// Copyright 2020-2026 Buf Technologies, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package buf.alpha.registry.v1alpha1;

import "google/protobuf/timestamp.proto";

message Token {
  string id = 1;
  google.protobuf.Timestamp create_time = 2;
  google.protobuf.Timestamp expire_time = 3;
  string note = 4;
}

// TokenService is the Token service.
service TokenService {
  // CreateToken creates a new token suitable for machine-to-machine authentication.
  rpc CreateToken(CreateTokenRequest) returns (CreateTokenResponse);
  // GetToken gets the specific token for the user
  //
  // This method requires authentication.
  rpc GetToken(GetTokenRequest) returns (GetTokenResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // ListTokens lists the users active tokens
  //
  // This method requires authentication.
  rpc ListTokens(ListTokensRequest) returns (ListTokensResponse) {
    option idempotency_level = NO_SIDE_EFFECTS;
  }
  // DeleteToken deletes an existing token.
  //
  // This method requires authentication.
  rpc DeleteToken(DeleteTokenRequest) returns (DeleteTokenResponse) {
    option idempotency_level = IDEMPOTENT;
  }
}

message CreateTokenRequest {
  string note = 1;
  // The time until which the token should be valid.
  // Must be in the future. May be null for no expiry.
  google.protobuf.Timestamp expire_time = 2;
  // The ID of the user to create a new token, can only be
  // the user who perform this action, or a machine user.
  // Default to the user who perform this action if this is empty.
  string user_id = 3;
}

message CreateTokenResponse {
  // The plaintext token to use for authentication.
  string token = 1;
}

message GetTokenRequest {
  string token_id = 1;
}

message GetTokenResponse {
  Token token = 1;
}

message ListTokensRequest {
  uint32 page_size = 1;
  // The first page is returned if this is empty.
  string page_token = 2;
  bool reverse = 3;
  // The ID of the user to list tokens, can only be
  // the user who perform this action, or a machine user.
  // Default to the user who perform this action if this is empty.
  string user_id = 4;
}

message ListTokensResponse {
  repeated Token tokens = 1;
  // There are no more pages if this is empty.
  string next_page_token = 2;
}

message DeleteTokenRequest {
  string token_id = 1;
}

message DeleteTokenResponse {}
