dynamic rbac and roles2

common/proto/auth.proto

@@ -22,6 +22,7 @@ service AuthService {
   rpc GrantPermission(GrantPermissionRequest) returns (RolePermissions);
   rpc RevokePermission(RevokePermissionRequest) returns (RolePermissions);
   rpc ListRolePermissions(ListRolePermissionsRequest) returns (RolePermissions);
+  rpc ListGrantableObjects(ListGrantableObjectsRequest) returns (ListGrantableObjectsResponse);
 
   // User administration.
   rpc AssignUserRole(AssignUserRoleRequest) returns (UserSummary);
@@ -145,6 +146,30 @@ message RolePermissions {
   repeated Permission effective_permissions = 3;
 }
 
+message ListGrantableObjectsRequest {
+  // The role being edited. The response contains only actions that may be
+  // granted to this role by the caller.
+  string target_role = 1;
+}
+
+message GrantableObject {
+  // Canonical value accepted by GrantPermission, for example
+  // data:acme/invoices.
+  string object = 1;
+  // Empty only for the data:* and journal:* global wildcards.
+  string profile = 2;
+  // Set only for a table-family root.
+  string table = 3;
+  // One of global_data, global_journal, profile, journal, or table.
+  string kind = 4;
+  // Actions the caller may grant to target_role for this object.
+  repeated string allowed_actions = 5;
+}
+
+message ListGrantableObjectsResponse {
+  repeated GrantableObject objects = 1;
+}
+
 message AssignUserRoleRequest {
   string username = 1;
   string role = 2;