// Copyright © 2019 The Things Network Foundation, The Things Industries B.V.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package ttn.lorawan.v3;

import "google/api/annotations.proto";
import "google/protobuf/empty.proto";
import "protoc-gen-openapiv2/options/annotations.proto";
import "ttn/lorawan/v3/oauth.proto";

option go_package = "go.thethings.network/lorawan-stack/v3/pkg/ttnpb";

// The OAuthAuthorizationRegistry service, exposed by the Identity Server,
// is used to manage OAuth client authorizations for users.
service OAuthAuthorizationRegistry {
  option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_tag) = {description: "Manage OAuth client authorizations for users."};
  // List OAuth clients that are authorized by the user.
  rpc List(ListOAuthClientAuthorizationsRequest) returns (OAuthClientAuthorizations) {
    option (google.api.http) = {get: "/users/{user_ids.user_id}/authorizations"};
  }
  // List OAuth access tokens issued to the OAuth client on behalf of the user.
  rpc ListTokens(ListOAuthAccessTokensRequest) returns (OAuthAccessTokens) {
    option (google.api.http) = {get: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}/tokens"};
  }
  // Delete (de-authorize) an OAuth client for the user.
  rpc Delete(OAuthClientAuthorizationIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {delete: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}"};
  }
  // Delete (invalidate) an OAuth access token.
  rpc DeleteToken(OAuthAccessTokenIdentifiers) returns (google.protobuf.Empty) {
    option (google.api.http) = {delete: "/users/{user_ids.user_id}/authorizations/{client_ids.client_id}/tokens/{id}"};
  }
}