@origincloud/iam 0.0.0-stage → 0.6.0

package/dist/v1beta1/service_account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service_account.js","sourceRoot":"","sources":["../../src/v1beta1/service_account.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,wDAAwD;AAExD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;;OAGG;IACM,OAAO,CAAU;IAE1B,+EAA+E;IAC/E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,OAAmC,EAAE,OAAqB;QAClF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,kBAAkB,CAAC,OAAmC,EAAE,OAAqB;QAClF,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/D,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAqB;QACpF,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,kBAAkB;YACtC,IAAI,EAAE,OAAO,CAAC,cAAc;YAC5B,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACnD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAqB;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;SAChC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF;AAkCD,qDAAqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,eAAe;IACf,iBAAiB,EAAE,mBAAmB;IACtC,kCAAkC;IAClC,MAAM,EAAE,QAAQ;IAChB,wEAAwE;IACxE,OAAO,EAAE,SAAS;CACV,CAAC"}

package/dist/v1beta1/user.d.ts

@@ -0,0 +1,50 @@
+import { type CallOptions, type Client, type Service } from "@origincloud/core";
+/**
+ * Calls UserService.
+ *
+ * The signed-in user. Each user can read only their own profile, by the
+ * name `users/me` or by their own id; the role bindings they hold are
+ * listed by ListRoleBindings with the parent `organizations/-`.
+ */
+export declare class UserClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    readonly service: Service;
+    /** A client of UserService that sends its calls through `client`. */
+    constructor(client: Client);
+    /**
+     * Returns the caller's own profile. Any other user is `NOT_FOUND`; a
+     * service account caller is refused with `BAD_REQUEST`, having no
+     * profile.
+     */
+    getUser(request: GetUserRequest, options?: CallOptions): Promise<User>;
+}
+/** A person who signs in to the platform. */
+export interface User {
+    /**
+     * The user's resource name, `users/{user}`, with their id; never
+     * `users/me`.
+     */
+    name?: string;
+    /**
+     * How a role binding shows the user: `user:{email}` once `email` is
+     * verified, `userId:{user}` until then.
+     */
+    member?: string;
+    /** The email address the user signs in with. */
+    email?: string;
+    /** Whether the user has confirmed `email`. */
+    emailVerified?: boolean;
+    /** The user's given name; empty when they haven't set one. */
+    givenName?: string;
+    /** The user's family name; empty when they haven't set one. */
+    familyName?: string;
+}
+/** The request for GetUser. */
+export interface GetUserRequest {
+    /** The user to return: `users/me`, or the caller's own `users/{user}`. */
+    name?: string;
+}
+//# sourceMappingURL=user.d.ts.map

package/dist/v1beta1/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,qEAAqE;gBACzD,MAAM,EAAE,MAAM;IAI1B;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAY7E;AAED,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/v1beta1/user.js

@@ -0,0 +1,36 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/user.proto
+import { pathValue, query } from "@origincloud/core";
+/**
+ * Calls UserService.
+ *
+ * The signed-in user. Each user can read only their own profile, by the
+ * name `users/me` or by their own id; the role bindings they hold are
+ * listed by ListRoleBindings with the parent `organizations/-`.
+ */
+export class UserClient {
+    /**
+     * The endpoint the client sends its calls to, which also serves the
+     * operations its methods answer with.
+     */
+    service;
+    /** A client of UserService that sends its calls through `client`. */
+    constructor(client) {
+        this.service = client.service("iam", false);
+    }
+    /**
+     * Returns the caller's own profile. Any other user is `NOT_FOUND`; a
+     * service account caller is refused with `BAD_REQUEST`, having no
+     * profile.
+     */
+    async getUser(request, options) {
+        const p0 = pathValue("name", request.name, "users/*");
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/${p0}`,
+            query: query(request, ["name"]),
+            idempotent: true,
+        }, options);
+    }
+}
+//# sourceMappingURL=user.js.map

package/dist/v1beta1/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6CAA6C;AAE7C,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACrB;;;OAGG;IACM,OAAO,CAAU;IAE1B,qEAAqE;IACrE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,OAAqB;QAC1D,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@origincloud/iam",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.6.0",
+  "description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/origincloudhq/sdk-typescript.git",
+    "directory": "packages/iam"
+  },
+  "bugs": "https://github.com/origincloudhq/sdk-typescript/issues",
+  "keywords": [
+    "origincloud",
+    "origin-cloud",
+    "sdk",
+    "iam"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "exports": {
+    "./*": {
+      "types": "./dist/*/index.d.ts",
+      "default": "./dist/*/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!dist/**/*.tsbuildinfo"
+  ],
+  "peerDependencies": {
+    "@origincloud/core": "^0.6.0"
+  },
+  "devDependencies": {
+    "@origincloud/core": "^0.6.0"
+  }
+}

package/src/v1beta1/audit_log.ts

@@ -0,0 +1,180 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/audit_log.proto
+
+import { type CallOptions, type Client, type Service, pathValue, query } from "@origincloud/core";
+
+/**
+ * Calls AuditLogService.
+ *
+ * An organization's audit log: a record of each change to who may do what
+ * in it, written when the change is made and never changed afterwards.
+ * It records role bindings created and deleted, members removed, invites
+ * created and deleted, and service accounts created and deleted.
+ *
+ * This API serves a recent window of the log, 90 days unless the platform
+ * sets it longer: a list says where its window starts in
+ * `windowStartTime`, and an older entry is `NOT_FOUND` here.
+ */
+export class AuditLogClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of AuditLogService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /**
+   * Returns an audit log entry. Needs `iam.audit_log.list` on the
+   * organization.
+   */
+  async getAuditLogEntry(request: GetAuditLogEntryRequest, options?: CallOptions): Promise<AuditLogEntry> {
+    const p0 = pathValue("name", request.name, "organizations/*/auditLogEntries/*");
+    return this.service.call<AuditLogEntry>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists an organization's audit log entries, most recent first,
+   * optionally only a project's, an actor's or an action's. Needs
+   * `iam.audit_log.list` on the organization.
+   */
+  async listAuditLogEntries(request: ListAuditLogEntriesRequest, options?: CallOptions): Promise<ListAuditLogEntriesResponse> {
+    const p0 = pathValue("parent", request.parent, "organizations/*");
+    return this.service.call<ListAuditLogEntriesResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}/auditLogEntries`,
+        query: query(request, ["parent"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Iterates over everything listAuditLogEntries lists from the request's page on,
+   * fetching the next page as the loop reaches it. A page that fails ends
+   * the iteration with its error.
+   */
+  async *allAuditLogEntries(request: ListAuditLogEntriesRequest, options?: CallOptions): AsyncGenerator<AuditLogEntry, void, undefined> {
+    for (let page = request; ; ) {
+      const response = await this.listAuditLogEntries(page, options);
+      yield* response.auditLogEntries ?? [];
+      if (!response.nextPageToken) return;
+      page = { ...page, pageToken: response.nextPageToken };
+    }
+  }
+}
+
+/** One recorded change. */
+export interface AuditLogEntry {
+  /** The entry's resource name. */
+  name?: string;
+  /**
+   * The project the change was limited to, `projects/{project}`; empty for
+   * a change to the whole organization.
+   */
+  project?: string;
+  /**
+   * Who made the change, as it was when the change was made:
+   * `user:{email}` with the verified address the account had then,
+   * `userId:{user}` when none was recorded, `serviceAccount:{service_account}`,
+   * or `platform` for a change the platform made itself. A later change of
+   * address doesn't change it.
+   */
+  actor?: string;
+  /**
+   * What was done, as a permission key names it, such as
+   * `iam.role.assign`.
+   */
+  action?: string;
+  /**
+   * What it was done to, written as `actor` is, or the email address
+   * invited; empty when the action has no target.
+   */
+  target?: string;
+  /** Whether the change was made. */
+  outcome?: AuditLogEntry_Outcome;
+  /** When the change was made. */
+  occurTime?: string;
+  /**
+   * Details of the change that depend on the action, such as the `role`
+   * granted or a service account's `displayName`.
+   */
+  details?: Record<string, string>;
+}
+
+/** Whether the change was made. */
+export const AuditLogEntry_Outcome = {
+  /** Not set. */
+  OUTCOME_UNSPECIFIED: "OUTCOME_UNSPECIFIED",
+  /** It was made. */
+  SUCCEEDED: "SUCCEEDED",
+  /** It was refused for lack of a permission. */
+  DENIED: "DENIED",
+} as const;
+
+/** Whether the change was made. */
+export type AuditLogEntry_Outcome = (typeof AuditLogEntry_Outcome)[keyof typeof AuditLogEntry_Outcome];
+
+/** The request for GetAuditLogEntry. */
+export interface GetAuditLogEntryRequest {
+  /** The entry to return. */
+  name?: string;
+}
+
+/** The request for ListAuditLogEntries. */
+export interface ListAuditLogEntriesRequest {
+  /**
+   * The organization whose audit log to list,
+   * `organizations/{organization}`.
+   */
+  parent?: string;
+  /**
+   * Only the entries of changes limited to this project,
+   * `projects/{project}`. Every entry when empty.
+   */
+  project?: string;
+  /**
+   * Only the entries of changes made by this member's account,
+   * `user:{email}` or `serviceAccount:{service_account}`. Every actor's
+   * when empty.
+   */
+  actor?: string;
+  /**
+   * Only the entries of this action, such as `iam.role.assign`. Every
+   * action's when empty.
+   */
+  action?: string;
+  /**
+   * The most entries to return; the server clamps it, and 0 means its
+   * default.
+   */
+  pageSize?: number;
+  /** A previous response's `nextPageToken`, for the page after it. */
+  pageToken?: string;
+}
+
+/** The response for ListAuditLogEntries. */
+export interface ListAuditLogEntriesResponse {
+  /** The entries on this page, most recent first. */
+  auditLogEntries?: AuditLogEntry[];
+  /** The token for the next page; empty on the last one. */
+  nextPageToken?: string;
+  /**
+   * Where the window this API serves starts: entries older than it aren't
+   * listed.
+   */
+  windowStartTime?: string;
+}

package/src/v1beta1/index.ts

@@ -0,0 +1,8 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+
+export * from "./audit_log.js";
+export * from "./permission.js";
+export * from "./role.js";
+export * from "./role_binding.js";
+export * from "./service_account.js";
+export * from "./user.js";

package/src/v1beta1/permission.ts

@@ -0,0 +1,138 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/permission.proto
+
+import { type CallOptions, type Client, type Service, pathValue, query } from "@origincloud/core";
+
+/**
+ * Calls PermissionService.
+ *
+ * The catalog of permissions, and which of them a caller holds. A
+ * permission allows one action on one kind of resource, such as
+ * `pvs.volume.create`; roles bundle them. Reading the catalog needs no
+ * permission.
+ */
+export class PermissionClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of PermissionService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /** Returns a permission. */
+  async getPermission(request: GetPermissionRequest, options?: CallOptions): Promise<Permission> {
+    const p0 = pathValue("name", request.name, "permissions/*");
+    return this.service.call<Permission>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists every permission the platform checks, in catalog order,
+   * including those no predefined role grants by default, such as the
+   * billing account permissions.
+   */
+  async listPermissions(request: ListPermissionsRequest, options?: CallOptions): Promise<ListPermissionsResponse> {
+    return this.service.call<ListPermissionsResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/permissions`,
+        query: query(request, []),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Returns the subset of `permissions` the caller holds on an organization
+   * or a project. A permission held on the organization counts for each of
+   * its projects; one held on a project counts only there. Every resource
+   * in a project is governed by the project's permissions, so asking about
+   * the project answers for each of its resources. A permission the
+   * catalog doesn't name is never held.
+   */
+  async testIamPermissions(request: TestIamPermissionsRequest, options?: CallOptions): Promise<TestIamPermissionsResponse> {
+    const p0 = pathValue("resource", request.resource, "*/*");
+    return this.service.call<TestIamPermissionsResponse>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}:testIamPermissions`,
+        body: request,
+        idempotent: true,
+      },
+      options,
+    );
+  }
+}
+
+/** One action on one kind of resource, which a role grants. */
+export interface Permission {
+  /**
+   * The permission's resource name, `permissions/{service}.{resource}.{action}`,
+   * such as `permissions/pvs.volume.create`.
+   */
+  name?: string;
+  /**
+   * The permission's URN, the identifier access policies and the audit log
+   * use.
+   */
+  urn?: string;
+  /** The service whose API checks it, such as `pvs`. */
+  service?: string;
+  /** The kind of resource it applies to, such as `volume`. */
+  resourceType?: string;
+  /** The action it allows, such as `create`. */
+  action?: string;
+}
+
+/** The request for GetPermission. */
+export interface GetPermissionRequest {
+  /** The permission to return, `permissions/{permission}`. */
+  name?: string;
+}
+
+/**
+ * The request for ListPermissions. The catalog is bounded, so it comes in
+ * one page.
+ */
+export interface ListPermissionsRequest {}
+
+/** The response for ListPermissions. */
+export interface ListPermissionsResponse {
+  /** Every permission, in catalog order. */
+  permissions?: Permission[];
+}
+
+/** The request for TestIamPermissions. */
+export interface TestIamPermissionsRequest {
+  /**
+   * The organization, `organizations/{organization}`, or the project,
+   * `projects/{project}`, to test the permissions on.
+   */
+  resource?: string;
+  /**
+   * The permissions to test, by their keys, such as `pvs.volume.create`;
+   * at most 100.
+   */
+  permissions?: string[];
+}
+
+/** The response for TestIamPermissions. */
+export interface TestIamPermissionsResponse {
+  /**
+   * The permissions of the request the caller holds on the resource, in the
+   * order they were asked for.
+   */
+  permissions?: string[];
+}

package/src/v1beta1/role.ts

@@ -0,0 +1,87 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/role.proto
+
+import { type CallOptions, type Client, type Service, pathValue, query } from "@origincloud/core";
+
+/**
+ * Calls RoleService.
+ *
+ * The catalog of predefined roles. A role is a named set of permissions; a
+ * role binding grants one to a principal in an organization or in one of
+ * its projects. The same for every caller: any authenticated caller can
+ * read it, and no permission is needed.
+ */
+export class RoleClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of RoleService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /** Returns a role. */
+  async getRole(request: GetRoleRequest, options?: CallOptions): Promise<Role> {
+    const p0 = pathValue("name", request.name, "roles/*");
+    return this.service.call<Role>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /** Lists every predefined role, in catalog order. */
+  async listRoles(request: ListRolesRequest, options?: CallOptions): Promise<ListRolesResponse> {
+    return this.service.call<ListRolesResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/roles`,
+        query: query(request, []),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+}
+
+/** A predefined role: a named set of permissions that a role binding grants. */
+export interface Role {
+  /**
+   * The role's resource name, such as `roles/owner`, `roles/viewer` or
+   * `roles/billing.administrator`. A role binding names its role by it.
+   */
+  name?: string;
+  /** The role's URN, the identifier access policies and the audit log use. */
+  urn?: string;
+  /** The name the console shows, such as `Owner`. */
+  displayName?: string;
+  /** What holding the role allows, in a sentence. */
+  description?: string;
+  /**
+   * The permissions the role grants, `permissions/{permission}`, in
+   * catalog order.
+   */
+  includedPermissions?: string[];
+}
+
+/** The request for GetRole. */
+export interface GetRoleRequest {
+  /** The role to return, `roles/{role}`. */
+  name?: string;
+}
+
+/** The request for ListRoles. The catalog is small, so it comes in one page. */
+export interface ListRolesRequest {}
+
+/** The response for ListRoles. */
+export interface ListRolesResponse {
+  /** Every predefined role, in catalog order. */
+  roles?: Role[];
+}