// SPDX-License-Identifier: MIT

syntax = "proto3";

package ermite;

import "google/protobuf/timestamp.proto";

// ServerService describes the server itself.
service ServerService {
  // GetVersion returns the server version and the optional capabilities of the
  // contract it implements. It needs no authentication, so a client can call
  // it first to check compatibility.
  rpc GetVersion(GetVersionRequest) returns (GetVersionResponse);
  // GetSigningKey returns the public key with which the server signs the
  // commits it creates (squash and merge commits, see MergeMode). It needs no
  // authentication: the key is public, and anyone verifying a commit needs it.
  // Servers that implement it list "signing_key" in
  // GetVersionResponse.features.
  rpc GetSigningKey(GetSigningKeyRequest) returns (GetSigningKeyResponse);
  // RotateOIDCKey replaces the key with which the server signs the OIDC ID
  // tokens of CI jobs (Job.id_token_url) by a new one. The previous key stops
  // signing at once but stays in the server's JWKS
  // ("/-/oidc/.well-known/jwks") for 24 hours, so that tokens it signed still
  // verify until they expire. It needs owner rights: the admin token, the
  // owner's session, or a token with every scope and no repository list or
  // branch prefixes (permission_denied otherwise). It fails with
  // failed_precondition when the server issues no ID tokens (it has no
  // secrets key to seal the key with). Servers that implement it list
  // "ci.oidc" in GetVersionResponse.features.
  rpc RotateOIDCKey(RotateOIDCKeyRequest) returns (RotateOIDCKeyResponse);
}

// GetVersionRequest is empty.
message GetVersionRequest {}

// GetVersionResponse describes the running server.
message GetVersionResponse {
  // Version is the server release, for example "v0.4.0", or "devel" for an
  // untagged build. Informational: clients must not compare it to decide what
  // is supported, they use features instead.
  string version = 1;
  // Features lists identifiers of the optional capabilities of the contract
  // that this server implements, for example "repo.update" or
  // "events.resume". A client that needs a capability missing from this list
  // should warn instead of failing on an unimplemented RPC or ignored field.
  // Identifiers are lowercase, dot-separated and never reused. The CI
  // identifiers are "ci.runs" (RunService runs, jobs, logs, checks, and the
  // run_updated and job_updated events), "ci.runs.filters" (ListRuns honours
  // its filters) and "ci.runners" (RunnerService, and RunService.ListRunners
  // and RemoveRunner). The CI execution identifiers are "ci.actions"
  // (RunnerService.ResolveActions and Job.github_token), "ci.annotations"
  // (annotations in UpdateJob and CompleteJob, and RunService.ListAnnotations)
  // and "ci.summaries" (RunnerService.UploadSummary and
  // RunService.GetStepSummaries). The CI platform identifiers are "ci.secrets"
  // (SecretService, VariableService and EnvironmentService, and in Job the
  // secrets, vars, environment, permissions and trusted fields and Run.trusted),
  // "ci.dispatch" (RunService.DispatchWorkflow), "ci.concurrency"
  // (CI_STATUS_PENDING and RunJob.concurrency_group), "ci.cache" (Job.cache)
  // and "ci.artifacts" (JobArtifactService and ArtifactService). The merge
  // request identifier "merge_requests.mergeability" covers
  // MergeRequest.mergeability, the MergeRequestMergeability event and
  // MERGE_MODE_MERGE_COMMIT. "merge_requests.auto_merge" covers
  // RepoSettings.allow_auto_merge, MergeRequest.auto_merge and auto_merged,
  // the EnableAutoMerge and CancelAutoMerge RPCs, the
  // MergeRequestAutoMergeEnabled and MergeRequestAutoMergeCancelled events
  // and MergeRequestMerged.auto. "releases" covers ReleaseService and the
  // release_published, release_updated, release_deleted and release_unpublished events.
  repeated string features = 2;
}

// GetSigningKeyRequest is empty.
message GetSigningKeyRequest {}

// GetSigningKeyResponse describes the commit signing key of the server.
message GetSigningKeyResponse {
  // PublicKey is the public key as one OpenSSH authorized_keys line, for
  // example "ssh-ed25519 AAAA...". Commits are signed in the SSH signature
  // format (SSHSIG).
  string public_key = 1;
  // Fingerprint is the SHA-256 fingerprint of the key, in the form
  // "SHA256:<base64>" that ssh-keygen prints.
  string fingerprint = 2;
  // CommitterName is the name the server records as the committer of the
  // commits it creates.
  string committer_name = 3;
  // CommitterEmail is the email address the server records as the committer of
  // the commits it creates. It is the principal of allowed_signers.
  string committer_email = 4;
  // AllowedSigners is a ready-to-use line for an allowed signers file
  // ("<committer_email> <public_key>"), to verify these commits with
  // "git config gpg.ssh.allowedSignersFile".
  string allowed_signers = 5;
}

// RotateOIDCKeyRequest is empty.
message RotateOIDCKeyRequest {}

// RotateOIDCKeyResponse describes the new signing key of the ID tokens.
message RotateOIDCKeyResponse {
  // Issuer is the "iss" of the ID tokens, for example
  // "https://git.example.com/-/oidc". Its discovery document is at
  // "<issuer>/.well-known/openid-configuration".
  string issuer = 1;
  // Kid is the key id of the new key, the "kid" of the tokens it signs: the
  // RFC 7638 thumbprint of its public key, base64url without padding.
  string kid = 2;
  // RetiredKid is the key id of the key it replaces; empty when there was
  // none.
  string retired_kid = 3;
  // RetiredUntil is when the replaced key leaves the JWKS. Unset when there
  // was none.
  google.protobuf.Timestamp retired_until = 4;
}