dynamic rbac and roles2

common/proto/auth.proto

@@ -22,6 +22,7 @@ service AuthService {
   rpc GrantPermission(GrantPermissionRequest) returns (RolePermissions);
   rpc RevokePermission(RevokePermissionRequest) returns (RolePermissions);
   rpc ListRolePermissions(ListRolePermissionsRequest) returns (RolePermissions);
+  rpc ListGrantableObjects(ListGrantableObjectsRequest) returns (ListGrantableObjectsResponse);
 
   // User administration.
   rpc AssignUserRole(AssignUserRoleRequest) returns (UserSummary);
@@ -145,6 +146,30 @@ message RolePermissions {
   repeated Permission effective_permissions = 3;
 }
 
+message ListGrantableObjectsRequest {
+  // The role being edited. The response contains only actions that may be
+  // granted to this role by the caller.
+  string target_role = 1;
+}
+
+message GrantableObject {
+  // Canonical value accepted by GrantPermission, for example
+  // data:acme/invoices.
+  string object = 1;
+  // Empty only for the data:* and journal:* global wildcards.
+  string profile = 2;
+  // Set only for a table-family root.
+  string table = 3;
+  // One of global_data, global_journal, profile, journal, or table.
+  string kind = 4;
+  // Actions the caller may grant to target_role for this object.
+  repeated string allowed_actions = 5;
+}
+
+message ListGrantableObjectsResponse {
+  repeated GrantableObject objects = 1;
+}
+
 message AssignUserRoleRequest {
   string username = 1;
   string role = 2;

common/src/proto/komp_ac.auth.rs

@@ -178,6 +178,37 @@ pub struct RolePermissions {
     pub effective_permissions: ::prost::alloc::vec::Vec<Permission>,
 }
 #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct ListGrantableObjectsRequest {
+    /// The role being edited. The response contains only actions that may be
+    /// granted to this role by the caller.
+    #[prost(string, tag = "1")]
+    pub target_role: ::prost::alloc::string::String,
+}
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct GrantableObject {
+    /// Canonical value accepted by GrantPermission, for example
+    /// data:acme/invoices.
+    #[prost(string, tag = "1")]
+    pub object: ::prost::alloc::string::String,
+    /// Empty only for the data:\* and journal:\* global wildcards.
+    #[prost(string, tag = "2")]
+    pub profile: ::prost::alloc::string::String,
+    /// Set only for a table-family root.
+    #[prost(string, tag = "3")]
+    pub table: ::prost::alloc::string::String,
+    /// One of global_data, global_journal, profile, journal, or table.
+    #[prost(string, tag = "4")]
+    pub kind: ::prost::alloc::string::String,
+    /// Actions the caller may grant to target_role for this object.
+    #[prost(string, repeated, tag = "5")]
+    pub allowed_actions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
+}
+#[derive(Clone, PartialEq, ::prost::Message)]
+pub struct ListGrantableObjectsResponse {
+    #[prost(message, repeated, tag = "1")]
+    pub objects: ::prost::alloc::vec::Vec<GrantableObject>,
+}
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct AssignUserRoleRequest {
     #[prost(string, tag = "1")]
     pub username: ::prost::alloc::string::String,
@@ -550,6 +581,32 @@ pub mod auth_service_client {
                 );
             self.inner.unary(req, path, codec).await
         }
+        pub async fn list_grantable_objects(
+            &mut self,
+            request: impl tonic::IntoRequest<super::ListGrantableObjectsRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::ListGrantableObjectsResponse>,
+            tonic::Status,
+        > {
+            self.inner
+                .ready()
+                .await
+                .map_err(|e| {
+                    tonic::Status::unknown(
+                        format!("Service was not ready: {}", e.into()),
+                    )
+                })?;
+            let codec = tonic_prost::ProstCodec::default();
+            let path = http::uri::PathAndQuery::from_static(
+                "/komp_ac.auth.AuthService/ListGrantableObjects",
+            );
+            let mut req = request.into_request();
+            req.extensions_mut()
+                .insert(
+                    GrpcMethod::new("komp_ac.auth.AuthService", "ListGrantableObjects"),
+                );
+            self.inner.unary(req, path, codec).await
+        }
         /// User administration.
         pub async fn assign_user_role(
             &mut self,
@@ -665,6 +722,13 @@ pub mod auth_service_server {
             &self,
             request: tonic::Request<super::ListRolePermissionsRequest>,
         ) -> std::result::Result<tonic::Response<super::RolePermissions>, tonic::Status>;
+        async fn list_grantable_objects(
+            &self,
+            request: tonic::Request<super::ListGrantableObjectsRequest>,
+        ) -> std::result::Result<
+            tonic::Response<super::ListGrantableObjectsResponse>,
+            tonic::Status,
+        >;
         /// User administration.
         async fn assign_user_role(
             &self,
@@ -1249,6 +1313,52 @@ pub mod auth_service_server {
                     };
                     Box::pin(fut)
                 }
+                "/komp_ac.auth.AuthService/ListGrantableObjects" => {
+                    #[allow(non_camel_case_types)]
+                    struct ListGrantableObjectsSvc<T: AuthService>(pub Arc<T>);
+                    impl<
+                        T: AuthService,
+                    > tonic::server::UnaryService<super::ListGrantableObjectsRequest>
+                    for ListGrantableObjectsSvc<T> {
+                        type Response = super::ListGrantableObjectsResponse;
+                        type Future = BoxFuture<
+                            tonic::Response<Self::Response>,
+                            tonic::Status,
+                        >;
+                        fn call(
+                            &mut self,
+                            request: tonic::Request<super::ListGrantableObjectsRequest>,
+                        ) -> Self::Future {
+                            let inner = Arc::clone(&self.0);
+                            let fut = async move {
+                                <T as AuthService>::list_grantable_objects(&inner, request)
+                                    .await
+                            };
+                            Box::pin(fut)
+                        }
+                    }
+                    let accept_compression_encodings = self.accept_compression_encodings;
+                    let send_compression_encodings = self.send_compression_encodings;
+                    let max_decoding_message_size = self.max_decoding_message_size;
+                    let max_encoding_message_size = self.max_encoding_message_size;
+                    let inner = self.inner.clone();
+                    let fut = async move {
+                        let method = ListGrantableObjectsSvc(inner);
+                        let codec = tonic_prost::ProstCodec::default();
+                        let mut grpc = tonic::server::Grpc::new(codec)
+                            .apply_compression_config(
+                                accept_compression_encodings,
+                                send_compression_encodings,
+                            )
+                            .apply_max_message_size_config(
+                                max_decoding_message_size,
+                                max_encoding_message_size,
+                            );
+                        let res = grpc.unary(method, req).await;
+                        Ok(res)
+                    };
+                    Box::pin(fut)
+                }
                 "/komp_ac.auth.AuthService/AssignUserRole" => {
                     #[allow(non_camel_case_types)]
                     struct AssignUserRoleSvc<T: AuthService>(pub Arc<T>);