svc.proto

// Copyright 2021-2023 Zenauth Ltd.
// SPDX-License-Identifier: Apache-2.0

syntax = "proto3";

package cerbos.svc.v1;

import "cerbos/request/v1/request.proto";
import "cerbos/response/v1/response.proto";
import "google/api/annotations.proto";
import "google/api/visibility.proto";
import "protoc-gen-openapiv2/options/annotations.proto";

option csharp_namespace = "Cerbos.Api.V1.Svc";
option go_package = "github.com/cerbos/cerbos/api/genpb/cerbos/svc/v1;svcv1";
option java_package = "dev.cerbos.api.v1.svc";
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  info: {
    title: "Cerbos";
    version: "latest";
    contact: {
      name: "Cerbos";
      url: "https://cerbos.dev";
      email: "info@cerbos.dev";
    };
  };
  schemes: HTTPS;
  consumes: "application/json";
  produces: "application/json";
  security_definitions: {
    security: {
      key: "BasicAuth";
      value: {type: TYPE_BASIC}
    }
  };
};

service CerbosService {
  option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_tag) = {description: "Cerbos Policy Decision Point"};

  rpc CheckResourceSet(cerbos.request.v1.CheckResourceSetRequest) returns (cerbos.response.v1.CheckResourceSetResponse) {
    option (google.api.http) = {
      post: "/api/check",
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Check"
      description: "[Deprecated: Use CheckResources API instead] Check whether a principal has permissions to perform the given actions on a set of resource instances."
      deprecated: true
    };
  }

  rpc CheckResourceBatch(cerbos.request.v1.CheckResourceBatchRequest) returns (cerbos.response.v1.CheckResourceBatchResponse) {
    option (google.api.http) = {
      post: "/api/check_resource_batch",
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Check resource batch"
      description: "[Deprecated: Use CheckResources API instead] Check a principal's permissions to a batch of heterogeneous resources and actions."
      deprecated: true
    };
  }

  rpc CheckResources(cerbos.request.v1.CheckResourcesRequest) returns (cerbos.response.v1.CheckResourcesResponse) {
    option (google.api.http) = {
      post: "/api/check/resources",
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Check resources"
      description: "Check a principal's permissions to a batch of heterogeneous resources and actions."
    };
  }

  rpc ServerInfo(cerbos.request.v1.ServerInfoRequest) returns (cerbos.response.v1.ServerInfoResponse) {
    option (google.api.http) = {get: "/api/server_info"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get server information"
      description: "Get information about the server e.g. server version"
    };
  }

  rpc PlanResources(cerbos.request.v1.PlanResourcesRequest) returns (cerbos.response.v1.PlanResourcesResponse) {
    option (google.api.http) = {
      post: "/api/plan/resources",
      body: "*"
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Plan resources"
      description: "Produce a query plan with conditions that must be satisfied for accessing a set of instances of a resource"
    };
  }
}

service CerbosAdminService {
  option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_tag) = {description: "Cerbos administration service"};

  rpc AddOrUpdatePolicy(cerbos.request.v1.AddOrUpdatePolicyRequest) returns (cerbos.response.v1.AddOrUpdatePolicyResponse) {
    option (google.api.http) = {
      post: "/admin/policy",
      body: "*",
      additional_bindings: {
        put: "/admin/policy",
        body: "*"
      }
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Add or update policies",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc ListPolicies(cerbos.request.v1.ListPoliciesRequest) returns (cerbos.response.v1.ListPoliciesResponse) {
    option (google.api.http) = {get: "/admin/policies"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List policies",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc GetPolicy(cerbos.request.v1.GetPolicyRequest) returns (cerbos.response.v1.GetPolicyResponse) {
    option (google.api.http) = {get: "/admin/policy"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get policy",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc DisablePolicy(cerbos.request.v1.DisablePolicyRequest) returns (cerbos.response.v1.DisablePolicyResponse) {
    option (google.api.http) = {delete: "/admin/policy"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Disable policy",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc ListAuditLogEntries(cerbos.request.v1.ListAuditLogEntriesRequest) returns (stream cerbos.response.v1.ListAuditLogEntriesResponse) {
    option (google.api.http) = {get: "/admin/auditlog/list/{kind}"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List audit log entries",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc AddOrUpdateSchema(cerbos.request.v1.AddOrUpdateSchemaRequest) returns (cerbos.response.v1.AddOrUpdateSchemaResponse) {
    option (google.api.http) = {
      post: "/admin/schema",
      body: "*",
      additional_bindings: {
        put: "/admin/schema",
        body: "*"
      }
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Add or update schema",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc ListSchemas(cerbos.request.v1.ListSchemasRequest) returns (cerbos.response.v1.ListSchemasResponse) {
    option (google.api.http) = {get: "/admin/schemas"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "List schemas",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc GetSchema(cerbos.request.v1.GetSchemaRequest) returns (cerbos.response.v1.GetSchemaResponse) {
    option (google.api.http) = {get: "/admin/schema"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Get schema",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc DeleteSchema(cerbos.request.v1.DeleteSchemaRequest) returns (cerbos.response.v1.DeleteSchemaResponse) {
    option (google.api.http) = {delete: "/admin/schema"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Delete schema",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }

  rpc ReloadStore(cerbos.request.v1.ReloadStoreRequest) returns (cerbos.response.v1.ReloadStoreResponse) {
    option (google.api.http) = {get: "/admin/store/reload"};
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
      summary: "Reload store",
      security: {
        security_requirement: {
          key: "BasicAuth";
          value: {};
        }
      }
    };
  }
}

service CerbosPlaygroundService {
  option (google.api.api_visibility).restriction = "INTERNAL";

  rpc PlaygroundValidate(cerbos.request.v1.PlaygroundValidateRequest) returns (cerbos.response.v1.PlaygroundValidateResponse) {
    option (google.api.http) = {
      post: "/api/playground/validate",
      body: "*"
    };
  }

  rpc PlaygroundTest(cerbos.request.v1.PlaygroundTestRequest) returns (cerbos.response.v1.PlaygroundTestResponse) {
    option (google.api.http) = {
      post: "/api/playground/test",
      body: "*"
    };
  }

  rpc PlaygroundEvaluate(cerbos.request.v1.PlaygroundEvaluateRequest) returns (cerbos.response.v1.PlaygroundEvaluateResponse) {
    option (google.api.http) = {
      post: "/api/playground/evaluate",
      body: "*"
    };
  }

  rpc PlaygroundProxy(cerbos.request.v1.PlaygroundProxyRequest) returns (cerbos.response.v1.PlaygroundProxyResponse) {
    option (google.api.http) = {
      post: "/api/playground/proxy",
      body: "*"
    };
  }
}