cosi.proto

syntax = "proto3";
package cosi.v1alpha1;

import "google/protobuf/descriptor.proto";

option go_package = "cosi";

extend google.protobuf.EnumOptions {
    // Indicates that this enum is OPTIONAL and part of an experimental
    // API that may be deprecated and eventually removed between minor
    // releases.
    bool alpha_enum = 1060;
}

extend google.protobuf.EnumValueOptions {
    // Indicates that this enum value is OPTIONAL and part of an
    // experimental API that may be deprecated and eventually removed
    // between minor releases.
    bool alpha_enum_value = 1060;
}

extend google.protobuf.FieldOptions {
    // Indicates that a field MAY contain information that is sensitive
    // and MUST be treated as such (e.g. not logged).
    bool cosi_secret = 1059;

    // Indicates that this field is OPTIONAL and part of an experimental
    // API that may be deprecated and eventually removed between minor
    // releases.
    bool alpha_field = 1060;
}

extend google.protobuf.MessageOptions {
    // Indicates that this message is OPTIONAL and part of an experimental
    // API that may be deprecated and eventually removed between minor
    // releases.
    bool alpha_message = 1060;
}

extend google.protobuf.MethodOptions {
    // Indicates that this method is OPTIONAL and part of an experimental
    // API that may be deprecated and eventually removed between minor
    // releases.
    bool alpha_method = 1060;
}

extend google.protobuf.ServiceOptions {
    // Indicates that this service is OPTIONAL and part of an experimental
    // API that may be deprecated and eventually removed between minor
    // releases.
    bool alpha_service = 1060;
}

service Provisioner {
    rpc ProvisionerGetInfo (ProvisionerGetInfoRequest) returns (ProvisionerGetInfoResponse) {}

    rpc ProvisionerCreateBucket (ProvisionerCreateBucketRequest) returns (ProvisionerCreateBucketResponse) {}
    rpc ProvisionerDeleteBucket (ProvisionerDeleteBucketRequest) returns (ProvisionerDeleteBucketResponse) {}

    rpc ProvisionerGrantBucketAccess (ProvisionerGrantBucketAccessRequest) returns (ProvisionerGrantBucketAccessResponse);
    rpc ProvisionerRevokeBucketAccess (ProvisionerRevokeBucketAccessRequest) returns (ProvisionerRevokeBucketAccessResponse);
}

message ProvisionerGetInfoRequest {
    // Intentionally left blank
}

message ProvisionerGetInfoResponse {    
    string provisioner_identity = 1;
}

message ProvisionerCreateBucketRequest {    
    string bucket_name = 1;

    string region = 2;

    string zone = 3;

    map<string,string> bucket_context = 4;

    enum AnonymousBucketAccessMode {
	BUCKET_PRIVATE = 0;
	BUCKET_READ_ONLY = 1;
	BUCKET_WRITE_ONLY = 2;
	BUCKET_READ_WRITE = 3;
    }
    
    AnonymousBucketAccessMode anonymous_bucket_access_mode = 5;
}

message ProvisionerCreateBucketResponse {
    // Intentionally left blank
}

message ProvisionerDeleteBucketRequest {
    string bucket_name = 1;
    
    string region = 2;

    string zone = 3;

    map<string,string> bucket_context = 4;    
}

message ProvisionerDeleteBucketResponse {
     // Intentionally left blank
}

message ProvisionerGrantBucketAccessRequest {
    string bucket_name = 1;
    
    string region = 2;

    string zone = 3;

    map<string,string> bucket_context = 4;  

    string principal = 5;
    
    string access_policy = 6;
}

message ProvisionerGrantBucketAccessResponse {
    // This is the account that is being provided access. This will
    // be required later to revoke access. 
    string principal = 1;
    
    string credentials_file_contents = 2;
    
    string credentials_file_path = 3;
} 
 
message ProvisionerRevokeBucketAccessRequest {
    string bucket_name = 1;
    
    string region = 2;

    string zone = 3;

    map<string,string> bucket_context = 4;  

    string principal = 5;
}

message ProvisionerRevokeBucketAccessResponse {
    // Intentionally left blank
}