syntax = "proto3";

package envoy.extensions.filters.http.rbac.v3;

import "envoy/config/rbac/v3/rbac.proto";

import "xds/annotations/v3/status.proto";
import "xds/type/matcher/v3/matcher.proto";

import "udpa/annotations/migrate.proto";
import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.http.rbac.v3";
option java_outer_classname = "RbacProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3;rbacv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: RBAC]
// Role-Based Access Control :ref:`configuration overview <config_http_filters_rbac>`.
// [#extension: envoy.filters.http.rbac]

// RBAC filter config.
// [#next-free-field: 8]
message RBAC {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.rbac.v2.RBAC";

  // The primary RBAC policy which will be applied globally, to all the incoming requests.
  //
  // * If absent, no RBAC enforcement occurs.
  // * If set but empty, all requests are denied.
  //
  // .. note::
  //
  //   When both ``rules`` and ``matcher`` are configured, ``rules`` will be ignored.
  //
  config.rbac.v3.RBAC rules = 1
      [(udpa.annotations.field_migrate).oneof_promotion = "rules_specifier"];

  // If specified, rules will emit stats with the given prefix.
  // This is useful for distinguishing metrics when multiple RBAC filters are configured.
  string rules_stat_prefix = 6;

  // Match tree for evaluating RBAC actions on incoming requests. Requests not matching any matcher will be denied.
  //
  // * If absent, no RBAC enforcement occurs.
  // * If set but empty, all requests are denied.
  //
  xds.type.matcher.v3.Matcher matcher = 4
      [(udpa.annotations.field_migrate).oneof_promotion = "rules_specifier"];

  // Shadow policy for testing RBAC rules without enforcing them. These rules generate stats and logs but do not deny
  // requests. If absent, no shadow RBAC policy will be applied.
  //
  // .. note::
  //
  //   When both ``shadow_rules`` and ``shadow_matcher`` are configured, ``shadow_rules`` will be ignored.
  //
  config.rbac.v3.RBAC shadow_rules = 2
      [(udpa.annotations.field_migrate).oneof_promotion = "shadow_rules_specifier"];

  // If absent, no shadow matcher will be applied.
  // Match tree for testing RBAC rules through stats and logs without enforcing them.
  // If absent, no shadow matching occurs.
  xds.type.matcher.v3.Matcher shadow_matcher = 5 [
    (udpa.annotations.field_migrate).oneof_promotion = "shadow_rules_specifier",
    (xds.annotations.v3.field_status).work_in_progress = true
  ];

  // If specified, shadow rules will emit stats with the given prefix.
  // This is useful for distinguishing metrics when multiple RBAC filters use shadow rules.
  string shadow_rules_stat_prefix = 3;

  // If ``track_per_rule_stats`` is ``true``, counters will be published for each rule and shadow rule.
  bool track_per_rule_stats = 7;
}

message RBACPerRoute {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.rbac.v2.RBACPerRoute";

  reserved 1;

  // Per-route specific RBAC configuration that overrides the global RBAC configuration.
  // If absent, RBAC policy will be disabled for this route.
  RBAC rbac = 2;
}
