// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package nearby.internal;

// option java_api_version = 2;
option java_multiple_files = true;
option java_package = "com.google.nearby.presence";
option java_outer_classname = "CredentialProto";
option optimize_for = LITE_RUNTIME;

// LINT.IfChange(IdentityType)
enum IdentityType {
  IDENTITY_TYPE_UNSPECIFIED = 0;
  IDENTITY_TYPE_PRIVATE_GROUP = 1;
  IDENTITY_TYPE_CONTACTS_GROUP = 2;
  IDENTITY_TYPE_PUBLIC = 3;
}
// LINT.ThenChange(//depot/google3/google/internal/location/nearby/presence/v1/nearby_resources.proto:IdentityType)
// LINT.IfChange(CredentialType)
enum CredentialType {
  CREDENTIAL_TYPE_UNKNOWN = 0;
  CREDENTIAL_TYPE_DEVICE = 1;
  CREDENTIAL_TYPE_GAIA = 2;
}
// LINT.ThenChange(//depot/google3/google/internal/location/nearby/presence/v1/nearby_resources.proto:CredentialType)

// The shared credential is derived from local credential, and distributed to
// remote devices based on the trust token for identity decryption and
// authentication.
// NEXT_ID=20
// LINT.IfChange(SharedCredential)
message SharedCredential {
  // The randomly generated unique id of the public credential.
  bytes secret_id = 1 [deprecated = true];

  // 32 bytes of secure random bytes used to derive any symmetric keys needed.
  bytes key_seed = 2;

  // The time in millis from epoch when this credential becomes effective.
  int64 start_time_millis = 3;

  // The time in millis from epoch when this credential expires.
  int64 end_time_millis = 4;

  // The encrypted Metadata in bytes. Encrypted by the v0
  // metadata_encryption_key.
  bytes encrypted_metadata_bytes_v0 = 5;

  // The tag for verifying metadata_encryption_key for a V0 advertisement.
  bytes metadata_encryption_key_tag_v0 = 6;

  // The public key is used to create a secure connection with the device.
  bytes connection_signature_verification_key = 7;

  // The public key is used to verify Advertisement Signature in BT5.0 (v1)
  // specs.
  bytes advertisement_signature_verification_key = 8;

  // The trust type assigned to the credential. The credential is only
  // accessible to contacts assigned with the same token. This field is only
  // visible to the generating device and the server for distribution/provision
  // purposes. Tokens are abstracted (with unnecessary details being removed)
  // when returned to downloading devices.
  IdentityType identity_type = 9;

  // The version number of this SharedCredential, matches the corresponding
  // protocol version.
  bytes version = 10 [deprecated = true];

  // The type assigned to the credential. The CredentialType is used to
  // determine whether a device identity credential or account based identity
  // credential is used for decryption.
  CredentialType credential_type = 11;

  // The encrypted Metadata in bytes. Encrypted by the v1
  // metadata_encryption_key.
  bytes encrypted_metadata_bytes_v1 = 12;

  // The HMAC of the plaintext identity token included (in encrypted form) in an
  // unsigned, short salt, V1 advertisement.
  bytes identity_token_short_salt_adv_hmac_key_v1 = 13;

  // The randomly generated positive unique id of the shared credential.
  int64 id = 14;

  // The DUSI number related to the uploader of this shared credential. Debug
  // purpose only.
  string dusi = 15;

  // Signature algorithm version. Used to determine which algorithm to use to
  // verify incoming signatures.
  string signature_version = 16 [deprecated = true];

  // The HMAC of the plaintext identity token included (in encrypted form) in an
  // unsigned, extended salt, V1 advertisement.
  bytes identity_token_extended_salt_adv_hmac_key_v1 = 17;

  // The HMAC of the plaintext identity token included (in encrypted form) in a
  // signed V1 advertisement.
  bytes identity_token_signed_adv_hmac_key_v1 = 18;

  // Credential version used to infer the expected credential material.
  int64 credential_version = 19;

  // The V0 encrypted Metadata in bytes. Encrypted by the rust np_adv library
  // with the V0 identity token.
  bytes rust_encrypted_metadata_bytes_v0 = 20;
}
// LINT.ThenChange(//depot/google3/google/internal/location/nearby/presence/v1/nearby_resources.proto:SharedCredential)