syntax = "proto3";

package linkedca;

option go_package = "go.step.sm/linkedca";

import "google/protobuf/timestamp.proto";
import "policy.proto";

message Provisioner {
	enum Type {
		NOOP = 0;
		JWK = 1;
		OIDC = 2;
		GCP = 3;
		AWS = 4;
		AZURE = 5;
		ACME = 6;
		X5C = 7;
		K8SSA = 8;
		SSHPOP = 9;
		SCEP = 10;
		NEBULA = 11;
	}
	string id = 1;
	string authority_id = 2;
	Type type = 3;
	string name = 4;
	ProvisionerDetails details = 5;
	Claims claims = 6;
	Template x509_template = 7;
	Template ssh_template = 8;
	google.protobuf.Timestamp created_at = 9;
	google.protobuf.Timestamp deleted_at = 10;
	Policy policy = 11;
	repeated Webhook webhooks = 12;
}

message ProvisionerIdentity {
	string id = 1;
	Provisioner.Type type = 2;
	string name = 3;
}

message ProvisionerDetails {
	oneof data {
		JWKProvisioner JWK = 20;
		OIDCProvisioner OIDC = 21;
		GCPProvisioner GCP = 22;
		AWSProvisioner AWS = 23;
		AzureProvisioner Azure = 24;
		ACMEProvisioner ACME = 25;
		X5CProvisioner X5C = 26;
		K8sSAProvisioner K8sSA = 27;
		SSHPOPProvisioner SSHPOP = 28;
		SCEPProvisioner SCEP = 29;
		NebulaProvisioner Nebula = 30;
	}
}

message ProvisionerList {
	repeated Provisioner provisioners = 1;
}

message Claims {
	X509Claims x509 = 1;
	SSHClaims ssh = 2;
	bool disable_renewal = 3;
	bool allow_renewal_after_expiry = 4;
}

message X509Claims {
	bool enabled = 1;
	Durations durations = 2;
}

message SSHClaims {
	bool enabled = 1;
	Durations user_durations = 2;
	Durations host_durations = 3;
}

message Durations {
	string default = 1;
	string min = 2;
	string max = 3;
}

message Template {
	bytes template = 1;
	bytes data = 2;
}

message JWKProvisioner {
	bytes public_key = 1;
	bytes encrypted_private_key = 2;
}

message OIDCProvisioner {
	string client_id = 1;
	string client_secret = 2;
	string configuration_endpoint = 3;
	repeated string admins = 4;
	repeated string domains = 5;
	repeated string groups = 6;
	string listen_address = 7;
	string tenant_id = 8;
}

message GCPProvisioner {
	repeated string service_accounts = 1;
	repeated string project_ids = 2;
	bool disable_custom_sans = 3;
	bool disable_trust_on_first_use = 4;
	string instance_age = 5;
}

message AWSProvisioner {
	repeated string accounts = 1;
	bool disable_custom_sans = 2;
	bool disable_trust_on_first_use = 3;
	string instance_age = 4;
}

message AzureProvisioner {
	string tenant_id = 1;
	repeated string resource_groups = 2;
	string audience = 3;
	bool disable_custom_sans = 4;
	bool disable_trust_on_first_use = 5;
	repeated string subscription_ids = 6;
	repeated string object_ids = 7;
}

message ACMEProvisioner {
	enum ChallengeType {
		UNKNOWN     = 0;
		HTTP_01     = 1;
		DNS_01      = 2;
		TLS_ALPN_01 = 3;
		DEVICE_ATTEST_01 = 4;
	}
	enum AttestationFormatType {
		NONE = 0;
		APPLE = 1;
		STEP  = 2;
		TPM   = 3;
	}
	bool force_cn = 1;
	bool require_eab = 2;
	repeated ChallengeType challenges = 3;
	repeated AttestationFormatType attestation_formats = 4;
	repeated bytes attestation_roots = 5;
	string terms_of_service = 6;
	string website = 7;
	repeated string caa_identities = 8;
}

message X5CProvisioner {
	repeated bytes roots = 1;
}

message K8sSAProvisioner {
	repeated bytes public_keys = 1;
}

message SSHPOPProvisioner {}

message SCEPProvisioner {
	bool force_cn = 1;
	string challenge = 2;
	repeated string capabilities = 3;
	int32 minimum_public_key_length = 4;
	bool include_root = 5;
	int32 encryption_algorithm_identifier = 6;
}

message NebulaProvisioner {
	repeated bytes roots = 1;
}

message BasicAuth {
	string username = 1;
	string password = 2;
}

message BearerToken {
	string bearer_token = 1;
}

message Webhook {
	enum Kind {
		NO_KIND = 0;
		ENRICHING = 1;
		AUTHORIZING = 2;
	}
	enum CertType {
		ALL = 0;
		X509 = 1;
		SSH = 2;
	}
	string name = 1;
	string id = 2;
	string url = 3;
	Kind kind = 4;
	string secret = 5;
	oneof auth {
		BearerToken bearer_token = 6;
		BasicAuth basic_auth = 7;
	}
	bool disable_tls_client_auth = 8;
	CertType cert_type = 9;
}