/*
	Copyright The containerd Authors.

	Licensed under the Apache License, Version 2.0 (the "License");
	you may not use this file except in compliance with the License.
	You may obtain a copy of the License at

		http://www.apache.org/licenses/LICENSE-2.0

	Unless required by applicable law or agreed to in writing, software
	distributed under the License is distributed on an "AS IS" BASIS,
	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	See the License for the specific language governing permissions and
	limitations under the License.
*/

syntax = "proto3";

package containerd.types.transfer;

import "google/protobuf/timestamp.proto";

option go_package = "github.com/containerd/containerd/api/types/transfer";

message OCIRegistry {
	string reference = 1;
	RegistryResolver resolver = 2;
}

enum HTTPDebug {
	DISABLED = 0;
	// Enable HTTP debugging
	DEBUG = 1;
	// Enable HTTP requests tracing
	TRACE = 2;
	// Enable both HTTP debugging and requests tracing
	BOTH = 3;
}

message RegistryResolver {
	// auth_stream is used to refer to a stream which auth callbacks may be
	// made on.
	string auth_stream = 1;

	// Headers
	map<string, string> headers = 2;

	string host_dir = 3;

	string default_scheme = 4;
	// Force skip verify
	// CA callback? Client TLS callback?

	// Whether to debug/trace HTTP requests to OCI registry.
	HTTPDebug http_debug = 5;

	// Stream ID to use for HTTP logs (when logs are streamed to client).
	// When empty, logs are written to containerd logs.
	string logs_stream = 6;
}

// AuthRequest is sent as a callback on a stream
message AuthRequest {
	// host is the registry host
	string host = 1;

	// reference is the namespace and repository name requested from the registry
	string reference = 2;

	// wwwauthenticate is the HTTP WWW-Authenticate header values returned from the registry
	repeated string wwwauthenticate = 3;
}

enum AuthType {
	NONE = 0;

	// CREDENTIALS is used to exchange username/password for access token
	// using an oauth or "Docker Registry Token" server
	CREDENTIALS = 1;

	// REFRESH is used to exchange secret for access token using an oauth
	// or "Docker Registry Token" server
	REFRESH = 2;

	// HEADER is used to set the HTTP Authorization header to secret
	// directly for the registry.
	// Value should be `<auth-scheme> <authorization-parameters>`
	HEADER = 3;
}

message AuthResponse {
	AuthType authType = 1;
	string secret = 2;
	string username = 3;
	google.protobuf.Timestamp expire_at = 4;
	// TODO: Stream error
}
