// Copyright IBM Corp. 2014, 2026
// SPDX-License-Identifier: BUSL-1.1

syntax = "proto3";

package proto;

option go_package = "github.com/hashicorp/terraform-policy-plugin/proto";

// EvaluateResult contains a single value for the overall result of the evaluate
// RPC. This allows users to differentiate between different types of
// diagnostics.
enum EvaluateResult {
  // INVALID means the result that was set by the server wasn't recognized by
  // the client. This means a future version of Terraform Policy has introduced
  // a new result type, and the client isn't aware of this. Clients should
  // handle this gracefully.
  INVALID_EVALUATE_RESULT = 0;

  // UNKNOWN means the result could not be verified at this time. This means
  // the client sent unknown values to the server as part of the request, and
  // within Terraform means the request happened at plan time. The
  // diagnostics will contain only warnings explaning which policies could
  // not be evaluated.
  UNKNOWN_EVALUATE_RESULT = 1;

  // ERROR means the policy files themselves were invalid in some way, and so
  // the policies could not be evaluated. This would cover things like
  // invalid references or invalid syntax. The diagnostics will contain
  // errors explaining exactly what went wrong.
  ERROR_EVALUATE_RESULT = 2;

  // ALLOW means the resource passed all relevant policies. The diagnostics
  // will not contain any errors, but might contain warnings.
  ALLOW_EVALUATE_RESULT = 3;

  // DENY means the resource failed at least one relevant policy. The
  // diagnostics will contain exact explanations as to why and should be
  // displayed to the user.
  DENY_EVALUATE_RESULT = 4;

  // SETUP_ERROR means the policy engine failed to set up properly. This
  // could be due to a missing or invalid configuration file, or a problem
  // with the policy engine itself. The diagnostics will contain errors
  // explaining exactly what went wrong.
  SETUP_ERROR_EVALUATE_RESULT = 5;
}

// Operation represents the Terraform operation being performed on a resource.
enum Operation {
  CREATE = 0;
  UPDATE = 1;
  DELETE = 2;
  NO_OP = 3;
}

message ResourceAttributes {
  bytes raw = 1;
  repeated AttributePath redacted_paths = 2; 
}

// AttributePath represents a set of steps to traverse into a data structure. It is
// used to refer to a sub-structure within a dynamic data structure presented
// separately.
message AttributePath {
    message Step {
        oneof selector {
            // Set "attribute_name" to represent looking up an attribute
            // in the current object value.
            string attribute_name = 1;

            // Set "element_key_*" to represent looking up an element in
            // an indexable collection type.
            string element_key_string = 2;
            int64 element_key_int = 3;
        }
    }
    repeated Step steps = 1;
}
