module czechlight-system {
  yang-version 1.1;
  namespace
    "http://czechlight.cesnet.cz/yang/czechlight-system";

  prefix "cla-sys";

  organization "CESNET";
  contact "photonic@cesnet.cz";
  description
    "YANG model for system administration in Czechlight devices.";

  revision 2021-01-13 {
    description "Initial release";
  }

  container firmware {
    config false;

    container installation {
      leaf status {
        description "Informs about the status of the current (or last) installation.";

        type enumeration {
          enum none;
          enum in-progress;
          enum succeeded;
          enum failed;
        }
      }

      leaf message {
        description "The last message from the installation process. This MAY contain the last error message.";
        type string;
      }

      notification update {
        description "Notifies clients about installation progress.";

        leaf message {
          description "Progress status.";
          type string;
        }

        leaf progress {
          description "Progress of the installation in percents.";

          type int8 {
            range "0 .. 100";
          }
        }
      }

      action install {
        input {
          leaf url {
            description "URL or path to the new firmware.";
            type string;
            mandatory true;
          }
        }
      }
    }
  }

  typedef username-type {
    type string {
      pattern "[a-z][a-z0-9-]{0,30}";
    }
  }

  grouping authentication-rpc-result {
    leaf result {
      mandatory true;
      type enumeration {
        enum success;
        enum failure;
      }
    }

    leaf message {
      description "Can be used to supply and error message.";
      type string;
    }
  }

  typedef authorized-key-format {
    description "Pubkey in the authorized_keys format for sshd.";
    type string;
  }


  container authentication {
    list users {
      config false;
      key 'name';

      leaf name {
        type username-type;
      }

      leaf password-last-change {
        type string;
      }

      list authorized-keys {
        key 'index';
        leaf index {
          type int32;
        }

        leaf public-key {
          mandatory true;
          type authorized-key-format;
        }

        action remove {
          output {
            uses authentication-rpc-result;
          }
        }
      }

      action change-password {
        input {
          leaf password-cleartext {
            mandatory true;
            description "This is supposed to be a plaintext password. Make sure it's not logged anywhere.";
            type string;
          }
        }

        output {
          uses authentication-rpc-result;
        }
      }

      action add-authorized-key {
        input {
          leaf key {
            mandatory true;
            type authorized-key-format;
          }
        }

        output {
          uses authentication-rpc-result;
        }
      }
    }
  }
}