github.com/cloudwan/edgelq-sdk@v1.15.4/iam/proto/v1/role.proto

syntax = "proto3";

package ntt.iam.v1;

import "edgelq-sdk/iam/proto/v1/condition.proto";
import "google/api/resource.proto";
import "goten-sdk/types/meta.proto";

option go_package = "github.com/cloudwan/edgelq-sdk/iam/resources/v1/role;role";
option java_multiple_files = true;
option java_outer_classname = "RoleProto";
option java_package = "com.ntt.iam.pb.v1";

// Role Resource
message Role {
  option (google.api.resource) = {
    type : "iam.edgelq.com/Role"
    pattern : "services/{service}/roles/{role}"
    pattern : "projects/{project}/roles/{role}"
    pattern : "organizations/{organization}/roles/{role}"
  };

  // Name of Role
  string name = 1;

  // Metadata is an object with information like create, update and delete time
  // (for async deleted resources), has user labels/annotations, sharding
  // information, multi-region syncing information and may have non-schema
  // owners (useful for taking ownership of resources belonging to lower level
  // services by higher ones).
  goten.types.Meta metadata = 4;

  // Display Name
  string display_name = 2;

  // Optional description
  string description = 9;

  // Category to which Role belongs to. It cannot be changed.
  Category category = 10;

  // List of scope params, they are used to evaluate object prefixes in
  // grants and values in their field conditions, if any.
  repeated ScopeParamType scope_params = 3;

  // List of const scope params for this role
  repeated ScopeParam const_values = 11;

  // List of default value for the passed scope params
  repeated ScopeParam default_values = 12;

  // List of permissions granted per each object prefix.
  repeated Grant grants = 5;

  // List of owned objects templates - during binding of a role, each owned
  // object specified in this role is computed against scope params from role
  // binding to evaluate final owned objects. For example, if owned_objects in
  // Role contains value "regions/{region}/devices/{device}, and RoleBinding
  // specifies region=useast and device=d1, then final owned_object will be
  // regions/useast/devices/d1. Ownership also would include any potential child
  // resources of this device. Note that RoleBinding scope (project,
  // organization, service) will still be prepended before each owned object to
  // form fully qualified name of the owned resource. Owned objects may contain
  // wildcards: '-'. As a special case, if owned objects contain string with
  // only single character: '-', then it means member of the role binding is
  // considered as full owner of the scope.
  // This field cannot be modified after role creation.
  repeated string owned_objects = 6;

  // List of services used by this role. It is being detected by the usage of
  // permissions in grants - or if it has owned objects, it contains all
  // services used by parent service.
  repeated string services = 7;

  // Internal field used by controller to ensure role bindings are in sync with
  // role updates.
  int64 rb_spec_generation = 8;

  message ScopeParamType {
    string name = 1;

    Type type = 2;

    enum Type {
      UNDEFINED = 0;

      STRING = 1;

      ARRAY_OF_STRINGS = 2;
    }
  }

  message Grant {
    // Optional prefix that is APPENDED to the scope inherited from RoleBinding
    // (project, organization, service). If not specified, then scope is
    // equal to the one from RoleBinding.
    string sub_scope = 1;

    // List of applicable permissions for this grant. Not relevant if is_owner
    // is true.
    repeated string permissions = 2;

    // List of resource field conditions. Values for conditions are extracted
    // from assigned RoleBinding (scope params).
    // Resource extraction is following:
    // - If request has resource body, then it is used.
    // - If request has resource name, then resource is extracted from database
    //   and its fields are used.
    // - If request has filter object applicable for collection requests (like
    // list,
    //   collection watch...), then service uses resource field paths and values
    //   extracted from filter conditions.
    repeated FieldCondition resource_field_conditions = 3;

    // List of request field conditions. Values for conditions are extracted
    // from assigned RoleBinding (scope params).
    repeated FieldCondition request_field_conditions = 4;

    // List of executable conditions to be applied in order to validate this
    // grant. Note that executable conditions are also specified in RoleBinding,
    // as often it is not possible to define all params in the Role itself,
    // before binding. Final executable conditions, in RoleBinding context, are
    // computed in the following way:
    // - Executable conditions from RoleBinding and Role are matched by
    //   condition reference.
    // - Params are merged FROM condition in Role into condition in RoleBinding.
    //   It is expected that Role defined "common" params and RoleBinding
    //   defines remaining ones.
    repeated ExecutableCondition executable_conditions = 5;

    message FieldCondition {
      string path = 1;

      string value = 2;
    }
  }

  // Category points to the intended role use. It may restrict how RoleBindings
  // are created.
  enum Category {
    // Undefined, not allowed.
    UNDEFINED = 0;

    // Role is intended for public access. Restricted members: allUsers,
    // allAuthenticatedUsers. No RoleBinding scope restrictions.
    PUBLIC = 1;

    // Role is for internal purposes, defined by a parent service. There are no
    // restrictions to scope and members.
    INTERNAL = 2;

    // Special owner role - reserved to "scope-admin" role in IAM. It is de
    // facto reserved category for EdgeLQ core services only, but is also kind
    // of USER type.
    OWNER = 3;

    // Role relevant for Service Management, check display name and/or
    // description for more information.
    SERVICE = 4;

    // Role for various edge agents. Restricted to project scope and service
    // account member types. Cannot be assigned to groups.
    AGENT = 5;

    // Role relevant for users, provides an access to various actions on
    // organization/project level. Typically should be given to users, but
    // ServiceAccount is also possible. Can be assigned to group members.
    USER = 6;
  }
}

message ScopeParam {
  // Name of the variable to be used in conditions/scope values.
  string name = 1;

  oneof value {
    // Value is a single string
    StringValue string = 2;

    // List of alternative values.
    ArrayOfStringsValue strings = 3;

    // Value is extracted dynamically from pointed object type.
    FromValue value_from = 4;
  }

  // StringValue represents single value
  message StringValue { string value = 1; }

  // ArrayOfStringsValue represents array of strings value
  message ArrayOfStringsValue { repeated string values = 1; }

  // FromValue represents a value(s) from specific dynamic object.
  message FromValue {
    // Source indicates type of dynamic object from where we take value(s).
    Source source = 1;

    // Path within specified object from which exactly we get value(s).
    string path = 2;

    // Source indicates which dynamic object is used to extract value from.
    enum Source {
      UNDEFINED = 0;

      // Object from which value is taken is metadata.
      // Valid for Service Accounts and user types.
      PRINCIPAL_METADATA = 1;

      // Object from which value is taken is User principal.
      // If principal executing an Action is not a User, then
      // value will be empty.
      PRINCIPAL_USER = 2;

      // Object from which value is taken is ServiceAccount principal.
      // If principal executing an Action is not a ServiceAccount, then
      // value will be empty.
      PRINCIPAL_SVCACC = 3;
    }
  }
}