google-cloud-policy_simulator-v1 0.a → 0.1.0

data/proto_docs/google/api/resource.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Api
+    # A simple descriptor of a resource type.
+    #
+    # ResourceDescriptor annotates a resource message (either by means of a
+    # protobuf annotation or use in the service config), and associates the
+    # resource's schema, the resource type, and the pattern of the resource name.
+    #
+    # Example:
+    #
+    #     message Topic {
+    #       // Indicates this message defines a resource schema.
+    #       // Declares the resource type in the format of {service}/{kind}.
+    #       // For Kubernetes resources, the format is {api group}/{kind}.
+    #       option (google.api.resource) = {
+    #         type: "pubsub.googleapis.com/Topic"
+    #         pattern: "projects/{project}/topics/{topic}"
+    #       };
+    #     }
+    #
+    # The ResourceDescriptor Yaml config will look like:
+    #
+    #     resources:
+    #     - type: "pubsub.googleapis.com/Topic"
+    #       pattern: "projects/{project}/topics/{topic}"
+    #
+    # Sometimes, resources have multiple patterns, typically because they can
+    # live under multiple parents.
+    #
+    # Example:
+    #
+    #     message LogEntry {
+    #       option (google.api.resource) = {
+    #         type: "logging.googleapis.com/LogEntry"
+    #         pattern: "projects/{project}/logs/{log}"
+    #         pattern: "folders/{folder}/logs/{log}"
+    #         pattern: "organizations/{organization}/logs/{log}"
+    #         pattern: "billingAccounts/{billing_account}/logs/{log}"
+    #       };
+    #     }
+    #
+    # The ResourceDescriptor Yaml config will look like:
+    #
+    #     resources:
+    #     - type: 'logging.googleapis.com/LogEntry'
+    #       pattern: "projects/{project}/logs/{log}"
+    #       pattern: "folders/{folder}/logs/{log}"
+    #       pattern: "organizations/{organization}/logs/{log}"
+    #       pattern: "billingAccounts/{billing_account}/logs/{log}"
+    # @!attribute [rw] type
+    #   @return [::String]
+    #     The resource type. It must be in the format of
+    #     \\{service_name}/\\{resource_type_kind}. The `resource_type_kind` must be
+    #     singular and must not include version numbers.
+    #
+    #     Example: `storage.googleapis.com/Bucket`
+    #
+    #     The value of the resource_type_kind must follow the regular expression
+    #     /[A-Za-z][a-zA-Z0-9]+/. It should start with an upper case character and
+    #     should use PascalCase (UpperCamelCase). The maximum number of
+    #     characters allowed for the `resource_type_kind` is 100.
+    # @!attribute [rw] pattern
+    #   @return [::Array<::String>]
+    #     Optional. The relative resource name pattern associated with this resource
+    #     type. The DNS prefix of the full resource name shouldn't be specified here.
+    #
+    #     The path pattern must follow the syntax, which aligns with HTTP binding
+    #     syntax:
+    #
+    #         Template = Segment { "/" Segment } ;
+    #         Segment = LITERAL | Variable ;
+    #         Variable = "{" LITERAL "}" ;
+    #
+    #     Examples:
+    #
+    #         - "projects/\\{project}/topics/\\{topic}"
+    #         - "projects/\\{project}/knowledgeBases/\\{knowledge_base}"
+    #
+    #     The components in braces correspond to the IDs for each resource in the
+    #     hierarchy. It is expected that, if multiple patterns are provided,
+    #     the same component name (e.g. "project") refers to IDs of the same
+    #     type of resource.
+    # @!attribute [rw] name_field
+    #   @return [::String]
+    #     Optional. The field on the resource that designates the resource name
+    #     field. If omitted, this is assumed to be "name".
+    # @!attribute [rw] history
+    #   @return [::Google::Api::ResourceDescriptor::History]
+    #     Optional. The historical or future-looking state of the resource pattern.
+    #
+    #     Example:
+    #
+    #         // The InspectTemplate message originally only supported resource
+    #         // names with organization, and project was added later.
+    #         message InspectTemplate {
+    #           option (google.api.resource) = {
+    #             type: "dlp.googleapis.com/InspectTemplate"
+    #             pattern:
+    #             "organizations/{organization}/inspectTemplates/{inspect_template}"
+    #             pattern: "projects/{project}/inspectTemplates/{inspect_template}"
+    #             history: ORIGINALLY_SINGLE_PATTERN
+    #           };
+    #         }
+    # @!attribute [rw] plural
+    #   @return [::String]
+    #     The plural name used in the resource name and permission names, such as
+    #     'projects' for the resource name of 'projects/\\{project}' and the permission
+    #     name of 'cloudresourcemanager.googleapis.com/projects.get'. It is the same
+    #     concept of the `plural` field in k8s CRD spec
+    #     https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
+    #
+    #     Note: The plural form is required even for singleton resources. See
+    #     https://aip.dev/156
+    # @!attribute [rw] singular
+    #   @return [::String]
+    #     The same concept of the `singular` field in k8s CRD spec
+    #     https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
+    #     Such as "project" for the `resourcemanager.googleapis.com/Project` type.
+    # @!attribute [rw] style
+    #   @return [::Array<::Google::Api::ResourceDescriptor::Style>]
+    #     Style flag(s) for this resource.
+    #     These indicate that a resource is expected to conform to a given
+    #     style. See the specific style flags for additional information.
+    class ResourceDescriptor
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+
+      # A description of the historical or future-looking state of the
+      # resource pattern.
+      module History
+        # The "unset" value.
+        HISTORY_UNSPECIFIED = 0
+
+        # The resource originally had one pattern and launched as such, and
+        # additional patterns were added later.
+        ORIGINALLY_SINGLE_PATTERN = 1
+
+        # The resource has one pattern, but the API owner expects to add more
+        # later. (This is the inverse of ORIGINALLY_SINGLE_PATTERN, and prevents
+        # that from being necessary once there are multiple patterns.)
+        FUTURE_MULTI_PATTERN = 2
+      end
+
+      # A flag representing a specific style that a resource claims to conform to.
+      module Style
+        # The unspecified value. Do not use.
+        STYLE_UNSPECIFIED = 0
+
+        # This resource is intended to be "declarative-friendly".
+        #
+        # Declarative-friendly resources must be more strictly consistent, and
+        # setting this to true communicates to tools that this resource should
+        # adhere to declarative-friendly expectations.
+        #
+        # Note: This is used by the API linter (linter.aip.dev) to enable
+        # additional checks.
+        DECLARATIVE_FRIENDLY = 1
+      end
+    end
+
+    # Defines a proto annotation that describes a string field that refers to
+    # an API resource.
+    # @!attribute [rw] type
+    #   @return [::String]
+    #     The resource type that the annotated field references.
+    #
+    #     Example:
+    #
+    #         message Subscription {
+    #           string topic = 2 [(google.api.resource_reference) = {
+    #             type: "pubsub.googleapis.com/Topic"
+    #           }];
+    #         }
+    #
+    #     Occasionally, a field may reference an arbitrary resource. In this case,
+    #     APIs use the special value * in their resource reference.
+    #
+    #     Example:
+    #
+    #         message GetIamPolicyRequest {
+    #           string resource = 2 [(google.api.resource_reference) = {
+    #             type: "*"
+    #           }];
+    #         }
+    # @!attribute [rw] child_type
+    #   @return [::String]
+    #     The resource type of a child collection that the annotated field
+    #     references. This is useful for annotating the `parent` field that
+    #     doesn't have a fixed resource type.
+    #
+    #     Example:
+    #
+    #         message ListLogEntriesRequest {
+    #           string parent = 1 [(google.api.resource_reference) = {
+    #             child_type: "logging.googleapis.com/LogEntry"
+    #           };
+    #         }
+    class ResourceReference
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+    end
+  end
+end

data/proto_docs/google/cloud/policysimulator/v1/explanations.rb

@@ -0,0 +1,277 @@
+# frozen_string_literal: true
+
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module PolicySimulator
+      module V1
+        # Information about the principal, resource, and permission to check.
+        # @!attribute [rw] principal
+        #   @return [::String]
+        #     Required. The principal whose access you want to check, in the form of
+        #     the email address that represents that principal. For example,
+        #     `alice@example.com` or
+        #     `my-service-account@my-project.iam.gserviceaccount.com`.
+        #
+        #     The principal must be a Google Account or a service account. Other types of
+        #     principals are not supported.
+        # @!attribute [rw] full_resource_name
+        #   @return [::String]
+        #     Required. The full resource name that identifies the resource. For example,
+        #     `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
+        #
+        #     For examples of full resource names for Google Cloud services, see
+        #     https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
+        # @!attribute [rw] permission
+        #   @return [::String]
+        #     Required. The IAM permission to check for the specified principal and
+        #     resource.
+        #
+        #     For a complete list of IAM permissions, see
+        #     https://cloud.google.com/iam/help/permissions/reference.
+        #
+        #     For a complete list of predefined IAM roles and the permissions in each
+        #     role, see https://cloud.google.com/iam/help/roles/reference.
+        class AccessTuple
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Details about how a specific IAM {::Google::Iam::V1::Policy Policy} contributed
+        # to the access check.
+        # @!attribute [rw] access
+        #   @return [::Google::Cloud::PolicySimulator::V1::AccessState]
+        #     Indicates whether _this policy_ provides the specified permission to the
+        #     specified principal for the specified resource.
+        #
+        #     This field does _not_ indicate whether the principal actually has the
+        #     permission for the resource. There might be another policy that overrides
+        #     this policy. To determine whether the principal actually has the
+        #     permission, use the `access` field in the
+        #     [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].
+        # @!attribute [rw] full_resource_name
+        #   @return [::String]
+        #     The full resource name that identifies the resource. For example,
+        #     `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
+        #
+        #     If the user who created the
+        #     {::Google::Cloud::PolicySimulator::V1::Replay Replay} does not have
+        #     access to the policy, this field is omitted.
+        #
+        #     For examples of full resource names for Google Cloud services, see
+        #     https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
+        # @!attribute [rw] policy
+        #   @return [::Google::Iam::V1::Policy]
+        #     The IAM policy attached to the resource.
+        #
+        #     If the user who created the
+        #     {::Google::Cloud::PolicySimulator::V1::Replay Replay} does not have
+        #     access to the policy, this field is empty.
+        # @!attribute [rw] binding_explanations
+        #   @return [::Array<::Google::Cloud::PolicySimulator::V1::BindingExplanation>]
+        #     Details about how each binding in the policy affects the principal's
+        #     ability, or inability, to use the permission for the resource.
+        #
+        #     If the user who created the
+        #     {::Google::Cloud::PolicySimulator::V1::Replay Replay} does not have
+        #     access to the policy, this field is omitted.
+        # @!attribute [rw] relevance
+        #   @return [::Google::Cloud::PolicySimulator::V1::HeuristicRelevance]
+        #     The relevance of this policy to the overall determination in the
+        #     [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].
+        #
+        #     If the user who created the
+        #     {::Google::Cloud::PolicySimulator::V1::Replay Replay} does not have
+        #     access to the policy, this field is omitted.
+        class ExplainedPolicy
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Details about how a binding in a policy affects a principal's ability to use
+        # a permission.
+        # @!attribute [rw] access
+        #   @return [::Google::Cloud::PolicySimulator::V1::AccessState]
+        #     Required. Indicates whether _this binding_ provides the specified
+        #     permission to the specified principal for the specified resource.
+        #
+        #     This field does _not_ indicate whether the principal actually has the
+        #     permission for the resource. There might be another binding that overrides
+        #     this binding. To determine whether the principal actually has the
+        #     permission, use the `access` field in the
+        #     [TroubleshootIamPolicyResponse][IamChecker.TroubleshootIamPolicyResponse].
+        # @!attribute [rw] role
+        #   @return [::String]
+        #     The role that this binding grants. For example,
+        #     `roles/compute.serviceAgent`.
+        #
+        #     For a complete list of predefined IAM roles, as well as the permissions in
+        #     each role, see https://cloud.google.com/iam/help/roles/reference.
+        # @!attribute [rw] role_permission
+        #   @return [::Google::Cloud::PolicySimulator::V1::BindingExplanation::RolePermission]
+        #     Indicates whether the role granted by this binding contains the specified
+        #     permission.
+        # @!attribute [rw] role_permission_relevance
+        #   @return [::Google::Cloud::PolicySimulator::V1::HeuristicRelevance]
+        #     The relevance of the permission's existence, or nonexistence, in the role
+        #     to the overall determination for the entire policy.
+        # @!attribute [rw] memberships
+        #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::PolicySimulator::V1::BindingExplanation::AnnotatedMembership}]
+        #     Indicates whether each principal in the binding includes the principal
+        #     specified in the request, either directly or indirectly. Each key
+        #     identifies a principal in the binding, and each value indicates whether the
+        #     principal in the binding includes the principal in the request.
+        #
+        #     For example, suppose that a binding includes the following principals:
+        #
+        #     * `user:alice@example.com`
+        #     * `group:product-eng@example.com`
+        #
+        #     The principal in the replayed access tuple is `user:bob@example.com`. This
+        #     user is a principal of the group `group:product-eng@example.com`.
+        #
+        #     For the first principal in the binding, the key is
+        #     `user:alice@example.com`, and the `membership` field in the value is set to
+        #     `MEMBERSHIP_NOT_INCLUDED`.
+        #
+        #     For the second principal in the binding, the key is
+        #     `group:product-eng@example.com`, and the `membership` field in the value is
+        #     set to `MEMBERSHIP_INCLUDED`.
+        # @!attribute [rw] relevance
+        #   @return [::Google::Cloud::PolicySimulator::V1::HeuristicRelevance]
+        #     The relevance of this binding to the overall determination for the entire
+        #     policy.
+        # @!attribute [rw] condition
+        #   @return [::Google::Type::Expr]
+        #     A condition expression that prevents this binding from granting access
+        #     unless the expression evaluates to `true`.
+        #
+        #     To learn about IAM Conditions, see
+        #     https://cloud.google.com/iam/docs/conditions-overview.
+        class BindingExplanation
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # Details about whether the binding includes the principal.
+          # @!attribute [rw] membership
+          #   @return [::Google::Cloud::PolicySimulator::V1::BindingExplanation::Membership]
+          #     Indicates whether the binding includes the principal.
+          # @!attribute [rw] relevance
+          #   @return [::Google::Cloud::PolicySimulator::V1::HeuristicRelevance]
+          #     The relevance of the principal's status to the overall determination for
+          #     the binding.
+          class AnnotatedMembership
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # @!attribute [rw] key
+          #   @return [::String]
+          # @!attribute [rw] value
+          #   @return [::Google::Cloud::PolicySimulator::V1::BindingExplanation::AnnotatedMembership]
+          class MembershipsEntry
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # Whether a role includes a specific permission.
+          module RolePermission
+            # Default value. This value is unused.
+            ROLE_PERMISSION_UNSPECIFIED = 0
+
+            # The permission is included in the role.
+            ROLE_PERMISSION_INCLUDED = 1
+
+            # The permission is not included in the role.
+            ROLE_PERMISSION_NOT_INCLUDED = 2
+
+            # The user who created the
+            # {::Google::Cloud::PolicySimulator::V1::Replay Replay} is not
+            # allowed to access the binding.
+            ROLE_PERMISSION_UNKNOWN_INFO_DENIED = 3
+          end
+
+          # Whether the binding includes the principal.
+          module Membership
+            # Default value. This value is unused.
+            MEMBERSHIP_UNSPECIFIED = 0
+
+            # The binding includes the principal. The principal can be included
+            # directly or indirectly. For example:
+            #
+            # * A principal is included directly if that principal is listed in the
+            #   binding.
+            # * A principal is included indirectly if that principal is in a Google
+            #   group or Google Workspace domain that is listed in the binding.
+            MEMBERSHIP_INCLUDED = 1
+
+            # The binding does not include the principal.
+            MEMBERSHIP_NOT_INCLUDED = 2
+
+            # The user who created the
+            # {::Google::Cloud::PolicySimulator::V1::Replay Replay} is not
+            # allowed to access the binding.
+            MEMBERSHIP_UNKNOWN_INFO_DENIED = 3
+
+            # The principal is an unsupported type. Only Google Accounts and service
+            # accounts are supported.
+            MEMBERSHIP_UNKNOWN_UNSUPPORTED = 4
+          end
+        end
+
+        # Whether a principal has a permission for a resource.
+        module AccessState
+          # Default value. This value is unused.
+          ACCESS_STATE_UNSPECIFIED = 0
+
+          # The principal has the permission.
+          GRANTED = 1
+
+          # The principal does not have the permission.
+          NOT_GRANTED = 2
+
+          # The principal has the permission only if a condition expression evaluates
+          # to `true`.
+          UNKNOWN_CONDITIONAL = 3
+
+          # The user who created the
+          # {::Google::Cloud::PolicySimulator::V1::Replay Replay} does not have
+          # access to all of the policies that Policy Simulator needs to evaluate.
+          UNKNOWN_INFO_DENIED = 4
+        end
+
+        # The extent to which a single data point, such as the existence of a binding
+        # or whether a binding includes a specific principal, contributes to an overall
+        # determination.
+        module HeuristicRelevance
+          # Default value. This value is unused.
+          HEURISTIC_RELEVANCE_UNSPECIFIED = 0
+
+          # The data point has a limited effect on the result. Changing the data point
+          # is unlikely to affect the overall determination.
+          NORMAL = 1
+
+          # The data point has a strong effect on the result. Changing the data point
+          # is likely to affect the overall determination.
+          HIGH = 2
+        end
+      end
+    end
+  end
+end