currentuser.proto

syntax = "proto3";

package hiber.user;

import "base.proto";
import "organization.proto";
import "role.proto";

option java_multiple_files = false;
option java_package = "global.hiber.api.grpc.user";
option java_outer_classname = "CurrentUserApi";
option go_package = ".;hiber";

/* Calls related to the current user. Typically, a newly created user only has access to these calls, all
 * others require an organization to be linked.
 */
service CurrentUserService {
    rpc CurrentUser (CurrentUserRequest) returns (hiber.user.CurrentUser);
    rpc DeleteCurrentUser (DeleteCurrentUserRequest) returns (DeleteCurrentUserRequest.Response);

    rpc RequestAccess (RequestAccessRequest) returns (RequestAccessRequest.Response);
    rpc CancelAccessRequest (CancelAccessRequestRequest) returns (CancelAccessRequestRequest.Response);
    rpc ListOrganizationInvites (ListOrganizationInvitesRequest) returns (ListOrganizationInvitesRequest.Response);
    rpc AcceptOrganizationInvite (AcceptOrganizationInviteRequest) returns (AcceptOrganizationInviteRequest.Response);

    rpc AccessibleOrganizations (AccessibleOrganizationsRequest) returns (AccessibleOrganizationsRequest.Response);
    rpc UpdateDefaultOrganization (UpdateDefaultOrganizationRequest) returns (UpdateDefaultOrganizationRequest.Response);

    rpc UpdateMissionControlSettings (UpdateMissionControlSettingsRequest) returns (UpdateMissionControlSettingsRequest.Response);
    rpc AcceptTermsAndConditions (AcceptTermsAndConditionsRequest) returns (AcceptTermsAndConditionsRequest.Response);
    rpc LogPasswordUpdated (LogPasswordUpdatedRequest) returns (LogPasswordUpdatedRequest.Response);

    rpc OverrideRoles (OverrideRoles.Request) returns (OverrideRoles.Response);
    rpc RestoreRoles (OverrideRoles.Restore.Request) returns (OverrideRoles.Restore.Response);
}

/* Your personal data. */
message CurrentUser {
    string id = 1;

    /* Email address of the current user.
     * Only set when you have permission to read the user data (i.e. a token without that permission would not see this)
     */
    optional string email = 2;

    /* Name of the current user.
     * Only set when you have permission to read the user data (i.e. a token without that permission would not see this)
     */
    optional string name = 3;

    /* The organizations that this user has access to. */
    repeated string organizations = 4;

    /* The default organization for this user, if any. */
    optional string default_organization = 5;

    /* Open access requests. */
    repeated string requested_organizations = 6;

    reserved 7;

    /* The current organization for this user.
     * If this is a user, this equals the default_organization, if any.
     * If this is a token, it's the token's organization.
     */
    optional string current_organization = 8;

    /* Permissions for the current organization. */
    optional Filter.OrganizationPermissions current_organization_permissions = 9;

    /* Permissions for the user. If this is a token, the user permissions may be limited or omitted. */
    optional Filter.UserPermissions user_permissions = 10;

    /* Permissions for customer support.
     * Used for features typically reserved for customer support, or that behave differently
     * when used by a customer support operator.
     */
    optional Filter.SupportPermissions support_permissions = 14;

    /* Roles for the current organization. */
    repeated string roles = 15;

    string mission_control_settings = 11;

    /* Whether the user accepted the terms and conditions. */
    bool accepted_tac = 12;

    string user_hash = 13;

    /* Whether a password reset is recommended for this user. */
    bool password_reset_recommended = 16;

    /* Why a password reset is recommended for this user. */
    optional string password_reset_recommended_reason = 17;
}

/* Get your personal data. */
message CurrentUserRequest {
    /* Pick the organization to use (/impersonate). If unset, your default organization is used. */
    optional string organization = 1;
}

/* Request access to an organization by name, if it exists.
 * You request will be saved and the organization owner notified.
 * Organization admins can approve or reject your request.
 */
message RequestAccessRequest {
    message Response {
    }

    string organization = 1;
}

/* Cancel a previously made access request. */
message CancelAccessRequestRequest {
    message Response {
    }

    string organization = 1;
}

/* List all invitations from organizations. */
message ListOrganizationInvitesRequest {
    message Invite {
        string organization = 1;
        string display_name = 2;
        Timestamp invited_at = 3;
    }

    message Response {
        repeated Invite organizations = 1;
    }

    optional string search = 1;
}

/* Accept an invitation to an organization. */
message AcceptOrganizationInviteRequest {
    message Response {
    }

    string organization = 1;

    /* Set to true to mark the organization as your default organization. */
    optional bool default_organization = 2;
}

/* Delete yourself.
 * Removes all login information and personal data, except for you email address for auditing purposes.
 */
message DeleteCurrentUserRequest {
    message Response {
    }
}

/* Set the default organization to use when it is not specified in the call.
 * Note: this can be a child organization of one of the owned organizations.
 */
message UpdateDefaultOrganizationRequest {
    message Response {
        string default_organization = 1;
    }

    string organization = 1;
}

/* Update mission control settings, which are in a json format. */
message UpdateMissionControlSettingsRequest {
    message Response {
        string mission_control_settings = 1;
    }

    string update = 1;
}

/* Accept the Hiber terms and conditions. */
message AcceptTermsAndConditionsRequest {
    message Response {
    }

    bool accept_tac = 1;
}

/* Log that the user has reset their password. */
message LogPasswordUpdatedRequest {
    message Response {
    }
}

/* List all organizations that can be impersonated. */
message AccessibleOrganizationsRequest {
    message AccessibleOrganization {
        /* Organization identifier, i.e. "my-organization" */
        string organization = 1;

        /* Organization name, i.e. "My Organization" */
        string display_name = 2;

        /* The contact person for this organization */
        organization.Organization.Contact contact = 5;

        /* If true, you are a member of this organization (= you are directly linked to this organization) */
        bool member = 3;

        /* If true, this is the organization that you use by default. */
        bool default_organization = 4;
    }

    message Response {
        /* Details for the organizations that you can access. */
        repeated AccessibleOrganization organizations = 3;

        Pagination.Result pagination = 2;

        reserved 1;
    }

    /* Search accessible organizations by name. */
    optional string search = 1;

    /* Only list organizations of which you are a member (exclude organizations that you can only impersonate). */
    optional bool member_only = 3;

    /* Only list your default organization. */
    optional bool default_only = 4;

    optional Pagination pagination = 2;
}

message OverrideRoles {
    message Request {
        /* Pick the organization to use (/impersonate). If unset, your default organization is used. */
        optional string organization = 1;

        /* Select the roles to list. Optional, when omitted or empty everything is included. */
        optional role.RoleSelection selection = 2;
    }

    message Response {
        hiber.user.CurrentUser current_user = 1;
        Request request = 2;
    }

    message Restore {
        message Request {
            /* Optionally, specify organization(s) with an active override that you wish to remove.
             * If no organizations are provided, all overrides will be removed.
             */
            repeated string organization = 1;
        }
        message Response {
            hiber.user.CurrentUser current_user = 1;
            Request request = 2;
        }
    }
}