CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(role): Classify resources for audit events

Browse Source
This commit is contained in:
Timothy Messier authored and Johan Brandhorst-Satzkorn committed 2022-04-20 13:32:32 -04:00
1 parent 4599e64cab
commit 38a3960047
6 files changed
+231 -87
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Makefile
+2
View File
@@ -175,6 +175,8 @@ protobuild:
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_store_service.pb.go
@protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/credentiallibraries/credential_library.pb.go
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/credential_library_service.pb.go
@protoc-go-inject-tag -input=./sdk/pbs/controller/api/resources/roles/role.pb.go
@protoc-go-inject-tag -input=./internal/gen/controller/api/services/role_service.pb.go
# these protos, services and openapi artifacts are purely for testing purposes
@protoc-go-inject-tag -input=./internal/gen/testing/event/event.pb.go
internal/gen/controller/api/services/role_service.pb.go
+24 -24
View File
@@ -29,7 +29,7 @@ type GetRoleRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *GetRoleRequest) Reset() {
@@ -123,9 +123,9 @@ type ListRolesRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty"`
Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty"`
ScopeId string `protobuf:"bytes,1,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
Recursive bool `protobuf:"varint,20,opt,name=recursive,proto3" json:"recursive,omitempty" class:"public"` // @gotags: `class:"public"`
Filter string `protobuf:"bytes,30,opt,name=filter,proto3" json:"filter,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *ListRolesRequest) Reset() {
@@ -335,7 +335,7 @@ type UpdateRoleRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
Item *roles.Role `protobuf:"bytes,2,opt,name=item,proto3" json:"item,omitempty"`
UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,3,opt,name=update_mask,proto3" json:"update_mask,omitempty"`
}
@@ -445,7 +445,7 @@ type DeleteRoleRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *DeleteRoleRequest) Reset() {
@@ -530,11 +530,11 @@ type AddRolePrincipalsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *AddRolePrincipalsRequest) Reset() {
@@ -642,11 +642,11 @@ type SetRolePrincipalsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *SetRolePrincipalsRequest) Reset() {
@@ -754,11 +754,11 @@ type RemoveRolePrincipalsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
PrincipalIds []string `protobuf:"bytes,3,rep,name=principal_ids,proto3" json:"principal_ids,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *RemoveRolePrincipalsRequest) Reset() {
@@ -866,11 +866,11 @@ type AddRoleGrantsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *AddRoleGrantsRequest) Reset() {
@@ -978,11 +978,11 @@ type SetRoleGrantsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *SetRoleGrantsRequest) Reset() {
@@ -1090,11 +1090,11 @@ type RemoveRoleGrantsRequest struct {
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty"`
Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
GrantStrings []string `protobuf:"bytes,3,rep,name=grant_strings,proto3" json:"grant_strings,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *RemoveRoleGrantsRequest) Reset() {
internal/proto/controller/api/resources/roles/v1/role.proto
+20 -20
View File
@@ -11,32 +11,32 @@ import "controller/custom_options/v1/options.proto";
message Principal {
// Output only. The ID of the principal.
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Output only. The type of the principal.
string type = 2;
string type = 2; // @gotags: `class:"public"`
// Output only. The Scope of the principal.
string scope_id = 3 [json_name="scope_id"];
string scope_id = 3 [json_name="scope_id"]; // @gotags: `class:"public"`
}
message GrantJson {
// Output only. The ID, if set.
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Output only. The type, if set.
string type = 2;
string type = 2; // @gotags: `class:"public"`
// Output only. The actions.
repeated string actions = 3;
repeated string actions = 3; // @gotags: `class:"public"`
}
message Grant {
// Output only. The original user-supplied string.
string raw = 1;
string raw = 1; // @gotags: `class:"public"`
// Output only. The canonically-formatted string.
string canonical = 2;
string canonical = 2; // @gotags: `class:"public"`
// Output only. The JSON representation of the grant.
GrantJson json = 3;
@@ -45,45 +45,45 @@ message Grant {
// Role contains all fields related to a Role resource
message Role {
// Output only. The ID of the Role.
string id = 10;
string id = 10; // @gotags: `class:"public"`
// The ID of the Scope containing this Role.
string scope_id = 20 [json_name="scope_id"];
string scope_id = 20 [json_name="scope_id"]; // @gotags: `class:"public"`
// Output only. Scope information for this resource.
resources.scopes.v1.ScopeInfo scope = 30;
// Optional name for identification purposes.
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"name" that: "name"}];
google.protobuf.StringValue name = 40 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"name" that: "name"}]; // @gotags: `class:"public"`
// Optional user-set description for identification purposes.
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"description" that: "description"}];
google.protobuf.StringValue description = 50 [(custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"description" that: "description"}]; // @gotags: `class:"public"`
// Output only. The time this resource was created.
google.protobuf.Timestamp created_time = 60 [json_name="created_time"];
google.protobuf.Timestamp created_time = 60 [json_name="created_time"]; // @gotags: `class:"public"`
// Output only. The time this resource was last updated.
google.protobuf.Timestamp updated_time = 70 [json_name="updated_time"];
google.protobuf.Timestamp updated_time = 70 [json_name="updated_time"]; // @gotags: `class:"public"`
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 80;
uint32 version = 80; // @gotags: `class:"public"`
// The Scope the grants will apply to. If the Role is at the global scope, this can be an org or project. If the Role is at an org scope, this can be a project within the org. It is invalid for this to be anything other than the Role's scope when the Role's scope is a project.
google.protobuf.StringValue grant_scope_id = 90 [json_name="grant_scope_id", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"grant_scope_id" that: "GrantScopeId"}];
google.protobuf.StringValue grant_scope_id = 90 [json_name="grant_scope_id", (custom_options.v1.generate_sdk_option) = true, (custom_options.v1.mask_mapping) = {this:"grant_scope_id" that: "GrantScopeId"}]; // @gotags: `class:"public"`
// Output only. The IDs (only) of principals that are assigned to this role.
repeated string principal_ids = 100 [json_name="principal_ids"];
repeated string principal_ids = 100 [json_name="principal_ids"]; // @gotags: `class:"public"`
// Output only. The principals that are assigned to this role.
repeated Principal principals = 110;
// Output only. The grants that this role provides for its principals.
repeated string grant_strings = 120 [json_name="grant_strings"];
repeated string grant_strings = 120 [json_name="grant_strings"]; // @gotags: `class:"public"`
// Output only. The parsed grant information.
repeated Grant grants = 130;
// Output only. The available actions on this resource for this user.
repeated string authorized_actions = 300 [json_name="authorized_actions"];
repeated string authorized_actions = 300 [json_name="authorized_actions"]; // @gotags: `class:"public"`
}
internal/proto/controller/api/services/v1/role_service.proto
+24 -24
View File
@@ -180,7 +180,7 @@ service RoleService {
}
message GetRoleRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
}
message GetRoleResponse {
@@ -188,9 +188,9 @@ message GetRoleResponse {
}
message ListRolesRequest {
string scope_id = 1 [json_name="scope_id"];
bool recursive = 20 [json_name="recursive"];
string filter = 30 [json_name="filter"];
string scope_id = 1 [json_name="scope_id"]; // @gotags: `class:"public"`
bool recursive = 20 [json_name="recursive"]; // @gotags: `class:"public"`
string filter = 30 [json_name="filter"]; // @gotags: `class:"public"`
}
message ListRolesResponse {
@@ -207,7 +207,7 @@ message CreateRoleResponse {
}
message UpdateRoleRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
resources.roles.v1.Role item = 2;
google.protobuf.FieldMask update_mask = 3 [json_name="update_mask"];
}
@@ -217,17 +217,17 @@ message UpdateRoleResponse {
}
message DeleteRoleRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
}
message DeleteRoleResponse {}
message AddRolePrincipalsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string principal_ids = 3 [json_name="principal_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string principal_ids = 3 [json_name="principal_ids"]; // @gotags: `class:"public"`
}
message AddRolePrincipalsResponse {
@@ -235,11 +235,11 @@ message AddRolePrincipalsResponse {
}
message SetRolePrincipalsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string principal_ids = 3 [json_name="principal_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string principal_ids = 3 [json_name="principal_ids"]; // @gotags: `class:"public"`
}
message SetRolePrincipalsResponse {
@@ -247,11 +247,11 @@ message SetRolePrincipalsResponse {
}
message RemoveRolePrincipalsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string principal_ids = 3 [json_name="principal_ids"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string principal_ids = 3 [json_name="principal_ids"]; // @gotags: `class:"public"`
}
message RemoveRolePrincipalsResponse {
@@ -259,11 +259,11 @@ message RemoveRolePrincipalsResponse {
}
message AddRoleGrantsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string grant_strings = 3 [json_name="grant_strings"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string grant_strings = 3 [json_name="grant_strings"]; // @gotags: `class:"public"`
}
message AddRoleGrantsResponse {
@@ -271,11 +271,11 @@ message AddRoleGrantsResponse {
}
message SetRoleGrantsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string grant_strings = 3 [json_name="grant_strings"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string grant_strings = 3 [json_name="grant_strings"]; // @gotags: `class:"public"`
}
message SetRoleGrantsResponse {
@@ -283,11 +283,11 @@ message SetRoleGrantsResponse {
}
message RemoveRoleGrantsRequest {
string id = 1;
string id = 1; // @gotags: `class:"public"`
// Version is used to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
uint32 version = 2;
repeated string grant_strings = 3 [json_name="grant_strings"];
uint32 version = 2; // @gotags: `class:"public"`
repeated string grant_strings = 3 [json_name="grant_strings"]; // @gotags: `class:"public"`
}
message RemoveRoleGrantsResponse {
internal/tests/api/roles/classification_test.go
+142
View File
@@ -0,0 +1,142 @@
package roles_test
import (
"context"
"encoding/json"
"testing"
"time"
"github.com/hashicorp/boundary/sdk/pbs/controller/api"
pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/roles"
"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
"github.com/hashicorp/boundary/sdk/wrapper"
"github.com/hashicorp/eventlogger"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"google.golang.org/protobuf/types/known/timestamppb"
"google.golang.org/protobuf/types/known/wrapperspb"
)
func TestRoles(t *testing.T) {
ctx := context.Background()
now := time.Now()
pbNow := timestamppb.Now()
wrapper := wrapper.TestWrapper(t)
testEncryptingFilter := api.NewEncryptFilter(t, wrapper)
tests := []struct {
name string
in *eventlogger.Event
want *eventlogger.Event
}{
{
name: "role",
in: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &pb.Role{
Id: "id",
ScopeId: "scope-id",
Scope: &scopes.ScopeInfo{
Id: "scope-id",
Type: "scope-type",
Name: "scope-name",
Description: "scope-description",
ParentScopeId: "scope-parent-scope-id",
},
Name: &wrapperspb.StringValue{Value: "name"},
Description: &wrapperspb.StringValue{Value: "description"},
CreatedTime: pbNow,
UpdatedTime: pbNow,
Version: 0,
GrantScopeId: &wrapperspb.StringValue{Value: "grant-scope-id"},
PrincipalIds: []string{
"principal-id",
},
Principals: []*pb.Principal{
{
Id: "principal-id",
Type: "principal-type",
ScopeId: "principal-scope-id",
},
},
GrantStrings: []string{
"grand-string",
},
Grants: []*pb.Grant{
{
Raw: "raw",
Canonical: "canonical",
Json: &pb.GrantJson{
Id: "grant-json-id",
Type: "grant-json-type",
Actions: []string{"action"},
},
},
},
AuthorizedActions: []string{"action-1"},
},
},
want: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &pb.Role{
Id: "id",
ScopeId: "scope-id",
Scope: &scopes.ScopeInfo{
Id: "scope-id",
Type: "scope-type",
Name: "scope-name",
Description: "scope-description",
ParentScopeId: "scope-parent-scope-id",
},
Name: &wrapperspb.StringValue{Value: "name"},
Description: &wrapperspb.StringValue{Value: "description"},
CreatedTime: pbNow,
UpdatedTime: pbNow,
Version: 0,
GrantScopeId: &wrapperspb.StringValue{Value: "grant-scope-id"},
PrincipalIds: []string{
"principal-id",
},
Principals: []*pb.Principal{
{
Id: "principal-id",
Type: "principal-type",
ScopeId: "principal-scope-id",
},
},
GrantStrings: []string{
"grand-string",
},
Grants: []*pb.Grant{
{
Raw: "raw",
Canonical: "canonical",
Json: &pb.GrantJson{
Id: "grant-json-id",
Type: "grant-json-type",
Actions: []string{"action"},
},
},
},
AuthorizedActions: []string{"action-1"},
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, err := testEncryptingFilter.Process(ctx, tt.in)
require.NoError(err)
require.NotNil(got)
gotJSON, err := json.Marshal(got)
require.NoError(err)
wantJSON, err := json.Marshal(tt.want)
require.NoError(err)
assert.JSONEq(string(wantJSON), string(gotJSON))
})
}
}
sdk/pbs/controller/api/resources/roles/role.pb.go
+19 -19
View File
@@ -30,11 +30,11 @@ type Principal struct {
unknownFields protoimpl.UnknownFields
// Output only. The ID of the principal.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The type of the principal.
Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The Scope of the principal.
ScopeId string `protobuf:"bytes,3,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
ScopeId string `protobuf:"bytes,3,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *Principal) Reset() {
@@ -96,11 +96,11 @@ type GrantJson struct {
unknownFields protoimpl.UnknownFields
// Output only. The ID, if set.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The type, if set.
Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The actions.
Actions []string `protobuf:"bytes,3,rep,name=actions,proto3" json:"actions,omitempty"`
Actions []string `protobuf:"bytes,3,rep,name=actions,proto3" json:"actions,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *GrantJson) Reset() {
@@ -162,9 +162,9 @@ type Grant struct {
unknownFields protoimpl.UnknownFields
// Output only. The original user-supplied string.
Raw string `protobuf:"bytes,1,opt,name=raw,proto3" json:"raw,omitempty"`
Raw string `protobuf:"bytes,1,opt,name=raw,proto3" json:"raw,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The canonically-formatted string.
Canonical string `protobuf:"bytes,2,opt,name=canonical,proto3" json:"canonical,omitempty"`
Canonical string `protobuf:"bytes,2,opt,name=canonical,proto3" json:"canonical,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The JSON representation of the grant.
Json *GrantJson `protobuf:"bytes,3,opt,name=json,proto3" json:"json,omitempty"`
}
@@ -229,34 +229,34 @@ type Role struct {
unknownFields protoimpl.UnknownFields
// Output only. The ID of the Role.
Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty"`
Id string `protobuf:"bytes,10,opt,name=id,proto3" json:"id,omitempty" class:"public"` // @gotags: `class:"public"`
// The ID of the Scope containing this Role.
ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty"`
ScopeId string `protobuf:"bytes,20,opt,name=scope_id,proto3" json:"scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. Scope information for this resource.
Scope *scopes.ScopeInfo `protobuf:"bytes,30,opt,name=scope,proto3" json:"scope,omitempty"`
// Optional name for identification purposes.
Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty"`
Name *wrapperspb.StringValue `protobuf:"bytes,40,opt,name=name,proto3" json:"name,omitempty" class:"public"` // @gotags: `class:"public"`
// Optional user-set description for identification purposes.
Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty"`
Description *wrapperspb.StringValue `protobuf:"bytes,50,opt,name=description,proto3" json:"description,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The time this resource was created.
CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty"`
CreatedTime *timestamppb.Timestamp `protobuf:"bytes,60,opt,name=created_time,proto3" json:"created_time,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The time this resource was last updated.
UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty"`
UpdatedTime *timestamppb.Timestamp `protobuf:"bytes,70,opt,name=updated_time,proto3" json:"updated_time,omitempty" class:"public"` // @gotags: `class:"public"`
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
// The mutation will fail if the version does not match the latest known good version.
Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty"`
Version uint32 `protobuf:"varint,80,opt,name=version,proto3" json:"version,omitempty" class:"public"` // @gotags: `class:"public"`
// The Scope the grants will apply to. If the Role is at the global scope, this can be an org or project. If the Role is at an org scope, this can be a project within the org. It is invalid for this to be anything other than the Role's scope when the Role's scope is a project.
GrantScopeId *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=grant_scope_id,proto3" json:"grant_scope_id,omitempty"`
GrantScopeId *wrapperspb.StringValue `protobuf:"bytes,90,opt,name=grant_scope_id,proto3" json:"grant_scope_id,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The IDs (only) of principals that are assigned to this role.
PrincipalIds []string `protobuf:"bytes,100,rep,name=principal_ids,proto3" json:"principal_ids,omitempty"`
PrincipalIds []string `protobuf:"bytes,100,rep,name=principal_ids,proto3" json:"principal_ids,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The principals that are assigned to this role.
Principals []*Principal `protobuf:"bytes,110,rep,name=principals,proto3" json:"principals,omitempty"`
// Output only. The grants that this role provides for its principals.
GrantStrings []string `protobuf:"bytes,120,rep,name=grant_strings,proto3" json:"grant_strings,omitempty"`
GrantStrings []string `protobuf:"bytes,120,rep,name=grant_strings,proto3" json:"grant_strings,omitempty" class:"public"` // @gotags: `class:"public"`
// Output only. The parsed grant information.
Grants []*Grant `protobuf:"bytes,130,rep,name=grants,proto3" json:"grants,omitempty"`
// Output only. The available actions on this resource for this user.
AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty"`
AuthorizedActions []string `protobuf:"bytes,300,rep,name=authorized_actions,proto3" json:"authorized_actions,omitempty" class:"public"` // @gotags: `class:"public"`
}
func (x *Role) Reset() {