//
// Copyright 2025 The Project Oak Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Private memory service definition: A memory consists of a datablob content
// and one or more tags. The service allows users to add a tagged memory and get
// the memories by tags.

syntax = "proto3";

package oak.private_memory;

// A simple key value pair.
message DataBlob {
  string id = 1;
  bytes blob = 2;
}

message WriteUnencryptedDataBlobRequest {
  DataBlob data_blob = 1;
}

message WriteDataBlobRequest {
  DataBlob data_blob = 1;
}

message WriteDataBlobResponse {}

message WriteUnencryptedDataBlobResponse {}

message ReadDataBlobRequest {
  string id = 1;
  // Whether to perform a strong read to ensure the latest data is returned.
  bool strong_read = 2;
}

message ReadUnencryptedDataBlobRequest {
  string id = 1;
  // Whether to perform a strong read to ensure the latest data is returned.
  bool strong_read = 2;
}

message ReadDataBlobResponse {
  DataBlob data_blob = 1;
}

message ReadUnencryptedDataBlobResponse {
  DataBlob data_blob = 1;
}

message ResetDatabaseRequest {}

message ResetDatabaseResponse {}

message WriteBlobsRequest {
  repeated DataBlob encrypted_blobs = 1;
  repeated DataBlob unencrypted_blobs = 2;
}

message WriteBlobsResponse {}

// The untrusted database service that the trusted application can connect to.
service SealedMemoryDatabaseService {
  // Writes a data blob to the database.
  rpc WriteDataBlob(WriteDataBlobRequest) returns (WriteDataBlobResponse) {}
  // Reads a data blob from the database.
  rpc ReadDataBlob(ReadDataBlobRequest) returns (ReadDataBlobResponse) {}
  // Writes an unencrypted data blob to the database.
  rpc WriteUnencryptedDataBlob(WriteUnencryptedDataBlobRequest)
      returns (WriteUnencryptedDataBlobResponse) {}
  // Reads an unencrypted data blob from the database.
  rpc ReadUnencryptedDataBlob(ReadUnencryptedDataBlobRequest)
      returns (ReadUnencryptedDataBlobResponse) {}

  // Resets the database. This is mainly used for testing.
  rpc ResetDatabase(ResetDatabaseRequest) returns (ResetDatabaseResponse) {}

  // Writes multiple blobs (encrypted or unencrypted) to the database in a
  // batch. Backend implementation should guarantee that either all blobs are
  // written or none are written.
  rpc WriteBlobs(WriteBlobsRequest) returns (WriteBlobsResponse) {}
}
