// Copyright 2020-2026 Buf Technologies, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package buf.alpha.audit.v1alpha1;

import "buf/alpha/registry/v1alpha1/admin.proto";
import "buf/alpha/registry/v1alpha1/repository.proto";
import "buf/alpha/registry/v1alpha1/role.proto";
import "google/protobuf/timestamp.proto";

// ActorType is the type of actor that caused the audited event.
enum ActorType {
  ACTOR_TYPE_UNSPECIFIED = 0;
  ACTOR_TYPE_USER = 1;
  ACTOR_TYPE_SYSTEM = 2;
}

// Actor is the actor who caused the audited event.
message Actor {
  // Type of actor who caused the audited event.
  ActorType type = 1;
  // Id of the actor who caused the audited event.
  string id = 2;
  // Name of the actor who caused the audited event.
  string name = 3;
}

// ResourceType is the type of the resource that was affected by the audited event.
//
// [#next-free-field: 24]
enum ResourceType {
  RESOURCE_TYPE_UNSPECIFIED = 0;
  RESOURCE_TYPE_USER = 1;
  RESOURCE_TYPE_ORGANIZATION = 2;
  RESOURCE_TYPE_ORGANIZATION_MEMBER = 3;
  RESOURCE_TYPE_ORGANIZATION_IDP_GROUP = 9;
  RESOURCE_TYPE_REPOSITORY = 4;
  RESOURCE_TYPE_REPOSITORY_CONTRIBUTOR = 5;
  RESOURCE_TYPE_REPOSITORY_COMMIT = 6;
  RESOURCE_TYPE_REPOSITORY_IDP_GROUP = 18;
  RESOURCE_TYPE_POLICY = 17;
  RESOURCE_TYPE_POLICY_COMMIT = 19;
  RESOURCE_TYPE_POLICY_LABEL = 20;
  RESOURCE_TYPE_POLICY_ENFORCEMENT = 22;
  RESOURCE_TYPE_PLUGIN = 7;
  RESOURCE_TYPE_PLUGIN_COMMIT = 15;
  RESOURCE_TYPE_CURATED_PLUGIN = 8;
  RESOURCE_TYPE_TOKEN = 10;
  RESOURCE_TYPE_SCIM_TOKEN = 11;
  RESOURCE_TYPE_REPOSITORY_LABEL = 12;
  RESOURCE_TYPE_SERVER = 13;
  RESOURCE_TYPE_DEVICE_AUTHORIZATION_GRANT = 14;
  RESOURCE_TYPE_PLUGIN_LABEL = 16;
  RESOURCE_TYPE_SDK_PLUGIN_CONSTRAINT = 21;
  RESOURCE_TYPE_AUTHORIZATION_REQUEST = 23;
}

// Resource is the affected resource by the audited event.
message Resource {
  // Type of resource that was affected by the audited event.
  ResourceType type = 1;
  // Id of the affected resource by the audited event.
  string id = 2;
  // Name of the affected resource by the audited event.
  string name = 3;
}

// EventType is the type of audited event.
//
// [#next-free-field: 86]
enum EventType {
  EVENT_TYPE_UNSPECIFIED = 0;
  EVENT_TYPE_ORGANIZATION_CREATED = 1;
  EVENT_TYPE_ORGANIZATION_DELETED = 2;
  EVENT_TYPE_ORGANIZATION_MEMBER_ADDED = 3;
  EVENT_TYPE_ORGANIZATION_MEMBER_ROLE_CHANGED = 4 [deprecated = true];
  EVENT_TYPE_ORGANIZATION_MEMBER_ROLES_CHANGED = 50;
  EVENT_TYPE_ORGANIZATION_MEMBER_REMOVED = 5;
  EVENT_TYPE_ORGANIZATION_IDP_GROUP_ADDED = 21;
  EVENT_TYPE_ORGANIZATION_IDP_GROUP_UPDATED = 59;
  EVENT_TYPE_ORGANIZATION_IDP_GROUP_REMOVED = 22;
  EVENT_TYPE_ORGANIZATION_RESOURCE_VISIBILITY_CONTROL_CHANGED = 81;
  EVENT_TYPE_ORGANIZATION_UNIQUENESS_POLICY_ENABLED = 82;
  EVENT_TYPE_ORGANIZATION_UNIQUENESS_POLICY_DISABLED = 83;
  EVENT_TYPE_REPOSITORY_CREATED = 6;
  EVENT_TYPE_REPOSITORY_DEPRECATED = 48;
  EVENT_TYPE_REPOSITORY_UNDEPRECATED = 49;
  EVENT_TYPE_REPOSITORY_DELETED = 7;
  EVENT_TYPE_REPOSITORY_COMMIT_PUSHED = 8;
  EVENT_TYPE_REPOSITORY_CONTRIBUTOR_ADDED = 9;
  EVENT_TYPE_REPOSITORY_CONTRIBUTOR_ROLE_CHANGED = 10;
  EVENT_TYPE_REPOSITORY_CONTRIBUTOR_ROLES_CHANGED = 63;
  EVENT_TYPE_REPOSITORY_CONTRIBUTOR_REMOVED = 11;
  EVENT_TYPE_REPOSITORY_VISIBILITY_CHANGED = 12;
  EVENT_TYPE_REPOSITORY_DEFAULT_LABEL_NAME_CHANGED = 40;
  EVENT_TYPE_REPOSITORY_IDP_GROUP_ADDED = 60;
  EVENT_TYPE_REPOSITORY_IDP_GROUP_UPDATED = 61;
  EVENT_TYPE_REPOSITORY_IDP_GROUP_REMOVED = 62;
  EVENT_TYPE_POLICY_CREATED = 54;
  EVENT_TYPE_POLICY_DELETED = 55;
  EVENT_TYPE_POLICY_DEPRECATED = 56;
  EVENT_TYPE_POLICY_UNDEPRECATED = 57;
  EVENT_TYPE_POLICY_VISIBILITY_CHANGED = 58;
  EVENT_TYPE_POLICY_COMMIT_PUSHED = 64;
  EVENT_TYPE_POLICY_LABEL_CREATED = 65;
  EVENT_TYPE_POLICY_LABEL_MOVED = 66;
  EVENT_TYPE_POLICY_LABEL_ARCHIVED = 67;
  EVENT_TYPE_POLICY_LABEL_UNARCHIVED = 68;
  EVENT_TYPE_PLUGIN_CREATED = 13;
  EVENT_TYPE_PLUGIN_DELETED = 14;
  EVENT_TYPE_PLUGIN_DEPRECATED = 51;
  EVENT_TYPE_PLUGIN_UNDEPRECATED = 52;
  EVENT_TYPE_PLUGIN_VISIBILITY_CHANGED = 53;
  EVENT_TYPE_PLUGIN_COMMIT_PUSHED = 43;
  EVENT_TYPE_CURATED_PLUGIN_CREATED = 20;
  EVENT_TYPE_CURATED_PLUGIN_DELETED = 31;
  EVENT_TYPE_CURATED_PLUGIN_STATUS_UPDATED = 78;
  EVENT_TYPE_USER_CREATED = 15;
  EVENT_TYPE_USER_DELETED = 16;
  EVENT_TYPE_USER_DEACTIVATED = 17;
  EVENT_TYPE_USER_LOGGED_IN = 18;
  EVENT_TYPE_USER_LOGGED_OUT = 19;
  EVENT_TYPE_TOKEN_CREATED = 23;
  EVENT_TYPE_TOKEN_DELETED = 24;
  EVENT_TYPE_USER_REACTIVATED = 25;
  EVENT_TYPE_SCIM_TOKEN_CREATED = 26;
  EVENT_TYPE_SCIM_TOKEN_DELETED = 27;
  EVENT_TYPE_REPOSITORY_COMMIT_DELETED = 28 [deprecated = true];
  EVENT_TYPE_REPOSITORY_LABEL_CREATED = 29;
  EVENT_TYPE_REPOSITORY_LABEL_MOVED = 30;
  EVENT_TYPE_REPOSITORY_LABEL_ARCHIVED = 38;
  EVENT_TYPE_REPOSITORY_LABEL_UNARCHIVED = 39;
  EVENT_TYPE_REPOSITORY_LABEL_ENFORCEMENT_IGNORES_CHANGED = 79;
  EVENT_TYPE_SERVER_BREAKING_CHANGE_POLICY_ENABLED = 32;
  EVENT_TYPE_SERVER_BREAKING_CHANGE_POLICY_DISABLED = 33;
  EVENT_TYPE_REPOSITORY_DEFAULT_BRANCH_CHANGED = 34 [deprecated = true];
  EVENT_TYPE_SERVER_UNIQUENESS_POLICY_ENABLED = 35;
  EVENT_TYPE_SERVER_UNIQUENESS_POLICY_DISABLED = 36;
  EVENT_TYPE_SERVER_RESOURCE_VISIBILITY_CONTROL_CHANGED = 80;
  EVENT_TYPE_USER_AUTO_MERGED_FROM_NEW_IDP = 37;
  EVENT_TYPE_DEVICE_AUTHORIZATION_GRANT_APPROVED = 41;
  EVENT_TYPE_DEVICE_AUTHORIZATION_GRANT_DENIED = 42;
  EVENT_TYPE_PLUGIN_LABEL_CREATED = 44;
  EVENT_TYPE_PLUGIN_LABEL_MOVED = 45;
  EVENT_TYPE_PLUGIN_LABEL_ARCHIVED = 46;
  EVENT_TYPE_PLUGIN_LABEL_UNARCHIVED = 47;
  EVENT_TYPE_SERVER_REVIEW_FLOW_ENABLED = 69;
  EVENT_TYPE_SERVER_REVIEW_FLOW_DISABLED = 70;
  EVENT_TYPE_SDK_PLUGIN_CONSTRAINT_CREATED = 71;
  EVENT_TYPE_SDK_PLUGIN_CONSTRAINT_UPDATED = 72;
  EVENT_TYPE_SDK_PLUGIN_CONSTRAINT_DELETED = 73;
  EVENT_TYPE_POLICY_ENFORCEMENT_CREATED = 74;
  EVENT_TYPE_POLICY_ENFORCEMENT_DELETED = 75;
  EVENT_TYPE_POLICY_ENFORCEMENT_POLICY_CHANGED = 76;
  EVENT_TYPE_POLICY_ENFORCEMENT_TARGETS_CHANGED = 77;
  EVENT_TYPE_AUTHORIZATION_REQUEST_APPROVED = 84;
  EVENT_TYPE_AUTHORIZATION_REQUEST_DENIED = 85;
}

// EventMetadata provides additional details about the audited event.
message EventMetadata {
  // UserAgent is the User-Agent header associated with the request that triggered the audited event, if any.
  string user_agent = 1;
  // IP is the IP address associated with the request that triggered the audited event, if any.
  string ip = 2;
  // TraceID is the ID of the trace associated with the audited event, if any.
  string trace_id = 3;
}

// Event is an audited action that happened in the BSR, with the information of what happened, when
// it happened, who did it, which resource was affected, and more contextual information on the
// event.
//
// [#next-free-field: 92]
message Event {
  // Unique id of the audited event.
  string event_id = 1;
  // Type of the audited event. It specifies "what" happened.
  EventType type = 2;
  // Actor of the audited event. It specifies "who" did it.
  Actor actor = 3;
  // Resource of the audited event. It specifies "which resource" was affected.
  Resource resource = 4;
  // Time of the audited event. It specifies "when" it happened.
  google.protobuf.Timestamp event_time = 5;
  // Metadata about the audited event. It specifies any additional details about the audited event.
  EventMetadata metadata = 6;
  // Payload of the audited event. It specifies additional context on the event.
  oneof payload {
    PayloadOrganizationCreated organization_created = 7;
    PayloadOrganizationDeleted organization_deleted = 8;
    PayloadOrganizationMemberAdded organization_member_added = 9;
    PayloadOrganizationMemberRoleChanged organization_member_role_changed = 10;
    PayloadOrganizationMemberRolesChanged organization_member_roles_changed = 56;
    PayloadOrganizationMemberRemoved organization_member_removed = 11;
    PayloadOrganizationResourceVisibilityControlChanged organization_resource_visibility_control_changed = 87;
    PayloadOrganizationUniquenessPolicyEnabled organization_uniqueness_policy_enabled = 88;
    PayloadOrganizationUniquenessPolicyDisabled organization_uniqueness_policy_disabled = 89;
    PayloadRepositoryCreated repository_created = 12;
    PayloadRepositoryDeprecated repository_deprecated = 54;
    PayloadRepositoryUndeprecated repository_undeprecated = 55;
    PayloadRepositoryDeleted repository_deleted = 13;
    PayloadRepositoryCommitPushed repository_commit_pushed = 14;
    PayloadRepositoryContributorAdded repository_contributor_added = 15;
    PayloadRepositoryContributorRoleChanged repository_contributor_role_changed = 16;
    PayloadRepositoryContributorRolesChanged repository_contributor_roles_changed = 69;
    PayloadRepositoryContributorRemoved repository_contributor_removed = 17;
    PayloadRepositoryVisibilityChanged repository_visibility_changed = 18;
    PayloadRepositoryDefaultLabelNameChanged repository_default_label_name_changed = 46;
    PayloadRepositoryIDPGroupAdded repository_idp_group_added = 66;
    PayloadRepositoryIDPGroupUpdated repository_idp_group_updated = 67;
    PayloadRepositoryIDPGroupRemoved repository_idp_group_removed = 68;
    PayloadPolicyCreated policy_created = 60;
    PayloadPolicyDeleted policy_deleted = 61;
    PayloadPolicyDeprecated policy_deprecated = 62;
    PayloadPolicyUndeprecated policy_undeprecated = 63;
    PayloadPolicyVisibilityChanged policy_visibility_changed = 64;
    PayloadPolicyCommitPushed policy_commit_pushed = 70;
    PayloadPolicyLabelCreated policy_label_created = 71;
    PayloadPolicyLabelMoved policy_label_moved = 72;
    PayloadPolicyLabelArchived policy_label_archived = 73;
    PayloadPolicyLabelUnarchived policy_label_unarchived = 74;
    PayloadPluginCreated plugin_created = 19;
    PayloadPluginDeleted plugin_deleted = 20;
    PayloadPluginDeprecated plugin_deprecated = 57;
    PayloadPluginUndeprecated plugin_undeprecated = 58;
    PayloadPluginVisibilityChanged plugin_visibility_changed = 59;
    PayloadPluginCommitPushed plugin_commit_pushed = 49;
    PayloadUserCreated user_created = 21;
    PayloadUserDeactivated user_deactivated = 22;
    PayloadUserDeleted user_deleted = 23;
    PayloadUserLoggedIn user_logged_in = 24;
    PayloadUserLoggedOut user_logged_out = 25;
    PayloadCuratedPluginCreated curated_plugin_created = 26;
    PayloadOrganizationIDPGroupAdded idp_group_added = 27;
    PayloadOrganizationIDPGroupUpdated idp_group_updated = 65;
    PayloadOrganizationIDPGroupRemoved idp_group_removed = 28;
    PayloadTokenCreated token_created = 29;
    PayloadTokenDeleted token_deleted = 30;
    PayloadUserReactivated user_reactivated = 31;
    PayloadSCIMTokenCreated scim_token_created = 32;
    PayloadSCIMTokenDeleted scim_token_deleted = 33;
    PayloadRepositoryCommitDeleted repository_commit_deleted = 34 [deprecated = true];
    PayloadRepositoryLabelCreated repository_label_created = 35;
    PayloadRepositoryLabelMoved repository_label_moved = 36;
    PayloadRepositoryLabelArchived repository_label_archived = 44;
    PayloadRepositoryLabelUnarchived repository_label_unarchived = 45;
    PayloadRepositoryLabelEnforcementIgnoresChanged repository_label_enforcement_ignores_changed = 85;
    PayloadCuratedPluginDeleted curated_plugin_deleted = 37;
    PayloadCuratedPluginStatusUpdated curated_plugin_status_updated = 84;
    PayloadServerBreakingChangePolicyEnabled payload_server_breaking_change_policy_enabled = 38;
    PayloadServerBreakingChangePolicyDisabled payload_server_breaking_change_policy_disabled = 39;
    PayloadRepositoryDefaultBranchChanged repository_default_branch_changed = 40 [deprecated = true];
    PayloadServerUniquenessPolicyEnabled payload_server_uniqueness_policy_enabled = 41;
    PayloadServerUniquenessPolicyDisabled payload_server_uniqueness_policy_disabled = 42;
    PayloadServerResourceVisibilityControlChanged server_resource_visibility_control_changed = 86;
    PayloadUserAutoMergedFromNewIdP user_auto_merged_from_new_idp = 43;
    PayloadDeviceAuthorizationGrantApproved device_authorization_grant_approved = 47;
    PayloadDeviceAuthorizationGrantDenied device_authorization_grant_denied = 48;
    PayloadPluginLabelCreated plugin_label_created = 50;
    PayloadPluginLabelMoved plugin_label_moved = 51;
    PayloadPluginLabelArchived plugin_label_archived = 52;
    PayloadPluginLabelUnarchived plugin_label_unarchived = 53;
    PayloadServerReviewFlowEnabled server_review_flow_enabled = 75;
    PayloadServerReviewFlowDisabled server_review_flow_disabled = 76;
    PayloadSDKPluginConstraintCreated sdk_plugin_constraint_created = 77;
    PayloadSDKPluginConstraintUpdated sdk_plugin_constraint_updated = 78;
    PayloadSDKPluginConstraintDeleted sdk_plugin_constraint_deleted = 79;
    PayloadPolicyEnforcementCreated policy_enforcement_created = 80;
    PayloadPolicyEnforcementDeleted policy_enforcement_deleted = 81;
    PayloadPolicyEnforcementPolicyChanged policy_enforcement_policy_changed = 82;
    PayloadPolicyEnforcementTargetsChanged policy_enforcement_targets_changed = 83;
    PayloadAuthorizationRequestApproved authorization_request_approved = 90;
    PayloadAuthorizationRequestDenied authorization_request_denied = 91;
  }
}

message PayloadOrganizationCreated {}

message PayloadOrganizationDeleted {}

message PayloadOrganizationMemberAdded {
  // organization_id is the id of the organization with the new member.
  string organization_id = 1;
  // organization_name is the name of the organization with the new member.
  string organization_name = 2;
  // member_role is the role granted to the member added to the organization.
  buf.alpha.registry.v1alpha1.OrganizationRole member_role = 3;
  // member_role_source is the source of the role granted to the member.
  buf.alpha.registry.v1alpha1.OrganizationRoleSource member_role_source = 4;
}

message PayloadOrganizationMemberRoleChanged {
  // Deprecated, use PayloadOrganizationMemberRolesChanged instead.
  option deprecated = true;

  // organization_id is the id of the organization within which the role was changed.
  string organization_id = 1;
  // organization_name is the name of the organization within which the role was changed.
  string organization_name = 2;
  // old_role is the old role of the member whose role was changed.
  buf.alpha.registry.v1alpha1.OrganizationRole old_role = 3;
  // new_role is the new role of the member whose role was changed.
  buf.alpha.registry.v1alpha1.OrganizationRole new_role = 4;
  // old_member_role_source is the old source of the role granted to the member.
  buf.alpha.registry.v1alpha1.OrganizationRoleSource old_member_role_source = 5;
  // new_member_role_source is the new source of the role granted to the member.
  buf.alpha.registry.v1alpha1.OrganizationRoleSource new_member_role_source = 6;
}

message PayloadOrganizationMemberRolesChanged {
  message OrganizationRole {
    // role is the role of the member.
    buf.alpha.registry.v1alpha1.OrganizationRole role = 1;
    // source is the source of the role granted to the member.
    buf.alpha.registry.v1alpha1.OrganizationRoleSource source = 2;
  }
  // organization_id is the id of the organization within which the roles was changed.
  string organization_id = 1;
  // organization_name is the name of the organization within which the roles was changed.
  string organization_name = 2;
  // old_roles are the old roles of the member.
  repeated OrganizationRole old_roles = 3;
  // new_roles are the new roles of the member.
  repeated OrganizationRole new_roles = 4;
}

message PayloadOrganizationMemberRemoved {
  // organization_id is the id of the organization that the member was removed from.
  string organization_id = 1;
  // organization_name is the name of the organization that the member was removed from.
  string organization_name = 2;
  // member_role is the role that the member had when removed from the organization.
  buf.alpha.registry.v1alpha1.OrganizationRole member_role = 3;
  // member_role_source is the source of the role granted to the member.
  buf.alpha.registry.v1alpha1.OrganizationRoleSource member_role_source = 4;
}

message PayloadOrganizationIDPGroupAdded {
  // organization_id is the id of the organization with the new IDP group.
  string organization_id = 1;
  // organization_name is the name of the organization with the new IDP group.
  string organization_name = 2;
  // role_override is the role override associated with the new IDP group.
  buf.alpha.registry.v1alpha1.OrganizationRole role_override = 3;
}

message PayloadOrganizationIDPGroupUpdated {
  // organization_id is the id of the organization with the updated IDP group.
  string organization_id = 1;
  // organization_name is the name of the organization with the updated IDP group.
  string organization_name = 2;
  // old_role_override is the role override associated with the IDP updated group. Only set if the
  // role override was changed.
  buf.alpha.registry.v1alpha1.OrganizationRole old_role_override = 3;
  // new_role_override is the role override associated with the IDP updated group. Only set if the
  // role override was changed.
  buf.alpha.registry.v1alpha1.OrganizationRole new_role_override = 4;
}

message PayloadOrganizationIDPGroupRemoved {
  // organization_id is the id of the organization with the removed IDP group.
  string organization_id = 1;
  // organization_name is the name of the organization with the removed IDP group.
  string organization_name = 2;
  // role_override is the role override associated with the removed IDP group.
  buf.alpha.registry.v1alpha1.OrganizationRole role_override = 3;
}

message PayloadRepositoryCreated {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // visibility is the visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
  // default_label_name is the name of the default label for the repository.
  // If empty, the repository was created with the default label name of 'main'.
  string default_label_name = 4;
}

message PayloadRepositoryDeleted {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // visibility is the visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadRepositoryDeprecated {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // visibility is the visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
  // deprecation_message is the deprecation message set by the deprecation actor.
  string deprecation_message = 4;
}

message PayloadRepositoryUndeprecated {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // visibility is the visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadRepositoryCommitPushed {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // repository_id is the id of the repository within which the commit was created.
  string repository_id = 3;
  // repository_name is the name of the repository within which the commit was created.
  string repository_name = 4;
  // tags are the tags included in the push. Optional.
  repeated string tags = 5;
  // draft_name is the name of the draft. Optional.
  string draft_name = 6;
  // manifest_digest is the module's manifest digest.
  string manifest_digest = 7;
  // b5_digest is the module's b5 digest.
  string b5_digest = 8;
}

message PayloadRepositoryContributorAdded {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // repository_id is the id of the repository with the new contributor.
  string repository_id = 3;
  // repository_name is the name of the repository with the new contributor.
  string repository_name = 4;
  // contributor_role is the role granted to the contributor added to the repository.
  buf.alpha.registry.v1alpha1.RepositoryRole contributor_role = 5;
}

message PayloadRepositoryContributorRoleChanged {
  // Deprecated, use PayloadRepositoryContributorRolesChanged instead.
  option deprecated = true;

  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // repository_id is the id of the repository within which the role was changed.
  string repository_id = 3;
  // repository_name is the name of the repository within which the role was changed.
  string repository_name = 4;
  // old_role is the old role of the contributor whose role was changed.
  buf.alpha.registry.v1alpha1.RepositoryRole old_role = 5;
  // new_role is the new role of the contributor whose role was changed.
  buf.alpha.registry.v1alpha1.RepositoryRole new_role = 6;
}

message PayloadRepositoryContributorRolesChanged {
  message RepositoryRole {
    // role is the role of the member.
    buf.alpha.registry.v1alpha1.RepositoryRole role = 1;
    // source is the source of the role granted to the member.
    buf.alpha.registry.v1alpha1.RepositoryRoleSource source = 2;
  }
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // repository_id is the id of the repository within which the role was changed.
  string repository_id = 3;
  // repository_name is the name of the repository within which the role was changed.
  string repository_name = 4;
  // old_roles are the old roles of the contributor.
  repeated RepositoryRole old_roles = 5;
  // new_roles are the new roles of the contributor.
  repeated RepositoryRole new_roles = 6;
}

message PayloadRepositoryContributorRemoved {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // repository_id is the id of the repository that the contributor was removed from.
  string repository_id = 3;
  // repository_name is the name of the repository that the contributor was removed from.
  string repository_name = 4;
  // contributor_role is the role that the contributor had when removed from the repository.
  buf.alpha.registry.v1alpha1.RepositoryRole contributor_role = 5;
}

message PayloadRepositoryVisibilityChanged {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // old_visibility is the old visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility old_visibility = 3;
  // new_visibility is the new visibility of the repository.
  buf.alpha.registry.v1alpha1.Visibility new_visibility = 4;
}

message PayloadRepositoryDefaultLabelNameChanged {
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // old_default_label_name is the old default label name of the repository.
  string old_default_label_name = 3;
  // new_default_label_name is the new default label name of the repository.
  string new_default_label_name = 4;
}

// PayloadRepositoryDefaultBranchChanged is deprecated.
//
// Use PayloadRepositoryDefaultLabelNameChanged instead.
message PayloadRepositoryDefaultBranchChanged {
  // Deprecated, use PayloadRepositoryDefaultLabelNameChanged instead.
  option deprecated = true;
  // owner_id is the id of the owner of the repository.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository.
  string owner_name = 2;
  // old_default_branch is the old default branch of the repository.
  string old_default_branch = 3;
  // new_default_branch is the new default branch of the repository.
  string new_default_branch = 4;
}

message PayloadRepositoryIDPGroupAdded {
  // repository_id is the id of the repository with the new IDP group.
  string repository_id = 1;
  // repository_name is the name of the repository with the new IDP group.
  string repository_name = 2;
  // role_override is the role override associated with the new IDP group.
  buf.alpha.registry.v1alpha1.RepositoryRole role_override = 3;
}

message PayloadRepositoryIDPGroupUpdated {
  // repository_id is the id of the repository with the updated IDP group.
  string repository_id = 1;
  // repository_name is the name of the repository with the updated IDP group.
  string repository_name = 2;
  // old_role_override is the role override associated with the IDP updated group. Only set if the
  // role override was changed.
  buf.alpha.registry.v1alpha1.RepositoryRole old_role_override = 3;
  // new_role_override is the role override associated with the IDP updated group. Only set if the
  // role override was changed.
  buf.alpha.registry.v1alpha1.RepositoryRole new_role_override = 4;
}

message PayloadRepositoryIDPGroupRemoved {
  // repository_id is the id of the repository with the removed IDP group.
  string repository_id = 1;
  // repository_name is the name of the repository with the removed IDP group.
  string repository_name = 2;
  // role_override is the role override associated with the removed IDP group.
  buf.alpha.registry.v1alpha1.RepositoryRole role_override = 3;
}

message PayloadPolicyCreated {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // visibility is the visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadPolicyDeleted {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // visibility is the visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadPolicyDeprecated {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // visibility is the visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadPolicyUndeprecated {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // visibility is the visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility visibility = 3;
}

message PayloadPolicyVisibilityChanged {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // old_visibility is the old visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility old_visibility = 4;
  // new_visibility is the new visibility of the policy.
  buf.alpha.registry.v1alpha1.Visibility new_visibility = 5;
}

message PayloadPolicyCommitPushed {
  // owner_id is the id of the owner of the policy.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy.
  string owner_name = 2;
  // policy_id is the id of the policy within which the commit was created.
  string policy_id = 3;
  // policy_name is the name of the policy within which the commit was created.
  string policy_name = 4;
  // o1_digest is the o1 digest of the pushed policy commit.
  string o1_digest = 5;
}

message PayloadPluginCreated {
  // owner_id is the id of the owner of the plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin.
  string owner_name = 2;
  // plugin_type is the type of the plugin.
  string plugin_type = 3;
  // visibility is the visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility visibility = 4;
}

message PayloadPluginDeleted {
  // owner_id is the id of the owner of the check plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the check plugin.
  string owner_name = 2;
  // plugin_type is the type of the plugin.
  string plugin_type = 3;
  // visibility is the visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility visibility = 4;
}

message PayloadPluginDeprecated {
  // owner_id is the id of the owner of the check plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the check plugin.
  string owner_name = 2;
  // plugin_type is the type of the plugin.
  string plugin_type = 3;
  // visibility is the visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility visibility = 4;
}

message PayloadPluginUndeprecated {
  // owner_id is the id of the owner of the check plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the check plugin.
  string owner_name = 2;
  // plugin_type is the type of the plugin.
  string plugin_type = 3;
  // visibility is the visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility visibility = 4;
}

message PayloadPluginVisibilityChanged {
  // owner_id is the id of the owner of the check plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the check plugin.
  string owner_name = 2;
  // plugin_type is the type of the plugin.
  string plugin_type = 3;
  // old_visibility is the old visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility old_visibility = 4;
  // new_visibility is the new visibility of the plugin.
  buf.alpha.registry.v1alpha1.Visibility new_visibility = 5;
}

message PayloadPluginCommitPushed {
  // owner_id is the id of the owner of the plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin.
  string owner_name = 2;
  // plugin_id is the id of the plugin.
  string plugin_id = 3;
  // plugin_name is the name of the plugin.
  string plugin_name = 4;
  // p1_digest is the p1 digest of the pushed plugin commit.
  string p1_digest = 5;
}

message PayloadUserCreated {}

message PayloadUserReactivated {}

message PayloadUserDeactivated {}

message PayloadUserDeleted {}

message PayloadUserLoggedIn {}

message PayloadUserLoggedOut {}

// PayloadUserAutoMergedFromNewIdP is the payload for the audit event
// EVENT_TYPE_USER_AUTO_MERGED_FROM_NEW_IDP. It has no additional information
// to be included, since the new user is automatically merged to an existing user
// without the new user being created.
message PayloadUserAutoMergedFromNewIdP {}

message PayloadCuratedPluginCreated {
  // owner_id is the id of the owner of the plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin.
  string owner_name = 2;
}

message PayloadCuratedPluginDeleted {
  // owner_id is the id of the owner of the plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin.
  string owner_name = 2;
}

message PayloadCuratedPluginStatusUpdated {
  // owner_id is the id of the owner of the plugin.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin.
  string owner_name = 2;
  // new_status is the new status of the plugin.
  string new_status = 3;
}

message PayloadTokenCreated {
  // owner_id is the id of the owner of the token.
  string owner_id = 1;
  // token_expiry_time is the expiry time of the token.
  google.protobuf.Timestamp token_expiry_time = 2;
}

message PayloadTokenDeleted {
  // owner_id is the id of the owner of the token.
  string owner_id = 1;
}

message PayloadSCIMTokenCreated {
  // token_expiry_time is the expiry time of the token.
  google.protobuf.Timestamp token_expiry_time = 1;
}

message PayloadSCIMTokenDeleted {}

// PayloadRepositoryCommitDeleted is deprecated.
//
// Individual repository commits cannot be deleted.
message PayloadRepositoryCommitDeleted {
  // Deprecated, individual repository commits cannot be deleted.
  option deprecated = true;
  // owner_id is the id of the owner of the repository from which the commit will be deleted.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository from which the commit will be deleted.
  string owner_name = 2;
  // repository_id is the id of the repository from which the commit will be deleted.
  string repository_id = 3;
  // repository_name is the name of the repository from which the commit will be deleted.
  string repository_name = 4;
  // draft_name is the name of the draft. Optional.
  string draft_name = 5;
}

message PayloadRepositoryLabelCreated {
  // owner_id is the id of the owner of the repository on which the label was created.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository on which the label was created.
  string owner_name = 2;
  // repository_id is the id of the repository on which the label was created.
  string repository_id = 3;
  // repository_name is the name of the repository from which the label was created.
  string repository_name = 4;
  // label_namespace is the namespace of the label that was created.
  string label_namespace = 5 [deprecated = true];
  // commit_id is the id of the commit on which the label was created.
  string commit_id = 6;
}

message PayloadRepositoryLabelMoved {
  // owner_id is the id of the owner of the repository on which the label was moved.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository on which the label was moved.
  string owner_name = 2;
  // repository_id is the id of the repository on which the label was moved.
  string repository_id = 3;
  // repository_name is the name of the repository from which the label was moved.
  string repository_name = 4;
  // label_namespace is the namespace of the label that was moved.
  string label_namespace = 5 [deprecated = true];
  // to_commit_id is the id of the commit on which the label was moved to.
  string to_commit_id = 6;
  // from_commit_id is the id of the commit on which the label was moved from.
  string from_commit_id = 7;
}

message PayloadRepositoryLabelArchived {
  // owner_id is the id of the owner of the repository on which the label was archived.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository on which the label was archived.
  string owner_name = 2;
  // repository_id is the id of the repository on which the label was archived.
  string repository_id = 3;
  // repository_name is the name of the repository from which the label was archived.
  string repository_name = 4;
}

message PayloadRepositoryLabelUnarchived {
  // owner_id is the id of the owner of the repository on which the label was unarchived.
  string owner_id = 1;
  // owner_name is the name of the owner of the repository on which the label was unarchived.
  string owner_name = 2;
  // repository_id is the id of the repository on which the label was unarchived.
  string repository_id = 3;
  // repository_name is the name of the repository from which the label was unarchived.
  string repository_name = 4;
}

message PayloadRepositoryLabelEnforcementIgnoresChanged {
  // IgnoreEntry is an entry of the ignore configuration applied to the repository label, for a
  // specific enforcement id.
  message IgnoreEntry {
    // The ignored rule or category id.
    //
    // If empty, this is an `ignore` entry. If populated, this is an `ignore_only` entry.
    string rule_or_category_id = 1;
    // The ignored file or directory paths.
    repeated string paths = 2;
  }
  // owner_id is the id of the repository owner.
  string owner_id = 1;
  // owner_name is the name of the repository owner.
  string owner_name = 2;
  // repository_id is the id of the repository.
  string repository_id = 3;
  // repository_name is the name of the repository.
  string repository_name = 4;
  // enforcement_id is the id of the enforcement.
  string enforcement_id = 5;
  // old ignore entries configured for the repository label and the enforcement.
  repeated IgnoreEntry old_ignore_entries = 6;
  // new ignore entries configured for the repository label and the enforcement.
  repeated IgnoreEntry new_ignore_entries = 7;
}

message PayloadServerBreakingChangePolicyEnabled {
  // category is the category of breaking changes.
  buf.alpha.registry.v1alpha1.BreakingChangeCategory category = 1;
  // ignore_unstable_packages tracks breaking change enforcement for unstable packages.
  optional bool ignore_unstable_packages = 2;
}

message PayloadServerBreakingChangePolicyDisabled {}

message PayloadServerReviewFlowEnabled {}

message PayloadServerReviewFlowDisabled {}

message PayloadServerUniquenessPolicyEnabled {}

message PayloadServerUniquenessPolicyDisabled {}

message PayloadDeviceAuthorizationGrantApproved {
  // client_id is the id of the registered oauth2 client of the grant.
  string client_id = 1;
}
message PayloadDeviceAuthorizationGrantDenied {
  // client_id is the id of the registered oauth2 client of the grant.
  string client_id = 1;
}
message PayloadAuthorizationRequestApproved {
  // client_id is the id of the registered oauth2 client of the request.
  string client_id = 1;
}
message PayloadAuthorizationRequestDenied {
  // client_id is the id of the registered oauth2 client of the request.
  string client_id = 1;
}

message PayloadPluginLabelCreated {
  // owner_id is the id of the owner of the plugin on which the label was created.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin on which the label was created.
  string owner_name = 2;
  // plugin_id is the id of the plugin on which the label was created.
  string plugin_id = 3;
  // plugin_name is the name of the plugin from which the label was created.
  string plugin_name = 4;
  // commit_id is the id of the commit on which the label was created.
  string commit_id = 6;
}

message PayloadPluginLabelMoved {
  // owner_id is the id of the owner of the plugin on which the label was moved.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin on which the label was moved.
  string owner_name = 2;
  // plugin_id is the id of the plugin on which the label was moved.
  string plugin_id = 3;
  // plugin_name is the name of the plugin from which the label was moved.
  string plugin_name = 4;
  // to_commit_id is the id of the commit on which the label was moved to.
  string to_commit_id = 6;
  // from_commit_id is the id of the commit on which the label was moved from.
  string from_commit_id = 7;
}

message PayloadPluginLabelArchived {
  // owner_id is the id of the owner of the plugin on which the label was archived.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin on which the label was archived.
  string owner_name = 2;
  // plugin_id is the id of the plugin on which the label was archived.
  string plugin_id = 3;
  // plugin_name is the name of the plugin from which the label was archived.
  string plugin_name = 4;
}

message PayloadPluginLabelUnarchived {
  // owner_id is the id of the owner of the plugin on which the label was unarchived.
  string owner_id = 1;
  // owner_name is the name of the owner of the plugin on which the label was unarchived.
  string owner_name = 2;
  // plugin_id is the id of the plugin on which the label was unarchived.
  string plugin_id = 3;
  // plugin_name is the name of the plugin from which the label was unarchived.
  string plugin_name = 4;
}

message PayloadPolicyLabelCreated {
  // owner_id is the id of the owner of the policy on which the label was created.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy on which the label was created.
  string owner_name = 2;
  // policy_id is the id of the policy on which the label was created.
  string policy_id = 3;
  // policy_name is the name of the policy from which the label was created.
  string policy_name = 4;
  // commit_id is the id of the commit on which the label was created.
  string commit_id = 6;
}

message PayloadPolicyLabelMoved {
  // owner_id is the id of the owner of the policy on which the label was moved.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy on which the label was moved.
  string owner_name = 2;
  // policy_id is the id of the policy on which the label was moved.
  string policy_id = 3;
  // policy_name is the name of the policy from which the label was moved.
  string policy_name = 4;
  // to_commit_id is the id of the commit on which the label was moved to.
  string to_commit_id = 6;
  // from_commit_id is the id of the commit on which the label was moved from.
  string from_commit_id = 7;
}

message PayloadPolicyLabelArchived {
  // owner_id is the id of the owner of the policy on which the label was archived.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy on which the label was archived.
  string owner_name = 2;
  // policy_id is the id of the policy on which the label was archived.
  string policy_id = 3;
  // policy_name is the name of the policy from which the label was archived.
  string policy_name = 4;
}

message PayloadPolicyLabelUnarchived {
  // owner_id is the id of the owner of the policy on which the label was unarchived.
  string owner_id = 1;
  // owner_name is the name of the owner of the policy on which the label was unarchived.
  string owner_name = 2;
  // policy_id is the id of the policy on which the label was unarchived.
  string policy_id = 3;
  // policy_name is the name of the policy from which the label was unarchived.
  string policy_name = 4;
}

message PayloadSDKPluginConstraintCreated {
  // repository_owner_id is the id of the owner of the repository of the SDK constraint.
  string repository_owner_id = 1;
  // repository_owner_name is the name of the owner of the repository of the SDK constraint.
  string repository_owner_name = 2;
  // repository_id is the id of the repository of the SDK constraint.
  string repository_id = 3;
  // repository_name is the name of the repository of the SDK constraint.
  string repository_name = 4;
  // plugin_owner_id is the id of the owner of the plugin of the SDK constraint.
  string plugin_owner_id = 5;
  // plugin_owner_name is the name of the owner of the plugin of the SDK constraint.
  string plugin_owner_name = 6;
  // plugin_id is the id of the plugin of the SDK constraint.
  string plugin_id = 7;
  // plugin_name is the name of the plugin of the SDK constraint.
  string plugin_name = 8;
}

message PayloadSDKPluginConstraintUpdated {
  // repository_owner_id is the id of the owner of the repository of the SDK constraint.
  string repository_owner_id = 1;
  // repository_owner_name is the name of the owner of the repository of the SDK constraint.
  string repository_owner_name = 2;
  // repository_id is the id of the repository of the SDK constraint.
  string repository_id = 3;
  // repository_name is the name of the repository of the SDK constraint.
  string repository_name = 4;
  // plugin_owner_id is the id of the owner of the plugin of the SDK constraint.
  string plugin_owner_id = 5;
  // plugin_owner_name is the name of the owner of the plugin of the SDK constraint.
  string plugin_owner_name = 6;
  // plugin_id is the id of the plugin of the SDK constraint.
  string plugin_id = 7;
  // plugin_name is the name of the plugin of the SDK constraint.
  string plugin_name = 8;
}

message PayloadSDKPluginConstraintDeleted {
  // repository_owner_id is the id of the owner of the repository of the SDK constraint.
  string repository_owner_id = 1;
  // repository_owner_name is the name of the owner of the repository of the SDK constraint.
  string repository_owner_name = 2;
  // repository_id is the id of the repository of the SDK constraint.
  string repository_id = 3;
  // repository_name is the name of the repository of the SDK constraint.
  string repository_name = 4;
  // plugin_owner_id is the id of the owner of the plugin of the SDK constraint.
  string plugin_owner_id = 5;
  // plugin_owner_name is the name of the owner of the plugin of the SDK constraint.
  string plugin_owner_name = 6;
  // plugin_id is the id of the plugin of the SDK constraint.
  string plugin_id = 7;
  // plugin_name is the name of the plugin of the SDK constraint.
  string plugin_name = 8;
}

// PolicyEnforcementScope is the scope to which a policy enforcement applies.
message PolicyEnforcementScope {
  message PolicyEnforcementScopeInstance {}
  message PolicyEnforcementScopeOwner {
    // owner_id is the id of the owner (organization or user).
    string owner_id = 1;
    // owner_name is the name of the owner (organization or user).
    string owner_name = 2;
  }
  message PolicyEnforcementScopeRepository {
    // repository_owner_id is the id of the owner of the repository.
    string repository_owner_id = 1;
    // repository_owner_name is the name of the owner of the repository.
    string repository_owner_name = 2;
    // repository_id is the id of the repository.
    string repository_id = 3;
    // repository_name is the name of the repository.
    string repository_name = 4;
  }
  oneof scope {
    PolicyEnforcementScopeInstance instance = 1;
    PolicyEnforcementScopeOwner owner = 2;
    PolicyEnforcementScopeRepository repository = 3;
  }
}

message PayloadPolicyEnforcementCreated {
  // scope is the scope to which the policy is enforced.
  PolicyEnforcementScope scope = 1;
  // policy_id is the id of the policy that is enforced.
  string policy_id = 2;
  // policy_ref is the reference of the policy that is enforced.
  string policy_ref = 3;
  // include_targets are the include targets of the policy enforcement.
  repeated string include_targets = 4;
}

message PayloadPolicyEnforcementDeleted {
  // scope is the scope to which the policy was enforced.
  PolicyEnforcementScope scope = 1;
  // policy_id is the id of the policy that was enforced.
  string policy_id = 2;
  // policy_ref is the reference of the policy that was enforced.
  string policy_ref = 3;
  // include_targets were the include targets of the policy enforcement.
  repeated string include_targets = 4;
}

message PayloadPolicyEnforcementPolicyChanged {
  // scope is the scope to which the policy is enforced. An enforcement cannot change its scope.
  PolicyEnforcementScope scope = 1;
  // old_policy_id is the id of the old policy.
  string old_policy_id = 2;
  // new_policy_id is the id of the new policy.
  string new_policy_id = 3;
  // old_policy_ref is the reference of the old policy.
  string old_policy_ref = 4;
  // new_policy_ref is the reference of the new policy.
  string new_policy_ref = 5;
}

message PayloadPolicyEnforcementTargetsChanged {
  // scope is the scope to which the policy is enforced. An enforcement cannot change its scope.
  PolicyEnforcementScope scope = 1;
  // old_include_targets are the old include targets of the policy enforcement.
  repeated string old_include_targets = 2;
  // new_include_targets are the new include targets of the policy enforcement.
  repeated string new_include_targets = 3;
}

message ResourceVisibilityControl {
  // Possible visibility that a resource can have.
  enum Visibility {
    VISIBILITY_UNSPECIFIED = 0;
    VISIBILITY_PUBLIC = 1;
    VISIBILITY_PRIVATE = 2;
  }
  // The visibility that is being controlled.
  Visibility visibility = 1;
  // Strict defines if the controlled visibility behaves like a restriction or a default value.
  bool strict = 2;
}

message PayloadServerResourceVisibilityControlChanged {
  // The resource type that had its visibility control changed.
  ResourceType resource_type = 1;
  // The old visibility control for resources of that type under the server instance. If not
  // present, then this visibility control was just created.
  optional ResourceVisibilityControl old_visibility_control = 2;
  // The new visibility control for resources of that type under the server instance. If not
  // present, then this visibility control was just deleted.
  optional ResourceVisibilityControl new_visibility_control = 3;
}

message PayloadOrganizationResourceVisibilityControlChanged {
  // The resource type that had its visibility control changed.
  ResourceType resource_type = 1;
  // The old visibility control for resources of that type under the organization. If not present,
  // then this visibility control was just created.
  optional ResourceVisibilityControl old_visibility_control = 2;
  // The new visibility control for resources of that type under the organization. If not present,
  // then this visibility control was just deleted.
  optional ResourceVisibilityControl new_visibility_control = 3;
}

message PayloadOrganizationUniquenessPolicyEnabled {}

message PayloadOrganizationUniquenessPolicyDisabled {}
