syntax = "proto3";

package envoy.extensions.filters.http.gcp_authn.v3;

import "envoy/config/core/v3/base.proto";
import "envoy/config/core/v3/http_uri.proto";

import "google/protobuf/duration.proto";
import "google/protobuf/wrappers.proto";

import "envoy/annotations/deprecation.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.http.gcp_authn.v3";
option java_outer_classname = "GcpAuthnProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3;gcp_authnv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: GCP authentication]
// GCP authentication :ref:`configuration overview <config_http_filters_gcp_authn>`.
// [#extension: envoy.filters.http.gcp_authn]

// Filter configuration.
// [#next-free-field: 7]
message GcpAuthnFilterConfig {
  // The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview).
  // The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]"
  //
  // This field is deprecated because it does not match the API surface provided by the google auth libraries.
  // Control planes should not attempt to override the metadata server URI.
  // The cluster and timeout can be configured using the ``cluster`` and ``timeout`` fields instead.
  // For backward compatibility, the cluster and timeout configured in this field will be used
  // if the new ``cluster`` and ``timeout`` fields are not set.
  config.core.v3.HttpUri http_uri = 1
      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];

  // Retry policy for fetching tokens.
  // Not supported by all data planes.
  config.core.v3.RetryPolicy retry_policy = 2;

  // Token cache configuration. This field is optional.
  TokenCacheConfig cache_config = 3;

  // Request header location to extract the token. By default (i.e. if this field is not specified), the token
  // is extracted to the Authorization HTTP header, in the format "Authorization: Bearer <token>".
  // Not supported by all data planes.
  TokenHeader token_header = 4;

  // Cluster to send traffic to the GCE metadata server. Not supported
  // by all data planes; a data plane may instead have its own mechanism
  // for contacting the metadata server.
  string cluster = 5;

  // Timeout for fetching the tokens from the GCE metadata server.
  // Not supported by all data planes.
  google.protobuf.Duration timeout = 6 [(validate.rules).duration = {
    lt {seconds: 4294967296}
    gte {}
  }];
}

// Audience is the URL of the receiving service that performs token authentication.
// It will be provided to the filter through cluster's typed_filter_metadata.
message Audience {
  message AccessToken {
  }

  message BoundJwt {
    // The audience URL, used for fetching bound JWT token.
    string url = 1 [(validate.rules).string = {min_len: 1}];
  }

  message BoundAccessToken {
  }

  // The audience URL, used for fetching unbound JWT token.
  string url = 1;

  // If defined, the filter will fetch unbound Access Token instead of JWT.
  // It takes precedence over ``url``.
  AccessToken access_token = 2;

  // If defined, the filter will fetch bound JWT token instead of unbound.
  // It takes precedence over ``access_token`` and ``url``.
  BoundJwt bound_jwt = 3;

  // If defined, the filter will fetch bound Access Token instead of unbound.
  // It takes precedence over ``bound_jwt``, ``access_token`` and ``url``.
  BoundAccessToken bound_access_token = 4;
}

// Token Cache configuration.
message TokenCacheConfig {
  // The number of cache entries. The maximum number of entries is INT64_MAX as it is constrained by underlying cache implementation.
  // Default value 0 (i.e., proto3 defaults) disables the cache by default. Other default values will enable the cache.
  google.protobuf.UInt64Value cache_size = 1 [(validate.rules).uint64 = {lte: 9223372036854775807}];
}

message TokenHeader {
  // The HTTP header's name.
  string name = 1
      [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}];

  // The header's prefix. The format is "value_prefix<token>"
  // For example, for "Authorization: Bearer <token>", value_prefix="Bearer " with a space at the
  // end.
  string value_prefix = 2
      [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}];
}
