#include "idl_types.h"

/*
  security IDL structures
*/

interface security
{
	/* a NULL sid */
	const string SID_NULL = "S-1-0-0";

	/* the world domain */
	const string SID_WORLD_DOMAIN = "S-1-1";
	const string SID_WORLD        = "S-1-1-0";

	/* SECURITY_CREATOR_SID_AUTHORITY */
	const string SID_CREATOR_OWNER_DOMAIN = "S-1-3";
	const string SID_CREATOR_OWNER        = "S-1-3-0";
	const string SID_CREATOR_GROUP        = "S-1-3-1";

	/* SECURITY_NT_AUTHORITY */
	const string SID_NT_AUTHORITY        = "S-1-5";
	const string SID_NETWORK             = "S-1-5-2";
	const string SID_ANONYMOUS           = "S-1-5-7";
	const string SID_AUTHENTICATED_USERS = "S-1-5-11";
	const string SID_SYSTEM              = "S-1-5-18";

	/* SECURITY_BUILTIN_DOMAIN_RID */
	const string SID_BUILTIN                   = "S-1-5-32";
	const string SID_BUILTIN_ADMINISTRATORS    = "S-1-5-32-544";
	const string SID_BUILTIN_USERS             = "S-1-5-32-545";
	const string SID_BUILTIN_GUESTS            = "S-1-5-32-546";
	const string SID_BUILTIN_POWER_USERS       = "S-1-5-32-547";
	const string SID_BUILTIN_ACCOUNT_OPERATORS = "S-1-5-32-548";
	const string SID_BUILTIN_SERVER_OPERATORS  = "S-1-5-32-549";
	const string SID_BUILTIN_PRINT_OPERATORS   = "S-1-5-32-550";
	const string SID_BUILTIN_BACKUP_OPERATORS  = "S-1-5-32-551";
	const string SID_BUILTIN_REPLICATOR        = "S-1-5-32-552";

	/* a domain SID. Note that unlike Samba3 this contains a pointer,
	   so you can't copy them using assignment */
	typedef [public,noprint] struct {
		uint8  sid_rev_num;             /**< SID revision number */
		uint8  num_auths;               /**< Number of sub-authorities */
		uint8  id_auth[6];              /**< Identifier Authority */
		uint32 sub_auths[num_auths];
	} dom_sid;

	const int SEC_ACE_FLAG_OBJECT_INHERIT		= 0x001;
	const int SEC_ACE_FLAG_CONTAINER_INHERIT	= 0x002;
	const int SEC_ACE_FLAG_NO_PROPAGATE_INHERIT	= 0x004;
	const int SEC_ACE_FLAG_INHERIT_ONLY		= 0x008;
	const int SEC_ACE_FLAG_INHERITED_ACE		= 0x010;
	const int SEC_ACE_FLAG_VALID_INHERIT		= 0x00f;
	const int SEC_ACE_FLAG_SUCCESSFUL_ACCESS	= 0x040;
	const int SEC_ACE_FLAG_FAILED_ACCESS		= 0x080;

	const int SEC_ACE_TYPE_ACCESS_ALLOWED		= 0x0;
	const int SEC_ACE_TYPE_ACCESS_DENIED		= 0x1;
	const int SEC_ACE_TYPE_SYSTEM_AUDIT		= 0x2;
	const int SEC_ACE_TYPE_SYSTEM_ALARM		= 0x3;
	const int SEC_ACE_TYPE_ALLOWED_COMPOUND		= 0x4;
	const int SEC_ACE_TYPE_ACCESS_ALLOWED_OBJECT	= 0x5;
	const int SEC_ACE_TYPE_ACCESS_DENIED_OBJECT     = 0x6;
	const int SEC_ACE_TYPE_SYSTEM_AUDIT_OBJECT      = 0x7;
	const int SEC_ACE_TYPE_SYSTEM_ALARM_OBJECT	= 0x8;

	typedef [public] struct {
		uint8 type;  /* SEC_ACE_TYPE_* */
		uint8 flags; /* SEC_ACE_FLAG_* */
		[value(ndr_size_security_ace(r))] uint16 size;
		uint32 access_mask;

#if 0
		/* the 'obj' part is present when type is XXXX_TYPE_XXXX_OBJECT */
		struct {
			uint32 flags;
			GUID object_guid;
			GUID inherit_guid;
		} *obj;
#endif

		dom_sid trustee;
	} security_ace;

	typedef [public] struct {
		uint16 revision;
		[value(ndr_size_security_acl(r))] uint16 size;
		uint32 num_aces;
		security_ace aces[num_aces];
	} security_acl;

	/* default revision for new ACLs */
	const int SD_REVISION                    = 1;

	/* security_descriptor->type bits */
	const int SEC_DESC_OWNER_DEFAULTED	 = 0x0001;
	const int SEC_DESC_GROUP_DEFAULTED	 = 0x0002;
	const int SEC_DESC_DACL_PRESENT		 = 0x0004;
	const int SEC_DESC_DACL_DEFAULTED	 = 0x0008;
	const int SEC_DESC_SACL_PRESENT		 = 0x0010;
	const int SEC_DESC_SACL_DEFAULTED	 = 0x0020;
	const int SEC_DESC_DACL_TRUSTED		 = 0x0040;
	const int SEC_DESC_SERVER_SECURITY	 = 0x0080;
	const int SEC_DESC_DACL_AUTO_INHERIT_REQ = 0x0100;
	const int SEC_DESC_SACL_AUTO_INHERIT_REQ = 0x0200;
	const int SEC_DESC_DACL_AUTO_INHERITED	 = 0x0400;
	const int SEC_DESC_SACL_AUTO_INHERITED	 = 0x0800;
	const int SEC_DESC_DACL_PROTECTED	 = 0x1000;
	const int SEC_DESC_SACL_PROTECTED	 = 0x2000;
	const int SEC_DESC_RM_CONTROL_VALID	 = 0x4000;
	const int SEC_DESC_SELF_RELATIVE	 = 0x8000;

	typedef [public,flag(NDR_LITTLE_ENDIAN)] struct {
		uint8 revision;
		uint16 type;     /* SEC_DESC_xxxx flags */
		[relative] dom_sid *owner_sid; 
		[relative] dom_sid *group_sid;
		[relative] security_acl *sacl; /* system ACL */
		[relative] security_acl *dacl; /* user (discretionary) ACL */
	} security_descriptor;

	typedef [public] struct {
		[range(0,0x40000),value(ndr_size_security_descriptor(r->sd))] uint32 sd_size;
		[subcontext(4)] security_descriptor *sd;
	} sec_desc_buf;

	typedef [public,printonly] struct {
		/* TODO */
		uint32 flags;
	} security_privilege;

	typedef [public,printonly] struct {
		uint32 flags;
		dom_sid *user_sid;
		dom_sid *group_sid;
		dom_sid *logon_sid;
		uint32 num_sids;
		dom_sid sids[num_sids];
		uint32 num_restricted_sids;
		dom_sid restricted_sids[num_restricted_sids];
		uint32 num_privileges;
		security_privilege privileges[num_privileges];
		security_acl *dacl;
	} security_token;

}