// Copyright 2025 Nitro Agility S.r.l.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
// SPDX-License-Identifier: Apache-2.0

syntax="proto3";

import "google/protobuf/struct.proto";

package policydecisionpoint;

option go_package = "github.com/permguard/permguard/internal/hosts/api/pdp/v1";

// PolicyStore is the location where policies are maintained.
message PolicyStore {
	string Kind = 1;
	string ID = 2;
}

// Principal represents the entity making the request.
message Principal {
	string Type = 1;
	string ID = 2;
	optional string Source = 3;
	optional string IdentityToken = 4;
	optional string AccessToken = 5;
}

// Entities represent the entities provided in the context for the authorization decision.
message Entities {
	string Schema = 1;
	repeated google.protobuf.Struct Items = 2;
}

// Subject is the entity on which the authorization decision is made.
message Subject {
	string Type = 1;
	string ID = 2;
	optional string Source = 3;
	optional google.protobuf.Struct Properties = 4;
}

// Resource is the entity on which the authorization decision is made.
message Resource {
	string Type = 1;
	string ID = 2;
	optional google.protobuf.Struct Properties = 3;
}

// Action is the operation on which the authorization decision is made.
message Action {
	string Name = 1;
	optional google.protobuf.Struct Properties = 2;
}

// AuthorizationCheck Request

// AuthorizationModelRequest is the input context for making the authorization decision.
message AuthorizationModelRequest {
	int64 ZoneID = 1;
	PolicyStore PolicyStore = 2;
	optional Principal Principal = 3;
	optional Entities Entities = 4;
}

// EvaluationRequest represents the request to evaluate the authorization decision.
message EvaluationRequest {
	optional string RequestID = 1;
	optional Subject Subject = 2;
	optional Resource Resource = 3;
	optional Action Action = 4;
	optional google.protobuf.Struct Context = 5;
}

// AuthorizationCheckRequest represents the request to perform an authorization decision.
message AuthorizationCheckRequest {
	AuthorizationModelRequest AuthorizationModel = 1;
	optional string RequestID = 2;
	optional Subject Subject = 3;
	optional Resource Resource = 4;
	optional Action Action = 5;
	optional google.protobuf.Struct Context = 6;
	repeated EvaluationRequest Evaluations = 7;
}

// AuthorizationCheck Response

 // ReasonResponse provides the rationale for the response.
message ReasonResponse {
	string Code = 1;
	string Message = 2;
}

// ContextResponse represents the context included in the response.
message ContextResponse {
	string ID = 1;
	ReasonResponse ReasonAdmin = 2;
	ReasonResponse ReasonUser = 3;
}

// EvaluationResponse represents the result of the evaluation process.
message EvaluationResponse {
	bool Decision = 1;
	optional string RequestID = 2;
	optional ContextResponse Context = 3;
}

// AuthorizationCheckResponse represents the outcome of the authorization decision.
message AuthorizationCheckResponse {
	bool Decision = 1;
	optional string RequestID = 2;
	optional ContextResponse Context = 3;
	repeated EvaluationResponse Evaluations = 4;
}

// V1PDPService	is the service for the Policy Decision Point.
service V1PDPService {
	rpc AuthorizationCheck(AuthorizationCheckRequest) returns (AuthorizationCheckResponse) {}
}
