go.chromium.org/luci@v0.0.0-20240309015107-7cdc2e660f33/resultdb/proto/config/project_config.proto (about) 1 // Copyright 2022 The LUCI Authors. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 syntax = "proto3"; 16 17 package luci.resultdb.config; 18 19 option go_package = "go.chromium.org/luci/resultdb/proto/config;resultpb"; 20 21 // ProjectConfig is the project-specific configuration data for Luci ResultDB. 22 message ProjectConfig { 23 // Per user allow list to control GCS buckets that can be referenced as 24 // artifacts in ResultDB invocations. 25 // Since ResultDB returns GCS artifacts through signed urls, the allow list 26 // is needed to prevent potential exploit where user could gain access to 27 // artifacts in GCS buckets they don't have access to by feigning the 28 // uploaded artifact GCS path. 29 repeated GcsAllowList gcs_allow_list = 1; 30 } 31 32 // Capture the per user GCS bucket allow list. 33 message GcsAllowList { 34 // The users allowed to reference the specified buckets. 35 // Each user is a LUCI Auth identity string, e.g. user:username@email.com 36 // For all available identity kinds see luci/auth/identity/identity.go 37 repeated string users = 1; 38 39 // GCS buckets the user is allowed to reference. 40 repeated string buckets = 2; 41 }