syntax = "proto3";

package coda.admin.v1;

option java_package = "coda.admin.v1";
option java_outer_classname = "RoleProto";

import "coda/admin/v1/access_types.proto";
import "coda/admin/v1/types.proto";
import "coda/common/v1/types.proto";

service RoleService {
  // ─── Role CRUD ───────────────────────────────────────────────────

  rpc CreateRole(CreateRoleRequest) returns (CreateRoleResponse);
  rpc GetRole(GetRoleRequest) returns (GetRoleResponse);
  rpc UpdateRole(UpdateRoleRequest) returns (UpdateRoleResponse);
  rpc DeleteRole(DeleteRoleRequest) returns (DeleteRoleResponse);
  rpc ListRoles(ListRolesRequest) returns (ListRolesResponse);

  // ─── Role configuration ──────────────────────────────────────────

  rpc SetRolePermissions(SetRolePermissionsRequest) returns (SetRolePermissionsResponse);
  rpc SetRoleInheritance(SetRoleInheritanceRequest) returns (SetRoleInheritanceResponse);

  // ─── User-role assignment ────────────────────────────────────────

  rpc AssignRole(AssignRoleRequest) returns (AssignRoleResponse);
  rpc RevokeRole(RevokeRoleRequest) returns (RevokeRoleResponse);
  rpc ListUserRoles(ListUserRolesRequest) returns (ListUserRolesResponse);

  // ─── Mutual exclusions ──────────────────────────────────────────

  rpc CreateRoleExclusion(CreateRoleExclusionRequest) returns (CreateRoleExclusionResponse);
  rpc DeleteRoleExclusion(DeleteRoleExclusionRequest) returns (DeleteRoleExclusionResponse);
  rpc ListRoleExclusions(ListRoleExclusionsRequest) returns (ListRoleExclusionsResponse);

  // ─── Module + permission catalog ─────────────────────────────────

  rpc ListModules(ListModulesRequest) returns (ListModulesResponse);
  rpc ListPermissions(ListPermissionsRequest) returns (ListPermissionsResponse);
}

// ─── Role CRUD ───────────────────────────────────────────────────────

message CreateRoleRequest {
  string tenant_id = 1;
  string name = 2;
  string description = 3;
  repeated string permission_names = 4;
  repeated string parent_role_ids = 5;
}

message CreateRoleResponse {
  RoleInfo role = 1;
}

message GetRoleRequest {
  string tenant_id = 1;
  string role_id = 2;
}

message GetRoleResponse {
  RoleInfo role = 1;
}

message UpdateRoleRequest {
  string tenant_id = 1;
  string role_id = 2;
  string name = 3;
  string description = 4;
}

message UpdateRoleResponse {
  RoleInfo role = 1;
}

message DeleteRoleRequest {
  string tenant_id = 1;
  string role_id = 2;
}

message DeleteRoleResponse {}

message ListRolesRequest {
  string tenant_id = 1;
  coda.common.v1.PageRequest page = 2;
}

message ListRolesResponse {
  repeated RoleInfo roles = 1;
  coda.common.v1.PageInfo page = 2;
}

// ─── Role configuration ─────────────────────────────────────────────

message SetRolePermissionsRequest {
  string tenant_id = 1;
  string role_id = 2;
  // Full replacement of the role's permission set
  repeated string permission_names = 3;
}

message SetRolePermissionsResponse {
  RoleInfo role = 1;
}

message SetRoleInheritanceRequest {
  string tenant_id = 1;
  string role_id = 2;
  // Full replacement of the role's parent role set
  repeated string parent_role_ids = 3;
}

message SetRoleInheritanceResponse {
  RoleInfo role = 1;
}

// ─── User-role assignment ────────────────────────────────────────────

message AssignRoleRequest {
  string tenant_id = 1;
  string user_id = 2;
  string role_id = 3;
}

message AssignRoleResponse {
  UserRoleInfo assignment = 1;
}

message RevokeRoleRequest {
  string tenant_id = 1;
  string user_id = 2;
  string role_id = 3;
}

message RevokeRoleResponse {}

message ListUserRolesRequest {
  string tenant_id = 1;
  string user_id = 2;
}

message ListUserRolesResponse {
  repeated UserRoleInfo roles = 1;
}

// ─── Mutual exclusions ──────────────────────────────────────────────

message CreateRoleExclusionRequest {
  string tenant_id = 1;
  string role_a_id = 2;
  string role_b_id = 3;
  string reason = 4;
}

message CreateRoleExclusionResponse {
  RoleExclusionInfo exclusion = 1;
}

message DeleteRoleExclusionRequest {
  string tenant_id = 1;
  string exclusion_id = 2;
}

message DeleteRoleExclusionResponse {}

message ListRoleExclusionsRequest {
  string tenant_id = 1;
  coda.common.v1.PageRequest page = 2;
}

message ListRoleExclusionsResponse {
  repeated RoleExclusionInfo exclusions = 1;
  coda.common.v1.PageInfo page = 2;
}

// ─── Module + permission catalog ─────────────────────────────────────

message ListModulesRequest {
  string tenant_id = 1;
}

message ListModulesResponse {
  repeated ModuleInfo modules = 1;
}

message ListPermissionsRequest {
  string tenant_id = 1;
  // Optional: filter by module
  string module_id = 2;
}

message ListPermissionsResponse {
  repeated PermissionInfo permissions = 1;
}