syntax = "proto3";

package polarsignals.serviceaccount.v1alpha1;

import "google/api/annotations.proto";
import "google/protobuf/timestamp.proto";

option go_package = "github.com/polarsignals/polarsignals/gen/go/serviceaccount";

// ServiceAccountService provides the ability to manage service accounts.
service ServiceAccountService {
  // ListServiceAccounts returns the service accounts for the organization.
  rpc ListServiceAccounts(ListServiceAccountsRequest) returns (ListServiceAccountsResponse) {
    option (google.api.http) = {get: "/v1/organizations/{organization_id}/serviceaccounts"};
  }

  // CreateServiceAccount creates a new service account.
  rpc CreateServiceAccount(CreateServiceAccountRequest) returns (CreateServiceAccountResponse) {
    option (google.api.http) = {
      post: "/v1/organizations/{organization_id}/serviceaccounts"
      body: "*"
    };
  }

  // DeleteServiceAccount deletes the service account with the given ID.
  rpc DeleteServiceAccount(DeleteServiceAccountRequest) returns (DeleteServiceAccountResponse) {
    option (google.api.http) = {delete: "/v1/organizations/{organization_id}/serviceaccounts/{id}"};
  }

  // ListServiceAccountTokens returns the tokens for the service account.
  rpc ListServiceAccountTokens(ListServiceAccountTokensRequest) returns (ListServiceAccountTokensResponse) {
    option (google.api.http) = {get: "/v1/organizations/{organization_id}/serviceaccounts/{service_account_id}/tokens"};
  }

  // CreateServiceAccountToken creates a new token for the service account.
  rpc CreateServiceAccountToken(CreateServiceAccountTokenRequest) returns (CreateServiceAccountTokenResponse) {
    option (google.api.http) = {
      post: "/v1/organizations/{organization_id}/serviceaccounts/{service_account_id}/tokens"
      body: "*"
    };
  }

  // DeleteServiceAccountToken deletes the token with the given ID for the service account.
  rpc DeleteServiceAccountToken(DeleteServiceAccountTokenRequest) returns (DeleteServiceAccountTokenResponse) {
    option (google.api.http) = {delete: "/v1/organizations/{organization_id}/serviceaccounts/{service_account_id}/tokens/{id}"};
  }
}

// ServiceAccount represents a service account.
message ServiceAccount {
  // The ID of the service account.
  string id = 1;
  // The name of the service account.
  string name = 2;
  // The ID of the organization.
  string organization_id = 3;
  // The time when the service account was created.
  google.protobuf.Timestamp created_at = 4;
  // The user or service account that created this service account.
  string created_by = 5;
}

// ServiceAccountToken represents a token for a service account.
message ServiceAccountToken {
  // The ID of the token.
  string id = 1;
  // The name of the token.
  string name = 2;
  // The ID of the service account.
  string service_account_id = 3;
  // The time when the token was created.
  google.protobuf.Timestamp created_at = 4;
  // The last time the token was used.
  google.protobuf.Timestamp last_used_at = 5;
  // The user or service account that created this token.
  string created_by = 6;
  // The token value - only returned on creation, never in list operations.
  string token = 7;
}

// ListServiceAccountsRequest is the request for the ListServiceAccounts method.
message ListServiceAccountsRequest {
  // The ID of the organization.
  string organization_id = 1;
}

// ListServiceAccountsResponse is the response for the ListServiceAccounts method.
message ListServiceAccountsResponse {
  // The service accounts.
  repeated ServiceAccount service_accounts = 1;
}

// CreateServiceAccountRequest is the request for the CreateServiceAccount method.
message CreateServiceAccountRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The name of the service account.
  string name = 2;
}

// CreateServiceAccountResponse is the response for the CreateServiceAccount method.
message CreateServiceAccountResponse {
  // The created service account.
  ServiceAccount service_account = 1;
}

// DeleteServiceAccountRequest is the request for the DeleteServiceAccount method.
message DeleteServiceAccountRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The ID of the service account.
  string id = 2;
}

// DeleteServiceAccountResponse is the response for the DeleteServiceAccount method.
message DeleteServiceAccountResponse {}

// ListServiceAccountTokensRequest is the request for the ListServiceAccountTokens method.
message ListServiceAccountTokensRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The ID of the service account.
  string service_account_id = 2;
}

// ListServiceAccountTokensResponse is the response for the ListServiceAccountTokens method.
message ListServiceAccountTokensResponse {
  // The tokens.
  repeated ServiceAccountToken tokens = 1;
}

// CreateServiceAccountTokenRequest is the request for the CreateServiceAccountToken method.
message CreateServiceAccountTokenRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The ID of the service account.
  string service_account_id = 2;
  // The name of the token.
  string name = 3;
  // Optional project ID to associate with this token.
  string project_id = 4;
}

// CreateServiceAccountTokenResponse is the response for the CreateServiceAccountToken method.
message CreateServiceAccountTokenResponse {
  // The created token, including the token value (this is the only time the token value is returned).
  ServiceAccountToken token = 1;
}

// DeleteServiceAccountTokenRequest is the request for the DeleteServiceAccountToken method.
message DeleteServiceAccountTokenRequest {
  // The ID of the organization.
  string organization_id = 1;
  // The ID of the service account.
  string service_account_id = 2;
  // The ID of the token.
  string id = 3;
}

// DeleteServiceAccountTokenResponse is the response for the DeleteServiceAccountToken method.
message DeleteServiceAccountTokenResponse {}