@origincloud/iam 0.0.0-stage → 0.6.0

package/src/v1beta1/role_binding.ts

@@ -0,0 +1,251 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/role_binding.proto
+
+import {
+  type CallOptions,
+  type Client,
+  type Empty,
+  type Service,
+  newRequestId,
+  pathValue,
+  query,
+} from "@origincloud/core";
+
+/**
+ * Calls RoleBindingService.
+ *
+ * Role bindings: each grants one role to one member, in a whole
+ * organization or in one of its projects. A member's access is the union
+ * of its bindings. Each binding is managed on its own, so creating or
+ * deleting one never touches another, whoever made it.
+ *
+ * A member is written as one of:
+ * - `user:{email}`: a user, by the verified email address of their
+ *   account. A binding holds on to the account, not the address: it
+ *   follows a later change of address, and is always shown with the
+ *   account's current one.
+ * - `serviceAccount:{service_account}`: a service account of the same
+ *   organization, by its id.
+ *
+ * and shown, never accepted, as:
+ * - `userId:{user}`: a user by the id of their account, when no verified
+ *   address can be shown: the account's current address isn't verified, or
+ *   the caller may only see their own bindings.
+ * - `deleted:user:{user}`: a user whose account no longer exists.
+ */
+export class RoleBindingClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of RoleBindingService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /** Returns a role binding. Needs `iam.member.list` on the organization. */
+  async getRoleBinding(request: GetRoleBindingRequest, options?: CallOptions): Promise<RoleBinding> {
+    const p0 = pathValue("name", request.name, "organizations/*/roleBindings/*");
+    return this.service.call<RoleBinding>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists an organization's role bindings, oldest first, optionally only a
+   * member's or a project's. Needs `iam.member.list` on the organization.
+   * With the parent `organizations/-` it lists the caller's own bindings in
+   * every organization and needs no permission; `member` must be empty
+   * there.
+   */
+  async listRoleBindings(request: ListRoleBindingsRequest, options?: CallOptions): Promise<ListRoleBindingsResponse> {
+    const p0 = pathValue("parent", request.parent, "organizations/*");
+    return this.service.call<ListRoleBindingsResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}/roleBindings`,
+        query: query(request, ["parent"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Iterates over everything listRoleBindings lists from the request's page on,
+   * fetching the next page as the loop reaches it. A page that fails ends
+   * the iteration with its error.
+   */
+  async *allRoleBindings(request: ListRoleBindingsRequest, options?: CallOptions): AsyncGenerator<RoleBinding, void, undefined> {
+    for (let page = request; ; ) {
+      const response = await this.listRoleBindings(page, options);
+      yield* response.roleBindings ?? [];
+      if (!response.nextPageToken) return;
+      page = { ...page, pageToken: response.nextPageToken };
+    }
+  }
+
+  /**
+   * Grants a role to a member. Needs `iam.role.assign` on the
+   * organization, for a project binding as well, and every permission of
+   * the role at the binding's scope: a permission held on the organization
+   * counts for any scope, one held on a project only for that project.
+   * Refused with `NOT_FOUND` when no account has `member`'s address as its
+   * verified email: nothing is held for an address until its account
+   * exists. Refused with `CONFLICT` when the member already holds the role
+   * at that scope, and with `BAD_REQUEST` when the member is a deleted
+   * service account.
+   */
+  async createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding> {
+    if (!request.requestId) request = { ...request, requestId: newRequestId() };
+    const p0 = pathValue("parent", request.parent, "organizations/*");
+    return this.service.call<RoleBinding>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}/roleBindings`,
+        body: request.roleBinding,
+        query: query(request, ["parent", "roleBinding"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Removes a role binding. Needs `iam.role.revoke` on the organization
+   * and every permission of the role at the binding's scope, as
+   * CreateRoleBinding does. Refused with `CONFLICT`, removing nothing,
+   * when it is the organization's last organization-wide binding of
+   * `roles/owner`: bind another owner first.
+   */
+  async deleteRoleBinding(request: DeleteRoleBindingRequest, options?: CallOptions): Promise<Empty> {
+    if (!request.requestId) request = { ...request, requestId: newRequestId() };
+    const p0 = pathValue("name", request.name, "organizations/*/roleBindings/*");
+    return this.service.call<Empty>(
+      {
+        method: "DELETE",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+}
+
+/**
+ * One role granted to one member, organization-wide or in one project. A
+ * binding can't be changed: delete it and create another.
+ */
+export interface RoleBinding {
+  /** The binding's resource name. */
+  name?: string;
+  /**
+   * The binding's URN, the identifier access policies and the audit log
+   * use.
+   */
+  urn?: string;
+  /**
+   * Who holds the role: `user:{email}` or
+   * `serviceAccount:{service_account}`. A user is shown with their
+   * account's current verified address, as `userId:{user}` when it has
+   * none, or as `deleted:user:{user}` once the account is gone.
+   */
+  member?: string;
+  /** The role granted, `roles/{role}`. */
+  role?: string;
+  /**
+   * The project the binding is limited to, `projects/{project}`, one of
+   * the organization's. Empty for a binding on the whole organization,
+   * which covers every project in it.
+   */
+  project?: string;
+  /**
+   * Who created the binding, written as a member is, or `platform` for a
+   * binding the platform made itself. Always `userId:{user}` for a user in
+   * a list of the caller's own bindings (`organizations/-`).
+   */
+  creator?: string;
+  /** When the binding was created. */
+  createTime?: string;
+}
+
+/** The request for GetRoleBinding. */
+export interface GetRoleBindingRequest {
+  /** The binding to return. */
+  name?: string;
+}
+
+/** The request for ListRoleBindings. */
+export interface ListRoleBindingsRequest {
+  /**
+   * The organization whose bindings to list, `organizations/{organization}`,
+   * or `organizations/-` for the caller's own bindings in every
+   * organization.
+   */
+  parent?: string;
+  /**
+   * Only the bindings of this member, `user:{email}` or
+   * `serviceAccount:{service_account}`. Every member's when empty.
+   */
+  member?: string;
+  /**
+   * Only the bindings limited to this project, `projects/{project}`. Every
+   * binding, organization-wide or not, when empty.
+   */
+  project?: string;
+  /**
+   * The most bindings to return; the server clamps it, and 0 means its
+   * default.
+   */
+  pageSize?: number;
+  /** A previous response's `nextPageToken`, for the page after it. */
+  pageToken?: string;
+}
+
+/** The response for ListRoleBindings. */
+export interface ListRoleBindingsResponse {
+  /** The bindings on this page. */
+  roleBindings?: RoleBinding[];
+  /** The token for the next page; empty on the last one. */
+  nextPageToken?: string;
+}
+
+/** The request for CreateRoleBinding. */
+export interface CreateRoleBindingRequest {
+  /**
+   * The organization to create the binding in,
+   * `organizations/{organization}`.
+   */
+  parent?: string;
+  /**
+   * The binding to create: its member and role, and optionally its
+   * project.
+   */
+  roleBinding?: RoleBinding;
+  /**
+   * A UUID. A repeat of the request with the same `requestId` within a
+   * day returns the binding the first request created, as it is now,
+   * instead of being refused as a conflict.
+   */
+  requestId?: string;
+}
+
+/** The request for DeleteRoleBinding. */
+export interface DeleteRoleBindingRequest {
+  /** The binding to delete. */
+  name?: string;
+  /**
+   * A UUID. A repeat of the request with the same `requestId` within a
+   * day succeeds as the first did, instead of answering `NOT_FOUND`.
+   */
+  requestId?: string;
+}

package/src/v1beta1/service_account.ts

@@ -0,0 +1,225 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/service_account.proto
+
+import {
+  type CallOptions,
+  type Client,
+  type Empty,
+  type Service,
+  newRequestId,
+  pathValue,
+  query,
+} from "@origincloud/core";
+
+/**
+ * Calls ServiceAccountService.
+ *
+ * Service accounts: an organization's credentials for software, which
+ * authenticate with the OAuth 2.0 client credentials grant and never log
+ * in interactively. A new service account holds no role: grant it one with
+ * a role binding on its `member`.
+ */
+export class ServiceAccountClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of ServiceAccountService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /**
+   * Returns a service account, deleted or not. Needs
+   * `iam.service_account.list` on the organization.
+   */
+  async getServiceAccount(request: GetServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount> {
+    const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
+    return this.service.call<ServiceAccount>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Lists an organization's service accounts, oldest first. Deleted ones
+   * are listed only when `showDeleted` is set. Needs
+   * `iam.service_account.list` on the organization.
+   */
+  async listServiceAccounts(request: ListServiceAccountsRequest, options?: CallOptions): Promise<ListServiceAccountsResponse> {
+    const p0 = pathValue("parent", request.parent, "organizations/*");
+    return this.service.call<ListServiceAccountsResponse>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}/serviceAccounts`,
+        query: query(request, ["parent"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Iterates over everything listServiceAccounts lists from the request's page on,
+   * fetching the next page as the loop reaches it. A page that fails ends
+   * the iteration with its error.
+   */
+  async *allServiceAccounts(request: ListServiceAccountsRequest, options?: CallOptions): AsyncGenerator<ServiceAccount, void, undefined> {
+    for (let page = request; ; ) {
+      const response = await this.listServiceAccounts(page, options);
+      yield* response.serviceAccounts ?? [];
+      if (!response.nextPageToken) return;
+      page = { ...page, pageToken: response.nextPageToken };
+    }
+  }
+
+  /**
+   * Creates a service account and its client secret. The response is the
+   * only place the secret is ever shown: store it now. Needs
+   * `iam.service_account.create` on the organization.
+   */
+  async createServiceAccount(request: CreateServiceAccountRequest, options?: CallOptions): Promise<ServiceAccount> {
+    if (!request.requestId) request = { ...request, requestId: newRequestId() };
+    const p0 = pathValue("parent", request.parent, "organizations/*");
+    return this.service.call<ServiceAccount>(
+      {
+        method: "POST",
+        path: `/v1beta1/${p0}/serviceAccounts`,
+        body: request.serviceAccount,
+        query: query(request, ["parent", "serviceAccount"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+
+  /**
+   * Deletes a service account for good: its credential is refused from
+   * then on, an access token it already holds is refused on its next
+   * request, and every role binding it holds, in any organization, is
+   * removed. It stays readable as `DELETED`. Deleting a deleted service
+   * account succeeds. Needs `iam.service_account.revoke` on the
+   * organization.
+   */
+  async deleteServiceAccount(request: DeleteServiceAccountRequest, options?: CallOptions): Promise<Empty> {
+    const p0 = pathValue("name", request.name, "organizations/*/serviceAccounts/*");
+    return this.service.call<Empty>(
+      {
+        method: "DELETE",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+      },
+      options,
+    );
+  }
+}
+
+/** A credential of an organization for software. */
+export interface ServiceAccount {
+  /** The service account's resource name. */
+  name?: string;
+  /** A name of your own, shown in the console; at most 100 characters. */
+  displayName?: string;
+  /**
+   * The member a role binding names it by,
+   * `serviceAccount:{service_account}`.
+   */
+  member?: string;
+  /** The OAuth 2.0 client id it authenticates with. */
+  clientId?: string;
+  /**
+   * The OAuth 2.0 client secret it authenticates with. Set only in the
+   * response that created the service account, and empty everywhere else:
+   * it can't be read again.
+   */
+  clientSecret?: string;
+  /** Where the service account is in its lifecycle. */
+  state?: ServiceAccount_State;
+  /**
+   * Who created the service account, written as a role binding's member
+   * is.
+   */
+  creator?: string;
+  /** When the service account was created. */
+  createTime?: string;
+  /** When the service account was deleted; unset while it is active. */
+  deleteTime?: string;
+}
+
+/** Where the service account is in its lifecycle. */
+export const ServiceAccount_State = {
+  /** Not set. */
+  STATE_UNSPECIFIED: "STATE_UNSPECIFIED",
+  /** Its credential is accepted. */
+  ACTIVE: "ACTIVE",
+  /** Deleted: its credential is refused, and it holds no role binding. */
+  DELETED: "DELETED",
+} as const;
+
+/** Where the service account is in its lifecycle. */
+export type ServiceAccount_State = (typeof ServiceAccount_State)[keyof typeof ServiceAccount_State];
+
+/** The request for GetServiceAccount. */
+export interface GetServiceAccountRequest {
+  /** The service account to return. */
+  name?: string;
+}
+
+/** The request for ListServiceAccounts. */
+export interface ListServiceAccountsRequest {
+  /**
+   * The organization whose service accounts to list,
+   * `organizations/{organization}`.
+   */
+  parent?: string;
+  /**
+   * The most service accounts to return; the server clamps it, and 0 means
+   * its default.
+   */
+  pageSize?: number;
+  /** A previous response's `nextPageToken`, for the page after it. */
+  pageToken?: string;
+  /** Whether deleted service accounts are listed too. */
+  showDeleted?: boolean;
+}
+
+/** The response for ListServiceAccounts. */
+export interface ListServiceAccountsResponse {
+  /** The service accounts on this page. */
+  serviceAccounts?: ServiceAccount[];
+  /** The token for the next page; empty on the last one. */
+  nextPageToken?: string;
+}
+
+/** The request for CreateServiceAccount. */
+export interface CreateServiceAccountRequest {
+  /**
+   * The organization to create the service account in,
+   * `organizations/{organization}`.
+   */
+  parent?: string;
+  /** The service account to create: its `displayName`. */
+  serviceAccount?: ServiceAccount;
+  /**
+   * A UUID. A repeat of the request with the same `requestId` within a
+   * day creates nothing and is refused with `CONFLICT`: the secret went to
+   * the first request only. The error's `ErrorInfo` metadata names the
+   * service account under `serviceAccount`; delete it and create a new one
+   * to get a working secret. The same `requestId` with a different
+   * request is refused with `CONFLICT` without that metadata.
+   */
+  requestId?: string;
+}
+
+/** The request for DeleteServiceAccount. */
+export interface DeleteServiceAccountRequest {
+  /** The service account to delete. */
+  name?: string;
+}

package/src/v1beta1/user.ts

@@ -0,0 +1,70 @@
+// Code generated by the SDK's generator (generator/). DO NOT EDIT.
+// source: origincloud/iam/v1beta1/user.proto
+
+import { type CallOptions, type Client, type Service, pathValue, query } from "@origincloud/core";
+
+/**
+ * Calls UserService.
+ *
+ * The signed-in user. Each user can read only their own profile, by the
+ * name `users/me` or by their own id; the role bindings they hold are
+ * listed by ListRoleBindings with the parent `organizations/-`.
+ */
+export class UserClient {
+  /**
+   * The endpoint the client sends its calls to, which also serves the
+   * operations its methods answer with.
+   */
+  readonly service: Service;
+
+  /** A client of UserService that sends its calls through `client`. */
+  constructor(client: Client) {
+    this.service = client.service("iam", false);
+  }
+
+  /**
+   * Returns the caller's own profile. Any other user is `NOT_FOUND`; a
+   * service account caller is refused with `BAD_REQUEST`, having no
+   * profile.
+   */
+  async getUser(request: GetUserRequest, options?: CallOptions): Promise<User> {
+    const p0 = pathValue("name", request.name, "users/*");
+    return this.service.call<User>(
+      {
+        method: "GET",
+        path: `/v1beta1/${p0}`,
+        query: query(request, ["name"]),
+        idempotent: true,
+      },
+      options,
+    );
+  }
+}
+
+/** A person who signs in to the platform. */
+export interface User {
+  /**
+   * The user's resource name, `users/{user}`, with their id; never
+   * `users/me`.
+   */
+  name?: string;
+  /**
+   * How a role binding shows the user: `user:{email}` once `email` is
+   * verified, `userId:{user}` until then.
+   */
+  member?: string;
+  /** The email address the user signs in with. */
+  email?: string;
+  /** Whether the user has confirmed `email`. */
+  emailVerified?: boolean;
+  /** The user's given name; empty when they haven't set one. */
+  givenName?: string;
+  /** The user's family name; empty when they haven't set one. */
+  familyName?: string;
+}
+
+/** The request for GetUser. */
+export interface GetUserRequest {
+  /** The user to return: `users/me`, or the caller's own `users/{user}`. */
+  name?: string;
+}