github.com/cloudwan/edgelq-sdk@v1.15.4/iam/proto/v1/condition.proto

syntax = "proto3";

package ntt.iam.v1;

import "google/api/resource.proto";
import "google/protobuf/struct.proto";
import "goten-sdk/types/meta.proto";

option go_package = "github.com/cloudwan/edgelq-sdk/iam/resources/v1/condition;condition";
option java_multiple_files = true;
option java_outer_classname = "ConditionProto";
option java_package = "com.ntt.iam.pb.v1";

// Condition Resource represents additional that is not
// built-in into the role. It can be attached to role grant
// or RoleBinding (applies to all grants then).
message Condition {
  option (google.api.resource) = {
    type : "iam.edgelq.com/Condition"
    pattern : "conditions/{condition}"
    pattern : "projects/{project}/conditions/{condition}"
    pattern : "organizations/{organization}/conditions/{condition}"
    pattern : "services/{service}/conditions/{condition}"
  };

  // Name of Condition
  // When creating a new instance, this field is optional and if not provided,
  // it will be generated automatically. Last ID segment must conform to the
  // following regex: [a-z][a-z0-9\\-]{0,28}[a-z0-9]
  string name = 1;

  // Metadata is an object with information like create, update and delete time
  // (for async deleted resources), has user labels/annotations, sharding
  // information, multi-region syncing information and may have non-schema
  // owners (useful for taking ownership of resources belonging to lower level
  // services by higher ones).
  goten.types.Meta metadata = 6;

  // Display Name
  string display_name = 2;

  // Description
  string description = 3;

  oneof condition {
    IpCondition ip_condition = 7;

    AttestationCondition attestation_condition = 8;
  }

  // Condition expression in [Google
  // CEL](https://github.com/google/cel-spec/blob/v0.4.0/doc/intro.md), syntax,
  // e.g. `resource.name == "projects/xyz/instances/abc"`
  //
  // Accessible parameters:
  // | variable | type | description | examples |
  // |-|-|-|-|
  // | `resource.body` | `string` | Resource type | `"iam.edgelq.com/Condition"`
  // | | `request.action` | `string` | Action verb | `"create"`, `"batchGet"` |
  // | `request.body` | `dyn` | Request body (in native format). |
  // request.body.page_size | | `parameters` | `map(string, dyn)` | Bound
  // parameters. | `parameters.minSeverity` | | `attest.policy` | `string` |
  // Name of attestation policy attested with by the atestee; empty string if
  // none. | `""`, `"projects/myProj/AttestationPolicies/myPol"` |
  //
  // Extension:
  //
  // Some
  //
  // Filter.`satisfies(other)`
  //
  // Access is determined by the return value. Return `true` to grant access or
  // `false` to deny. Any execution error results in access denied.
  // DEPRECATED: This should not be actually used at all, as CEL conditions
  // are obsolete.
  string expression = 4;

  // Typed parameters declarations. When binding a Condition passed parameters
  // must correspond to declarations.
  // DEPRECATED: Along with expression, CEL conditions are gone.
  repeated ParameterDeclaration parameter_declarations = 5;

  // Parameter Declarations used
  message ParameterDeclaration {
    // Parameter Key - must be unique within condition. Defined parameter
    // variables are accessible in condition expression via `parameters.<key>`,
    // e.g.`parameters.projectId`
    string key = 1;

    // Parameter value type
    ParameterType type = 2;
  }

  // IpCondition presents list of allowed/disallowed source IP
  // addresses.
  message IpCondition {
    // Allowed IP cidrs in v4 or v6 format.
    // If specified, at least one must be satisfied during execution.
    repeated string allowed_cidrs = 1;

    // Disallowed IP cidrs in v4 or v6 format.
    // If specified, client IP must not be in any specified range.
    repeated string disabled_cidrs = 2;
  }

  // AttestationCondition requires that associated roles/grants
  // are authorized only if caller attaches proper attestation token
  // next to authorization one.
  message AttestationCondition {
    // Domain name that must be present in attestation token.
    string domain = 1;

    // List of permissions excepted from this condition.
    // By default, it contains:
    // * services/iam.edgelq.com/permissions/attestationDomains.get
    // * services/iam.edgelq.com/permissions/attestationDomains.verify
    // * services/iam.edgelq.com/permissions/serviceAccounts.get
    // * services/iam.edgelq.com/permissions/serviceAccountKeys.get
    // * services/devices.edgelq.com/permissions/devices.list
    // * services/devices.edgelq.com/permissions/provisioningPolicies.list
    // * services/devices.edgelq.com/permissions/provisioningPolicies.provisionDeviceViaPolicy
    // * services/devices.edgelq.com/permissions/provisioningPolicies.requestProvisioningApproval
    // Those are necessary to obtain attestation token in the first
    // place.
    repeated string except_permissions = 2;
  }

  // Parameter Type.
  enum ParameterType {
    TYPE_UNSPECIFIED = 0;

    STRING = 1;

    INT64 = 2;

    DOUBLE = 3;

    BOOL = 4;

    STRING_ARRAY = 5;

    INT64_ARRAY = 6;

    DOUBLE_ARRAY = 7;

    BOOL_ARRAY = 8;

    OBJECT = 9;
  }
}

// ExecutableCondition represents instantiation of condition with params,
// in other words: Executable condition, that is used in Role bindings.
message ExecutableCondition {
  // Reference to Condition which may also be parameterized
  string condition = 1;

  // Parameters in string form. Parameters must match
  // [declarations][ntt.iam.v1.Condition.parameter_declarations]
  // TODO: Only used by deprecated CEL conditions.
  google.protobuf.Struct params = 3;

  reserved 2;
}