// Copyright 2017 Google Inc. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package configpb;

import "github.com/google/trillian/crypto/keyspb/keyspb.proto";
import "google/protobuf/any.proto";
import "google/protobuf/timestamp.proto";

message LogBackend {
  // name defines the name of the log backend for use in LogConfig messages and must be unique.
  string name = 1;
  // backend_spec defines the RPC endpoint that clients should use to send requests
  // to this log backend. These should be in the same format as rpcBackendFlag in the
  // CTFE main and must not be an empty string.
  string backend_spec = 2;
}

// LogBackendSet supports a configuration where a single set of frontends handle
// requests for multiple backends. For example this could be used to run different
// backends in different geographic regions.
message LogBackendSet {
  repeated LogBackend backend = 1;
}

// LogConfigSet is a set of LogConfig messages.
message LogConfigSet {
  repeated LogConfig config = 1;
}

// LogConfig describes the configuration options for a log instance.
message LogConfig {
  int64 log_id = 1;
  string prefix = 2;
  repeated string roots_pem_file = 3;
  google.protobuf.Any private_key = 4;
  // The public key is included for the convenience of test tools (and obviously
  // should match the private key above); it is not used by the CT personality.
  keyspb.PublicKey public_key = 5;
  bool reject_expired = 6;
  repeated string ext_key_usages = 7;
  // not_after_start defines the start of the range of acceptable NotAfter
  // values, inclusive.
  // Leaving this unset implies no lower bound to the range.
  google.protobuf.Timestamp not_after_start = 8;
  // not_after_limit defines the end of the range of acceptable NotAfter values,
  // exclusive.
  // Leaving this unset implies no upper bound to the range.
  google.protobuf.Timestamp not_after_limit = 9;
  // accept_only_ca controls whether or not *only* certificates with the CA bit
  // set will be accepted.
  bool accept_only_ca = 10;
  // backend_name if set indicates which backend serves this log. The name must be
  // one of those defined in the LogBackendSet.
  string log_backend_name = 11;
}

// LogMultiConfig wraps up a LogBackendSet and corresponding LogConfigSet so
// that they can easily be parsed as a single proto.
message LogMultiConfig {
  // The set of backends that this configuration will use to send requests to.
  // The names of the backends in the LogBackendSet must all be distinct.
  LogBackendSet backends = 1;
  // The set of logs that will use the above backends. All the protos in this
  // LogConfigSet must set a valid log_backend_name for the config to be usable.
  LogConfigSet log_configs = 2;
}
