syntax = "proto3";

package nebius.iam.v1;

import "buf/validate/validate.proto";
import "nebius/annotations.proto";
import "nebius/common/v1/metadata.proto";

option go_package = "github.com/nebius/gosdk/proto/nebius/iam/v1";
option java_multiple_files = true;
option java_outer_classname = "FederatedCredentialsProto";
option java_package = "ai.nebius.pub.iam.v1";

message FederatedCredentials {
  // Federated credentials resource metadata.
  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];

  // Federated credentials resource specification.
  FederatedCredentialsSpec spec = 2 [(buf.validate.field).required = true];

  // Federated credentials resource status.
  FederatedCredentialsStatus status = 3 [(field_behavior) = OUTPUT_ONLY];
}

message FederatedCredentialsSpec {
  // Provider settings used to authenticate a federated subject.
  oneof credentials_provider {
    option (buf.validate.oneof).required = true;

    OidcCredentialsProvider oidc_provider = 1;
  }

  // Federated subject ID. For oidc_provider, the subject is calculated from the
  // "sub" claim of the federated JWT token.
  string federated_subject_id = 101;

  // IAM subject (service account) that the federated subject impersonates.
  string subject_id = 111 [(buf.validate.field).required = true];
}

// The OIDC provider does not have to be a full OIDC provider, but it must expose
// OIDC discovery metadata at the "/.well-known/openid-configuration" endpoint.
// The discovery metadata must contain "jwks_uri", which points to the JSON Web
// Key Set (JWKS). The JWKS contains public keys used to verify JSON
// Web Tokens (JWTs) issued by the identity provider.
message OidcCredentialsProvider {
  // OIDC-compatible JWT issuer URL.
  string issuer_url = 1 [(buf.validate.field).required = true];

  // JSON representation of a JSON Web Key Set (JWKS) with public keys used for
  // JWT signature verification.
  // If set, the token service uses this JWKS to verify token signatures.
  string jwk_set_json = 2;
}

message FederatedCredentialsStatus {}