// Long-lived API key, browser session, and JWK material for the
// Identity / Me services.
//
// Plan reference: A1 + B1 in check-ia-and-plan-optimized-cook.md.
syntax = "proto3";

package tars.identity.v1;

import "google/api/field_behavior.proto";
import "google/protobuf/timestamp.proto";

option go_package = "github.com/tetrateio/fraser/api/tars/identity/v1;identityv1";

// ApiKeyState is the lifecycle of a long-lived API key.
enum ApiKeyState {
  API_KEY_STATE_UNSPECIFIED = 0;
  API_KEY_STATE_ACTIVE = 1;
  API_KEY_STATE_REVOKED = 2;
}

// ApiKeyType is what an API key is authorized to do. UNSPECIFIED is
// treated as PROMPT (the historical default) for backward compatibility.
enum ApiKeyType {
  API_KEY_TYPE_UNSPECIFIED = 0;
  // Inference / data-plane keys: call the prompt (LLM) APIs. Default.
  API_KEY_TYPE_PROMPT = 1;
  // Management / control-plane keys: drive the management APIs.
  API_KEY_TYPE_MANAGEMENT = 2;
}

// ApiKey is metadata about an issued long-lived API key.
//
// The plaintext secret is returned exactly once at issue time on the
// IssueMyKeyResponse. After that only the typed prefix and metadata
// are visible.
message ApiKey {
  // Resource name key_<ulid>. Server-assigned; immutable.
  string id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Identity that owns this key.
  string identity_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Customer scope.
  string customer_id = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Human-friendly label set by the issuer.
  string name = 4;

  // Typed prefix portion of the key (e.g. tat_live_a4F...). Safe to log.
  string prefix = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Lifecycle state.
  ApiKeyState state = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // What the key is authorized to do. Defaults to PROMPT when
  // unspecified.
  ApiKeyType type = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional explicit expiry; zero means non-expiring.
  google.protobuf.Timestamp expires_at = 7;

  // Last-used timestamp; updated by the facade on accepted calls.
  google.protobuf.Timestamp last_used_at = 8 [(google.api.field_behavior) = OUTPUT_ONLY];

  google.protobuf.Timestamp created_at = 50 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp revoked_at = 51 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Session is a browser session JWT issued by Login.
message Session {
  // Session id sess_<ulid>. Server-assigned; immutable.
  string id = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Identity bound to this session.
  string identity_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Issued-at and absolute expiry.
  google.protobuf.Timestamp issued_at = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp expires_at = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Whether the session has step-up MFA in the trailing window.
  bool step_up_active = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // User-agent and originating IP captured at issue time. Audit-only.
  string user_agent = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
  string ip = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Jwk represents a workload's public signing key (JWK form, ECDSA P-256).
//
// Workloads register a JWK once; they then mint short-lived JWTs locally,
// signed with the matching private key, which the facade verifies against
// the registered JWK.
message Jwk {
  // kid claim used in workload JWTs.
  string kid = 1 [(google.api.field_behavior) = REQUIRED];

  // Identity that owns this key.
  string identity_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // PEM-encoded SPKI public key (ECDSA P-256).
  bytes public_key_pem = 3 [(google.api.field_behavior) = REQUIRED];

  google.protobuf.Timestamp created_at = 50 [(google.api.field_behavior) = OUTPUT_ONLY];
  google.protobuf.Timestamp deleted_at = 51 [(google.api.field_behavior) = OUTPUT_ONLY];
}
