syntax = "proto3";

package code.justin.tv.sse.sandstorm;
option go_package = "sandstorm";

service Sandstorm {
  // CreateSecret creates a new secret.
  rpc CreateSecret(CreateSecretReq) returns (CreateSecretRes);
  // UpdateSecret updates an existing secret.
  // null values will not be updated.
  rpc UpdateSecret(UpdateSecretReq) returns (UpdateSecretRes);
  // DescribeSecret returns information on a secret.
  rpc DescribeSecret(DescribeSecretReq) returns (DescribeSecretRes);
  // Retrieve decrypted secret information.
  rpc GetDecryptedSecret(GetDecryptedSecretReq) returns (GetDecryptedSecretRes);
  // Long poll until a secret is returned.
  rpc WaitForSecretUpdates(WaitForSecretUpdatesReq) returns (WaitForSecretUpdatesRes);
}

enum SecretClass {
  SC_NOT_SET = 0;
  PUBLIC = 1;
  INTERNAL = 2;
  RESTRICTED = 3;
  CUSTOMER = 4;
}

enum BroadcastSetting {
  DNB_NOT_SET = 0;
  BROADCAST = 1;
  DO_NOT_BROADCAST = 2;
}

message CreateSecretReq {
  string name = 1;  // (required) name of the secret.
  SecretClass secret_class = 2;  // secret data classification
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  bytes plaintext = 4;  // (required) secret value
}

message CreateSecretRes {
  string name = 1;
  SecretClass secret_class = 2;
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  int64 updated_at = 4;  // update time unix timestamp
}

message UpdateSecretReq {
  string name = 1;  // name of the secret
  SecretClass secret_class = 2;  // secret data classification
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  bytes plaintext = 4;  // secret value
}

message UpdateSecretRes {
  string name = 1;  // name of the secret
  SecretClass secret_class = 2;  // secret data classification
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  int64 updated_at = 4;  // update time unix timestamp
}

message DescribeSecretReq {
  string name = 1;  // name of the secret
}

message DescribeSecretRes {
  string name = 1;  // name of the secret
  SecretClass secret_class = 2;  // secret data classification
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  int64 updated_at = 4;  // update time unix timestamp
}

message GetDecryptedSecretReq {
  string name = 1;  // name of secret
}

message GetDecryptedSecretRes {
  string name = 1;  // name of the secret
  SecretClass secret_class = 2;  // secret data classification
  BroadcastSetting do_not_broadcast = 3;  // disable broadcasting to WaitForSecretUpdates
  int64 updated_at = 4;  // update time unix timestamp
  bytes plaintext = 5;  // secret value
}

message SecretUpdateCondition {
  string name = 1;  // name of secret
}

message WaitForSecretUpdatesReq {
  repeated SecretUpdateCondition conditions = 1;  // conditions to wait for
  int32 timeout_s = 2;  // end request after this time
  int32 splay_s = 3;  // randomize wait time
  int32 dwell_s = 4;  // batch events by this timeframe
}

message SecretUpdateEvent {
  string name = 1;  // name of secret
  int64 updated_at = 4;  // update time unix timestamp
}

message WaitForSecretUpdatesRes {
  repeated SecretUpdateEvent secret_updates = 1;  // events received
}
