// Copyright 2020-2026 Buf Technologies, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package buf.alpha.registry.v1alpha1;

import "buf/alpha/registry/v1alpha1/role.proto";

// AuthzService supplies authorization helpers.
service AuthzService {
  // UserCanCreateOrganizationRepository returns whether the user is authorized
  // to create repositories in an organization.
  rpc UserCanCreateOrganizationRepository(UserCanCreateOrganizationRepositoryRequest) returns (UserCanCreateOrganizationRepositoryResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanSeeRepositorySettings returns whether the user is authorized
  // to see repository settings.
  rpc UserCanSeeRepositorySettings(UserCanSeeRepositorySettingsRequest) returns (UserCanSeeRepositorySettingsResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanSeeOrganizationSettings returns whether the user is authorized
  // to see organization settings.
  rpc UserCanSeeOrganizationSettings(UserCanSeeOrganizationSettingsRequest) returns (UserCanSeeOrganizationSettingsResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanAddOrganizationMember returns whether the user is authorized to add
  // any members to the organization and the list of roles they can add.
  rpc UserCanAddOrganizationMember(UserCanAddOrganizationMemberRequest) returns (UserCanAddOrganizationMemberResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanUpdateOrganizationMember returns whether the user is authorized to update
  // any members' membership information in the organization and the list of roles they can update.
  rpc UserCanUpdateOrganizationMember(UserCanUpdateOrganizationMemberRequest) returns (UserCanUpdateOrganizationMemberResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanRemoveOrganizationMember returns whether the user is authorized to remove
  // any members from the organization and the list of roles they can remove.
  rpc UserCanRemoveOrganizationMember(UserCanRemoveOrganizationMemberRequest) returns (UserCanRemoveOrganizationMemberResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanDeleteOrganization returns whether the user is authorized
  // to delete an organization.
  rpc UserCanDeleteOrganization(UserCanDeleteOrganizationRequest) returns (UserCanDeleteOrganizationResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanDeleteRepository returns whether the user is authorized
  // to delete a repository.
  rpc UserCanDeleteRepository(UserCanDeleteRepositoryRequest) returns (UserCanDeleteRepositoryResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanDeleteUser returns whether the user is authorized
  // to delete a user.
  rpc UserCanDeleteUser(UserCanDeleteUserRequest) returns (UserCanDeleteUserResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanSeeServerAdminPanel returns whether the user is authorized
  // to see server admin panel.
  rpc UserCanSeeServerAdminPanel(UserCanSeeServerAdminPanelRequest) returns (UserCanSeeServerAdminPanelResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanManageRepositoryContributors returns whether the user is authorized to manage
  // any contributors to the repository and the list of roles they can manage.
  rpc UserCanManageRepositoryContributors(UserCanManageRepositoryContributorsRequest) returns (UserCanManageRepositoryContributorsResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // UserCanReviewCommits returns whether the user is authorized to review
  // commits within a repository.
  rpc UserCanReviewCommits(UserCanReviewCommitsRequest) returns (UserCanReviewCommitsResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
}

message UserCanCreateOrganizationRepositoryRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanCreateOrganizationRepositoryResponse {
  bool authorized = 1;
}

message UserCanSeeRepositorySettingsRequest {
  // The ID of the repository for which to check
  // whether the user is authorized.
  string repository_id = 1;
}

message UserCanSeeRepositorySettingsResponse {
  bool authorized = 1;
}

message UserCanSeeOrganizationSettingsRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanSeeOrganizationSettingsResponse {
  bool authorized = 1;
}

message UserCanAddOrganizationMemberRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanAddOrganizationMemberResponse {
  // The list of roles that the user is authorized to add, empty list means the user is
  // not authorized to add any members.
  repeated OrganizationRole authorized_roles = 1;
}

message UserCanUpdateOrganizationMemberRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanUpdateOrganizationMemberResponse {
  // The list of roles that the user is authorized to update (from and to), empty list means the user is
  // not authorized to update any members' role.
  repeated OrganizationRole authorized_roles = 1;
}

message UserCanRemoveOrganizationMemberRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanRemoveOrganizationMemberResponse {
  // The list of roles that the user is authorized to remove, empty list means the user is
  // not authorized to remove any members.
  repeated OrganizationRole authorized_roles = 1;
}

message UserCanDeleteOrganizationRequest {
  // The ID of the organization for which to check
  // whether the user is authorized.
  string organization_id = 1;
}

message UserCanDeleteOrganizationResponse {
  bool authorized = 1;
}

message UserCanDeleteRepositoryRequest {
  // The ID of the repository for which to check
  // whether the user is authorized.
  string repository_id = 1;
}

message UserCanDeleteRepositoryResponse {
  bool authorized = 1;
}

message UserCanDeleteUserRequest {}

message UserCanDeleteUserResponse {
  bool authorized = 1;
}

message UserCanSeeServerAdminPanelRequest {}

message UserCanSeeServerAdminPanelResponse {
  bool authorized = 1;
}

message UserCanManageRepositoryContributorsRequest {
  // The ID of the repository for which to check
  // whether the user is authorized.
  string repository_id = 1;
}

message UserCanManageRepositoryContributorsResponse {
  // The list of roles that the user is authorized to manage, empty list means the user is
  // not authorized to manage any contributors.
  repeated RepositoryRole authorized_roles = 1;
}

message UserCanReviewCommitsRequest {
  // The ID of the repository for which to check
  // whether the user is authorized.
  string repository_id = 1;
}

message UserCanReviewCommitsResponse {
  bool authorized = 1;
}
