syntax = "proto3";

package laborato.operator.alerts;

import "google/protobuf/empty.proto";
import "google/protobuf/timestamp.proto";

enum AlertStatus {
  ALERT_STATUS_UNSPECIFIED = 0;
  ALERT_STATUS_OPEN = 1;
  ALERT_STATUS_ACKNOWLEDGED = 2;
  ALERT_STATUS_RESOLVED = 3;
  ALERT_STATUS_CLOSED = 4;
}

message AlertItem {
  int64 id = 1;
  string type = 2;
  uint32 severity = 3;
  AlertStatus status = 4;

  string agent_id = 5;
  bytes user_id = 6;
  bytes group_id = 7;
  int64 agent_category_id = 8;
  int64 policy_id = 9;

  string title = 10;
  string message = 11;

  google.protobuf.Timestamp first_occurred_at = 12;
  google.protobuf.Timestamp last_occurred_at = 13;
  uint32 occurrence_count = 14;

  string deduplication_key = 15;
  string metadata_json = 16;
}

message GetAlertRequest {
  int64 id = 1;
}

message ListAlertsRequest {
  string agent_id = 1;
  bytes user_id = 2;
  bytes group_id = 3;
  int64 agent_category_id = 4;

  string type = 5;
  AlertStatus status = 6;
  bool open_only = 7;
}

message ListAlertsResponse {
  repeated AlertItem items = 1;
}

message AcknowledgeAlertRequest {
  int64 id = 1;
}

message ResolveAlertRequest {
  int64 id = 1;
}

message CloseAlertRequest {
  int64 id = 1;
}

service AlertQueryService {
  rpc GetAlert(GetAlertRequest) returns (AlertItem);
  rpc ListAlerts(ListAlertsRequest) returns (ListAlertsResponse);
  rpc AcknowledgeAlert(AcknowledgeAlertRequest) returns (google.protobuf.Empty);
  rpc ResolveAlert(ResolveAlertRequest) returns (google.protobuf.Empty);
  rpc CloseAlert(CloseAlertRequest) returns (google.protobuf.Empty);
}