diff --git a/common/proto/auth.proto b/common/proto/auth.proto index 39aa6eb9..55283319 100644 --- a/common/proto/auth.proto +++ b/common/proto/auth.proto @@ -22,6 +22,7 @@ service AuthService { rpc GrantPermission(GrantPermissionRequest) returns (RolePermissions); rpc RevokePermission(RevokePermissionRequest) returns (RolePermissions); rpc ListRolePermissions(ListRolePermissionsRequest) returns (RolePermissions); + rpc ListGrantableObjects(ListGrantableObjectsRequest) returns (ListGrantableObjectsResponse); // User administration. rpc AssignUserRole(AssignUserRoleRequest) returns (UserSummary); @@ -145,6 +146,30 @@ message RolePermissions { repeated Permission effective_permissions = 3; } +message ListGrantableObjectsRequest { + // The role being edited. The response contains only actions that may be + // granted to this role by the caller. + string target_role = 1; +} + +message GrantableObject { + // Canonical value accepted by GrantPermission, for example + // data:acme/invoices. + string object = 1; + // Empty only for the data:* and journal:* global wildcards. + string profile = 2; + // Set only for a table-family root. + string table = 3; + // One of global_data, global_journal, profile, journal, or table. + string kind = 4; + // Actions the caller may grant to target_role for this object. + repeated string allowed_actions = 5; +} + +message ListGrantableObjectsResponse { + repeated GrantableObject objects = 1; +} + message AssignUserRoleRequest { string username = 1; string role = 2; diff --git a/common/src/proto/descriptor.bin b/common/src/proto/descriptor.bin index ff0f25cb..469176c6 100644 Binary files a/common/src/proto/descriptor.bin and b/common/src/proto/descriptor.bin differ diff --git a/common/src/proto/komp_ac.auth.rs b/common/src/proto/komp_ac.auth.rs index 5451ccaf..fcec578c 100644 --- a/common/src/proto/komp_ac.auth.rs +++ b/common/src/proto/komp_ac.auth.rs @@ -178,6 +178,37 @@ pub struct RolePermissions { pub effective_permissions: ::prost::alloc::vec::Vec, } #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)] +pub struct ListGrantableObjectsRequest { + /// The role being edited. The response contains only actions that may be + /// granted to this role by the caller. + #[prost(string, tag = "1")] + pub target_role: ::prost::alloc::string::String, +} +#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)] +pub struct GrantableObject { + /// Canonical value accepted by GrantPermission, for example + /// data:acme/invoices. + #[prost(string, tag = "1")] + pub object: ::prost::alloc::string::String, + /// Empty only for the data:\* and journal:\* global wildcards. + #[prost(string, tag = "2")] + pub profile: ::prost::alloc::string::String, + /// Set only for a table-family root. + #[prost(string, tag = "3")] + pub table: ::prost::alloc::string::String, + /// One of global_data, global_journal, profile, journal, or table. + #[prost(string, tag = "4")] + pub kind: ::prost::alloc::string::String, + /// Actions the caller may grant to target_role for this object. + #[prost(string, repeated, tag = "5")] + pub allowed_actions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>, +} +#[derive(Clone, PartialEq, ::prost::Message)] +pub struct ListGrantableObjectsResponse { + #[prost(message, repeated, tag = "1")] + pub objects: ::prost::alloc::vec::Vec, +} +#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)] pub struct AssignUserRoleRequest { #[prost(string, tag = "1")] pub username: ::prost::alloc::string::String, @@ -550,6 +581,32 @@ pub mod auth_service_client { ); self.inner.unary(req, path, codec).await } + pub async fn list_grantable_objects( + &mut self, + request: impl tonic::IntoRequest, + ) -> std::result::Result< + tonic::Response, + tonic::Status, + > { + self.inner + .ready() + .await + .map_err(|e| { + tonic::Status::unknown( + format!("Service was not ready: {}", e.into()), + ) + })?; + let codec = tonic_prost::ProstCodec::default(); + let path = http::uri::PathAndQuery::from_static( + "/komp_ac.auth.AuthService/ListGrantableObjects", + ); + let mut req = request.into_request(); + req.extensions_mut() + .insert( + GrpcMethod::new("komp_ac.auth.AuthService", "ListGrantableObjects"), + ); + self.inner.unary(req, path, codec).await + } /// User administration. pub async fn assign_user_role( &mut self, @@ -665,6 +722,13 @@ pub mod auth_service_server { &self, request: tonic::Request, ) -> std::result::Result, tonic::Status>; + async fn list_grantable_objects( + &self, + request: tonic::Request, + ) -> std::result::Result< + tonic::Response, + tonic::Status, + >; /// User administration. async fn assign_user_role( &self, @@ -1249,6 +1313,52 @@ pub mod auth_service_server { }; Box::pin(fut) } + "/komp_ac.auth.AuthService/ListGrantableObjects" => { + #[allow(non_camel_case_types)] + struct ListGrantableObjectsSvc(pub Arc); + impl< + T: AuthService, + > tonic::server::UnaryService + for ListGrantableObjectsSvc { + type Response = super::ListGrantableObjectsResponse; + type Future = BoxFuture< + tonic::Response, + tonic::Status, + >; + fn call( + &mut self, + request: tonic::Request, + ) -> Self::Future { + let inner = Arc::clone(&self.0); + let fut = async move { + ::list_grantable_objects(&inner, request) + .await + }; + Box::pin(fut) + } + } + let accept_compression_encodings = self.accept_compression_encodings; + let send_compression_encodings = self.send_compression_encodings; + let max_decoding_message_size = self.max_decoding_message_size; + let max_encoding_message_size = self.max_encoding_message_size; + let inner = self.inner.clone(); + let fut = async move { + let method = ListGrantableObjectsSvc(inner); + let codec = tonic_prost::ProstCodec::default(); + let mut grpc = tonic::server::Grpc::new(codec) + .apply_compression_config( + accept_compression_encodings, + send_compression_encodings, + ) + .apply_max_message_size_config( + max_decoding_message_size, + max_encoding_message_size, + ); + let res = grpc.unary(method, req).await; + Ok(res) + }; + Box::pin(fut) + } "/komp_ac.auth.AuthService/AssignUserRole" => { #[allow(non_camel_case_types)] struct AssignUserRoleSvc(pub Arc); diff --git a/server b/server index 5dd123bf..3f4c9dfd 160000 --- a/server +++ b/server @@ -1 +1 @@ -Subproject commit 5dd123bf34e3254520e4d198494872601a34f8d0 +Subproject commit 3f4c9dfdfa480c7213fb0850b72e114379bb4c47