@origincloud/iam 0.31.0 → 0.33.0

package/dist/v1beta1/audit_log.d.ts

@@ -110,9 +110,9 @@ export interface ListAuditLogEntriesRequest {
      */
     project?: string;
     /**
-     * Only the entries of changes made by this member's account,
-     * `user:{email}`, `serviceAccount:{service_account}` or
-     * `serviceAgent:{service_agent}`. Every actor's when empty.
+     * Only the entries of changes made by this member, named by its full
+     * name as a role binding's member is, or as an entry's `actor` shows it.
+     * Every actor's when empty.
      */
     actor?: string;
     /**

package/dist/v1beta1/role_binding.d.ts

@@ -7,7 +7,21 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
  * of its bindings. Each binding is managed on its own, so creating or
  * deleting one never touches another, whoever made it.
  *
- * A member is written as one of:
+ * A member is named by its full name, one of:
+ * - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
+ *   account, which must exist and be enabled.
+ * - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
+ *   one of the organization's own service accounts.
+ * - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
+ *   service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
+ *   A service agent is the identity one of the platform's services acts as
+ *   in an organization. Any organization can bind one, but only to a role
+ *   its service needs; nobody outside the platform can act as one or get a
+ *   credential for it. Every organization is created with compute's service
+ *   agent bound to `roles/kms.grant-delegate`; delete that binding and
+ *   compute makes no new grants on the organization's keys.
+ *
+ * A member is also accepted in the form responses show it in:
  * - `user:{email}`: a user, by the verified email address of their
  *   account. A binding holds on to the account, not the address: it
  *   follows a later change of address, and is always shown with the
@@ -15,13 +29,7 @@ import { type CallOptions, type Client, type Empty, type Service } from "@origin
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
  * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
- *   such as `serviceAgent:compute`. A service agent is the identity one of
- *   the platform's services acts as in an organization. Any organization
- *   can bind one, but only to a role its service needs; nobody outside the
- *   platform can act as one or get a credential for it. Every organization
- *   is created with `serviceAgent:compute` bound to
- *   `roles/kms.grant-delegate`; delete that binding and compute makes no
- *   new grants on the organization's keys.
+ *   such as `serviceAgent:compute`.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -58,12 +66,14 @@ export declare class RoleBindingClient {
      * organization, for a project binding as well, and every permission of
      * the role at the binding's scope: a permission held on the organization
      * counts for any scope, one held on a project only for that project.
-     * Refused with `NOT_FOUND` when no account has `member`'s address as its
-     * verified email: nothing is held for an address until its account
-     * exists. Refused with `CONFLICT` when the member already holds the role
-     * at that scope, and with `BAD_REQUEST` when the member is a deleted
-     * service account, names no service agent the platform has, or is a
-     * service agent and the role isn't one its service needs.
+     * Refused with `NOT_FOUND` when `member` names a user without an enabled
+     * account, a service account of another organization, or an address no
+     * enabled account has verified: nothing is held for an address until its
+     * account exists.
+     * Refused with `CONFLICT` when the member already holds the role at that
+     * scope, and with `BAD_REQUEST` when the member is a deleted service
+     * account, names no service agent the platform has, or is a service
+     * agent and the role isn't one its service needs.
      */
     createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding>;
     /**
@@ -88,10 +98,12 @@ export interface RoleBinding {
      */
     urn?: string;
     /**
-     * Who holds the role: `user:{email}`, `serviceAccount:{service_account}`
-     * or `serviceAgent:{service_agent}`. A user is shown with their
-     * account's current verified address, as `userId:{user}` when it has
-     * none, or as `deleted:user:{user}` once the account is gone.
+     * Who holds the role: given as a member's full name, such as
+     * `//iam.origincloudapis.eu/users/{user}`, or in the form shown here.
+     * Shown as `user:{email}`, `serviceAccount:{service_account}` or
+     * `serviceAgent:{service_agent}`: a user with their account's current
+     * verified address, as `userId:{user}` when it has none, or as
+     * `deleted:user:{user}` once the account is gone.
      */
     member?: string;
     /** The role granted, `roles/{role}`. */
@@ -125,9 +137,9 @@ export interface ListRoleBindingsRequest {
      */
     parent?: string;
     /**
-     * Only the bindings of this member, `user:{email}`,
-     * `serviceAccount:{service_account}` or `serviceAgent:{service_agent}`.
-     * Every member's when empty.
+     * Only the bindings of this member, by its full name, such as
+     * `//iam.origincloudapis.eu/users/{user}`, or as a binding's `member`
+     * shows it. Every member's when empty.
      */
     member?: string;
     /**

package/dist/v1beta1/role_binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAejG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAelH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBvG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAelG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"role_binding.d.ts","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,KAAK,EACV,KAAK,OAAO,EAIb,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,4EAA4E;gBAChE,MAAM,EAAE,MAAM;IAI1B,2EAA2E;IACrE,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAejG;;;;;;OAMG;IACG,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAelH;;;;OAIG;IACI,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;IAS7H;;;;;;;;;;;;;OAaG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBvG;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;CAelG;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,iCAAiC;IACjC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/v1beta1/role_binding.js

@@ -9,7 +9,21 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
  * of its bindings. Each binding is managed on its own, so creating or
  * deleting one never touches another, whoever made it.
  *
- * A member is written as one of:
+ * A member is named by its full name, one of:
+ * - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
+ *   account, which must exist and be enabled.
+ * - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
+ *   one of the organization's own service accounts.
+ * - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
+ *   service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
+ *   A service agent is the identity one of the platform's services acts as
+ *   in an organization. Any organization can bind one, but only to a role
+ *   its service needs; nobody outside the platform can act as one or get a
+ *   credential for it. Every organization is created with compute's service
+ *   agent bound to `roles/kms.grant-delegate`; delete that binding and
+ *   compute makes no new grants on the organization's keys.
+ *
+ * A member is also accepted in the form responses show it in:
  * - `user:{email}`: a user, by the verified email address of their
  *   account. A binding holds on to the account, not the address: it
  *   follows a later change of address, and is always shown with the
@@ -17,13 +31,7 @@ import { newRequestId, pathValue, query, } from "@origincloud/core";
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
  * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
- *   such as `serviceAgent:compute`. A service agent is the identity one of
- *   the platform's services acts as in an organization. Any organization
- *   can bind one, but only to a role its service needs; nobody outside the
- *   platform can act as one or get a credential for it. Every organization
- *   is created with `serviceAgent:compute` bound to
- *   `roles/kms.grant-delegate`; delete that binding and compute makes no
- *   new grants on the organization's keys.
+ *   such as `serviceAgent:compute`.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -92,12 +100,14 @@ export class RoleBindingClient {
      * organization, for a project binding as well, and every permission of
      * the role at the binding's scope: a permission held on the organization
      * counts for any scope, one held on a project only for that project.
-     * Refused with `NOT_FOUND` when no account has `member`'s address as its
-     * verified email: nothing is held for an address until its account
-     * exists. Refused with `CONFLICT` when the member already holds the role
-     * at that scope, and with `BAD_REQUEST` when the member is a deleted
-     * service account, names no service agent the platform has, or is a
-     * service agent and the role isn't one its service needs.
+     * Refused with `NOT_FOUND` when `member` names a user without an enabled
+     * account, a service account of another organization, or an address no
+     * enabled account has verified: nothing is held for an address until its
+     * account exists.
+     * Refused with `CONFLICT` when the member already holds the role at that
+     * scope, and with `BAD_REQUEST` when the member is a deleted service
+     * account, names no service agent the platform has, or is a service
+     * agent and the role isn't one its service needs.
      */
     async createRoleBinding(request, options) {
         if (!request.requestId)

package/dist/v1beta1/role_binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"role_binding.js","sourceRoot":"","sources":["../../src/v1beta1/role_binding.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,EAKL,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACM,OAAO,CAAU;IAE1B,4EAA4E;IAC5E,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,cAAc,CAAC,OAA8B,EAAE,OAAqB;QACxE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAgC,EAAE,OAAqB;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACjC,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,CAAC,eAAe,CAAC,OAAgC,EAAE,OAAqB;QAC5E,KAAK,IAAI,IAAI,GAAG,OAAO,IAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,aAAa;gBAAE,OAAO;YACpC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACtD,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,YAAY,EAAE,eAAe;YACnC,IAAI,EAAE,OAAO,CAAC,WAAW;YACzB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAiC,EAAE,OAAqB;QAC9E,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/dist/v1beta1/user.d.ts

@@ -2,9 +2,11 @@ import { type CallOptions, type Client, type Service } from "@origincloud/core";
 /**
  * Calls UserService.
  *
- * The signed-in user. Each user can read only their own profile, by the
- * name `users/me` or by their own id; the role bindings they hold are
- * listed by ListRoleBindings with the parent `organizations/-`.
+ * Users. Each user can read only their own profile, by the name `users/me`
+ * or by their own id; the role bindings they hold are listed by
+ * ListRoleBindings with the parent `organizations/-`. Anyone who may grant
+ * roles in an organization can look a user up by email address, to name
+ * them in a role binding.
  */
 export declare class UserClient {
     /**
@@ -20,6 +22,17 @@ export declare class UserClient {
      * profile.
      */
     getUser(request: GetUserRequest, options?: CallOptions): Promise<User>;
+    /**
+     * Looks up the user whose account has verified an email address, and
+     * answers them with their `name`: their full name is
+     * `//iam.origincloudapis.eu/` followed by it, which is how a role
+     * binding names them as a member. Needs `iam.role.assign` on
+     * `organization`, the permission a binding of the user needs anyway.
+     * Refused with `NOT_FOUND` when no enabled account has verified the
+     * address, and with `CONFLICT` when more than one has. The answer leaves
+     * `givenName` and `familyName` empty: only the user reads those.
+     */
+    lookupUser(request: LookupUserRequest, options?: CallOptions): Promise<User>;
 }
 /** A person who signs in to the platform. */
 export interface User {
@@ -47,4 +60,17 @@ export interface GetUserRequest {
     /** The user to return: `users/me`, or the caller's own `users/{user}`. */
     name?: string;
 }
+/** The request for LookupUser. */
+export interface LookupUserRequest {
+    /**
+     * The email address the user's account has verified, matched exactly,
+     * case aside.
+     */
+    email?: string;
+    /**
+     * The organization the caller looks the user up for, where it needs
+     * `iam.role.assign`: `organizations/{organization}`, or its full name.
+     */
+    organization?: string;
+}
 //# sourceMappingURL=user.d.ts.map

package/dist/v1beta1/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,qEAAqE;gBACzD,MAAM,EAAE,MAAM;IAI1B;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAc7E;AAED,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAoB,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;GAQG;AACH,qBAAa,UAAU;IACrB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,qEAAqE;gBACzD,MAAM,EAAE,MAAM;IAI1B;;;;OAIG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5E;;;;;;;;;OASG;IACG,UAAU,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAWnF;AAED,6CAA6C;AAC7C,MAAM,WAAW,IAAI;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/v1beta1/user.js

@@ -4,9 +4,11 @@ import { pathValue, query } from "@origincloud/core";
 /**
  * Calls UserService.
  *
- * The signed-in user. Each user can read only their own profile, by the
- * name `users/me` or by their own id; the role bindings they hold are
- * listed by ListRoleBindings with the parent `organizations/-`.
+ * Users. Each user can read only their own profile, by the name `users/me`
+ * or by their own id; the role bindings they hold are listed by
+ * ListRoleBindings with the parent `organizations/-`. Anyone who may grant
+ * roles in an organization can look a user up by email address, to name
+ * them in a role binding.
  */
 export class UserClient {
     /**
@@ -35,5 +37,23 @@ export class UserClient {
             idempotent: true,
         }, options);
     }
+    /**
+     * Looks up the user whose account has verified an email address, and
+     * answers them with their `name`: their full name is
+     * `//iam.origincloudapis.eu/` followed by it, which is how a role
+     * binding names them as a member. Needs `iam.role.assign` on
+     * `organization`, the permission a binding of the user needs anyway.
+     * Refused with `NOT_FOUND` when no enabled account has verified the
+     * address, and with `CONFLICT` when more than one has. The answer leaves
+     * `givenName` and `familyName` empty: only the user reads those.
+     */
+    async lookupUser(request, options) {
+        return this.service.call({
+            method: "GET",
+            path: `/v1beta1/users:lookup`,
+            query: query(request, []),
+            idempotent: true,
+        }, options);
+    }
 }
 //# sourceMappingURL=user.js.map

package/dist/v1beta1/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6CAA6C;AAE7C,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACrB;;;OAGG;IACM,OAAO,CAAU;IAE1B,qEAAqE;IACrE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,OAAqB;QAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/v1beta1/user.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6CAA6C;AAE7C,OAAO,EAA+C,SAAS,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAElG;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB;;;OAGG;IACM,OAAO,CAAU;IAE1B,qEAAqE;IACrE,YAAY,MAAc;QACxB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,OAAqB;QAC1D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY,EAAE,EAAE;YACtB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;YAC/B,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,OAA0B,EAAE,OAAqB;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CACtB;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACzB,UAAU,EAAE,IAAI;SACjB,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@origincloud/iam",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "Origin Cloud's IAM service: users, service accounts, roles, role bindings, permissions and the audit log.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/origincloudhq/sdk-typescript#readme",
@@ -34,9 +34,9 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "peerDependencies": {
-    "@origincloud/core": "^0.31.0"
+    "@origincloud/core": "^0.33.0"
   },
   "devDependencies": {
-    "@origincloud/core": "^0.31.0"
+    "@origincloud/core": "^0.33.0"
   }
 }

package/src/v1beta1/audit_log.ts

@@ -158,9 +158,9 @@ export interface ListAuditLogEntriesRequest {
    */
   project?: string;
   /**
-   * Only the entries of changes made by this member's account,
-   * `user:{email}`, `serviceAccount:{service_account}` or
-   * `serviceAgent:{service_agent}`. Every actor's when empty.
+   * Only the entries of changes made by this member, named by its full
+   * name as a role binding's member is, or as an entry's `actor` shows it.
+   * Every actor's when empty.
    */
   actor?: string;
   /**

package/src/v1beta1/role_binding.ts

@@ -19,7 +19,21 @@ import {
  * of its bindings. Each binding is managed on its own, so creating or
  * deleting one never touches another, whoever made it.
  *
- * A member is written as one of:
+ * A member is named by its full name, one of:
+ * - `//iam.origincloudapis.eu/users/{user}`: a user, by the id of their
+ *   account, which must exist and be enabled.
+ * - `//iam.origincloudapis.eu/organizations/{organization}/serviceAccounts/{service_account}`:
+ *   one of the organization's own service accounts.
+ * - `//iam.origincloudapis.eu/serviceAgents/{service_agent}`: a platform
+ *   service agent, such as `//iam.origincloudapis.eu/serviceAgents/compute`.
+ *   A service agent is the identity one of the platform's services acts as
+ *   in an organization. Any organization can bind one, but only to a role
+ *   its service needs; nobody outside the platform can act as one or get a
+ *   credential for it. Every organization is created with compute's service
+ *   agent bound to `roles/kms.grant-delegate`; delete that binding and
+ *   compute makes no new grants on the organization's keys.
+ *
+ * A member is also accepted in the form responses show it in:
  * - `user:{email}`: a user, by the verified email address of their
  *   account. A binding holds on to the account, not the address: it
  *   follows a later change of address, and is always shown with the
@@ -27,13 +41,7 @@ import {
  * - `serviceAccount:{service_account}`: a service account of the same
  *   organization, by its id.
  * - `serviceAgent:{service_agent}`: a platform service agent, by its name,
- *   such as `serviceAgent:compute`. A service agent is the identity one of
- *   the platform's services acts as in an organization. Any organization
- *   can bind one, but only to a role its service needs; nobody outside the
- *   platform can act as one or get a credential for it. Every organization
- *   is created with `serviceAgent:compute` bound to
- *   `roles/kms.grant-delegate`; delete that binding and compute makes no
- *   new grants on the organization's keys.
+ *   such as `serviceAgent:compute`.
  *
  * and shown, never accepted, as:
  * - `userId:{user}`: a user by the id of their account, when no verified
@@ -110,12 +118,14 @@ export class RoleBindingClient {
    * organization, for a project binding as well, and every permission of
    * the role at the binding's scope: a permission held on the organization
    * counts for any scope, one held on a project only for that project.
-   * Refused with `NOT_FOUND` when no account has `member`'s address as its
-   * verified email: nothing is held for an address until its account
-   * exists. Refused with `CONFLICT` when the member already holds the role
-   * at that scope, and with `BAD_REQUEST` when the member is a deleted
-   * service account, names no service agent the platform has, or is a
-   * service agent and the role isn't one its service needs.
+   * Refused with `NOT_FOUND` when `member` names a user without an enabled
+   * account, a service account of another organization, or an address no
+   * enabled account has verified: nothing is held for an address until its
+   * account exists.
+   * Refused with `CONFLICT` when the member already holds the role at that
+   * scope, and with `BAD_REQUEST` when the member is a deleted service
+   * account, names no service agent the platform has, or is a service
+   * agent and the role isn't one its service needs.
    */
   async createRoleBinding(request: CreateRoleBindingRequest, options?: CallOptions): Promise<RoleBinding> {
     if (!request.requestId) request = { ...request, requestId: newRequestId() };
@@ -171,10 +181,12 @@ export interface RoleBinding {
    */
   urn?: string;
   /**
-   * Who holds the role: `user:{email}`, `serviceAccount:{service_account}`
-   * or `serviceAgent:{service_agent}`. A user is shown with their
-   * account's current verified address, as `userId:{user}` when it has
-   * none, or as `deleted:user:{user}` once the account is gone.
+   * Who holds the role: given as a member's full name, such as
+   * `//iam.origincloudapis.eu/users/{user}`, or in the form shown here.
+   * Shown as `user:{email}`, `serviceAccount:{service_account}` or
+   * `serviceAgent:{service_agent}`: a user with their account's current
+   * verified address, as `userId:{user}` when it has none, or as
+   * `deleted:user:{user}` once the account is gone.
    */
   member?: string;
   /** The role granted, `roles/{role}`. */
@@ -210,9 +222,9 @@ export interface ListRoleBindingsRequest {
    */
   parent?: string;
   /**
-   * Only the bindings of this member, `user:{email}`,
-   * `serviceAccount:{service_account}` or `serviceAgent:{service_agent}`.
-   * Every member's when empty.
+   * Only the bindings of this member, by its full name, such as
+   * `//iam.origincloudapis.eu/users/{user}`, or as a binding's `member`
+   * shows it. Every member's when empty.
    */
   member?: string;
   /**

package/src/v1beta1/user.ts

@@ -6,9 +6,11 @@ import { type CallOptions, type Client, type Service, pathValue, query } from "@
 /**
  * Calls UserService.
  *
- * The signed-in user. Each user can read only their own profile, by the
- * name `users/me` or by their own id; the role bindings they hold are
- * listed by ListRoleBindings with the parent `organizations/-`.
+ * Users. Each user can read only their own profile, by the name `users/me`
+ * or by their own id; the role bindings they hold are listed by
+ * ListRoleBindings with the parent `organizations/-`. Anyone who may grant
+ * roles in an organization can look a user up by email address, to name
+ * them in a role binding.
  */
 export class UserClient {
   /**
@@ -41,6 +43,28 @@ export class UserClient {
       options,
     );
   }
+
+  /**
+   * Looks up the user whose account has verified an email address, and
+   * answers them with their `name`: their full name is
+   * `//iam.origincloudapis.eu/` followed by it, which is how a role
+   * binding names them as a member. Needs `iam.role.assign` on
+   * `organization`, the permission a binding of the user needs anyway.
+   * Refused with `NOT_FOUND` when no enabled account has verified the
+   * address, and with `CONFLICT` when more than one has. The answer leaves
+   * `givenName` and `familyName` empty: only the user reads those.
+   */
+  async lookupUser(request: LookupUserRequest, options?: CallOptions): Promise<User> {
+    return this.service.call<User>(
+      {
+        method: "GET",
+        path: `/v1beta1/users:lookup`,
+        query: query(request, []),
+        idempotent: true,
+      },
+      options,
+    );
+  }
 }
 
 /** A person who signs in to the platform. */
@@ -70,3 +94,17 @@ export interface GetUserRequest {
   /** The user to return: `users/me`, or the caller's own `users/{user}`. */
   name?: string;
 }
+
+/** The request for LookupUser. */
+export interface LookupUserRequest {
+  /**
+   * The email address the user's account has verified, matched exactly,
+   * case aside.
+   */
+  email?: string;
+  /**
+   * The organization the caller looks the user up for, where it needs
+   * `iam.role.assign`: `organizations/{organization}`, or its full name.
+   */
+  organization?: string;
+}