@origincloud/iam 0.31.0 → 0.32.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/v1beta1/audit_log.d.ts +3 -3
- package/dist/v1beta1/role_binding.d.ts +33 -21
- package/dist/v1beta1/role_binding.d.ts.map +1 -1
- package/dist/v1beta1/role_binding.js +24 -14
- package/dist/v1beta1/role_binding.js.map +1 -1
- package/package.json +3 -3
- package/src/v1beta1/audit_log.ts +3 -3
- package/src/v1beta1/role_binding.ts +33 -21
|
@@ -110,9 +110,9 @@ export interface ListAuditLogEntriesRequest {
|
|
|
110
110
|
*/
|
|
111
111
|
project?: string;
|
|
112
112
|
/**
|
|
113
|
-
* Only the entries of changes made by this member
|
|
114
|
-
*
|
|
115
|
-
*
|
|
113
|
+
* Only the entries of changes made by this member, named by its full
|
|
114
|
+
* name as a role binding's member is, or as an entry's `actor` shows it.
|
|
115
|
+
* Every actor's when empty.
|
|
116
116
|
*/
|
|
117
117
|
actor?: string;
|
|
118
118
|
/**
|
|
@@ -7,7 +7,21 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
|
|
|
7
7
|
* of its bindings. Each binding is managed on its own, so creating or
|
|
8
8
|
* deleting one never touches another, whoever made it.
|
|
9
9
|
*
|
|
10
|
-
* A member is
|
|
10
|
+
* A member is named by its full name, one of:
|
|
11
|
+
* - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
|
|
12
|
+
* account, which must exist and be enabled.
|
|
13
|
+
* - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
|
|
14
|
+
* one of the organization's own service accounts.
|
|
15
|
+
* - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
|
|
16
|
+
* service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
|
|
17
|
+
* A service agent is the identity one of the platform's services acts as
|
|
18
|
+
* in an organization. Any organization can bind one, but only to a role
|
|
19
|
+
* its service needs; nobody outside the platform can act as one or get a
|
|
20
|
+
* credential for it. Every organization is created with compute's service
|
|
21
|
+
* agent bound to `roles/kms.grant-delegate`; delete that binding and
|
|
22
|
+
* compute makes no new grants on the organization's keys.
|
|
23
|
+
*
|
|
24
|
+
* A member is also accepted in the form responses show it in:
|
|
11
25
|
* - `user:{email}`: a user, by the verified email address of their
|
|
12
26
|
* account. A binding holds on to the account, not the address: it
|
|
13
27
|
* follows a later change of address, and is always shown with the
|
|
@@ -15,13 +29,7 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
|
|
|
15
29
|
* - `serviceAccount:{service_account}`: a service account of the same
|
|
16
30
|
* organization, by its id.
|
|
17
31
|
* - `serviceAgent:{service_agent}`: a platform service agent, by its name,
|
|
18
|
-
* such as `serviceAgent:compute`.
|
|
19
|
-
* the platform's services acts as in an organization. Any organization
|
|
20
|
-
* can bind one, but only to a role its service needs; nobody outside the
|
|
21
|
-
* platform can act as one or get a credential for it. Every organization
|
|
22
|
-
* is created with `serviceAgent:compute` bound to
|
|
23
|
-
* `roles/kms.grant-delegate`; delete that binding and compute makes no
|
|
24
|
-
* new grants on the organization's keys.
|
|
32
|
+
* such as `serviceAgent:compute`.
|
|
25
33
|
*
|
|
26
34
|
* and shown, never accepted, as:
|
|
27
35
|
* - `userId:{user}`: a user by the id of their account, when no verified
|
|
@@ -58,12 +66,14 @@ export declare class RoleBindingClient {
|
|
|
58
66
|
* organization, for a project binding as well, and every permission of
|
|
59
67
|
* the role at the binding's scope: a permission held on the organization
|
|
60
68
|
* counts for any scope, one held on a project only for that project.
|
|
61
|
-
* Refused with `NOT_FOUND` when
|
|
62
|
-
*
|
|
63
|
-
*
|
|
64
|
-
*
|
|
65
|
-
*
|
|
66
|
-
*
|
|
69
|
+
* Refused with `NOT_FOUND` when `member` names a user without an enabled
|
|
70
|
+
* account, a service account of another organization, or an address no
|
|
71
|
+
* enabled account has verified: nothing is held for an address until its
|
|
72
|
+
* account exists.
|
|
73
|
+
* Refused with `CONFLICT` when the member already holds the role at that
|
|
74
|
+
* scope, and with `BAD_REQUEST` when the member is a deleted service
|
|
75
|
+
* account, names no service agent the platform has, or is a service
|
|
76
|
+
* agent and the role isn't one its service needs.
|
|
67
77
|
*/
|
|
68
78
|
createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding>;
|
|
69
79
|
/**
|
|
@@ -88,10 +98,12 @@ export interface RoleBinding {
|
|
|
88
98
|
*/
|
|
89
99
|
urn?: string;
|
|
90
100
|
/**
|
|
91
|
-
* Who holds the role:
|
|
92
|
-
*
|
|
93
|
-
*
|
|
94
|
-
*
|
|
101
|
+
* Who holds the role: given as a member's full name, such as
|
|
102
|
+
* `//iam.origincloudapis.eu/users/{user}`, or in the form shown here.
|
|
103
|
+
* Shown as `user:{email}`, `serviceAccount:{service_account}` or
|
|
104
|
+
* `serviceAgent:{service_agent}`: a user with their account's current
|
|
105
|
+
* verified address, as `userId:{user}` when it has none, or as
|
|
106
|
+
* `deleted:user:{user}` once the account is gone.
|
|
95
107
|
*/
|
|
96
108
|
member?: string;
|
|
97
109
|
/** The role granted, `roles/{role}`. */
|
|
@@ -125,9 +137,9 @@ export interface ListRoleBindingsRequest {
|
|
|
125
137
|
*/
|
|
126
138
|
parent?: string;
|
|
127
139
|
/**
|
|
128
|
-
* Only the bindings of this member,
|
|
129
|
-
*
|
|
130
|
-
* Every member's when empty.
|
|
140
|
+
* Only the bindings of this member, by its full name, such as
|
|
141
|
+
* `//iam.origincloudapis.eu/users/{user}`, or as a binding's `member`
|
|
142
|
+
* shows it. Every member's when empty.
|
|
131
143
|
*/
|
|
132
144
|
member?: string;
|
|
133
145
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B
|
|
1
|
+
{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAejG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAelH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBvG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAelG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
|
|
@@ -9,7 +9,21 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
|
|
|
9
9
|
* of its bindings. Each binding is managed on its own, so creating or
|
|
10
10
|
* deleting one never touches another, whoever made it.
|
|
11
11
|
*
|
|
12
|
-
* A member is
|
|
12
|
+
* A member is named by its full name, one of:
|
|
13
|
+
* - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
|
|
14
|
+
* account, which must exist and be enabled.
|
|
15
|
+
* - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
|
|
16
|
+
* one of the organization's own service accounts.
|
|
17
|
+
* - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
|
|
18
|
+
* service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
|
|
19
|
+
* A service agent is the identity one of the platform's services acts as
|
|
20
|
+
* in an organization. Any organization can bind one, but only to a role
|
|
21
|
+
* its service needs; nobody outside the platform can act as one or get a
|
|
22
|
+
* credential for it. Every organization is created with compute's service
|
|
23
|
+
* agent bound to `roles/kms.grant-delegate`; delete that binding and
|
|
24
|
+
* compute makes no new grants on the organization's keys.
|
|
25
|
+
*
|
|
26
|
+
* A member is also accepted in the form responses show it in:
|
|
13
27
|
* - `user:{email}`: a user, by the verified email address of their
|
|
14
28
|
* account. A binding holds on to the account, not the address: it
|
|
15
29
|
* follows a later change of address, and is always shown with the
|
|
@@ -17,13 +31,7 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
|
|
|
17
31
|
* - `serviceAccount:{service_account}`: a service account of the same
|
|
18
32
|
* organization, by its id.
|
|
19
33
|
* - `serviceAgent:{service_agent}`: a platform service agent, by its name,
|
|
20
|
-
* such as `serviceAgent:compute`.
|
|
21
|
-
* the platform's services acts as in an organization. Any organization
|
|
22
|
-
* can bind one, but only to a role its service needs; nobody outside the
|
|
23
|
-
* platform can act as one or get a credential for it. Every organization
|
|
24
|
-
* is created with `serviceAgent:compute` bound to
|
|
25
|
-
* `roles/kms.grant-delegate`; delete that binding and compute makes no
|
|
26
|
-
* new grants on the organization's keys.
|
|
34
|
+
* such as `serviceAgent:compute`.
|
|
27
35
|
*
|
|
28
36
|
* and shown, never accepted, as:
|
|
29
37
|
* - `userId:{user}`: a user by the id of their account, when no verified
|
|
@@ -92,12 +100,14 @@ export class RoleBindingClient {
|
|
|
92
100
|
* organization, for a project binding as well, and every permission of
|
|
93
101
|
* the role at the binding's scope: a permission held on the organization
|
|
94
102
|
* counts for any scope, one held on a project only for that project.
|
|
95
|
-
* Refused with `NOT_FOUND` when
|
|
96
|
-
*
|
|
97
|
-
*
|
|
98
|
-
*
|
|
99
|
-
*
|
|
100
|
-
*
|
|
103
|
+
* Refused with `NOT_FOUND` when `member` names a user without an enabled
|
|
104
|
+
* account, a service account of another organization, or an address no
|
|
105
|
+
* enabled account has verified: nothing is held for an address until its
|
|
106
|
+
* account exists.
|
|
107
|
+
* Refused with `CONFLICT` when the member already holds the role at that
|
|
108
|
+
* scope, and with `BAD_REQUEST` when the member is a deleted service
|
|
109
|
+
* account, names no service agent the platform has, or is a service
|
|
110
|
+
* agent and the role isn't one its service needs.
|
|
101
111
|
*/
|
|
102
112
|
async createRoleBinding(request, options) {
|
|
103
113
|
if (!request.requestId)
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B
|
|
1
|
+
{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@origincloud/iam",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.32.0",
|
|
4
4
|
"description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
|
|
@@ -34,9 +34,9 @@
|
|
|
34
34
|
"!dist/**/*.tsbuildinfo"
|
|
35
35
|
],
|
|
36
36
|
"peerDependencies": {
|
|
37
|
-
"@origincloud/core": "^0.
|
|
37
|
+
"@origincloud/core": "^0.32.0"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
|
-
"@origincloud/core": "^0.
|
|
40
|
+
"@origincloud/core": "^0.32.0"
|
|
41
41
|
}
|
|
42
42
|
}
|
package/src/v1beta1/audit_log.ts
CHANGED
|
@@ -158,9 +158,9 @@ export interface ListAuditLogEntriesRequest {
|
|
|
158
158
|
*/
|
|
159
159
|
project?: string;
|
|
160
160
|
/**
|
|
161
|
-
* Only the entries of changes made by this member
|
|
162
|
-
*
|
|
163
|
-
*
|
|
161
|
+
* Only the entries of changes made by this member, named by its full
|
|
162
|
+
* name as a role binding's member is, or as an entry's `actor` shows it.
|
|
163
|
+
* Every actor's when empty.
|
|
164
164
|
*/
|
|
165
165
|
actor?: string;
|
|
166
166
|
/**
|
|
@@ -19,7 +19,21 @@ import {
|
|
|
19
19
|
* of its bindings. Each binding is managed on its own, so creating or
|
|
20
20
|
* deleting one never touches another, whoever made it.
|
|
21
21
|
*
|
|
22
|
-
* A member is
|
|
22
|
+
* A member is named by its full name, one of:
|
|
23
|
+
* - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
|
|
24
|
+
* account, which must exist and be enabled.
|
|
25
|
+
* - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
|
|
26
|
+
* one of the organization's own service accounts.
|
|
27
|
+
* - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
|
|
28
|
+
* service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
|
|
29
|
+
* A service agent is the identity one of the platform's services acts as
|
|
30
|
+
* in an organization. Any organization can bind one, but only to a role
|
|
31
|
+
* its service needs; nobody outside the platform can act as one or get a
|
|
32
|
+
* credential for it. Every organization is created with compute's service
|
|
33
|
+
* agent bound to `roles/kms.grant-delegate`; delete that binding and
|
|
34
|
+
* compute makes no new grants on the organization's keys.
|
|
35
|
+
*
|
|
36
|
+
* A member is also accepted in the form responses show it in:
|
|
23
37
|
* - `user:{email}`: a user, by the verified email address of their
|
|
24
38
|
* account. A binding holds on to the account, not the address: it
|
|
25
39
|
* follows a later change of address, and is always shown with the
|
|
@@ -27,13 +41,7 @@ import {
|
|
|
27
41
|
* - `serviceAccount:{service_account}`: a service account of the same
|
|
28
42
|
* organization, by its id.
|
|
29
43
|
* - `serviceAgent:{service_agent}`: a platform service agent, by its name,
|
|
30
|
-
* such as `serviceAgent:compute`.
|
|
31
|
-
* the platform's services acts as in an organization. Any organization
|
|
32
|
-
* can bind one, but only to a role its service needs; nobody outside the
|
|
33
|
-
* platform can act as one or get a credential for it. Every organization
|
|
34
|
-
* is created with `serviceAgent:compute` bound to
|
|
35
|
-
* `roles/kms.grant-delegate`; delete that binding and compute makes no
|
|
36
|
-
* new grants on the organization's keys.
|
|
44
|
+
* such as `serviceAgent:compute`.
|
|
37
45
|
*
|
|
38
46
|
* and shown, never accepted, as:
|
|
39
47
|
* - `userId:{user}`: a user by the id of their account, when no verified
|
|
@@ -110,12 +118,14 @@ export class RoleBindingClient {
|
|
|
110
118
|
* organization, for a project binding as well, and every permission of
|
|
111
119
|
* the role at the binding's scope: a permission held on the organization
|
|
112
120
|
* counts for any scope, one held on a project only for that project.
|
|
113
|
-
* Refused with `NOT_FOUND` when
|
|
114
|
-
*
|
|
115
|
-
*
|
|
116
|
-
*
|
|
117
|
-
*
|
|
118
|
-
*
|
|
121
|
+
* Refused with `NOT_FOUND` when `member` names a user without an enabled
|
|
122
|
+
* account, a service account of another organization, or an address no
|
|
123
|
+
* enabled account has verified: nothing is held for an address until its
|
|
124
|
+
* account exists.
|
|
125
|
+
* Refused with `CONFLICT` when the member already holds the role at that
|
|
126
|
+
* scope, and with `BAD_REQUEST` when the member is a deleted service
|
|
127
|
+
* account, names no service agent the platform has, or is a service
|
|
128
|
+
* agent and the role isn't one its service needs.
|
|
119
129
|
*/
|
|
120
130
|
async createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding> {
|
|
121
131
|
if (!request.requestId) request = { ...request, requestId: newRequestId() };
|
|
@@ -171,10 +181,12 @@ export interface RoleBinding {
|
|
|
171
181
|
*/
|
|
172
182
|
urn?: string;
|
|
173
183
|
/**
|
|
174
|
-
* Who holds the role:
|
|
175
|
-
*
|
|
176
|
-
*
|
|
177
|
-
*
|
|
184
|
+
* Who holds the role: given as a member's full name, such as
|
|
185
|
+
* `//iam.origincloudapis.eu/users/{user}`, or in the form shown here.
|
|
186
|
+
* Shown as `user:{email}`, `serviceAccount:{service_account}` or
|
|
187
|
+
* `serviceAgent:{service_agent}`: a user with their account's current
|
|
188
|
+
* verified address, as `userId:{user}` when it has none, or as
|
|
189
|
+
* `deleted:user:{user}` once the account is gone.
|
|
178
190
|
*/
|
|
179
191
|
member?: string;
|
|
180
192
|
/** The role granted, `roles/{role}`. */
|
|
@@ -210,9 +222,9 @@ export interface ListRoleBindingsRequest {
|
|
|
210
222
|
*/
|
|
211
223
|
parent?: string;
|
|
212
224
|
/**
|
|
213
|
-
* Only the bindings of this member,
|
|
214
|
-
*
|
|
215
|
-
* Every member's when empty.
|
|
225
|
+
* Only the bindings of this member, by its full name, such as
|
|
226
|
+
* `//iam.origincloudapis.eu/users/{user}`, or as a binding's `member`
|
|
227
|
+
* shows it. Every member's when empty.
|
|
216
228
|
*/
|
|
217
229
|
member?: string;
|
|
218
230
|
/**
|