// Copyright 2023 Ant Group Co., Ltd.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

syntax = "proto3";

import "secretflowapis/v1/sdc/digital_envelope.proto";
import "secretflowapis/v1/common.proto";
import "secretflowapis/v1/status.proto";
import "secretflowapis/v1/sdc/core.proto";
import "secretflowapis/v1/sdc/dataagent/data_agent.proto";
import "secretflowapis/v1/sdc/teeapps/tee_task_params.proto";

package secretflowapis.v1.sdc.authmanager;

// OPENSOURCE-CLEANUP REMOVE 2
option java_package = "com.alipay.secretflow.secretflowapis.v1.sdc.authmanager";
option java_outer_classname = "AuthManagerProto";

message GetExportDataKeyRequest {
  RequestHeader header = 1;
  // 数据信息
  string data_uuid = 2;
  // 分区 id
  string partition_id = 3;
  // 数据请求者的公钥
  //
  PublicKey public_key = 4;
}

message GetExportDataKeyResponse {
  Status status = 1;
  // 数据解密密钥
  repeated SegmentDataMeta data_keys = 2;
}

message GetComputeMetaRequest {
  RequestHeader header = 1;
  // quote.report_data = sha256(tee_task_params|public_key)
  UnifiedAttestationReport attestation_report = 2;
  teeapps.TeeTaskParams tee_task_params = 3;
  // The temporary public key generated by the worker
  PublicKey public_key = 4;
}

// This plaintext message will be encrypted by GetComputeMetaResponse
message ComputeMeta {
  string cmd = 1;
  DataAccessToken access_token = 2;
  message InputMeta {
    Schema schema = 1;
    // The data storage path and the corresponding data decryption key
    DataUri data_uri_with_dks = 2;
  }
  // The order of `input_metas` is same to `TeeTaskParams.inputs`.
  repeated InputMeta input_metas = 3;

  // The public key of AuthManager
  //
  // The worker completes the computation, it will randomly generate a data
  // encryption key to encrypt the result, and this data encryption key needs to
  // be encrypted with the public key of `AuthManager` before being persistently
  // stored.
  PublicKey public_key = 4;

  // All ancestors of the output data
  //
  // When AuthManager verifies the permissions of the task, it collects all
  // inputs' ancestors, and merges them into a deduplicated set of ancestors,
  // which represents all ancestor information of the outputs.
  // After completing the computation, the worker fills in the meta information
  // of each output data with `all_ancestors`, making it easier
  // for AuthManager to quickly search for them.
  repeated Ancestor all_ancestors = 5;
}

message GetComputeMetaResponse {
  Status status = 1;
  // Encrypted AppMeta using digital envelope.
  AsymmetricSecret encrypted_response = 2;
}

/// 运行在 TEE 中的授权管理服务，用于验证任务执行权限，以及数据导出权限
//
//  *
//  任务执行权限，授权管理服务依据数据授权信息以及任务是否需要先验审批，来决定任
//    务是否可以执行：
//    - 数据授权信息具体见 `DataAuth`中的描述，数据提供者会指定数据使用者以及可
//      被使用的任务种类等信息，如果任务不满足数据授权要求，就会被拒绝执行；
//    - 对于任务中需要包含动态脚本的任务（如 SQL 查询），虽然数据结果在经过数据
//      导出授权前都是密文状态，但是仍然可能会有侧信道攻击的风险，因此在执行需要数据
//      提供者审批（对任务内容进行签名，见 TaskInfo），以防止恶意动态脚本执行。
//      当然，这是一个可选配置，因为每次发起任务都需要审批会降低易用性，实际部署需
//      要在易用性和安全性做折中考虑。
//  * 数据导出权限，满足以下条件的请求者可以获得数据加密密钥
//    - 原始数据：请求者是该数据的 owner；
//    - 中间数据：
//        统计类数据：请求者是任务发起者或者原始数据提供者
//        模型/分析结果：请求者是任务发起者，并且所有原始数据提供者已授权
service AuthManager {
  // 请求获取数据加密密钥，AuthManager
  // 验证请求者拥有数据导出权限后， 会使用请求者公钥加密数据加密密钥
  rpc GetExportDataKey(GetExportDataKeyRequest)
      returns (GetExportDataKeyResponse) {}

  // The following services are implemented for TEE apps. TEE apps communicate
  // with server via digital envelops. TEE apps send self-generated public key
  // with RA report to server. Server then uses this public key to encrypt
  // requested data back to TEE apps.
  rpc GetComputeMeta(GetComputeMetaRequest) returns (GetComputeMetaResponse) {}

  // 功能：请求auth、返回RA报告、证书
  rpc GetRaCertPems(dataagent.GetRaCertPemsRequest)
      returns (dataagent.GetRaCertPemsResponse) {}

  // 功能：请求auth
  //      1. 生成授权data meta
  //      2. 储存数据的加密data_key（由于数据直接发送到ray
  //      worker，因此数据不存储）
  rpc CreateDataWithAuth(dataagent.CreateDataWithAuthRequest)
      returns (dataagent.CreateDataWithAuthResponse) {}

  // 功能：注册机构public key
  rpc RegisterInsPubKey(dataagent.RegisterInsPubKeyRequest)
      returns (dataagent.RegisterInsPubKeyResponse) {}

  // 功能：注册mac key
  rpc CreateDataMacKey(dataagent.CreateDataMacKeyRequest)
      returns (dataagent.CreateDataMacKeyResponse) {}
}