// SPDX-License-Identifier: Apache-2.0
// The distributed firewall (docs/network/DFW-HOSTBRIDGE.md §6.1), one to one with the
// REST API below /v1/firewall and /v1/vms/{id}/firewall: the same checks and privileges,
// bodies as JSON in the schemas of the REST API (docs/api/openapi.yaml, tag `firewall`).
syntax = "proto3";

package kyvernon.v1;

import "kyvernon/v1/tenants.proto";

// The distributed firewall: groups, services, policies and rules, profiles, settings, realization, logs and the firewall of virtual machines. Bodies are JSON in the schemas of the REST API.
service FirewallService {
  // GroupView[] of `tenant`.
  rpc ListGroups(FirewallRequest) returns (JsonBody);
  // GroupBody -> GroupView.
  rpc CreateGroup(FirewallRequest) returns (JsonBody);
  // GroupView of group `id`.
  rpc GetGroup(FirewallRequest) returns (JsonBody);
  // GroupBody for group `id` -> GroupView.
  rpc UpdateGroup(FirewallRequest) returns (JsonBody);
  // JSON {"fwVersion": n}.
  rpc DeleteGroup(FirewallRequest) returns (JsonBody);
  // GroupMembersView.
  rpc GroupMembers(FirewallRequest) returns (JsonBody);

  // ServiceView[] of `tenant`.
  rpc ListServices(FirewallRequest) returns (JsonBody);
  // ServiceBody -> ServiceView.
  rpc CreateService(FirewallRequest) returns (JsonBody);
  // ServiceView of service `id`.
  rpc GetService(FirewallRequest) returns (JsonBody);
  // ServiceBody for service `id` -> ServiceView.
  rpc UpdateService(FirewallRequest) returns (JsonBody);
  // Deletes service `id` -> JSON {"fwVersion": n}.
  rpc DeleteService(FirewallRequest) returns (JsonBody);

  // PolicyView[] of `tenant`.
  rpc ListPolicies(FirewallRequest) returns (JsonBody);
  // PolicyBody -> PolicyView.
  rpc CreatePolicy(FirewallRequest) returns (JsonBody);
  // PolicyView of policy `id`.
  rpc GetPolicy(FirewallRequest) returns (JsonBody);
  // PolicyBody for policy `id` -> PolicyView.
  rpc UpdatePolicy(FirewallRequest) returns (JsonBody);
  // Deletes policy `id` -> JSON {"fwVersion": n}.
  rpc DeletePolicy(FirewallRequest) returns (JsonBody);

  // Rules of policy `id`; `sub_id` is the rule id or number.
  rpc ListRules(FirewallRequest) returns (JsonBody);
  // RuleBody for policy `id` -> RuleView (at `position`, else last).
  rpc AddRule(FirewallRequest) returns (JsonBody);
  // RuleView of rule `sub_id` of policy `id`.
  rpc GetRule(FirewallRequest) returns (JsonBody);
  // RuleBody for rule `sub_id` of policy `id` -> RuleView.
  rpc UpdateRule(FirewallRequest) returns (JsonBody);
  // Deletes rule `sub_id` of policy `id` -> JSON {"fwVersion": n}.
  rpc DeleteRule(FirewallRequest) returns (JsonBody);
  // MoveRuleBody -> RuleView.
  rpc MoveRule(FirewallRequest) returns (JsonBody);
  // PolicyStatsView of policy `id`.
  rpc PolicyStats(FirewallRequest) returns (JsonBody);
  // RuleStatsView of rule number `id`.
  rpc RuleStats(FirewallRequest) returns (JsonBody);

  // ProfileView[]: the built-in and the provider profiles.
  rpc ListProfiles(FirewallRequest) returns (JsonBody);
  // ProfileView of profile `id`.
  rpc GetProfile(FirewallRequest) returns (JsonBody);
  // ProfileBody; `id` empty creates a profile, a built-in name replaces the built-in.
  rpc PutProfile(FirewallRequest) returns (JsonBody);
  // Deletes profile `id` (not a built-in one).
  rpc DeleteProfile(FirewallRequest) returns (JsonBody);
  // SettingsView of the provider.
  rpc GetSettings(FirewallRequest) returns (JsonBody);
  // SettingsView -> SettingsView.
  rpc PutSettings(FirewallRequest) returns (JsonBody);
  // TagCategoryView[]: the tag categories groups can select on.
  rpc ListTagCategories(FirewallRequest) returns (JsonBody);
  // Tag category `id` as JSON -> TagCategoryView.
  rpc SetTagCategory(FirewallRequest) returns (JsonBody);

  // HostRealizationView[] (`id`: one host).
  rpc Realization(FirewallRequest) returns (JsonBody);
  // SimulateBody -> SimulateView.
  rpc Simulate(FirewallRequest) returns (JsonBody);
  // LogRecordView[] (`id`: host, `number`: rule, `limit`).
  rpc Logs(FirewallRequest) returns (JsonBody);
  // VnicFirewallView[] of VM `id` (`sub_id`: one NIC key).
  rpc VmFirewall(FirewallRequest) returns (JsonBody);
  // LogRecordView[] of VM `id`.
  rpc VmLogs(FirewallRequest) returns (JsonBody);
  // NicProfileBody for NIC `sub_id` of VM `id` -> VnicFirewallView.
  rpc SetNicProfile(FirewallRequest) returns (JsonBody);
  // TemplateView[].
  rpc ListTemplates(FirewallRequest) returns (JsonBody);
  // TemplateView of template `id`.
  rpc GetTemplate(FirewallRequest) returns (JsonBody);
  // TemplateBody for provider template `id` (created or replaced) -> TemplateView.
  rpc PutTemplate(FirewallRequest) returns (JsonBody);
  // Deletes provider template `id` -> `{"version"}`.
  rpc DeleteTemplate(FirewallRequest) returns (JsonBody);
  // Template `id`, ApplyTemplateBody -> TaskRef JSON.
  rpc ApplyTemplate(FirewallRequest) returns (JsonBody);
  // OpenPortBody for VM `id` -> RuleView.
  rpc OpenPort(FirewallRequest) returns (JsonBody);
  // ModeBody for VM `id` -> TaskRef JSON.
  rpc SetMode(FirewallRequest) returns (JsonBody);
  // VnicFirewallView[] of VM `id`.
  rpc ConfirmMode(FirewallRequest) returns (JsonBody);
  // MonitorReportView of VM `id`.
  rpc MonitorReport(FirewallRequest) returns (JsonBody);
  // BypassView[].
  rpc ListBypasses(FirewallRequest) returns (JsonBody);
  // BypassBody -> TaskRef JSON.
  rpc EnableBypass(FirewallRequest) returns (JsonBody);
  // Ends bypass `id` -> {}.
  rpc RemoveBypass(FirewallRequest) returns (JsonBody);
}

// One request shape for every call.
message FirewallRequest {
  // Object id (group, service, policy, profile, tag category, VM, host or rule number).
  string id = 1;
  // Second id (rule id or number, NIC key).
  string sub_id = 2;
  // Tenant of a list or of a new object (empty: the provider; a tenant user: its own).
  string tenant = 3;
  // Body as JSON (REST schema).
  string json = 4;
  // Expected record version (If-Match); 0: none.
  uint64 if_match = 5;
  // Wait until the hosts concerned applied the change.
  bool wait_realized = 6;
  // Longest wait in seconds (default 30, at most 300).
  uint32 timeout_seconds = 7;
  // Position of a new rule (AddRule; absent: last).
  optional uint32 position = 8;
  // Rule number filter (Logs).
  optional uint32 number = 9;
  // Most records (Logs, VmLogs).
  uint32 limit = 10;
}