boundary/internal/proto/controller/api/resources/roles/v1/role.proto

// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: MPL-2.0

syntax = "proto3";

package controller.api.resources.roles.v1;

import "controller/api/resources/scopes/v1/scope.proto";
import "controller/custom_options/v1/options.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/wrappers.proto";

option go_package = "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/roles;roles";

message Principal {
  // Output only. The ID of the principal.
  string id = 1; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The type of the principal.
  string type = 2; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The Scope of the principal.
  string scope_id = 3 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`
}

message GrantJson {
  // Output only. The ID, if set.
  // Deprecated: use "ids" instead.
  string id = 1 [deprecated = true]; // @gotags: `class:"public"`

  // Output only. The IDs, if set.
  repeated string ids = 4; // @gotags: `class:"public"`

  // Output only. The type, if set.
  string type = 2; // @gotags: `class:"public"`

  // Output only. The actions.
  repeated string actions = 3; // @gotags: `class:"public"`
}

message Grant {
  // Output only. The original user-supplied string.
  string raw = 1; // @gotags: `class:"public"`

  // Output only. The canonically-formatted string.
  string canonical = 2; // @gotags: `class:"public"`

  // Output only. The JSON representation of the grant.
  GrantJson json = 3;
}

// Role contains all fields related to a Role resource
message Role {
  // Output only. The ID of the Role.
  string id = 10; // @gotags: `class:"public" eventstream:"observation"`

  // The ID of the Scope containing this Role.
  string scope_id = 20 [json_name = "scope_id"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. Scope information for this resource.
  resources.scopes.v1.ScopeInfo scope = 30;

  // Optional name for identification purposes.
  google.protobuf.StringValue name = 40 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "name"
      that: "name"
    }
  ]; // @gotags: `class:"public"`

  // Optional user-set description for identification purposes.
  google.protobuf.StringValue description = 50 [
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "description"
      that: "description"
    }
  ]; // @gotags: `class:"public"`

  // Output only. The time this resource was created.
  google.protobuf.Timestamp created_time = 60 [json_name = "created_time"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The time this resource was last updated.
  google.protobuf.Timestamp updated_time = 70 [json_name = "updated_time"]; // @gotags: `class:"public" eventstream:"observation"`

  // Version is used in mutation requests, after the initial creation, to ensure this resource has not changed.
  // The mutation will fail if the version does not match the latest known good version.
  uint32 version = 80; // @gotags: `class:"public"`

  // The Scope the grants will apply to. If the Role is at the global scope, this can be an org or project. If the Role is at an org scope, this can be a project within the org. It is invalid for this to be anything other than the Role's scope when the Role's scope is a project.
  google.protobuf.StringValue grant_scope_id = 90 [
    json_name = "grant_scope_id",
    (custom_options.v1.generate_sdk_option) = true,
    (custom_options.v1.mask_mapping) = {
      this: "grant_scope_id"
      that: "GrantScopeId"
    }
  ]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The IDs (only) of principals that are assigned to this role.
  repeated string principal_ids = 100 [json_name = "principal_ids"]; // @gotags: `class:"public" eventstream:"observation"`

  // Output only. The principals that are assigned to this role.
  repeated Principal principals = 110;

  // Output only. The grants that this role provides for its principals.
  repeated string grant_strings = 120 [json_name = "grant_strings"]; // @gotags: `class:"public"`

  // Output only. The parsed grant information.
  repeated Grant grants = 130;

  // Output only. The available actions on this resource for this user.
  repeated string authorized_actions = 300 [json_name = "authorized_actions"]; // @gotags: `class:"public"`
}