = 1;
  // reads provides a sequence of ReadPolicy results or errors.
  repeated ReadResponse reads = 2;
}

// Context-dependent error messages.
message ErrorList {
  // The errors in the list.
  repeated google.protobuf.Any errors = 1;
}


service PolicyService {
  // ListPolicies returns the set of stored policies in the policy store.
  //
  // This is equivalent in functionality to OPA's
  // [Policy REST API List method](https://www.openpolicyagent.org/docs/latest/rest-api/#list-policies).
  //
  // Warning: This request will enumerate *all* policies stored by the
  // Enterprise OPA instance. This can have substantial overheads if the
  // policies are large in size.
  rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse);

  // CreatePolicy inserts a new policy module into the policy store.
  //
  // This is equivalent in functionality to OPA's
  // [Policy REST API Create/Update method](https://www.openpolicyagent.org/docs/latest/rest-api/#create-or-update-a-policy).
  //
  // Warning: Inserting a new policy will trigger a full recompilation
  // of *all* policies in the store, in order to ensure the new policy does
  // not break existing policies. This is a known performance hazard for the
  // OPA REST API, and remains a hazard for gRPC as well. Keeping the unique
  // number of policies down, or using Bundles are the recommended
  // workarounds for most OPA users.
  rpc CreatePolicy(CreatePolicyRequest) returns (CreatePolicyResponse);

  // GetPolicy fetches a policy module's code from the policy store.
  //
  // This is roughly equivalent in functionality to OPA's
  // [Policy REST API Get method](https://www.openpolicyagent.org/docs/latest/rest-api/#get-a-policy).
  //
  // Note: Only the raw policy text is returned in this version of the API.
  rpc GetPolicy(GetPolicyRequest) returns (GetPolicyResponse);

  // UpdatePolicy updates a policy module in the policy store.
  //
  // This is equivalent in functionality to OPA's
  // [Policy REST API Create/Update method](https://www.openpolicyagent.org/docs/latest/rest-api/#create-or-update-a-policy).
  //
  // Warning: Modifying an existing policy will trigger a full recompilation
  // of *all* policies in the store, in order to ensure the updated policy does
  // not break existing policies. This is a known performance hazard for the
  // OPA REST API, and remains a hazard for gRPC as well. Keeping the unique
  // number of policies down, or using Bundles are the recommended
  // workarounds for most OPA users.
  rpc UpdatePolicy(UpdatePolicyRequest) returns (UpdatePolicyResponse);

  // DeletePolicy removes a policy module from the policy store.
  //
  // This is equivalent in functionality to OPA's
  // [Policy REST API Delete method](https://www.openpolicyagent.org/docs/latest/rest-api/#delete-a-policy).
  //
  // Warning: Removing a policy will trigger a full recompilation of *all*
  // policies in the store, in order to ensure that removing the policy
  // module does not break existing policies. This is a known performance
  // hazard for the OPA REST API, and remains a hazard for gRPC as well.
  // Keeping the unique number of policies down, or using Bundles are the
  // recommended workarounds for most OPA users.
  rpc DeletePolicy(DeletePolicyRequest) returns (DeletePolicyResponse);

  // StreamingPolicyRW specifies a stream of fixed-structure, batched
  // read/write operations.
  //
  // WritePolicy operations are executed sequentially, aborting the entire
  // gRPC call if any operations fail.
  //
  // The ReadPolicy operations are then executed in parallel, but will report
  // errors inline in their responses, instead of aborting the entire gRPC
  // call.
  rpc StreamingPolicyRW(stream StreamingPolicyRWRequest) returns (stream StreamingPolicyRWResponse);
}