//
// Copyright 2025 The Project Oak Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Private memory service definition: A memory consists of a datablob content
// and one or more tags. The service allows users to add a tagged memory and get
// the memories by tags.

syntax = "proto3";

package oak.private_memory;
import "proto/sealed_memory.proto";

// Contains all the ground truths files of an icing database.
//
// Can be used to rebuild the original database.
// It allows exporting an icing database as a byte array, so we can
// store it as a blob.
message IcingGroundTruthFiles {
  bytes schema_pb = 1;
  bytes overlay_schema_pb = 2;
  bytes schema_store_header = 3;
  bytes document_log = 4;
}

message EncryptedDataBlob {
  bytes nonce = 1;
  bytes data = 2;
}

message WrappedDataEncryptionKey {
  EncryptedDataBlob wrapped_key = 1;
}

message PlainTextUserInfo {
  KeyDerivationInfo key_derivation_info = 1;
  WrappedDataEncryptionKey wrapped_dek = 2;
}

message EncryptedUserInfo {
  IcingGroundTruthFiles icing_db = 1;
}
// Contain the user's key derivation info, icing db, etc.
// This is the struct stored in spanner.
message UserDb {
  // The information stored encrypted at storage.
  EncryptedUserInfo encrypted_info = 1;
  // The information stored in plaintext at storage.
  PlainTextUserInfo plaintext_info = 2;
}