Jeff Mitchell
feb3aea38f
This allows specifying multiple IDs in grants via an `ids` field, which will eventually become the normal way to specify IDs. Internally, each grant with multiple IDs turns into multiple ACL grants each with a single ID; to make this distinction clearer and allow for better separation of concerns an AclGrant type has been introduced, so really multiple IDs in a Grant turn into multiple AclGrants. The nice thing about doing it this way is that it becomes purely a parsing concern; no actual validation logic has changed. For backwards compatibility with grants already stored in roles, we do not error out if `id` is specified. However, eventually we will simply not support grants with `id` coming via the API; they will fail API validation, such that new grants will require the use of the updated `ids` field. A follow-on PR will plumb this through the service handlers/API/CLI, but I decided to do it in separate chunks to make reviewing easier, given that they are easily separable into the internal and external aspects of the change. * Add CLI/API checks around using ID in grants (#3264) * Plumb through some contexts to remove a lot of deprecated errors (#3268)
116 lines
4.2 KiB
Protocol Buffer
116 lines
4.2 KiB
Protocol Buffer
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
syntax = "proto3";
|
|
|
|
package controller.api.resources.roles.v1;
|
|
|
|
import "controller/api/resources/scopes/v1/scope.proto";
|
|
import "controller/custom_options/v1/options.proto";
|
|
import "google/protobuf/timestamp.proto";
|
|
import "google/protobuf/wrappers.proto";
|
|
|
|
option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/roles;roles";
|
|
|
|
message Principal {
|
|
// Output only. The ID of the principal.
|
|
string id = 1; // @gotags: `class:"public"`
|
|
|
|
// Output only. The type of the principal.
|
|
string type = 2; // @gotags: `class:"public"`
|
|
|
|
// Output only. The Scope of the principal.
|
|
string scope_id = 3 [json_name = "scope_id"]; // @gotags: `class:"public"`
|
|
}
|
|
|
|
message GrantJson {
|
|
// Output only. The ID, if set.
|
|
// Deprecated: use "ids" instead.
|
|
string id = 1 [deprecated = true]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The IDs, if set.
|
|
repeated string ids = 4; // @gotags: `class:"public"`
|
|
|
|
// Output only. The type, if set.
|
|
string type = 2; // @gotags: `class:"public"`
|
|
|
|
// Output only. The actions.
|
|
repeated string actions = 3; // @gotags: `class:"public"`
|
|
}
|
|
|
|
message Grant {
|
|
// Output only. The original user-supplied string.
|
|
string raw = 1; // @gotags: `class:"public"`
|
|
|
|
// Output only. The canonically-formatted string.
|
|
string canonical = 2; // @gotags: `class:"public"`
|
|
|
|
// Output only. The JSON representation of the grant.
|
|
GrantJson json = 3;
|
|
}
|
|
|
|
// Role contains all fields related to a Role resource
|
|
message Role {
|
|
// Output only. The ID of the Role.
|
|
string id = 10; // @gotags: `class:"public"`
|
|
|
|
// The ID of the Scope containing this Role.
|
|
string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public"`
|
|
|
|
// Output only. Scope information for this resource.
|
|
resources.scopes.v1.ScopeInfo scope = 30;
|
|
|
|
// Optional name for identification purposes.
|
|
google.protobuf.StringValue name = 40 [
|
|
(custom_options.v1.generate_sdk_option) = true,
|
|
(custom_options.v1.mask_mapping) = {
|
|
this: "name"
|
|
that: "name"
|
|
}
|
|
]; // @gotags: `class:"public"`
|
|
|
|
// Optional user-set description for identification purposes.
|
|
google.protobuf.StringValue description = 50 [
|
|
(custom_options.v1.generate_sdk_option) = true,
|
|
(custom_options.v1.mask_mapping) = {
|
|
this: "description"
|
|
that: "description"
|
|
}
|
|
]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The time this resource was created.
|
|
google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The time this resource was last updated.
|
|
google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public"`
|
|
|
|
// Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
|
|
// The mutation will fail if the version does not match the latest known good version.
|
|
uint32 version = 80; // @gotags: `class:"public"`
|
|
|
|
// The Scope the grants will apply to. If the Role is at the global scope, this can be an org or project. If the Role is at an org scope, this can be a project within the org. It is invalid for this to be anything other than the Role's scope when the Role's scope is a project.
|
|
google.protobuf.StringValue grant_scope_id = 90 [
|
|
json_name = "grant_scope_id",
|
|
(custom_options.v1.generate_sdk_option) = true,
|
|
(custom_options.v1.mask_mapping) = {
|
|
this: "grant_scope_id"
|
|
that: "GrantScopeId"
|
|
}
|
|
]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The IDs (only) of principals that are assigned to this role.
|
|
repeated string principal_ids = 100 [json_name = "principal_ids"]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The principals that are assigned to this role.
|
|
repeated Principal principals = 110;
|
|
|
|
// Output only. The grants that this role provides for its principals.
|
|
repeated string grant_strings = 120 [json_name = "grant_strings"]; // @gotags: `class:"public"`
|
|
|
|
// Output only. The parsed grant information.
|
|
repeated Grant grants = 130;
|
|
|
|
// Output only. The available actions on this resource for this user.
|
|
repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
|
|
}
|