Multiple grant scope IDs (#4251)

Co-authored-by: Timothy Messier <tim.messier@gmail.com> Co-authored-by: Todd <github@quaddi.com>
2024-01-23 14:33:09 -05:00
1 parent 659df2797c
commit f5dd457b34
@@ -88,16 +88,27 @@ message Role {
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 80; // @gotags: `class:"public"`

-  // The Scope the grants will apply to. If the Role is at the global scope, this can be an org or project. If the Role is at an org scope, this can be a project within the org. It is invalid for this to be anything other than the Role's scope when the Role's scope is a project.
+  // The Scope the grants will apply to. If the Role is at the global scope,
+  // this can be an org or project. If the Role is at an org scope, this can be
+  // a project within the org. It is invalid for this to be anything other than
+  // the Role's scope when the Role's scope is a project.
+  //
+  // Deprecated: Use "grant_scope_ids" instead.
  google.protobuf.StringValue grant_scope_id = 90 [
    json_name = "grant_scope_id",
-    (custom_options.v1.generate_sdk_option) = true,
-    (custom_options.v1.mask_mapping) = {
-      this: "grant_scope_id"
-      that: "GrantScopeId"
-    }
+    deprecated = true,
+    (custom_options.v1.generate_sdk_option) = true
  ]; // @gotags: `class:"public" eventstream:"observation"`

+  // Output only. The IDs of Scopes the grants will apply to. This can include
+  // the role's own scope ID, or "this" for the same behavior; specific IDs of
+  // scopes that are children of the role's scope; the value "children" to match
+  // all direct child scopes of the role's scope; or the value "descendants" to
+  // match all descendant scopes (e.g. child scopes, children of child scopes;
+  // only valid at "global" scope since it is the only one with children of
+  // children).
+  repeated string grant_scope_ids = 91 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
+
  // Output only. The IDs (only) of principals that are assigned to this role.
  repeated string principal_ids = 100 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`

@@ -152,6 +152,46 @@ service RoleService {
    };
    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Removes grants from a Role."};
  }
+
+  // AddRoleGrantScopes adds grants scopes to a Role. The provided request must
+  // include the Role id which the grant scopes will be added to. An error is
+  // returned if the provided id is malformed or references a non-existing
+  // resource.
+  rpc AddRoleGrantScopes(AddRoleGrantScopesRequest) returns (AddRoleGrantScopesResponse) {
+    option (google.api.http) = {
+      post: "/v1/roles/{id}:add-grant-scopes"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Adds grant scopes to a Role"};
+  }
+
+  // SetRoleGrants sets the Role's grant scopes. Any existing grant scopes on
+  // the Role are deleted if they are not included in this request. The provided
+  // request must include the Role ID on which the grants will be set. If
+  // missing, malformed, or referencing a non-existing resource, an error is
+  // returned.
+  rpc SetRoleGrantScopes(SetRoleGrantScopesRequest) returns (SetRoleGrantScopesResponse) {
+    option (google.api.http) = {
+      post: "/v1/roles/{id}:set-grant-scopes"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Set grant scopes for a Role, removing any grant scopes that are not specified in the request."};
+  }
+
+  // RemoveRoleGrantScopes removes the grant scopes from the specified Role. The
+  // provided request must include the Role IDs from which the grants will be
+  // removed. If missing, malformed, or references a non-existing resource, an
+  // error is returned.
+  rpc RemoveRoleGrantScopes(RemoveRoleGrantScopesRequest) returns (RemoveRoleGrantScopesResponse) {
+    option (google.api.http) = {
+      post: "/v1/roles/{id}:remove-grant-scopes"
+      body: "*"
+      response_body: "item"
+    };
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {summary: "Removes grant scopes from a Role."};
+  }
 }

 message GetRoleRequest {
@@ -305,3 +345,39 @@ message RemoveRoleGrantsRequest {
 message RemoveRoleGrantsResponse {
  resources.roles.v1.Role item = 1;
 }
+
+message AddRoleGrantScopesRequest {
+  string id = 1; // @gotags: `class:"public"`
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2; // @gotags: `class:"public"`
+  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
+}
+
+message AddRoleGrantScopesResponse {
+  resources.roles.v1.Role item = 1;
+}
+
+message SetRoleGrantScopesRequest {
+  string id = 1; // @gotags: `class:"public"`
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2; // @gotags: `class:"public"`
+  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
+}
+
+message SetRoleGrantScopesResponse {
+  resources.roles.v1.Role item = 1;
+}
+
+message RemoveRoleGrantScopesRequest {
+  string id = 1; // @gotags: `class:"public"`
+  // Version is used to ensure this resource has not changed.
+  // The mutation will fail if the version does not match the latest known good version.
+  uint32 version = 2; // @gotags: `class:"public"`
+  repeated string grant_scope_ids = 3 [json_name = "grant_scope_ids"]; // @gotags: `class:"public"`
+}
+
+message RemoveRoleGrantScopesResponse {
+  resources.roles.v1.Role item = 1;
+}