# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
"""Client and server classes corresponding to protobuf-defined services."""
import grpc

from ai.stigmer.iam.iampolicy.v1 import api_pb2 as ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2
from ai.stigmer.iam.iampolicy.v1 import spec_pb2 as ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2
from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2


class IamPolicyCommandControllerStub(object):
    """IAM Policy Command Controller

    This service manages the lifecycle of IAM policies in Stigmer.
    IAM policies define access control rules by connecting three key elements:
    - Principal: WHO gets access (user, team, etc.)
    - Resource: WHAT is being accessed (any API resource)
    - Relation: HOW they can access it (viewer, admin, user, etc.)

    Under the hood, each IAM policy creates an OpenFGA tuple that enforces
    the permission in the authorization system.

    Common Use Cases:
    - Granting users access to organizations
    - Setting up team-based access control
    - Managing fine-grained permissions on any resource
    """

    def __init__(self, channel):
        """Constructor.

        Args:
            channel: A grpc.Channel.
        """
        self.create = channel.unary_unary(
                '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/create',
                request_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
                response_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
                _registered_method=True)
        self.delete = channel.unary_unary(
                '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/delete',
                request_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
                response_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
                _registered_method=True)
        self.bootstrapPolicy = channel.unary_unary(
                '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/bootstrapPolicy',
                request_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
                response_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
                _registered_method=True)
        self.cleanupResourcePolicies = channel.unary_unary(
                '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/cleanupResourcePolicies',
                request_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.ApiResourceRef.SerializeToString,
                response_deserializer=google_dot_protobuf_dot_empty__pb2.Empty.FromString,
                _registered_method=True)


class IamPolicyCommandControllerServicer(object):
    """IAM Policy Command Controller

    This service manages the lifecycle of IAM policies in Stigmer.
    IAM policies define access control rules by connecting three key elements:
    - Principal: WHO gets access (user, team, etc.)
    - Resource: WHAT is being accessed (any API resource)
    - Relation: HOW they can access it (viewer, admin, user, etc.)

    Under the hood, each IAM policy creates an OpenFGA tuple that enforces
    the permission in the authorization system.

    Common Use Cases:
    - Granting users access to organizations
    - Setting up team-based access control
    - Managing fine-grained permissions on any resource
    """

    def create(self, request, context):
        """Create a new IAM policy

        Creates a single IAM policy that grants a principal access to a resource with a specific relation.
        This is the fundamental operation for establishing permissions.

        The operation:
        1. Validates the input (principal, resource, relation are all valid)
        2. Checks for duplicates (skips if the exact policy already exists, idempotent)
        3. Creates the policy in the database with auto-generated ID and metadata
        4. Writes the corresponding tuple to OpenFGA (where authorization is enforced)

        Authorization:
        - Caller must have 'can_grant_access' permission on the RESOURCE being shared
        - This ensures only resource owners/admins can grant access to their resources

        Example:
        Input:
        principal: {kind: "identity_account", id: "ia-alice-123"}
        resource: {kind: "organization", id: "org-demo-456"}
        relation: "viewer"
        Result:
        Created IamPolicy with auto-generated ID (e.g., "iamp-01HQ...")
        Alice can view (but not modify) the organization

        Input: IamPolicySpec containing principal, resource, and relation
        Output: The created IamPolicy with generated ID and metadata
        """
        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
        context.set_details('Method not implemented!')
        raise NotImplementedError('Method not implemented!')

    def delete(self, request, context):
        """Delete a single IAM policy by spec

        Removes an existing IAM policy by matching the principal, resource, and relation.
        This is a surgical operation - it removes one specific policy without affecting others.

        The operation:
        1. Finds the policy by matching principal+resource+relation
        2. Removes it from the database
        3. Deletes the corresponding tuple from OpenFGA
        4. If no matching policy exists, the operation is idempotent (no error)

        Authorization:
        - Caller must have 'can_grant_access' permission on the RESOURCE referenced in the policy

        Use Cases:
        - Revoking a specific permission from a user
        - Removing access after a team member leaves
        - Cleaning up individual policies

        Example:
        Input:
        principal: {kind: "identity_account", id: "ia-alice-123"}
        resource: {kind: "organization", id: "org-demo-456"}
        relation: "viewer"
        Result: The policy granting Alice viewer access to the organization is deleted

        Input: IamPolicySpec identifying the policy to delete (principal, resource, relation)
        Output: The deleted IamPolicy object (for audit/confirmation purposes)
        """
        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
        context.set_details('Method not implemented!')
        raise NotImplementedError('Method not implemented!')

    def bootstrapPolicy(self, request, context):
        """Bootstrap IAM policy during resource creation

        Creates IAM policies during resource creation when standard authorization cannot work yet
        because no tuples exist. This solves the chicken-and-egg problem where creating the first
        policy for a resource requires authorization, but authorization requires that first policy.

        The operation:
        1. Validates that caller has can_bootstrap_iam permission on platform:stigmer
        2. Validates the input (principal, resource, relation are all valid)
        3. Checks for duplicates (skips if the exact policy already exists, idempotent)
        4. Creates the policy in the database with auto-generated ID and metadata
        5. Writes the corresponding tuple to OpenFGA (where authorization is enforced)

        Authorization:
        - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
        - This is typically only called by resource creation handlers running as machine accounts

        Use Cases:
        - Creating scope links (agent#organization@organization:acme) during agent creation
        - Creating owner relations (agent#owner@identity_account:alice) during agent creation
        - Establishing initial authorization tuples for any newly created resource

        Example:
        Input:
        principal: {kind: "organization", id: "org-demo-123"}
        resource: {kind: "agent", id: "agt-abc-456"}
        relation: "organization"
        Result:
        Created IamPolicy establishing agent's organization scope
        Subsequent IAM policy operations can now use standard authorization

        Note: After the bootstrap policies are created, subsequent IAM policy modifications
        must use the standard 'create' RPC which requires 'can_grant_access' permission.

        Input: IamPolicySpec containing principal, resource, and relation
        Output: The created IamPolicy with generated ID and metadata
        """
        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
        context.set_details('Method not implemented!')
        raise NotImplementedError('Method not implemented!')

    def cleanupResourcePolicies(self, request, context):
        """Cleanup all IAM policies for a deleted resource

        This is a system-level cleanup operation that removes all IAM policies
        associated with a deleted resource. It performs bidirectional cleanup:
        1. Policies where resource is the TARGET (policies granting access TO this resource)
        2. Policies where resource is the PRINCIPAL (policies where this resource HAS access)

        The operation:
        1. Validates can_bootstrap_iam permission on platform:stigmer
        2. Finds all policies where resource_id appears (as principal OR resource)
        3. Deletes all matching policies from MongoDB
        4. Removes all corresponding tuples from OpenFGA
        5. Returns Empty (idempotent if no policies exist)

        Authorization:
        - Caller must have 'can_bootstrap_iam' permission on platform:stigmer
        - This is typically only granted to platform services

        Use Cases:
        - Resource deletion cleanup
        - Preventing orphaned FGA tuples
        - Maintaining authorization system integrity

        Example:
        Input: {kind: "organization", id: "org-demo-123"}
        Result: All policies referencing org-demo-123 are deleted

        Input: ApiResourceRef with resource kind and ID
        Output: Empty (google.protobuf.Empty)
        """
        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
        context.set_details('Method not implemented!')
        raise NotImplementedError('Method not implemented!')


def add_IamPolicyCommandControllerServicer_to_server(servicer, server):
    rpc_method_handlers = {
            'create': grpc.unary_unary_rpc_method_handler(
                    servicer.create,
                    request_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.FromString,
                    response_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.SerializeToString,
            ),
            'delete': grpc.unary_unary_rpc_method_handler(
                    servicer.delete,
                    request_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.FromString,
                    response_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.SerializeToString,
            ),
            'bootstrapPolicy': grpc.unary_unary_rpc_method_handler(
                    servicer.bootstrapPolicy,
                    request_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.FromString,
                    response_serializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.SerializeToString,
            ),
            'cleanupResourcePolicies': grpc.unary_unary_rpc_method_handler(
                    servicer.cleanupResourcePolicies,
                    request_deserializer=ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.ApiResourceRef.FromString,
                    response_serializer=google_dot_protobuf_dot_empty__pb2.Empty.SerializeToString,
            ),
    }
    generic_handler = grpc.method_handlers_generic_handler(
            'ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController', rpc_method_handlers)
    server.add_generic_rpc_handlers((generic_handler,))
    server.add_registered_method_handlers('ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController', rpc_method_handlers)


 # This class is part of an EXPERIMENTAL API.
class IamPolicyCommandController(object):
    """IAM Policy Command Controller

    This service manages the lifecycle of IAM policies in Stigmer.
    IAM policies define access control rules by connecting three key elements:
    - Principal: WHO gets access (user, team, etc.)
    - Resource: WHAT is being accessed (any API resource)
    - Relation: HOW they can access it (viewer, admin, user, etc.)

    Under the hood, each IAM policy creates an OpenFGA tuple that enforces
    the permission in the authorization system.

    Common Use Cases:
    - Granting users access to organizations
    - Setting up team-based access control
    - Managing fine-grained permissions on any resource
    """

    @staticmethod
    def create(request,
            target,
            options=(),
            channel_credentials=None,
            call_credentials=None,
            insecure=False,
            compression=None,
            wait_for_ready=None,
            timeout=None,
            metadata=None):
        return grpc.experimental.unary_unary(
            request,
            target,
            '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/create',
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
            options,
            channel_credentials,
            insecure,
            call_credentials,
            compression,
            wait_for_ready,
            timeout,
            metadata,
            _registered_method=True)

    @staticmethod
    def delete(request,
            target,
            options=(),
            channel_credentials=None,
            call_credentials=None,
            insecure=False,
            compression=None,
            wait_for_ready=None,
            timeout=None,
            metadata=None):
        return grpc.experimental.unary_unary(
            request,
            target,
            '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/delete',
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
            options,
            channel_credentials,
            insecure,
            call_credentials,
            compression,
            wait_for_ready,
            timeout,
            metadata,
            _registered_method=True)

    @staticmethod
    def bootstrapPolicy(request,
            target,
            options=(),
            channel_credentials=None,
            call_credentials=None,
            insecure=False,
            compression=None,
            wait_for_ready=None,
            timeout=None,
            metadata=None):
        return grpc.experimental.unary_unary(
            request,
            target,
            '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/bootstrapPolicy',
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.IamPolicySpec.SerializeToString,
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_api__pb2.IamPolicy.FromString,
            options,
            channel_credentials,
            insecure,
            call_credentials,
            compression,
            wait_for_ready,
            timeout,
            metadata,
            _registered_method=True)

    @staticmethod
    def cleanupResourcePolicies(request,
            target,
            options=(),
            channel_credentials=None,
            call_credentials=None,
            insecure=False,
            compression=None,
            wait_for_ready=None,
            timeout=None,
            metadata=None):
        return grpc.experimental.unary_unary(
            request,
            target,
            '/ai.stigmer.iam.iampolicy.v1.IamPolicyCommandController/cleanupResourcePolicies',
            ai_dot_stigmer_dot_iam_dot_iampolicy_dot_v1_dot_spec__pb2.ApiResourceRef.SerializeToString,
            google_dot_protobuf_dot_empty__pb2.Empty.FromString,
            options,
            channel_credentials,
            insecure,
            call_credentials,
            compression,
            wait_for_ready,
            timeout,
            metadata,
            _registered_method=True)
