@origincloud/iam 0.0.0-stage → 0.6.0

package/dist/v1beta1/role.d.ts

@@ -0,0 +1,55 @@
+import { type CallOptions, type Client, type Service } from "@origincloud/core";
+/**
+ * Calls RoleService.
+ *
+ * The catalog of predefined roles. A role is a named set of permissions; a
+ * role binding grants one to a principal in an organization or in one of
+ * its projects. The same for every caller: any authenticated caller can
+ * read it, and no permission is needed.
+ */
+export declare class RoleClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of RoleService that sends its calls through `client`. */
+    constructor(client: Client);
+    /** Returns a role. */
+    getRole(request: GetRoleRequest, options?: CallOptions): Promise<Role>;
+    /** Lists every predefined role, in catalog order. */
+    listRoles(request: ListRolesRequest, options?: CallOptions): Promise<ListRolesResponse>;
+}
+/** A predefined role: a named set of permissions that a role binding grants. */
+export interface Role {
+    /**
+     * The role's resource name, such as `roles/owner`, `roles/viewer` or
+     * `roles/billing.administrator`. A role binding names its role by it.
+     */
+    name?: string;
+    /** The role's URN, the identifier access policies and the audit log use. */
+    urn?: string;
+    /** The name the console shows, such as `Owner`. */
+    displayName?: string;
+    /** What holding the role allows, in a sentence. */
+    description?: string;
+    /**
+     * The permissions the role grants, `permissions/{permission}`, in
+     * catalog order.
+     */
+    includedPermissions?: string[];
+}
+/** The request for GetRole. */
+export interface GetRoleRequest {
+    /** The role to return, `roles/{role}`. */
+    name?: string;
+}
+/** The request for ListRoles. The catalog is small, so it comes in one page. */
+export interface ListRolesRequest {
+}
+/** The response for ListRoles. */
+export interface ListRolesResponse {
+    /** Every predefined role, in catalog order. */
+    roles?: Role[];
+}
+//# sourceMappingURL=role.d.ts.map

package/dist/v1beta1/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,qEAAqE;gBACzD,MAAM,EAAE,MAAM;IAI1B,sBAAsB;IAChB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAa5E,qDAAqD;IAC/C,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAW9F;AAED,gFAAgF;AAChF,MAAM,WAAW,IAAI;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;CAAG;AAEpC,kCAAkC;AAClC,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;CAChB"}

package/dist/v1beta1/role.js

@@ -0,0 +1,42 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/role.proto
+import { pathValue, query } from "@origincloud/core";
+/**
+ * Calls RoleService.
+ *
+ * The catalog of predefined roles. A role is a named set of permissions; a
+ * role binding grants one to a principal in an organization or in one of
+ * its projects. The same for every caller: any authenticated caller can
+ * read it, and no permission is needed.
+ */
+export class RoleClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of RoleService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("iam", false);
+    }
+    /** Returns a role. */
+    async getRole(request, options) {
+        const p0 = pathValue("name", request.name, "roles/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+    /** Lists every predefined role, in catalog order. */
+    async listRoles(request, options) {
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/roles`,
+            query: query(request, []),
+            idempotent: true,
+        }, options);
+    }
+}
+//# sourceMappingURL=role.js.map

package/dist/v1beta1/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../src/v1beta1/role.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6CAA6C;AAE7C,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACrB;;;OAGG;IACM,OAAO,CAAU;IAE1B,qEAAqE;IACrE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,sBAAsB;IACtB,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,OAAqB;QAC1D,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS,CAAC,OAAyB,EAAE,OAAqB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/v1beta1/role_binding.d.ts

@@ -0,0 +1,172 @@
+import { type CallOptions, type Client, type Empty, type Service } from "@origincloud/core";
+/**
+ * Calls RoleBindingService.
+ *
+ * Role bindings: each grants one role to one member, in a whole
+ * organization or in one of its projects. A member's access is the union
+ * of its bindings. Each binding is managed on its own, so creating or
+ * deleting one never touches another, whoever made it.
+ *
+ * A member is written as one of:
+ * - `user:{email}`: a user, by the verified email address of their
+ *   account. A binding holds on to the account, not the address: it
+ *   follows a later change of address, and is always shown with the
+ *   account's current one.
+ * - `serviceAccount:{service_account}`: a service account of the same
+ *   organization, by its id.
+ *
+ * and shown, never accepted, as:
+ * - `userId:{user}`: a user by the id of their account, when no verified
+ *   address can be shown: the account's current address isn't verified, or
+ *   the caller may only see their own bindings.
+ * - `deleted:user:{user}`: a user whose account no longer exists.
+ */
+export declare class RoleBindingClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of RoleBindingService that sends its calls through `client`. */
+    constructor(client: Client);
+    /** Returns a role binding. Needs `iam.member.list` on the organization. */
+    getRoleBinding(request: GetRoleBindingRequest, options?: CallOptions): Promise<RoleBinding>;
+    /**
+     * Lists an organization's role bindings, oldest first, optionally only a
+     * member's or a project's. Needs `iam.member.list` on the organization.
+     * With the parent `organizations/-` it lists the caller's own bindings in
+     * every organization and needs no permission; `member` must be empty
+     * there.
+     */
+    listRoleBindings(request: ListRoleBindingsRequest, options?: CallOptions): Promise<ListRoleBindingsResponse>;
+    /**
+     * Iterates over everything listRoleBindings lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    allRoleBindings(request: ListRoleBindingsRequest, options?: CallOptions): AsyncGenerator<RoleBinding, void, undefined>;
+    /**
+     * Grants a role to a member. Needs `iam.role.assign` on the
+     * organization, for a project binding as well, and every permission of
+     * the role at the binding's scope: a permission held on the organization
+     * counts for any scope, one held on a project only for that project.
+     * Refused with `NOT_FOUND` when no account has `member`'s address as its
+     * verified email: nothing is held for an address until its account
+     * exists. Refused with `CONFLICT` when the member already holds the role
+     * at that scope, and with `BAD_REQUEST` when the member is a deleted
+     * service account.
+     */
+    createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding>;
+    /**
+     * Removes a role binding. Needs `iam.role.revoke` on the organization
+     * and every permission of the role at the binding's scope, as
+     * CreateRoleBinding does. Refused with `CONFLICT`, removing nothing,
+     * when it is the organization's last organization-wide binding of
+     * `roles/owner`: bind another owner first.
+     */
+    deleteRoleBinding(request: DeleteRoleBindingRequest, options?: CallOptions): Promise<Empty>;
+}
+/**
+ * One role granted to one member, organization-wide or in one project. A
+ * binding can't be changed: delete it and create another.
+ */
+export interface RoleBinding {
+    /** The binding's resource name. */
+    name?: string;
+    /**
+     * The binding's URN, the identifier access policies and the audit log
+     * use.
+     */
+    urn?: string;
+    /**
+     * Who holds the role: `user:{email}` or
+     * `serviceAccount:{service_account}`. A user is shown with their
+     * account's current verified address, as `userId:{user}` when it has
+     * none, or as `deleted:user:{user}` once the account is gone.
+     */
+    member?: string;
+    /** The role granted, `roles/{role}`. */
+    role?: string;
+    /**
+     * The project the binding is limited to, `projects/{project}`, one of
+     * the organization's. Empty for a binding on the whole organization,
+     * which covers every project in it.
+     */
+    project?: string;
+    /**
+     * Who created the binding, written as a member is, or `platform` for a
+     * binding the platform made itself. Always `userId:{user}` for a user in
+     * a list of the caller's own bindings (`organizations/-`).
+     */
+    creator?: string;
+    /** When the binding was created. */
+    createTime?: string;
+}
+/** The request for GetRoleBinding. */
+export interface GetRoleBindingRequest {
+    /** The binding to return. */
+    name?: string;
+}
+/** The request for ListRoleBindings. */
+export interface ListRoleBindingsRequest {
+    /**
+     * The organization whose bindings to list, `organizations/{organization}`,
+     * or `organizations/-` for the caller's own bindings in every
+     * organization.
+     */
+    parent?: string;
+    /**
+     * Only the bindings of this member, `user:{email}` or
+     * `serviceAccount:{service_account}`. Every member's when empty.
+     */
+    member?: string;
+    /**
+     * Only the bindings limited to this project, `projects/{project}`. Every
+     * binding, organization-wide or not, when empty.
+     */
+    project?: string;
+    /**
+     * The most bindings to return; the server clamps it, and 0 means its
+     * default.
+     */
+    pageSize?: number;
+    /** A previous response's `nextPageToken`, for the page after it. */
+    pageToken?: string;
+}
+/** The response for ListRoleBindings. */
+export interface ListRoleBindingsResponse {
+    /** The bindings on this page. */
+    roleBindings?: RoleBinding[];
+    /** The token for the next page; empty on the last one. */
+    nextPageToken?: string;
+}
+/** The request for CreateRoleBinding. */
+export interface CreateRoleBindingRequest {
+    /**
+     * The organization to create the binding in,
+     * `organizations/{organization}`.
+     */
+    parent?: string;
+    /**
+     * The binding to create: its member and role, and optionally its
+     * project.
+     */
+    roleBinding?: RoleBinding;
+    /**
+     * A UUID. A repeat of the request with the same `requestId` within a
+     * day returns the binding the first request created, as it is now,
+     * instead of being refused as a conflict.
+     */
+    requestId?: string;
+}
+/** The request for DeleteRoleBinding. */
+export interface DeleteRoleBindingRequest {
+    /** The binding to delete. */
+    name?: string;
+    /**
+     * A UUID. A repeat of the request with the same `requestId` within a
+     * day succeeds as the first did, instead of answering `NOT_FOUND`.
+     */
+    requestId?: string;
+}
+//# sourceMappingURL=role_binding.d.ts.map

package/dist/v1beta1/role_binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAajG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAalH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;OAUG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAevG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAalG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/v1beta1/role_binding.js

@@ -0,0 +1,118 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/role_binding.proto
+import { newRequestId, pathValue, query, } from "@origincloud/core";
+/**
+ * Calls RoleBindingService.
+ *
+ * Role bindings: each grants one role to one member, in a whole
+ * organization or in one of its projects. A member's access is the union
+ * of its bindings. Each binding is managed on its own, so creating or
+ * deleting one never touches another, whoever made it.
+ *
+ * A member is written as one of:
+ * - `user:{email}`: a user, by the verified email address of their
+ *   account. A binding holds on to the account, not the address: it
+ *   follows a later change of address, and is always shown with the
+ *   account's current one.
+ * - `serviceAccount:{service_account}`: a service account of the same
+ *   organization, by its id.
+ *
+ * and shown, never accepted, as:
+ * - `userId:{user}`: a user by the id of their account, when no verified
+ *   address can be shown: the account's current address isn't verified, or
+ *   the caller may only see their own bindings.
+ * - `deleted:user:{user}`: a user whose account no longer exists.
+ */
+export class RoleBindingClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of RoleBindingService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("iam", false);
+    }
+    /** Returns a role binding. Needs `iam.member.list` on the organization. */
+    async getRoleBinding(request, options) {
+        const p0 = pathValue("name", request.name, "organizations/*/roleBindings/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Lists an organization's role bindings, oldest first, optionally only a
+     * member's or a project's. Needs `iam.member.list` on the organization.
+     * With the parent `organizations/-` it lists the caller's own bindings in
+     * every organization and needs no permission; `member` must be empty
+     * there.
+     */
+    async listRoleBindings(request, options) {
+        const p0 = pathValue("parent", request.parent, "organizations/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}/roleBindings`,
+            query: query(request, ["parent"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Iterates over everything listRoleBindings lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    async *allRoleBindings(request, options) {
+        for (let page = request;;) {
+            const response = await this.listRoleBindings(page, options);
+            yield* response.roleBindings ?? [];
+            if (!response.nextPageToken)
+                return;
+            page = { ...page, pageToken: response.nextPageToken };
+        }
+    }
+    /**
+     * Grants a role to a member. Needs `iam.role.assign` on the
+     * organization, for a project binding as well, and every permission of
+     * the role at the binding's scope: a permission held on the organization
+     * counts for any scope, one held on a project only for that project.
+     * Refused with `NOT_FOUND` when no account has `member`'s address as its
+     * verified email: nothing is held for an address until its account
+     * exists. Refused with `CONFLICT` when the member already holds the role
+     * at that scope, and with `BAD_REQUEST` when the member is a deleted
+     * service account.
+     */
+    async createRoleBinding(request, options) {
+        if (!request.requestId)
+            request = { ...request, requestId: newRequestId() };
+        const p0 = pathValue("parent", request.parent, "organizations/*");
+        return this.service.call({
+            method: "POST",
+            path: `/v1beta1/${p0}/roleBindings`,
+            body: request.roleBinding,
+            query: query(request, ["parent", "roleBinding"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Removes a role binding. Needs `iam.role.revoke` on the organization
+     * and every permission of the role at the binding's scope, as
+     * CreateRoleBinding does. Refused with `CONFLICT`, removing nothing,
+     * when it is the organization's last organization-wide binding of
+     * `roles/owner`: bind another owner first.
+     */
+    async deleteRoleBinding(request, options) {
+        if (!request.requestId)
+            request = { ...request, requestId: newRequestId() };
+        const p0 = pathValue("name", request.name, "organizations/*/roleBindings/*");
+        return this.service.call({
+            method: "DELETE",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+}
+//# sourceMappingURL=role_binding.js.map

package/dist/v1beta1/role_binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/v1beta1/service_account.d.ts

@@ -0,0 +1,146 @@
+import { type CallOptions, type Client, type Empty, type Service } from "@origincloud/core";
+/**
+ * Calls ServiceAccountService.
+ *
+ * Service accounts: an organization's credentials for software, which
+ * authenticate with the OAuth 2.0 client credentials grant and never log
+ * in interactively. A new service account holds no role: grant it one with
+ * a role binding on its `member`.
+ */
+export declare class ServiceAccountClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of ServiceAccountService that sends its calls through `client`. */
+    constructor(client: Client);
+    /**
+     * Returns a service account, deleted or not. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    getServiceAccount(request: GetServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount>;
+    /**
+     * Lists an organization's service accounts, oldest first. Deleted ones
+     * are listed only when `showDeleted` is set. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    listServiceAccounts(request: ListServiceAccountsRequest, options?: CallOptions): Promise<ListServiceAccountsResponse>;
+    /**
+     * Iterates over everything listServiceAccounts lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    allServiceAccounts(request: ListServiceAccountsRequest, options?: CallOptions): AsyncGenerator<ServiceAccount, void, undefined>;
+    /**
+     * Creates a service account and its client secret. The response is the
+     * only place the secret is ever shown: store it now. Needs
+     * `iam.service_account.create` on the organization.
+     */
+    createServiceAccount(request: CreateServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount>;
+    /**
+     * Deletes a service account for good: its credential is refused from
+     * then on, an access token it already holds is refused on its next
+     * request, and every role binding it holds, in any organization, is
+     * removed. It stays readable as `DELETED`. Deleting a deleted service
+     * account succeeds. Needs `iam.service_account.revoke` on the
+     * organization.
+     */
+    deleteServiceAccount(request: DeleteServiceAccountRequest, options?: CallOptions): Promise<Empty>;
+}
+/** A credential of an organization for software. */
+export interface ServiceAccount {
+    /** The service account's resource name. */
+    name?: string;
+    /** A name of your own, shown in the console; at most 100 characters. */
+    displayName?: string;
+    /**
+     * The member a role binding names it by,
+     * `serviceAccount:{service_account}`.
+     */
+    member?: string;
+    /** The OAuth 2.0 client id it authenticates with. */
+    clientId?: string;
+    /**
+     * The OAuth 2.0 client secret it authenticates with. Set only in the
+     * response that created the service account, and empty everywhere else:
+     * it can't be read again.
+     */
+    clientSecret?: string;
+    /** Where the service account is in its lifecycle. */
+    state?: ServiceAccount_State;
+    /**
+     * Who created the service account, written as a role binding's member
+     * is.
+     */
+    creator?: string;
+    /** When the service account was created. */
+    createTime?: string;
+    /** When the service account was deleted; unset while it is active. */
+    deleteTime?: string;
+}
+/** Where the service account is in its lifecycle. */
+export declare const ServiceAccount_State: {
+    /** Not set. */
+    readonly STATE_UNSPECIFIED: "STATE_UNSPECIFIED";
+    /** Its credential is accepted. */
+    readonly ACTIVE: "ACTIVE";
+    /** Deleted: its credential is refused, and it holds no role binding. */
+    readonly DELETED: "DELETED";
+};
+/** Where the service account is in its lifecycle. */
+export type ServiceAccount_State = (typeof ServiceAccount_State)[keyof typeof ServiceAccount_State];
+/** The request for GetServiceAccount. */
+export interface GetServiceAccountRequest {
+    /** The service account to return. */
+    name?: string;
+}
+/** The request for ListServiceAccounts. */
+export interface ListServiceAccountsRequest {
+    /**
+     * The organization whose service accounts to list,
+     * `organizations/{organization}`.
+     */
+    parent?: string;
+    /**
+     * The most service accounts to return; the server clamps it, and 0 means
+     * its default.
+     */
+    pageSize?: number;
+    /** A previous response's `nextPageToken`, for the page after it. */
+    pageToken?: string;
+    /** Whether deleted service accounts are listed too. */
+    showDeleted?: boolean;
+}
+/** The response for ListServiceAccounts. */
+export interface ListServiceAccountsResponse {
+    /** The service accounts on this page. */
+    serviceAccounts?: ServiceAccount[];
+    /** The token for the next page; empty on the last one. */
+    nextPageToken?: string;
+}
+/** The request for CreateServiceAccount. */
+export interface CreateServiceAccountRequest {
+    /**
+     * The organization to create the service account in,
+     * `organizations/{organization}`.
+     */
+    parent?: string;
+    /** The service account to create: its `displayName`. */
+    serviceAccount?: ServiceAccount;
+    /**
+     * A UUID. A repeat of the request with the same `requestId` within a
+     * day creates nothing and is refused with `CONFLICT`: the secret went to
+     * the first request only. The error's `ErrorInfo` metadata names the
+     * service account under `serviceAccount`; delete it and create a new one
+     * to get a working secret. The same `requestId` with a different
+     * request is refused with `CONFLICT` without that metadata.
+     */
+    requestId?: string;
+}
+/** The request for DeleteServiceAccount. */
+export interface DeleteServiceAccountRequest {
+    /** The service account to delete. */
+    name?: string;
+}
+//# sourceMappingURL=service_account.d.ts.map

package/dist/v1beta1/service_account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service_account.d.ts","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;GAOG;AACH,qBAAa,oBAAoB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,+EAA+E;gBACnE,MAAM,EAAE,MAAM;IAI1B;;;OAGG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAa1G;;;;OAIG;IACG,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAa3H;;;;OAIG;IACI,kBAAkB,CAAC,OAAO,EAAE,0BAA0B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC;IAStI;;;;OAIG;IACG,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;IAehH;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAWxG;AAED,oDAAoD;AACpD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,eAAO,MAAM,oBAAoB;IAC/B,eAAe;;IAEf,kCAAkC;;IAElC,wEAAwE;;CAEhE,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEpG,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,yCAAyC;IACzC,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC1C,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/v1beta1/service_account.js

@@ -0,0 +1,106 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/service_account.proto
+import { newRequestId, pathValue, query, } from "@origincloud/core";
+/**
+ * Calls ServiceAccountService.
+ *
+ * Service accounts: an organization's credentials for software, which
+ * authenticate with the OAuth 2.0 client credentials grant and never log
+ * in interactively. A new service account holds no role: grant it one with
+ * a role binding on its `member`.
+ */
+export class ServiceAccountClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of ServiceAccountService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("iam", false);
+    }
+    /**
+     * Returns a service account, deleted or not. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    async getServiceAccount(request, options) {
+        const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Lists an organization's service accounts, oldest first. Deleted ones
+     * are listed only when `showDeleted` is set. Needs
+     * `iam.service_account.list` on the organization.
+     */
+    async listServiceAccounts(request, options) {
+        const p0 = pathValue("parent", request.parent, "organizations/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}/serviceAccounts`,
+            query: query(request, ["parent"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Iterates over everything listServiceAccounts lists from the request's page on,
+     * fetching the next page as the loop reaches it. A page that fails ends
+     * the iteration with its error.
+     */
+    async *allServiceAccounts(request, options) {
+        for (let page = request;;) {
+            const response = await this.listServiceAccounts(page, options);
+            yield* response.serviceAccounts ?? [];
+            if (!response.nextPageToken)
+                return;
+            page = { ...page, pageToken: response.nextPageToken };
+        }
+    }
+    /**
+     * Creates a service account and its client secret. The response is the
+     * only place the secret is ever shown: store it now. Needs
+     * `iam.service_account.create` on the organization.
+     */
+    async createServiceAccount(request, options) {
+        if (!request.requestId)
+            request = { ...request, requestId: newRequestId() };
+        const p0 = pathValue("parent", request.parent, "organizations/*");
+        return this.service.call({
+            method: "POST",
+            path: `/v1beta1/${p0}/serviceAccounts`,
+            body: request.serviceAccount,
+            query: query(request, ["parent", "serviceAccount"]),
+            idempotent: true,
+        }, options);
+    }
+    /**
+     * Deletes a service account for good: its credential is refused from
+     * then on, an access token it already holds is refused on its next
+     * request, and every role binding it holds, in any organization, is
+     * removed. It stays readable as `DELETED`. Deleting a deleted service
+     * account succeeds. Needs `iam.service_account.revoke` on the
+     * organization.
+     */
+    async deleteServiceAccount(request, options) {
+        const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
+        return this.service.call({
+            method: "DELETE",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+        }, options);
+    }
+}
+/** Where the service account is in its lifecycle. */
+export const ServiceAccount_State = {
+    /** Not set. */
+    STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
+    /** Its credential is accepted. */
+    ACTIVE: "ACTIVE",
+    /** Deleted: its credential is refused, and it holds no role binding. */
+    DELETED: "DELETED",
+};
+//# sourceMappingURL=service_account.js.map