syntax = "proto3";

package rbac;

service RbacService {
  rpc ListRoles (Empty) returns (ListRolesResponse);
  rpc ListPermissions (Empty) returns (ListPermissionsResponse);
  rpc ListOAuthScopes (Empty) returns (ListOAuthScopesResponse);
  rpc ListOAuthClients (Empty) returns (ListOAuthClientsResponse);
  rpc CreateRole (CreateRoleRequest) returns (Role);
  rpc AssignUserRole (AssignUserRoleRequest) returns (AssignUserRoleResponse);
  rpc RemoveUserRole (RemoveUserRoleRequest) returns (Empty);
  rpc CreateOAuthClient (CreateOAuthClientRequest) returns (OAuthClientDetail);
  rpc UpdateOAuthClient (UpdateOAuthClientRequest) returns (OAuthClientDetail);
  rpc RotateOAuthSecret (RotateOAuthSecretRequest) returns (RotateOAuthSecretResponse);
}

message Empty {}

message Permission {
  string id = 1;
  string slug = 2;
  string name = 3;
  optional string description = 4;
}

message Role {
  string id = 1;
  string slug = 2;
  string name = 3;
  optional string description = 4;
  repeated Permission permissions = 5;
}

message OAuthScope {
  string id = 1;
  string slug = 2;
  string name = 3;
  optional string description = 4;
}

message OAuthClient {
  string id = 1;
  string name = 2;
  string clientId = 3;
  repeated string redirectUris = 4;
  repeated string scopes = 5;
  bool isActive = 6;
  string type = 7;
}

message OAuthClientDetail {
  string id = 1;
  string name = 2;
  string clientId = 3;
  repeated string redirectUris = 4;
  repeated string scopes = 5;
  bool isActive = 6;
  string type = 7;
  optional string clientSecret = 8;
}

message ListRolesResponse {
  repeated Role roles = 1;
}

message ListPermissionsResponse {
  repeated Permission permissions = 1;
}

message ListOAuthScopesResponse {
  repeated OAuthScope scopes = 1;
}

message ListOAuthClientsResponse {
  repeated OAuthClient clients = 1;
}

message CreateRoleRequest {
  string actorUserId = 1;
  string slug = 2;
  string name = 3;
  optional string description = 4;
  repeated string permissionSlugs = 5;
}

message AssignUserRoleRequest {
  string actorUserId = 1;
  string userId = 2;
  string roleSlug = 3;
}

message AssignUserRoleResponse {
  string userId = 1;
  repeated string roles = 2;
}

message RemoveUserRoleRequest {
  string actorUserId = 1;
  string userId = 2;
  string roleSlug = 3;
}

message CreateOAuthClientRequest {
  string actorUserId = 1;
  string name = 2;
  repeated string redirectUris = 3;
  repeated string scopes = 4;
  optional string type = 5;
}

message UpdateOAuthClientRequest {
  string actorUserId = 1;
  string clientId = 2;
  optional string name = 3;
  repeated string redirectUris = 4;
  repeated string scopes = 5;
  optional bool isActive = 6;
}

message RotateOAuthSecretRequest {
  string actorUserId = 1;
  string clientId = 2;
}

message RotateOAuthSecretResponse {
  string clientId = 1;
  string clientSecret = 2;
}