
syntax = "proto3";
package spire.common;
option go_package = "github.com/spiffe/spire/proto/spire/common";

/** Represents an empty message */
message Empty {}

/** A type which contains attestation data for specific platform. */
message AttestationData {
    /** Type of attestation to perform. */
    string type = 1;
    /** The attestation data. */
    bytes data = 2;
}

/** A type which describes the conditions under which a registration
entry is matched. */
message Selector {
    /** A selector type represents the type of attestation used in attesting
    the entity (Eg: AWS, K8). */
    string type = 1;
    /** The value to be attested. */
    string value = 2;
}

/** Represents a type with a list of Selector. */
message Selectors {
    /** A list of Selector. */
    repeated Selector entries = 1;
}

/* Represents an attested SPIRE agent */
message AttestedNode {
    // Node SPIFFE ID
    string spiffe_id = 1;

    // Attestation data type
    string attestation_data_type = 2;

    // Node certificate serial number
    string cert_serial_number = 3;

    // Node certificate not_after (seconds since unix epoch)
    int64 cert_not_after = 4;

    // Node certificate serial number
    string new_cert_serial_number = 5;

    // Node certificate not_after (seconds since unix epoch)
    int64 new_cert_not_after = 6;

    // Node selectors
    repeated Selector selectors = 7;

    // CanReattest field (can the attestation safely be deleted and recreated automatically)
    bool can_reattest = 8;
}

/** This is a curated record that the Server uses to set up and
manage the various registered nodes and workloads that are controlled by it. */
message RegistrationEntry {
    /** A list of selectors. */
    repeated Selector selectors = 1;
    /** The SPIFFE ID of an entity that is authorized to attest the validity
    of a selector */
    string parent_id = 2;
    /** The SPIFFE ID is a structured string used to identify a resource or
    caller. It is defined as a URI comprising a “trust domain” and an
    associated path. */
    string spiffe_id = 3;
    /** Time to live for X509-SVIDs generated from this entry. Was previously called 'ttl'. */
    int32 x509_svid_ttl = 4;
    /** A list of federated trust domain SPIFFE IDs. */
    repeated string federates_with = 5;
    /** Entry ID */
    string entry_id = 6;
    /** Whether or not the workload is an admin workload. Admin workloads
    can use their SVID's to authenticate with the Server APIs, for
    example. */
    bool admin = 7;
    /** To enable signing CA CSR in upstream spire server  */
    bool downstream = 8;
    /** Expiration of this entry, in seconds from epoch */
    int64 entryExpiry = 9;
    /** DNS entries */
    repeated string dns_names = 10;
    /** Revision number is bumped every time the entry is updated */
    int64 revision_number = 11;
    /** Determines if the issued SVID must be stored through an SVIDStore plugin */
    bool store_svid = 12;
    /** Time to live for JWT-SVIDs generated from this entry, if set will override ttl field. */
    int32 jwt_svid_ttl = 13;
    /** An operator-specified string used to provide guidance on how this
    identity should be used by a workload when more than one SVID is returned. */
    string hint = 14;
    /** Time of creation, in seconds from epoch */
    int64 created_at = 15;
}

/** The RegistrationEntryMask is used to update only selected fields of the RegistrationEntry */
message RegistrationEntryMask {
    bool selectors = 1;
    bool parent_id = 2;
    bool spiffe_id = 3;
    bool x509_svid_ttl = 4;
    bool federates_with = 5;
    bool entry_id = 6;
    bool admin = 7;
    bool downstream = 8;
    bool entryExpiry = 9;
    bool dns_names = 10;
    bool store_svid = 11;
    bool jwt_svid_ttl = 12;
    bool hint = 13;
}


/** A list of registration entries. */
message RegistrationEntries {
    /** A list of RegistrationEntry. */
    repeated RegistrationEntry entries = 1;
}

/** Certificate represents a ASN.1/DER encoded X509 certificate */
message Certificate {
    bytes der_bytes = 1;
}

/** PublicKey represents a PKIX encoded public key */
message PublicKey {
    /** PKIX encoded key data */
    bytes pkix_bytes = 1;

    /** key identifier */
    string kid = 2;

    /** not after (seconds since unix epoch, 0 means "never expires") */
    int64 not_after = 3;

    /** Whether or not the key is tainted */
    bool tainted_key = 4;
}

message Bundle {
    /** the SPIFFE ID of the trust domain the bundle belongs to */
    string trust_domain_id = 1;

    /** list of root CA certificates */
    repeated Certificate root_cas = 2;

    /** list of JWT signing keys */
    repeated PublicKey jwt_signing_keys = 3;

    /** refresh hint is a hint, in seconds, on how often a bundle consumer
     * should poll for bundle updates */
    int64 refresh_hint = 4;

    /** sequence number is a monotonically increasing number that is
     * incremented every time the bundle is updated */
    uint64 sequence_number = 5;

    /** list of X.509 tainted keys */
    repeated X509TaintedKey x509_tainted_keys = 6;
}

message X509TaintedKey {
        /** tainted public key*/
	bytes public_key = 1;
}

message BundleMask {
    bool root_cas = 1;
    bool jwt_signing_keys = 2;
    bool refresh_hint = 3;
    bool sequence_number = 4;
    bool x509_tainted_keys = 5;
}

message AttestedNodeMask{
    bool attestation_data_type = 1;
    bool cert_serial_number = 2;
    bool cert_not_after = 3;
    bool new_cert_serial_number = 4;
    bool new_cert_not_after = 5;
    bool can_reattest = 6;
}
