// M-Files Server gRPC API 26.11. Generated from the M-Files Server IDL; do not edit.
// Documentation: https://developer.m-files.com/APIs/gRPC-API/
syntax = "proto3";

package MFiles;

import "mfiles/api/annotations.proto";
import "mfiles/structs.proto";

option csharp_namespace = "MFiles.Grpc";
option go_package = "github.com/M-Files/mfiles-grpc-api/go/mfiles;mfiles";
option java_multiple_files = true;
option java_package = "com.mfiles.grpc";
option objc_class_prefix = "MF_";

// Lists the named access control lists that the calling user can see.
//
// Provides methods for read-only access to named ACLs.
//
// A named access control list (named ACL) is a reusable, named set of permissions that
// administrators define in the vault, such as "Visible to company management only". Users pick
// one when they set the permissions of an object. Use
// [GetNamedACLs](mfiles:MFiles.IRPCNamedACLs.GetNamedACLs) to fill a permissions picker or to resolve a named ACL ID that you find in an
// [AccessControlList](mfiles:MFiles.AccessControlList).
//
// The service is read-only. Creating and editing named ACLs is an administrative operation. For
// how permissions work, see
// [Permissions](https://developer.m-files.com/APIs/gRPC-API/concepts/permissions/).
service IRPCNamedACLs {
	option (mfiles.api.service) = { book: "vault" level: LEVEL_STANDARD title: "Named access control lists" };

	// Gets the named ACLs of the given types that the calling user is allowed to see.
	//
	// - Requires a vault session. No special vault rights are needed; named ACLs that the user is not
	//   allowed to see are left out.
	// - `types` is a bit mask of [NACLType](mfiles:MFiles.NACLType) values and must not be 0: with 0
	//   the call succeeds but returns nothing. Use 1 (`NACLTYPE_NORMAL`) for the named ACLs that users
	//   can select, 2 (`NACLTYPE_INTERNAL`) for those that the vault uses for internal purposes,
	//   or 3 for both.
	// - Built-in named ACLs have negative IDs, for example -1 "Full control for all internal users"
	//   and -20 "Only for me". They are returned only with `include_builtin`.
	// - "Current user" entries in the returned ACLs are replaced with the calling user, so "Only for
	//   me" contains the caller's own user ID.
	// - Names are in the session's vault language when translations exist. The order of the results
	//   is not specified.
	// - Cacheable: the response carries the metadata structure version trailer, see
	//   [Metadata structure version and caching](https://developer.m-files.com/APIs/gRPC-API/concepts/metadata-structure-version-and-caching/).
	rpc GetNamedACLs( GetNamedACLsRequest ) returns ( GetNamedACLsResponse ) {
		option idempotency_level = IDEMPOTENT;
		option (mfiles.api.method) = { session: SESSION_REQUIREMENT_SESSION_OR_ASSERTION returns_metadata_structure_version: true };
	}
}

// The request of GetNamedACLs.
message GetNamedACLsRequest {

	// True to include the built-in named ACLs (negative IDs), such as "Only for me". They cannot be modified.
	bool include_builtin = 1;

	// Bit mask of [NACLType](mfiles:MFiles.NACLType) values: 1 for normal, 2 for internal, 3 for both. 0 returns nothing.
	uint32 types = 2;
}

// The response of GetNamedACLs.
message GetNamedACLsResponse {

	// The named ACLs; see [NamedACL](mfiles:MFiles.NamedACL). `acl_for_objects` is the permission set that the named ACL applies to objects.
	repeated NamedACL named_acls = 1;
}