syntax = "proto3";

package polarsignals.organization.v1alpha1;

import "google/api/annotations.proto";
import "polarsignals/user/v1alpha1/user.proto";
import "google/protobuf/timestamp.proto";

option go_package = "github.com/polarsignals/polarsignals/gen/go/organization";

// OrganizationService provides the ability to manage organizations.
service OrganizationService {
  // GetOrganization returns the organization with the given ID.
  rpc GetOrganizations(GetOrganizationsRequest) returns (GetOrganizationsResponse) {
    option (google.api.http) = {get: "/v1"};
  }

  // CreateOrganization creates a new organization.
  rpc CreateOrganization(CreateOrganizationRequest) returns (CreateOrganizationResponse) {
    option (google.api.http) = {
      post: "/v1"
      body: "*"
    };
  }

  // GetOrganization returns the organization with the given ID.
  rpc GetOrganization(GetOrganizationRequest) returns (GetOrganizationResponse) {
    option (google.api.http) = {get: "/v1/{id}"};
  }

  // UpdateOrganization updates the organization with the given ID.
  rpc UpdateOrganization(UpdateOrganizationRequest) returns (UpdateOrganizationResponse) {
    option (google.api.http) = {
      patch: "/v1/{id}"
      body: "*"
    };
  }

  // DeleteOrganization deletes the organization with the given ID.
  rpc DeleteOrganization(DeleteOrganizationRequest) returns (DeleteOrganizationResponse) {
    option (google.api.http) = {delete: "/v1/{id}"};
  }

  // GetOrganizationUsers returns the users of the organization with the given ID.
  rpc GetOrganizationUsers(GetOrganizationUsersRequest) returns (GetOrganizationUsersResponse) {
    option (google.api.http) = {get: "/v1/{id}/users"};
  }

  // AddORganizationUser adds a user to the organization with the given ID.
  rpc AddOrganizationUser(AddOrganizationUserRequest) returns (AddOrganizationUserResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/users"
      body: "*"
    };
  }

  // RemoveOrganizationUser removes a user from the organization with the given ID.
  rpc RemoveOrganizationUser(RemoveOrganizationUserRequest) returns (RemoveOrganizationUserResponse) {
    option (google.api.http) = {delete: "/v1/{id}/users"};
  }

  // IsInviteTokenValid checks if the given invite token is valid.
  rpc IsInviteTokenValid(IsInviteTokenValidRequest) returns (IsInviteTokenValidResponse) {
    option (google.api.http) = {post: "/v1/invite-token-validity/{token}"};
  }

  // AcceptInviteToken accepts the given invite token.
  rpc AcceptInviteToken(AcceptInviteTokenRequest) returns (AcceptInviteTokenResponse) {
    option (google.api.http) = {
      post: "/v1/accept-invite-token/{token}"
      body: "*"
    };
  }

  // GetInviteToken returns the invite token with the given ID.
  rpc GetInviteTokens(GetInviteTokensRequest) returns (GetInviteTokensResponse) {
    option (google.api.http) = {get: "/v1/{id}/invite-tokens"};
  }

  // ActivateFreeTrial activates the free trial for the organization with the given ID.
  rpc ActivateFreeTrial(ActivateFreeTrialRequest) returns (ActivateFreeTrialResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/activate-free-trial"
      body: "*"
    };
  }

  // InviteUsersViaEmail invites users to the organization with the given email addresses.
  rpc InviteUsersViaEmail(InviteUsersViaEmailRequest) returns (InviteUsersViaEmailResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/invite-users-via-email"
      body: "*"
    };
  }

  // EnableSSO enables SSO for the organization with the given ID.
  rpc EnableSSO(EnableSSORequest) returns (EnableSSOResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/enable-sso"
      body: "*"
    };
  }

  // DisableSSO disables SSO for the organization with the given ID.
  rpc DisableSSO(DisableSSORequest) returns (DisableSSOResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/disable-sso"
      body: "*"
    };
  }

  // GetSSOSettings returns the SSO settings for the organization with the given ID.
  rpc GetSSOSettings(GetSSOSettingsRequest) returns (GetSSOSettingsResponse) {
    option (google.api.http) = {get: "/v1/{id}/sso-settings"};
  }

  // GetSSOConnectorId returns the SSO login URL for the organization with the given organization identifier.
  rpc GetSSOConnectorId(GetSSOConnectorIdRequest) returns (GetSSOConnectorIdResponse) {
    option (google.api.http) = {get: "/v1/sso-login-url/{organization_identifier}"};
  }

  // UpdateUserRole updates the role of the user with the given id for the given organization_id.
  rpc UpdateUserRole(UpdateUserRoleRequest) returns (UpdateUserRoleResponse) {
    option (google.api.http) = {
      post: "/v1/{organization_id}/users/{user_id}/role"
      body: "*"
    };
  }

  // UpdateSSODefaultRole updates the default role assigned to SSO users.
  rpc UpdateSSODefaultRole(UpdateSSODefaultRoleRequest) returns (UpdateSSODefaultRoleResponse) {
    option (google.api.http) = {
      post: "/v1/{id}/sso-default-role"
      body: "*"
    };
  }

}

// Organization represents an organization.
message Organization {
  // The ID of the organization.
  string id = 1;
  // The name of the organization.
  string name = 2;
  // the feature flags enabled for the organization.
  repeated string feature_flags = 3;
  // the price id override for the organization.
  string price_id = 4;
  // trial expiration date.
  google.protobuf.Timestamp trial_ends_at = 5;
  // is the organization using PO billing
  bool is_po_billing = 6;

  string po_number = 7;
  float po_discount = 8;
  float po_flat = 9;
}

// InviteToken represents an invite token.
message InviteToken {
  // The ID of the invite token.
  string id = 1;
  // The ID of the organization.
  string organization_id = 2;
  // The role of the user.
  string role = 3;
}

// GetOrganizationsRequest is the request for the GetOrganizations method.
message GetOrganizationsRequest {}

// GetOrganizationsResponse is the response for the GetOrganizations method.
message GetOrganizationsResponse {
  // The organizations.
  repeated Organization organizations = 1;
}

// CreateOrganizationRequest is the request for the CreateOrganization method.
message CreateOrganizationRequest {
  // The name of the organization.
  string name = 1;
}

// CreateOrganizationResponse is the response for the CreateOrganization method.
message CreateOrganizationResponse {
  // The ID of the organization.
  string id = 1;
}

// GetOrganizationRequest is the request for the GetOrganization method.
message GetOrganizationRequest {
  // The ID of the organization.
  string id = 1;
}

// GetOrganizationResponse is the response for the GetOrganization method.
message GetOrganizationResponse {
  // The organization.
  Organization organization = 1;
}

// UpdateOrganizationRequest is the request for the UpdateOrganization method.
message UpdateOrganizationRequest {
  // The ID of the organization.
  string id = 1;
  // The name of the organization.
  string name = 2;
}

// UpdateOrganizationResponse is the response for the UpdateOrganization method.
message UpdateOrganizationResponse {}

// DeleteOrganizationRequest is the request for the DeleteOrganization method.
message DeleteOrganizationRequest {
  // The ID of the organization.
  string id = 1;
}

// DeleteOrganizationResponse is the response for the DeleteOrganization method.
message DeleteOrganizationResponse {}

// GetOrganizationUsersRequest is the request for the GetOrganizationUsers method.
message GetOrganizationUsersRequest {
  // The ID of the organization.
  string id = 1;
}

// GetOrganizationUsersResponse is the response for the GetOrganizationUsers method.
message GetOrganizationUsersResponse {
  // The users.
  repeated polarsignals.user.v1alpha1.User users = 1;
}

// AddOrganizationUserRequest is the request for the AddOrganizationUser method.
message AddOrganizationUserRequest {
  // The ID of the organization.
  string id = 1;
  // The ID of the user.
  string email = 2;
}

// AddOrganizationUserResponse is the response for the AddOrganizationUser method.
message AddOrganizationUserResponse {}

// RemoveOrganizationUserRequest is the request for the RemoveOrganizationUser method.
message RemoveOrganizationUserRequest {
  // The ID of the organization.
  string id = 1;
  // The ID of the user.
  string user_id = 2;
}

// RemoveOrganizationUserResponse is the response for the RemoveOrganizationUser method.
message RemoveOrganizationUserResponse {}

// IsInviteTokenValidRequest is the request for the IsInviteTokenValid method.
message IsInviteTokenValidRequest {
  // The invite token.
  string token = 1;
}

// IsInviteTokenValidResponse is the response for the IsInviteTokenValid method.
message IsInviteTokenValidResponse {
  // The organization name.
  string organization_name = 1;
}

// AcceptInviteTokenRequest is the request for the AcceptInviteToken method.
message AcceptInviteTokenRequest {
  // The invite token.
  string token = 1;
}

// AcceptInviteTokenResponse is the response for the AcceptInviteToken method.
message AcceptInviteTokenResponse {}

// GetInviteTokensRequest is the request for the GetInviteTokens method.
message GetInviteTokensRequest {
  // The ID of the organization.
  string id = 1;
}

// GetInviteTokensResponse is the response for the GetInviteTokens method.
message GetInviteTokensResponse {
  // The invite tokens.
  repeated InviteToken invite_tokens = 1;
}

// ActivateFreeTrialRequest is the request for the ActivateFreeTrial method.
message ActivateFreeTrialRequest {
  // The ID of the organization.
  string id = 1;
}

// ActivateFreeTrialResponse is the response for the ActivateFreeTrial method.
message ActivateFreeTrialResponse {}

// InviteUsersViaEmailRequest is the request for the InviteUsersViaEmail method.
message InviteUsersViaEmailRequest {
  // The ID of the organization.
  string id = 1;
  // The email addresses of the users.
  repeated string emails = 2;
}

// InviteUsersViaEmailResponse is the response for the InviteUsersViaEmail method.
message InviteUsersViaEmailResponse {}

// EnableSSORequest is the request for the EnableSSO method.
message EnableSSORequest {
  // The ID of the organization.
  string id = 1;
  // The SSO settings.
  SSOSettings sso_settings = 2;
}

// EnableSSOResponse is the response for the EnableSSO method.
message EnableSSOResponse {}

// DisableSSORequest is the request for the DisableSSO method.
message DisableSSORequest {
  // The ID of the organization.
  string id = 1;
}

// DisableSSOResponse is the response for the DisableSSO method.
message DisableSSOResponse {}

// GetSSOSettingsRequest is the request for the GetSSOSettings method.
message GetSSOSettingsRequest {
  // The ID of the organization.
  string id = 1;
}

// GetSSOSettingsResponse is the response for the GetSSOSettings method.
message GetSSOSettingsResponse {
  // The SSO settings.
  SSOSettings sso_settings = 1;
}

// SSOSettings represents the SSO settings.
message SSOSettings {
  // Organization identifier
  string organization_identifier = 1;
  // Type
  string sso_type = 2;
  oneof sso_config {
    // OIDC configuration
    OIDCConfig oidc_config = 3;
  }
  // Default role for SSO users (opaque role reference like "system:viewer" or "<org-id>:<role-name>")
  string default_role = 4;
}

// OIDCConfig represents the OIDC configuration.
message OIDCConfig {
  // The issuer URL.
  string issuer_url = 1;
  // The client ID.
  string client_id = 2;
  // The client secret.
  string client_secret = 3;
  // Whether to request and pass through group memberships.
  bool enable_groups = 4;
}

// GetSSOConnectorIdRequest is the request for the GetSSOConnectorId method.
message GetSSOConnectorIdRequest {
  // The organization identifier.
  string organization_identifier = 1;
}

// GetSSOConnectorIdResponse is the response for the GetSSOConnectorId method.
message GetSSOConnectorIdResponse {
  // The Connector Id.
  string connector_id = 1;
}

// UpdateUserRoleRequest is the request for the UpdateUserRole method.
message UpdateUserRoleRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The ID of the user.
  string user_id = 2;
  // The role of the user.
  string role = 3;
}

// UpdateUserRoleResponse is the response for the UpdateUserRole method.
message UpdateUserRoleResponse {}

// UpdateSSODefaultRoleRequest is the request for the UpdateSSODefaultRole method.
message UpdateSSODefaultRoleRequest {
  // The ID of the organization.
  string id = 1;
  // The default role for SSO users (opaque role string, empty to clear).
  string default_role = 2;
}

// UpdateSSODefaultRoleResponse is the response for the UpdateSSODefaultRole method.
message UpdateSSODefaultRoleResponse {}