/*
Proto contract of Authentication API module.
This is a collection that allows for:
- Managing users
- Providing access tokens

Version     Date            Author      Comment
V1.0.0      19-06-2024      MiAl        Initial version
V1.0.1      14-01-2025      KdJ         Updated proto references
V1.1.0      22-01-2025      MiAl        Changed create user response
V1.2.0      23-06-2025      SGi         Proto refactor for CRUD operations
V1.3.0      02-10-2025      KdJ         Update all Id's to string values for usage as GUID string
*/

syntax = "proto3";

import "Interfaces/google/api/annotations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";
import "Interfaces/PrintManager/Protos/V1/bergstein.digi.printmanager.proto_options.proto";
import "Interfaces/PrintManager/Protos/V1/bergstein.digi.printmanager.paging.proto";
import "Interfaces/PrintManager/Protos/V1/bergstein.digi.printmanager.audit.proto";
import "Interfaces/Application/Protos/V1/bergstein.digi.moduleinfo.proto";

package authentication;

option csharp_namespace = "Bergstein.Digi.Shared.Interfaces.PrintManager.Authentication.Protos.V1";

// Service for creating, reading, updating, deleting user.
service UserService {
    
  /*
  Endpoint for a creating a users in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts.

  Returns on a success:
  - the created user

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more User fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc CreateUser (CreateUserRequest) returns (NewUserReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/user"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single user in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts or the requesting user.

  Returns on a success:
  - the requested user

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested user (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetUser (GetUserRequest) returns (GetUserReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user/{id}"
    };
  }

  /*
  Endpoint for getting all the registered users in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts.

  Returns on a success:
  - list of registered users

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListUser (ListUserRequest) returns (ListUserReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user"
    };
  }

  /*
  Endpoint for updating a registered users in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts or the requesting user.

  Returns on a success:
  - the updated user

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more User fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested user (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc UpdateUser (UpdateUserRequest) returns (UpdateUserReply) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/user"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered users in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested user (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteUser (DeleteUserRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/user/{id}"
    };
  }
 
  /*
  Endpoint for updating a registered users password in the system.

  This is only accessible by providing the original user credentials.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when password format does not meet the specifications
  - NOT_FOUND (5) status when the requested user (ID), to update, was not found
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the correct user credentials (user name and/or password)
  */
  rpc UpdateUserPassword (UpdateUserPasswordRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/user/password"
      body: "*"
    };
  }

  /*
  Endpoint for subscribing on an event when a registered user updates it's password in the system.

  This is only accessible for User Managers, Administrators and/or System accounts.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when password format does not meet the specifications
  - NOT_FOUND (5) status when the requested user (ID), to update, was not found
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the correct user credentials (user name and/or password)
  */
  rpc OnUserPasswordUpdated (SubscribeOnUserPasswordUpdate) returns (stream UserPasswordUpdatedReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/user/event/user_password_updated"
      body: "*"
    };
  }

  /*
  Endpoint for subscribing on an event when an user is updated.

  This endpoint provides a real-time stream of users that have been modified in the system.
  Clients can optionally filter which users they want to receive updates for.

  Returns on a success:
    - a stream of UserUpdated messages containing the modified user; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserUpdated (SubscribeOnUserUpdated) returns (stream UserUpdated) {

  }

  /*
  Endpoint for subscribing on an event when a new user is created.

  This endpoint provides a real-time stream of newly created users in the system.
  Clients can optionally filter which users they want to receive creation notifications for.

  Returns on a success:
    - a stream of UserCreated messages containing the newly created user; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserCreated (SubscribeOnUserCreated) returns (stream UserCreated) {

  }

  /*
  Endpoint for subscribing on an event when an user is deleted.

  This endpoint provides a real-time stream notification when users are removed from the system.
  Clients can optionally filter which users they want to receive deletion notifications for.

  Returns on a success:
    - a stream of UserDeleted messages containing the deleted user information; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserDeleted (SubscribeOnUserDeleted) returns (stream UserDeleted) {

  }
}

// The create user request. The Id field should be left at 0, since this is created by the database.
message CreateUserRequest {
  // The new user
  User user = 1;
}

// The get user request.
message GetUserRequest {
  // The matching Id of the user to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The get users request.
message ListUserRequest {
  // The paging request to indicate the paging behavior.
  shared.PagingRequest paging = 1;
  // The direction of the ordering.
  bool descending = 2;
  // The ordering indicated property wise (value is not default -> order on property).
  User order = 3;
  // The filtering indicated property wise (value is not default -> filter on properties).
  User filter = 4;
}

// The update user request.
message UpdateUserRequest {
  // The user entity to update. Matches on the Id field.
  User user = 1;
}

// The delete user request.
message DeleteUserRequest {
  // The id of the user to delete.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The update user password request
message UpdateUserPasswordRequest {
  // The user name of the User entity.
  string name = 1;
  // The old password.
  string old_password = 2;
  // The new password.
  string new_password = 3;
}

// A request to stream updates when a user updates his/her password.
message SubscribeOnUserPasswordUpdate {
  // Empty for now. In the future we might want to implement a filter.
}

// A reply when a user updates his/her password.
message UserPasswordUpdatedReply {
  // User id which had it's password updated
  string id = 1;
}

// The new user reply
message NewUserReply {
  // The new temporary password. A user is required to update its password first before continuing.
  string temporary_password = 1;
  // The new user entity.
  User user = 2;
}

// The get user reply.
message GetUserReply {
  // The user entity.
  User user = 1;
}

// The update user reply.
message UpdateUserReply {
  // The user entity.
  User user = 1;
}

// The users reply.
message ListUserReply {
  // The collection of users.
  repeated User users = 1;
  // The paging meta data
  shared.PagingReply paging = 2;
}

// A User entity.
message User {
  // The id of the user. This is generated by the database.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The name of the user. The minimum length is 3 characters and maximum length is 30 characters. Must be unique in the system.
  string name = 2;
  // The first name of the user. The maximum length is 30 characters.
  string first_name = 3;
  // The middle name of the user. The maximum length is 30 characters.
  string middle_name = 4;
  // The last name of the user. The maximum length is 30 characters.
  string last_name = 5;
  // The email address of the user. The maximum length is 50 characters and must adhere to the email address format (RFC 5322 : 3.4.1). Must be unique in the system.
  string email = 6;
  // The flag indicating that the user must change it's password on the next login.
  bool must_reset_password = 7;
  // List of user permissions
  repeated UserPermission user_permissions = 8;
  // List of user roles
  repeated UserRole user_roles = 9;
  // The audit information about this entity.
  shared.Audit audit = 10;
}

// The subscribe request 
message SubscribeOnUserUpdated {
  repeated string filter_user_ids = 1;
}

message UserUpdated {
  User user = 1;
}

message SubscribeOnUserCreated {
  repeated string filter_user_ids = 1;
}

message UserCreated{
  User user = 1;
}

message SubscribeOnUserDeleted {
  repeated string filter_user_ids = 1;
}

message UserDeleted{
  User user = 1;
}

// Service for obtaining an access token.
service TokenService {
  /*
  Endpoint for creating an access token to be used to access all other authenticated endpoints.
  Obtaining this access token is done via a LoginRequest of a specific (system) user.
 
  Returns on a success:
  - OK (0) the access token and refresh token
 
  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT (3) status when either or both of user name and password is incorrect
  - FAILED_PRECONDITION (9) status when login is successful but the users password must be reset before obtaining an access token (see UpdateUserPassword)
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc CreateAccessToken (CreateAccessTokenRequest) returns (CreateAccessTokenReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/token/access"
      body: "*"
    };
  }

  /*
  Endpoint for creating an access token, from a renewal token, to be used to access all other authenticated endpoints.
  Obtaining this access token is done via a LoginRequest of a specific (system) user.

  Returns on a success:
  - a new access token and updated refresh token

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested user (ID), to login, was not found
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc RefreshAccessToken (RefreshTokenRequest) returns (RefreshTokenReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/token/refresh"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single user refresh token in the system.

  Returns on a success:
  - the requested user refresh token

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested user (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetUserRefreshToken (GetUserRefreshTokenRequest) returns (GetUserRefreshTokenReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/token/refresh/{id}"
    };
  }

  /*
  Endpoint for a getting all user refresh token in the system.

  Returns on a success:
  - the requested user refresh tokens

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested user (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListUserRefreshToken (ListUserRefreshTokenRequest) returns (ListUserRefreshTokenReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/token/refresh"
    };
  }

  /*
  Endpoint for a getting all user refresh token for a given user.

  Returns on a success:
  - the requested user refresh tokens

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested user (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListUserRefreshTokenForUser (ListUserRefreshTokenForUserRequest) returns (ListUserRefreshTokenForUserReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/token/refresh_for_user"
    };
  }

  /*
  Endpoint for revoking a registered user refresh token in the system.

  Returns on a success:
  - nothing; OK status (0) 

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more User fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested user (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc RevokeUserRefreshToken (RevokeUserRefreshTokenRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/token/refresh/revoke/{id}"
      body: "*"
    };
  }

  /*
  Endpoint for revoking a registered user refresh token in the system for a the calling user.

  Returns on a success:
  - nothing; OK status (0) 

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more User fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested user (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc RevokeUserRefreshTokenForUser (RevokeUserRefreshTokenForUserRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/token/refresh/revoke_for_user/{id}"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered user refresh token in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested user (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteUserRefreshToken (DeleteUserRefreshTokenRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/token/refresh/{id}"
    };
  }
}

// The login request of a specific user to obtain an access token.
// Depending on the security policy, you must also set 'X-Client-Id' header to identify the calling client application.
message CreateAccessTokenRequest {
  // User name of the user to login.
  string user_name = 1;
  // The password of the user to login.
  string password = 2;
}

// The refresh token request to get a new access token and refresh token with.
// Depending on the security policy, you must also set 'X-Client-Id' header to identify the calling client application.
message RefreshTokenRequest {
  // User name of the user to login.
  string user_name = 1;
  // The value of the refresh token.
  string refresh_token = 2;
}

message GetUserRefreshTokenRequest {
  // The id of the requested token.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

message ListUserRefreshTokenRequest {
  // The paging request to indicate the paging behavior.
  shared.PagingRequest paging = 1;
  // The direction of the ordering.
  bool descending = 2;
  // The ordering indicated property wise (value is not default -> order on property).
  UserRefreshToken order = 3;
  // The filtering indicated property wise (value is not default -> filter on properties).
  UserRefreshToken filter = 4;
}

message ListUserRefreshTokenForUserRequest {
  // The paging request to indicate the paging behavior.
  shared.PagingRequest paging = 1;
  // The direction of the ordering.
  bool descending = 2;
  // The ordering indicated property wise (value is not default -> order on property).
  UserRefreshToken order = 3;
  // The filtering indicated property wise (value is not default -> filter on properties).
  UserRefreshToken filter = 4;
}

message RevokeUserRefreshTokenRequest {
  // The id of the user refresh token to revoke.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

message RevokeUserRefreshTokenForUserRequest {
  // The id of the user refresh token to revoke.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

message DeleteUserRefreshTokenRequest {
  // The id of the user refresh token to delete.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// A token reply.
message CreateAccessTokenReply {
  // The access token to authenticate on a API endpoint.
  Token access_token = 1;
  // The refresh token to fetch a new access token with.
  Token refresh_token = 2;
}

// A token reply.
message RefreshTokenReply {
  // The access token to authenticate on a API endpoint.
  Token access_token = 1;
  // The refresh token to fetch a new access token with.
  Token refresh_token = 2;
}

message GetUserRefreshTokenReply {
  // The resulting user refresh token.
  UserRefreshToken user_refresh_token = 1;
}

message ListUserRefreshTokenReply {
  // The resulting user refresh tokens.
  repeated UserRefreshToken user_refresh_tokens = 1;
  // The paging meta data
  shared.PagingReply paging = 2;
}

message ListUserRefreshTokenForUserReply {
  // The resulting user refresh tokens.
  repeated UserRefreshToken user_refresh_tokens = 1;
  // The paging meta data
  shared.PagingReply paging = 2;
}

// A token for authentication.
message Token {
  // The token value.
  string value = 1;
  // The issued date time of the token (Unix epoch format) as an UTC time stamp.
  google.protobuf.Timestamp issued_date_time = 2;
  // The expiration date time of the token (Unix epoch format) as an UTC time stamp.
  google.protobuf.Timestamp expiration_date_time = 3;
}

message UserRefreshToken {
  // The id of the entity.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The id of the associated user.
  string user_id = 2 [(proto_options.field_attributes) = IS_GUID];
  // The associated user of entity.
  User user = 3;
  // The issue date and time of the refresh token in UTC time stamp.
  google.protobuf.Timestamp issued_date_time = 4;
  // The date and time when the refresh token expires as UTC time stamp and cannot be used anymore.
  google.protobuf.Timestamp expiration_date_time = 5;
  // The session id, which identifies a single login (chain) of (refresh) tokens. The format is a GUID. The maximum length is 38 characters.
  string session_id = 6 [(proto_options.field_attributes) = IS_GUID];
  // The client id to identify the calling client. The maximum length is 32 characters.
  string client_id = 7;
  // The user agent of the calling client from a browser context. The maximum length is 256 characters.
  string user_agent = 8;
  // The IP address of the calling client. The maximum length is 100 characters.
  string ip_address = 9;
  // The boolean flag indicating this token is revoked and thus unusable for future use.
  bool revoked = 10;
  // The date and time when the this token was revoked. If the revoked flag was not set, a default timestamp will be set.
  google.protobuf.Timestamp revoked_date_time = 11;
  // The optional id of the previous refresh token. This will form a token chain for a certain login session.
  google.protobuf.StringValue rotated_from_id = 12;
}

// Service for reading info about the module configurations
service AuthenticationModuleInfoService {

  /*
  Endpoint for getting info about the this module.

  Returns on a success:
  - Info about this module

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc GetModuleInfo (google.protobuf.Empty) returns (module_info.ModuleInfoReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/module_info"
    };
  }  

  /*
  Endpoint for getting the Feature Flag values of this module.

  Returns on a success:
  - list with the Feature Flags and their values.

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc GetFeatureFlags (google.protobuf.Empty) returns (module_info.FeatureFlagsReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/feature_flags"
    };
  }

  /*
  Endpoint for getting the Release Notes of this module.

  Returns on a success:
  - the release notes

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc GetReleaseNotes (google.protobuf.Empty) returns (module_info.ReleaseNotesReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/release_notes"
    };
  }

  /*
  Endpoint for getting the Health Checks for this module.

  Returns on a success:
  - a list with healthchecks and their respective status.

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  */
  rpc GetHealthChecks (google.protobuf.Empty) returns (module_info.HealthChecksReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/health_checks"
    };
  }
}

service PermissionService {
    
  /*
  Endpoint for a creating a permission in the system.

  This is only accessible for User Manager accounts and/or Administrator accounts.

  Returns on a success:
  - the created user

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more User fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListPermission (ListPermissionRequest) returns (ListPermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/permission"
    };
  }

  /*
  Endpoint for a getting a single Permission in the system.

  This is only accessible for Administrator accounts or the requesting user.

  Returns on a success:
  - the requested Permission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested Permission (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetPermission (GetPermissionRequest) returns (GetPermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/permission/{id}"
    };
  }
}

// A request for listing all Permissions.
message ListPermissionRequest {
  // The paging request to indicate the paging behavior.
  shared.PagingRequest paging = 1;
  // The direction of the ordering.
  bool descending = 2;
  // The ordering indicated property wise (value is not default -> order on property).
  Permission order = 3;
  // The filtering indicated property wise (value is not default -> filter on properties).
  Permission filter = 4;
}

// The get Permission request.
message GetPermissionRequest {
  // The matching Id of the Permission to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

message ListPermissionReply {
  repeated Permission permissions = 1;
  // The paging meta data
  shared.PagingReply paging = 2;
}

// The Permission Reply.
message GetPermissionReply {
  // The Permission entity.
  Permission permission = 1;
}

message Permission {
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  string Key = 2;
  // List of user permissions
  repeated UserPermission user_permissions = 3;
  // List of role permissions
  repeated RolePermission role_permissions = 4;
  // The audit information about this entity.
  shared.Audit audit = 5;
}

service UserRoleService {
    
  /*
  Endpoint for creating UserRole in the system.

  Returns on a success:
  - the created userrole

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more UserRole fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc CreateUserRole (CreateUserRoleRequest) returns (CreateUserRoleReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/user_role"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single userrole in the system.

  Returns on a success:
  - the requested userrole

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested userrole (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetUserRole (GetUserRoleRequest) returns (GetUserRoleReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user_role/{id}"
    };
  }

  /*
  Endpoint for getting all the userroles in the system.

  Returns on a success:
  - list of registered userroles

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListUserRole (ListUserRoleRequest) returns (ListUserRoleReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user_role"
    };
  }

  /*
  Endpoint for updating a registered userroles in the system.

  Returns on a success:
  - the updated userroles

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more userroles fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested userrole (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc UpdateUserRole (UpdateUserRoleRequest) returns (UpdateUserRoleReply) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/user_role"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered userroles in the system.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested userroles (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteUserRole (DeleteUserRoleRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/user_role/{id}"
    };
  }

  /*
  Endpoint for subscribing on an event when an user-role is updated.

  This endpoint provides a real-time stream of user-roles that have been modified in the system.
  Clients can optionally filter which user-roles they want to receive updates for.

  Returns on a success:
    - a stream of UserRoleUpdated messages containing the modified user-role; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserRoleUpdated (SubscribeOnUserRoleUpdated) returns (stream UserRoleUpdated) {

  }

  /*
  Endpoint for subscribing on an event when a new user-role is created.

  This endpoint provides a real-time stream of newly created user-roles in the system.
  Clients can optionally filter which user-roles they want to receive creation notifications for.

  Returns on a success:
    - a stream of UserRoleCreated messages containing the newly created user-role; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserRoleCreated (SubscribeOnUserRoleCreated) returns (stream UserRoleCreated) {

  }

  /*
  Endpoint for subscribing on an event when an user-role is deleted.

  This endpoint provides a real-time stream notification when user-roles are removed from the system.
  Clients can optionally filter which user-roles they want to receive deletion notifications for.

  Returns on a success:
    - a stream of UserRoleDeleted messages containing the deleted user-role information; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserRoleDeleted (SubscribeOnUserRoleDeleted) returns (stream UserRoleDeleted) {

  }
}

// The create UserRole request. The Id field should be left at 0, since this is created by the database.
message CreateUserRoleRequest {
  // The new userrole
  UserRole user_role = 1;
}

// The get UserRole request.
message GetUserRoleRequest {
  // The matching Id of the userrole to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// A request for listing all userrole.
message ListUserRoleRequest {
  shared.PagingRequest paging = 1;
  bool descending = 2;
  UserRole order = 3;
  UserRole filter = 4;
}

// The update userroles request.
message UpdateUserRoleRequest {
  // The userrole entity to update. Matches on the Id field.
  UserRole user_role = 1;
}

// The delete userroles request
message DeleteUserRoleRequest {
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The userroles Reply.
message GetUserRoleReply {
  // The userroles entity.
  UserRole user_role = 1;
}

// The userroles Reply.
message CreateUserRoleReply {
  // The userroles entity.
  UserRole user_role = 1;
}

// The userroles Reply.
message UpdateUserRoleReply {
  // The userroles entity.
  UserRole user_role = 1;
}

// The userroles Reply.
message ListUserRoleReply {
  // The collection of userroles.
  repeated UserRole user_roles = 1;
  shared.PagingReply paging = 2;
}

// A userroles entity.
message UserRole {
  // The id of the userroles. This is generated by the database.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The foreign key id that is attached to this userroles.
  google.protobuf.StringValue user_id = 2 [(proto_options.field_attributes) = IS_GUID];
  // The foreign key id that is attached to this userroles.
  google.protobuf.StringValue role_id = 3 [(proto_options.field_attributes) = IS_GUID];
  // The user name for display purposes
  User user = 4;
  // The role name for display purposes
  Role role = 5;
  // The audit information about this entity.
  shared.Audit audit = 6;
}

// The subscribe request 
message SubscribeOnUserRoleUpdated {
  repeated string filter_user_role_ids = 1;
}

message UserRoleUpdated {
  UserRole user_role = 1;
}

message SubscribeOnUserRoleCreated {
  repeated string filter_user_role_ids = 1;
}

message UserRoleCreated{
  UserRole user_role = 1;
}

message SubscribeOnUserRoleDeleted {
  repeated string filter_user_role_ids = 1;
}

message UserRoleDeleted{
  UserRole user_role = 1;
}

service RoleService {
    
  /*
  Endpoint for creating Role in the system.

  Returns on a success:
  - the created Role

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more Role fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc CreateRole (CreateRoleRequest) returns (CreateRoleReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/role"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single Role in the system.

  Returns on a success:
  - the requested Role

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested Role (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetRole (GetRoleRequest) returns (GetRoleReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/role/{id}"
    };
  }

  /*
  Endpoint for getting all the Role in the system.

  Returns on a success:
  - list of registered Role

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListRole (ListRoleRequest) returns (ListRoleReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/role"
    };
  }

  /*
  Endpoint for updating a registered Role in the system.

  Returns on a success:
  - the updated Role

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more Role fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested Role (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc UpdateRole (UpdateRoleRequest) returns (UpdateRoleReply) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/role"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered Role in the system.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested Role (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteRole (DeleteRoleRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/role/{id}"
    };
  }

  /*
  Endpoint for subscribing on an event when an role is updated.

  This endpoint provides a real-time stream of roles that have been modified in the system.
  Clients can optionally filter which roles they want to receive updates for.

  Returns on a success:
    - a stream of RoleUpdated messages containing the modified role; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRoleUpdated (SubscribeOnRoleUpdated) returns (stream RoleUpdated) {

  }

  /*
  Endpoint for subscribing on an event when a new role is created.

  This endpoint provides a real-time stream of newly created roles in the system.
  Clients can optionally filter which roles they want to receive creation notifications for.

  Returns on a success:
    - a stream of RoleCreated messages containing the newly created role; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRoleCreated (SubscribeOnRoleCreated) returns (stream RoleCreated) {

  }

  /*
  Endpoint for subscribing on an event when an role is deleted.

  This endpoint provides a real-time stream notification when roles are removed from the system.
  Clients can optionally filter which roles they want to receive deletion notifications for.

  Returns on a success:
    - a stream of RoleDeleted messages containing the deleted role information; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRoleDeleted (SubscribeOnRoleDeleted) returns (stream RoleDeleted) {

  }
}

// The create Role request. The Id field should be left at 0, since this is created by the database.
message CreateRoleRequest {
  // The new Role
  Role role = 1;
}

// The get Role request.
message GetRoleRequest {
  // The matching Id of the Role to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// A request for listing all Role.
message ListRoleRequest {
  shared.PagingRequest paging = 1;
  bool descending = 2;
  Role order = 3;
  Role filter = 4;
}

// The update Role request.
message UpdateRoleRequest {
  // The Role entity to update. Matches on the Id field.
  Role role = 1;
}

// The delete Role request
message DeleteRoleRequest {
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The Role Reply.
message GetRoleReply {
  // The Role entity.
  Role role = 1;
}

// The Role Reply.
message CreateRoleReply {
  // The Role entity.
  Role role = 1;
}

// The Role Reply.
message UpdateRoleReply {
  // The Role entity.
  Role role = 1;
}

// The Role Reply.
message ListRoleReply {
  // The collection of Role.
  repeated Role roles = 1;
  shared.PagingReply paging = 2;
}

// A Role entity.
message Role {
  // The id of the Role.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The name of this Role. The minimum length is 3 characters and maximum length is 50 characters.
  string name = 2;
  // List of user roles
  repeated UserRole user_roles = 3;
  // List of role permissions
  repeated RolePermission role_permissions = 4;
  // The audit information about this entity.
  shared.Audit audit = 5;
}

// The subscribe request 
message SubscribeOnRoleUpdated {
  repeated string filter_role_ids = 1;
}

message RoleUpdated {
  Role role = 1;
}

message SubscribeOnRoleCreated {
  repeated string filter_role_ids = 1;
}

message RoleCreated{
  Role role = 1;
}

message SubscribeOnRoleDeleted {
  repeated string filter_role_ids = 1;
}

message RoleDeleted{
  Role role = 1;
}

service RolePermissionService {
    
  /*
  Endpoint for creating RolePermission in the system.

  Returns on a success:
  - the created RolePermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more RolePermission fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right RolePermission
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc CreateRolePermission (CreateRolePermissionRequest) returns (CreateRolePermissionReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/role_permission"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single RolePermission in the system.

  Returns on a success:
  - the requested RolePermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested RolePermission (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right RolePermission
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetRolePermission (GetRolePermissionRequest) returns (GetRolePermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/role_permission/{id}"
    };
  }

  /*
  Endpoint for getting all the RolePermission in the system.

  Returns on a success:
  - list of registered rolepermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - PERMISSION_DENIED (7) status when you do not have the right rolepermission
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListRolePermission (ListRolePermissionRequest) returns (ListRolePermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/role_permission"
    };
  }

  /*
  Endpoint for updating a registered rolepermission in the system.

  Returns on a success:
  - the updated rolepermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more rolepermission fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested rolepermission (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right RolePermission
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc UpdateRolePermission (UpdateRolePermissionRequest) returns (UpdateRolePermissionReply) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/role_permission"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered rolepermission in the system.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested rolepermission (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right RolePermission
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteRolePermission (DeleteRolePermissionRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/role_permission/{id}"
    };
  }

  /*
  Endpoint for subscribing on an event when an role-permission is updated.

  This endpoint provides a real-time stream of role-permissions that have been modified in the system.
  Clients can optionally filter which role-permissions they want to receive updates for.

  Returns on a success:
    - a stream of RolePermissionUpdated messages containing the modified role-permission; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRolePermissionUpdated (SubscribeOnRolePermissionUpdated) returns (stream RolePermissionUpdated) {

  }

  /*
  Endpoint for subscribing on an event when a new role-permission is created.

  This endpoint provides a real-time stream of newly created role-permissions in the system.
  Clients can optionally filter which role-permissions they want to receive creation notifications for.

  Returns on a success:
    - a stream of RolePermissionCreated messages containing the newly created role-permission; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRolePermissionCreated (SubscribeOnRolePermissionCreated) returns (stream RolePermissionCreated) {

  }

  /*
  Endpoint for subscribing on an event when an role-permission is deleted.

  This endpoint provides a real-time stream notification when role-permissions are removed from the system.
  Clients can optionally filter which role-permissions they want to receive deletion notifications for.

  Returns on a success:
    - a stream of RolePermissionDeleted messages containing the deleted role-permission information; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnRolePermissionDeleted (SubscribeOnRolePermissionDeleted) returns (stream RolePermissionDeleted) {

  }
}

// The create rolepermission request. The Id field should be left at 0, since this is created by the database.
message CreateRolePermissionRequest {
  // The new rolepermission
  RolePermission RolePermission = 1;
}

// The get rolepermission request.
message GetRolePermissionRequest {
  // The matching Id of the rolepermission to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// A request for listing all rolepermission.
message ListRolePermissionRequest {
  shared.PagingRequest paging = 1;
  bool descending = 2;
  RolePermission order = 3;
  RolePermission filter = 4;
}

// The update rolepermission request.
message UpdateRolePermissionRequest {
  // The rolepermission entity to update. Matches on the Id field.
  RolePermission role_permission = 1;
}

// The delete rolepermission request
message DeleteRolePermissionRequest {
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The rolepermission Reply.
message GetRolePermissionReply {
  // The rolepermission entity.
  RolePermission role_permission = 1;
}

// The rolepermission Reply.
message CreateRolePermissionReply {
  // The rolepermission entity.
  RolePermission role_permission = 1;
}

// The rolepermission Reply.
message UpdateRolePermissionReply {
  // The rolepermission entity.
  RolePermission role_permission = 1;
}

// The rolepermission Reply.
message ListRolePermissionReply {
  // The collection of rolepermission.
  repeated RolePermission role_permissions = 1;
  shared.PagingReply paging = 2;
}

// A rolepermission entity.
message RolePermission {
  // The id of the rolepermission.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The foreign key id that is attached to this rolepermission. 
  google.protobuf.StringValue role_id = 2 [(proto_options.field_attributes) = IS_GUID];
  // the role name
  Role Role = 3;
  // The foreign key id that is attached to this rolepermission. 
  google.protobuf.StringValue permission_id = 4 [(proto_options.field_attributes) = IS_GUID];
  // The permission Entity
  Permission Permission = 5;
  // The audit information about this entity.
  shared.Audit audit = 6;
}

// The subscribe request 
message SubscribeOnRolePermissionUpdated {
  repeated string filter_role_permission_ids = 1;
}

message RolePermissionUpdated {
  RolePermission role_permission = 1;
}

message SubscribeOnRolePermissionCreated {
  repeated string filter_role_permission_ids = 1;
}

message RolePermissionCreated{
  RolePermission role_permission = 1;
}

message SubscribeOnRolePermissionDeleted {
  repeated string filter_role_permission_ids = 1;
}

message RolePermissionDeleted{
  RolePermission role_permission = 1;
}

service UserPermissionService {
    
  /*
  Endpoint for creating UserPermission in the system.

  Returns on a success:
  - the created userpermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more UserPermission fields no not fall within the set format/limits.
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc CreateUserPermission (CreateUserPermissionRequest) returns (CreateUserPermissionReply) {
    option (google.api.http) = {
      post: "/authentication_module/v1/user_permission"
      body: "*"
    };
  }

  /*
  Endpoint for a getting a single UserPermission in the system.

  Returns on a success:
  - the requested userpermission

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) status when the requested userpermission (ID), to fetch, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc GetUserPermission (GetUserPermissionRequest) returns (GetUserPermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user_permission/{id}"
    };
  }

  /*
  Endpoint for getting all the userpermissions in the system.

  Returns on a success:
  - list of registered userpermissions

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc ListUserPermission (ListUserPermissionRequest) returns (ListUserPermissionReply) {
    option (google.api.http) = {
      get: "/authentication_module/v1/user_permission"
    };
  }

  /*
  Endpoint for updating a registered userpermissions in the system.

  Returns on a success:
  - the updated userpermissions

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - INVALID_ARGUMENT status when the one or more userpermissions fields no not fall within the set format/limits.
  - NOT_FOUND (5) status when the requested userpermission (ID), to update, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc UpdateUserPermission (UpdateUserPermissionRequest) returns (UpdateUserPermissionReply) {
    option (google.api.http) = {
      patch: "/authentication_module/v1/user_permission"
      body: "*"
    };
  }

  /*
  Endpoint for deleting a registered userpermissions in the system.

  Returns on a success:
  - nothing; OK status (0)

  Returns on a failure:
  - CANCELLED (1) status when you abort the call
  - NOT_FOUND (5) when the requested userpermissions (ID), to remove, was not found
  - PERMISSION_DENIED (7) status when you do not have the right role
  - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
  - UNAUTHENTICATED (16) status when you do not provide the required access token
  */
  rpc DeleteUserPermission (DeleteUserPermissionRequest) returns (google.protobuf.Empty) {
    option (google.api.http) = {
      delete: "/authentication_module/v1/user_permission/{id}"
    };
  }

  /*
  Endpoint for subscribing on an event when an user-permission is updated.

  This endpoint provides a real-time stream of user-permissions that have been modified in the system.
  Clients can optionally filter which user-permissions they want to receive updates for.

  Returns on a success:
    - a stream of UserPermissionUpdated messages containing the modified user-permission; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserPermissionUpdated (SubscribeOnUserPermissionUpdated) returns (stream UserPermissionUpdated) {

  }

  /*
  Endpoint for subscribing on an event when a new user-permission is created.

  This endpoint provides a real-time stream of newly created user-permissions in the system.
  Clients can optionally filter which user-permissions they want to receive creation notifications for.

  Returns on a success:
    - a stream of UserPermissionCreated messages containing the newly created user-permission; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserPermissionCreated (SubscribeOnUserPermissionCreated) returns (stream UserPermissionCreated) {

  }

  /*
  Endpoint for subscribing on an event when an user-permission is deleted.

  This endpoint provides a real-time stream notification when user-permissions are removed from the system.
  Clients can optionally filter which user-permissions they want to receive deletion notifications for.

  Returns on a success:
    - a stream of UserPermissionDeleted messages containing the deleted user-permission information; OK status (0)

  Returns on a failure:
    - CANCELLED (1) status when you abort the call
    - INTERNAL (13) status when something went wrong on the server (please contact your administrator in this case)
    - UNAUTHENTICATED (16) status when you do not provide a valid access token (when Authentication is enabled)
  */
  rpc OnUserPermissionDeleted (SubscribeOnUserPermissionDeleted) returns (stream UserPermissionDeleted) {

  }
}

// The create userpermission request. The Id field should be left at 0, since this is created by the database.
message CreateUserPermissionRequest {
  // The new userpermission
  UserPermission user_permission = 1;
}

// The get userpermission request.
message GetUserPermissionRequest {
  // The matching Id of the userpermission to get.
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// A request for listing all userpermission.
message ListUserPermissionRequest {
  shared.PagingRequest paging = 1;
  bool descending = 2;
  UserPermission order = 3;
  UserPermission filter = 4;
}

// The update userpermission request.
message UpdateUserPermissionRequest {
  // The userpermission entity to update. Matches on the Id field.
  UserPermission user_permission = 1;
}

// The delete userpermission request
message DeleteUserPermissionRequest {
  string id = 1 [(proto_options.field_attributes) = IS_GUID];
}

// The userpermission Reply.
message GetUserPermissionReply {
  // The userpermission entity.
  UserPermission user_permission = 1;
}

// The userpermission Reply.
message CreateUserPermissionReply {
  // The userpermission entity.
  UserPermission user_permission = 1;
}

// The userpermission Reply.
message UpdateUserPermissionReply {
  // The userpermission entity.
  UserPermission user_permission = 1;
}

// The userpermission Reply.
message ListUserPermissionReply {
  // The collection of userpermissions.
  repeated UserPermission user_permissions = 1;
  shared.PagingReply paging = 2;
}

// A userpermission entity.
message UserPermission {
  // The id of the userpermission. This is generated by the database.
  string id = 1 [
      (proto_options.field_attributes) = IS_GUID,
      (proto_options.field_attributes) = IS_PRIMARY_KEY
  ];
  // The foreign key id that is attached to this userpermission.
  google.protobuf.StringValue user_id = 2 [(proto_options.field_attributes) = IS_GUID];
  // The foreign key id that is attached to this userpermission.
  google.protobuf.StringValue permission_id = 3 [(proto_options.field_attributes) = IS_GUID];
  // The user (navigation prop)
  User user = 4;
  // The permission key for display purposes
  Permission permission = 5;
  // The audit information about this entity.
  shared.Audit audit = 6;
}

// The subscribe request 
message SubscribeOnUserPermissionUpdated {
  repeated string filter_user_permission_ids = 1;
}

message UserPermissionUpdated {
  UserPermission user_permission = 1;
}

message SubscribeOnUserPermissionCreated {
  repeated string filter_user_permission_ids = 1;
}

message UserPermissionCreated{
  UserPermission user_permission = 1;
}

message SubscribeOnUserPermissionDeleted {
  repeated string filter_user_permission_ids = 1;
}

message UserPermissionDeleted{
  UserPermission user_permission = 1;
}