syntax = "proto2";

import "grr/proto/api_utils.proto";
import "grr/proto/semantic.proto";


message ApiAuthorization {
  optional string router = 1 [(sem_type) = {
      description: "api_call_router.ApiCallRouter class name that this "
                   "authorization applies to."
    }];
  optional ApiDataObject router_params = 4 [(sem_type) = {
      description: "Router configuration. Will be passed to router "
      "constructor as keyword arguments."
    }];

  repeated string users = 2 [(sem_type) = {
      description: "List of users that will use a given API router."
    }];
  repeated string groups = 3[(sem_type) = {
      description: "List of groups that will use a given API router."
    }];
}

message ApiLabelsRestrictedCallRouterParams {
  repeated string labels_whitelist = 1;
  repeated string labels_owners_whitelist = 2;

  optional bool allow_flows_access = 3;
  optional bool allow_vfs_access = 4;
}

message RobotRouterSearchClientsParams {
  optional bool enabled = 1;
}

message RobotRouterFileFinderFlowParams {
  optional bool enabled = 1;

  optional bool globs_allowed = 2 [(sem_type) = {
      description: "If false, using '*' in FileFinder paths is not allowed."
    }];

  optional bool interpolations_allowed = 3 [(sem_type) = {
      description: "If false, using interpolations in FileFinder is not "
      "allowed."
    }];

  optional string file_finder_flow_name = 4 [(sem_type) = {
      description: "Name of the flow to use. Must be interface-compatible "
      "with FileFinder. Default is 'FileFinder'."
    }];

  optional uint64 max_flows_per_client_daily = 5 [(sem_type) = {
      description: "Maximum number of FileFinder flows that can be started on a "
      "single client within 24 hours. Default is 0, meaning no limit."
    }];
  optional uint64 min_interval_between_duplicate_flows = 6 [(sem_type) = {
      type: "Duration",
      description: "Minimum time that has to pass between 2 FileFinder flows "
      "with same arguments. Default is 0, meaning any time."
    }];

  optional uint64 max_file_size = 7 [(sem_type) = {
      description: "Maximum file size in bytes. Will be enforced for all "
      "FileFinder actions. Files bigger than max_file_size will be skipped."
    }];
}

message RobotRouterArtifactCollectorFlowParams {
  optional bool enabled = 1;

  repeated string artifacts_whitelist = 2 [(sem_type) = {
      description: "Only artifacts from this whitelist can be collected. "
      "Empty list means no artifacts can be collected."
    }];

  optional string artifact_collector_flow_name = 3 [(sem_type) = {
      description: "Name of the flow to use. Must be interface-compatible "
      "with CollectArtifacts."
    }];

  optional uint64 max_flows_per_client_daily = 5 [(sem_type) = {
      description: "Maximum number of ArtifactCollectorFlow flows that can be "
      "started on a single client within 24 hours. Default is 0, meaning no "
      "limit."
    }];
  optional uint64 min_interval_between_duplicate_flows = 6 [(sem_type) = {
      type: "Duration",
      description: "Minimum time that has to pass between 2 "
      "ArtifactCollectorFlow flows with same arguments. Default is 0, "
      "meaning any time."
    }];
}

message RobotRouterGetFlowParams {
  optional bool enabled = 1;
}

message RobotRouterListFlowResultsParams {
  optional bool enabled = 1;
}

message RobotRouterGetFlowFilesArchiveParams {
  optional bool enabled = 1;

  repeated string path_globs_blacklist = 2 [(sem_type) = {
      type: "GlobExpression",
      description: "Only files not matching these globs will be included "
      "into the archive. Blacklist is always applied first. Files not "
      "matching the blacklist should still match the whitelist."
    }];

  repeated string path_globs_whitelist = 3 [(sem_type) = {
      type: "GlobExpression",
      description: "Only files matching these globs will be included into "
      "the archive. Whitelist is applied after the blacklist."
    }];

  optional bool skip_glob_checks_for_artifact_collector = 4;
}

message ApiCallRobotRouterParams {
  optional RobotRouterSearchClientsParams search_clients = 1;

  optional RobotRouterFileFinderFlowParams file_finder_flow = 2;
  optional RobotRouterArtifactCollectorFlowParams artifact_collector_flow = 3;

  optional RobotRouterGetFlowParams get_flow = 4;
  optional RobotRouterListFlowResultsParams list_flow_results = 5;
  optional RobotRouterGetFlowFilesArchiveParams get_flow_files_archive = 6;

  optional string robot_id = 7;
}
