374 lines
13 KiB
Protocol Buffer
374 lines
13 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package controller.api.services.v1;
|
|
|
|
option go_package = "github.com/hashicorp/watchtower/internal/gen/controller/api/services;services";
|
|
|
|
import "protoc-gen-swagger/options/annotations.proto";
|
|
import "google/api/annotations.proto";
|
|
import "google/protobuf/field_mask.proto";
|
|
import "google/protobuf/wrappers.proto";
|
|
import "controller/api/resources/roles/v1/role.proto";
|
|
|
|
service RoleService {
|
|
|
|
// GetRole returns a stored Role if present. The provided request
|
|
// must include the org and role id for the role being retrieved. If
|
|
// any of those ids are missing, malformed or reference a non existing
|
|
// resource an error is returned.
|
|
rpc GetRole(GetRoleRequest) returns (GetRoleResponse) {
|
|
option (google.api.http) = {
|
|
get: "/v1/orgs/{org_id}/roles/{id}"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
get: "/v1/orgs/{org_id}/projects/{project_id}/roles/{id}"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Gets a single Role"
|
|
};
|
|
}
|
|
|
|
// ListRoles returns a list of stored roles which exist inside the org
|
|
// referenced inside the request. The request must include the org id for
|
|
// the roles being retrieved. If the org id is missing, malformed, or
|
|
// reference a non existing org, an error is returned.
|
|
rpc ListRoles(ListRolesRequest) returns (ListRolesResponse) {
|
|
option (google.api.http) = {
|
|
get: "/v1/orgs/{org_id}/roles"
|
|
additional_bindings {
|
|
get: "/v1/orgs/{org_id}/projects/{project_id}/roles"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Lists all Roles"
|
|
};
|
|
}
|
|
|
|
// CreateRole creates and stores a role in watchtower. The provided
|
|
// request must include the org id in which the role will be created.
|
|
// If the org id is missing, malformed or references a non existing
|
|
// org, an error is returned. If a name is provided that is in
|
|
// use in another role in the same org, an error is returned.
|
|
rpc CreateRole(CreateRoleRequest) returns (CreateRoleResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles"
|
|
body: "item"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles"
|
|
body: "item"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Creates a single Role"
|
|
};
|
|
}
|
|
|
|
// UpdateRole updates an existing role in watchtower. The provided
|
|
// role must not have any read only fields set. The update mask must be
|
|
// included in the request and contain at least 1 mutable field. To unset
|
|
// a field's value, include the field in the update mask and don't set it
|
|
// in the provided role. An error is returned if either the org
|
|
// or role ids are missing or reference a non existing resource. An error
|
|
// is also returned if the request attempts to update the name to one that is
|
|
// already in use in this org.
|
|
rpc UpdateRole(UpdateRoleRequest) returns (UpdateRoleResponse) {
|
|
option (google.api.http) = {
|
|
patch: "/v1/orgs/{org_id}/roles/{id}"
|
|
body: "item"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
patch: "/v1/orgs/{org_id}/projects/{project_id}/roles/{id}"
|
|
body: "item"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Updates a Role"
|
|
};
|
|
}
|
|
|
|
// DeleteRole removes a role from Watchtower. If the provided org or role ids
|
|
// are malformed or not provided an error is returned. No error is returned
|
|
// if either ids reference resources that do not exist as the response itself
|
|
// specifies if the resource existed before the DeleteRole request was
|
|
// received.
|
|
rpc DeleteRole(DeleteRoleRequest) returns (DeleteRoleResponse) {
|
|
option (google.api.http) = {
|
|
delete: "/v1/orgs/{org_id}/roles/{id}"
|
|
additional_bindings {
|
|
delete: "/v1/orgs/{org_id}/projects/{project_id}/roles/{id}"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Deletes a Role"
|
|
};
|
|
}
|
|
|
|
// AddRolePrincipals adds users and/or groups to a role. The provided request must include
|
|
// the org id and the role id which the users and/or groups will be added to. If the
|
|
// org id is missing, malformed or references a non existing org,
|
|
// an error is returned.
|
|
rpc AddRolePrincipals(AddRolePrincipalsRequest) returns (AddRolePrincipalsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:add-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:add-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Adds Users and/or Groups to a Role"
|
|
};
|
|
}
|
|
|
|
// SetRolePrincipals sets the role's users and/or groups. Any existing principals on
|
|
// the role are deleted if they are not included in this request. The provided
|
|
// request must include the org id and the role id which the users and/or groups
|
|
// will be set to. If the org id is missing, malformed or references a non
|
|
// existing org, an error is returned.
|
|
rpc SetRolePrincipals(SetRolePrincipalsRequest) returns (SetRolePrincipalsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:set-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:set-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Set Users and/or Groups to a Role, removing any principals that are not specified in the request."
|
|
};
|
|
}
|
|
|
|
// RemoveRolePrincipals removes the users and/or groups from the specified role.
|
|
// The provided request must include the org id and the role id which the users
|
|
// and/or groups will be removed from. If the org id is missing, malformed or references a non
|
|
// existing org, an error is returned. It is not an error to have duplicate
|
|
// user/group ids.
|
|
rpc RemoveRolePrincipals(RemoveRolePrincipalsRequest) returns (RemoveRolePrincipalsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:remove-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:remove-principals"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Removes the specified Users and/or Groups from a Role."
|
|
};
|
|
}
|
|
|
|
// AddRoleGrants adds grants to a role. The provided request must include
|
|
// the org id and the role id which the grants will be added to. If the
|
|
// org id is missing, malformed or references a non existing org,
|
|
// an error is returned. It is not an error to have duplicate grants.
|
|
rpc AddRoleGrants(AddRoleGrantsRequest) returns (AddRoleGrantsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:add-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:add-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Adds grants to a role"
|
|
};
|
|
}
|
|
|
|
// SetRoleGrants sets the role's grants. Any existing grants on the role are
|
|
// deleted if they are not included in this request. The provided request must
|
|
// include the org id and the role id which the grants will be set to. If the
|
|
// org id is missing, malformed or references a non existing org, an
|
|
// error is returned. It is not an error to have duplicate grants.
|
|
rpc SetRoleGrants(SetRoleGrantsRequest) returns (SetRoleGrantsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:set-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:set-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Set grants for a role, removing any grants that are not specified in the request."
|
|
};
|
|
}
|
|
|
|
// RemoveRoleGrants removes the users and/or groups from the specified role.
|
|
// The provided request must include the org id and the role id which the users
|
|
// and/or groups will be removed from. If the org id is missing, malformed or references a non
|
|
// existing org, an error is returned. It is not an error to have duplicate
|
|
// user/group ids.
|
|
rpc RemoveRoleGrants(RemoveRoleGrantsRequest) returns (RemoveRoleGrantsResponse) {
|
|
option (google.api.http) = {
|
|
post: "/v1/orgs/{org_id}/roles/{role_id}:remove-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
additional_bindings {
|
|
post: "/v1/orgs/{org_id}/projects/{project_id}/roles/{role_id}:remove-grants"
|
|
body: "*"
|
|
response_body: "item"
|
|
}
|
|
};
|
|
option (grpc.gateway.protoc_gen_swagger.options.openapiv2_operation) = {
|
|
summary: "Removes grants from a role."
|
|
};
|
|
}
|
|
|
|
}
|
|
|
|
message GetRoleRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string id = 3;
|
|
string view = 4;
|
|
}
|
|
|
|
message GetRoleResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message ListRolesRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string view = 3;
|
|
}
|
|
|
|
message ListRolesResponse {
|
|
repeated resources.roles.v1.Role items = 1;
|
|
}
|
|
|
|
message CreateRoleRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
resources.roles.v1.Role item = 3;
|
|
}
|
|
|
|
message CreateRoleResponse {
|
|
string uri = 1;
|
|
resources.roles.v1.Role item = 2;
|
|
}
|
|
|
|
// TODO: Add versions to Update and Delete role requests.
|
|
message UpdateRoleRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string id = 3;
|
|
resources.roles.v1.Role item = 4;
|
|
google.protobuf.FieldMask update_mask = 5;
|
|
}
|
|
|
|
message UpdateRoleResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message DeleteRoleRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string id = 3;
|
|
}
|
|
|
|
message DeleteRoleResponse {
|
|
bool existed = 1;
|
|
}
|
|
|
|
message AddRolePrincipalsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string principal_ids = 5 [json_name="principal_ids"];
|
|
}
|
|
|
|
message AddRolePrincipalsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message SetRolePrincipalsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string principal_ids = 5 [json_name="principal_ids"];
|
|
}
|
|
|
|
message SetRolePrincipalsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message RemoveRolePrincipalsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string principal_ids = 5 [json_name="principal_ids"];
|
|
}
|
|
|
|
message RemoveRolePrincipalsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message AddRoleGrantsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string grants = 5 [json_name="grants"];
|
|
}
|
|
|
|
message AddRoleGrantsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message SetRoleGrantsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string grants = 5 [json_name="grants"];
|
|
}
|
|
|
|
message SetRoleGrantsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
}
|
|
|
|
message RemoveRoleGrantsRequest {
|
|
string org_id = 1;
|
|
string project_id = 2;
|
|
string role_id = 3;
|
|
// The version ensures the role hasn't changed since it was last retrieved and if
|
|
// it has the request will fail.
|
|
google.protobuf.UInt32Value version = 4;
|
|
repeated string grants = 5 [json_name="grants"];
|
|
}
|
|
|
|
message RemoveRoleGrantsResponse {
|
|
resources.roles.v1.Role item = 1;
|
|
} |