github.com/cloudwan/edgelq-sdk@v1.15.4/iam/proto/v1/role_binding.proto

syntax = "proto3";

package ntt.iam.v1;

import "edgelq-sdk/iam/proto/v1/condition.proto";
import "edgelq-sdk/iam/proto/v1/role.proto";
import "google/api/resource.proto";
import "goten-sdk/types/meta.proto";

option go_package = "github.com/cloudwan/edgelq-sdk/iam/resources/v1/role_binding;role_binding";
option java_multiple_files = true;
option java_outer_classname = "RoleBindingProto";
option java_package = "com.ntt.iam.pb.v1";

// RoleBinding Resource
message RoleBinding {
  option (google.api.resource) = {
    type : "iam.edgelq.com/RoleBinding"
    pattern : "roleBindings/{role_binding}"
    pattern : "projects/{project}/roleBindings/{role_binding}"
    pattern : "organizations/{organization}/roleBindings/{role_binding}"
    pattern : "services/{service}/roleBindings/{role_binding}"
  };

  // Name of RoleBinding
  string name = 1;

  // Metadata is an object with information like create, update and delete time
  // (for async deleted resources), has user labels/annotations, sharding
  // information, multi-region syncing information and may have non-schema
  // owners (useful for taking ownership of resources belonging to lower level
  // services by higher ones).
  goten.types.Meta metadata = 8;

  // Applied role.
  string role = 2;

  // Binding members
  // Format of the string is one of:
  // - "allUsers" (anyone)
  // - "allAuthenticatedUsers" (anyone logged in from handling service point of
  // view)
  // - "user:admin.super@example.com"
  // - "serviceAccount:device_agent@watchdog.serviceaccounts.iam.edgelq.com"
  // - "group:nice.group@example.com"
  // - "domain:example.com" (anyone with exact email domain)
  string member = 4;

  // All scope params defined as required by a role
  repeated ScopeParam scope_params = 5;

  // optional executable conditions to be added to the role binding.
  // They are matched with the executable conditions in a role grants
  // by condition reference. If there is condition defined in RoleBinding,
  // but not in any role grant, then executable condition is applied to
  // all role grants.
  repeated ExecutableCondition executable_conditions = 6;

  // List of owned objects WITHIN role binding scope - for example
  // if role binding is a child of project and owner_objects contain some
  // device, member has all possible permissions for this device in project,
  // regardless of method. In case ownership is for whole role binding scope, it
  // will contain "-" string. This is computed based on a role with
  // wildcard grants.
  repeated string owned_objects = 3;

  // Member type, its prefix from member before ':' rune, fo example "user".
  // If member has no ':' (like allUsers), then it will contain same value.
  string member_type = 9;

  // Role category, taken from role itself, allows for additional filtering.
  Role.Category category = 14;

  // Internal field used by IAM controller to note role binding ancestry path
  // for Group type (RoleBindings inherited from Group)
  repeated Parent ancestry_path = 7;

  // Internal field used by IAM controller to note parent role binding
  // from Parent Organization type. It is much different compared to
  // "ancestry_path", we just need direct parent. This is because it is simpler
  // - controller for this inheritance does not need full ancestry path for loop
  // detection. Groups are complicated and it is legal for two groups containing
  // each other as members. But organization ancestry path does not allow loops,
  // so we can afford simple field!
  string parent_by_org = 12;

  // Internal field used to synchronize role binding with role.
  // This value increases when we spec in a role changes in a way requiring role
  // binding resynchronization.
  int64 spec_generation = 10;

  // Internal field indicating if role binding has owned objects.
  // It is used for filtering, as its not possible to filter by
  // len(owned_objects) > 0
  bool has_owned_objects = 11;

  // If true, then this RoleBinding DOES NOT apply to child entities.
  // TODO: For now IAM Server decides if this RB is not assignable, consider
  // opening this.
  bool disable_for_child_scopes = 13;

  // Provides information about inheritance of this role binding - if it was
  // created from another role binding.
  message Parent {
    // Role bindings which have group as member have child for each service
    // account and user in that group. All those role bindings have one common
    // parent pointing at group role binding
    string parent = 1;

    // Member of the parent role binding
    string member = 2;
  }
}