// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

edition = "2023";

package web_app;

// This message is the main payload of the IWA Key Distribution Component.
message IwaKeyDistribution {
  // Data about key rotations.
  IwaKeyRotations key_rotation_data = 1;

  // Data about special app permissions. These permissions provide certain
  // trusted and allowlisted apps additional and more powerful permissions.
  IwaSpecialAppPermissions special_app_permissions_data = 2;

  // Data about allowlisted/blocklisted apps.
  IwaAccessControl iwa_access_control = 3;
}

message IwaKeyRotations {
  message KeyRotationInfo {
    // base64-encoded public key that this IWA’s bundle must be signed with.
    string expected_key = 1;

    // Optional base64-encoded public key that is still trusted for execution
    // of existing installations, but triggers a mandatory update to
    // `expected_key`.
    //
    // This is a temporary measure to allow devices to update more gracefully
    // in case of network errors or other transient issues, instead of
    // unconditionally bringing down existing apps.
    string previous_key = 2;
  }

  // A list of key rotations mapping web bundle IDs to expected keys.
  map<string, KeyRotationInfo> key_rotations = 1;
}

message IwaSpecialAppPermissions {
  message SpecialAppPermissions {
    message MultiScreenCapturePermissions {
      // The permission to allow remove "Your screen is captured" notification
      // for multi-screen capture.
      bool skip_capture_started_notification = 2;
    }
    message ChromeOsPermissions {
      // Allows the IWA to use the `setShape` Blink extension API.
      bool allow_set_shape = 1;
    }
    // Special permissions for multi-screen capture.
    MultiScreenCapturePermissions multi_screen_capture = 1;
    // Special permissions specific to ChromeOS.
    ChromeOsPermissions chrome_os_permissions = 2;
  }

  // A list of special app permissions mapping web bundle IDs to additional
  // capabilities.
  map<string, SpecialAppPermissions> special_app_permissions = 1;
}

message IwaAccessControl {
  // Types introduced for the future extensibility.
  message ManagedAllowlistItemData {}
  message BlocklistItemData {}
  message UserInstallAllowlistItemData {
    // This information is needed to present the enterprise
    // name in the install wizard.
    string enterprise_name = 1;

    enum Entitlement {
      UNKNOWN = 0;
      CONTROLLED_FRAME = 1;
      DIRECT_SOCKETS = 2;
      DIRECT_SOCKETS_MULTICAST = 3;
      reserved 4;
      SMART_CARD = 5;
      SUB_APPS = 6;
      UNRESTRICTED_WEBUSB = 7;
      WEB_PRINTING = 8;
    }

    message VersionRange {
      string begin = 1;
      string end = 2;
    }

    message Entitlements {
      VersionRange version_range = 1;
      repeated Entitlement entitlement = 2;
    }

    repeated Entitlements entitlements = 2;
  }

  // Keys represent web bundle ids of allowed apps.
  // Only allowed apps can be installed and updated.
  map<string, ManagedAllowlistItemData> managed_allowlist = 1;

  // Keys represent web bundle ids of blocked apps.
  // Only allowed apps can be installed and updated.
  map<string, BlocklistItemData> blocklist = 2;

  // Keys represent web bundle ids of apps allowed for manual installation.
  // Only allowed apps can be installed and updated.
  map<string, UserInstallAllowlistItemData> user_install_allowlist = 3;
}