Skip to content

Commit f2df05d

Browse files
oguzhand95oguzhand95
authored
chore: Update protos (#133)
Signed-off-by: Oğuzhan Durgun <[email protected]>
1 parent 919e33f commit f2df05d

File tree

11 files changed

+1749
-599
lines changed

11 files changed

+1749
-599
lines changed

‎.github/renovate.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@
2424
}
2525
],
2626
"labels": [
27-
"chore",
28-
"ci",
29-
"bots"
27+
"area/ci",
28+
"bots",
29+
"kind/chore"
3030
]
3131
}

‎buf.lock

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ deps:
99
- remote: buf.build
1010
owner: cerbos
1111
repository: cerbos-api
12-
commit: 75004b0044b24782a2000dbf4f395cd1
13-
digest: shake256:e11642fbe5550cae550115f8a857a89726d373f79766d82bcaea41c88d3436c12fb953d7af5a4eed18e5feffd3ea80ae072ca42f70aceea019eb046be09d833d
12+
commit: df180e07d6154eb8a2d7801459003b9f
13+
digest: shake256:b2712ba97cdbf03c5111261ed409b5d77cf0c9aa2336cfb6a4f78a22f75598e3ff30efba74429cb91ef1edad3eed653f1a4a1f2741671d434846ef6db4faeb05
1414
- remote: buf.build
1515
owner: googleapis
1616
repository: googleapis

‎proto/cerbos/request/v1/request.proto

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -631,6 +631,28 @@ message EnablePolicyRequest {
631631
];
632632
}
633633

634+
message InspectPoliciesRequest {
635+
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
636+
json_schema: {description: "Inspect policies request"}
637+
};
638+
bool include_disabled = 1 [
639+
(google.api.field_behavior) = OPTIONAL,
640+
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Include disabled policies"}
641+
];
642+
string name_regexp = 2 [
643+
(google.api.field_behavior) = OPTIONAL,
644+
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Filter policies by name with regexp"}
645+
];
646+
string scope_regexp = 3 [
647+
(google.api.field_behavior) = OPTIONAL,
648+
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Filter policies by scope with regexp"}
649+
];
650+
string version_regexp = 4 [
651+
(google.api.field_behavior) = OPTIONAL,
652+
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Filter policies by version with regexp"}
653+
];
654+
}
655+
634656
message AddOrUpdateSchemaRequest {
635657
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
636658
json_schema: {description: "Add/update schema request"}

‎proto/cerbos/response/v1/response.proto

Lines changed: 90 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,10 @@ message CheckResourceSetResponse {
7272

7373
message ActionEffectMap {
7474
map<string, cerbos.effect.v1.Effect> actions = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Mapping of each action to an effect."}];
75-
repeated cerbos.schema.v1.ValidationError validation_errors = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "List of validation errors (if schema validation is enabled)"}];
75+
repeated cerbos.schema.v1.ValidationError validation_errors = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description:
76+
"List of validation errors (if schema validation is "
77+
"enabled)"
78+
}];
7679
}
7780

7881
message Meta {
@@ -99,18 +102,32 @@ message CheckResourceSetResponse {
99102
json_schema: {description: "Unique resource instance ID supplied in the request."}
100103
};
101104
map<string, EffectMeta> actions = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
102-
description: "Metadata about the effect calculated for each action on this resource instance."
103-
example: "{\"view:*\":{\"matched_policy\": \"album:object:default\"},\"comment\":{\"matched_policy\": \"album:object:default\"}}"
105+
description:
106+
"Metadata about the effect calculated for each "
107+
"action on this resource instance."
108+
example:
109+
"{\"view:*\":{\"matched_policy\": "
110+
"\"album:object:default\"},\"comment\":{\"matched_"
111+
"policy\": \"album:object:default\"}}"
104112
}];
105113
repeated string effective_derived_roles = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
106-
description: "Derived roles that were effective during policy evaluation."
114+
description:
115+
"Derived roles that were effective during policy "
116+
"evaluation."
107117
example: "[\"owner\"]"
108118
}];
109119
}
110120

111121
map<string, ActionMeta> resource_instances = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
112122
description: "Metadata about resource instances."
113-
example: "{\"XX125\": {\"actions\": {\"view:*\":{\"matched_policy\": \"album:object:default\"},\"comment\":{\"matched_policy\": \"album:object:default\"}}, \"effective_derived_roles\": [\"owner\"]}, \"XX225\": {\"actions\": {\"view:*\":{\"matched_policy\": \"album:object:default\"},\"comment\":{\"matched_policy\": \"album:object:default\"}}}}"
123+
example:
124+
"{\"XX125\": {\"actions\": {\"view:*\":{\"matched_policy\": "
125+
"\"album:object:default\"},\"comment\":{\"matched_policy\": "
126+
"\"album:object:default\"}}, \"effective_derived_roles\": "
127+
"[\"owner\"]}, \"XX225\": {\"actions\": "
128+
"{\"view:*\":{\"matched_policy\": "
129+
"\"album:object:default\"},\"comment\":{\"matched_policy\": "
130+
"\"album:object:default\"}}}}"
114131
}];
115132
}
116133

@@ -119,8 +136,14 @@ message CheckResourceSetResponse {
119136
example: "\"c2db17b8-4f9f-4fb1-acfd-9162a02be42b\""
120137
}];
121138
map<string, ActionEffectMap> resource_instances = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
122-
description: "Results for each resource instance, keyed by the ID supplied in the request"
123-
example: "{\"XX125\":{\"actions\":{\"view:*\":\"EFFECT_ALLOW\", \"comment\": \"EFFECT_ALLOW\"}}, \"XX225\":{\"actions\":{\"view:*\":\"EFFECT_DENY\", \"comment\": \"EFFECT_DENY\"}}}"
139+
description:
140+
"Results for each resource instance, keyed by the ID "
141+
"supplied in the request"
142+
example:
143+
"{\"XX125\":{\"actions\":{\"view:*\":\"EFFECT_ALLOW\", "
144+
"\"comment\": \"EFFECT_ALLOW\"}}, "
145+
"\"XX225\":{\"actions\":{\"view:*\":\"EFFECT_DENY\", "
146+
"\"comment\": \"EFFECT_DENY\"}}}"
124147
}];
125148
Meta meta = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Optional metadata about the request evaluation process"}];
126149
}
@@ -140,7 +163,10 @@ message CheckResourceBatchResponse {
140163
description: "Mapping of each action to an effect."
141164
example: "{\"view\":\"EFFECT_ALLOW\"}"
142165
}];
143-
repeated cerbos.schema.v1.ValidationError validation_errors = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "List of validation errors (if schema validation is enabled)"}];
166+
repeated cerbos.schema.v1.ValidationError validation_errors = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description:
167+
"List of validation errors (if schema validation is "
168+
"enabled)"
169+
}];
144170
}
145171

146172
string request_id = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -149,7 +175,9 @@ message CheckResourceBatchResponse {
149175
}];
150176
repeated ActionEffectMap results = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
151177
description: "Result for each resource"
152-
example: "[{\"resourceId\":\"XX125\",\"actions\":{\"view\":\"EFFECT_ALLOW\"}}]"
178+
example:
179+
"[{\"resourceId\":\"XX125\",\"actions\":{\"view\":\"EFFECT_"
180+
"ALLOW\"}}]"
153181
}];
154182
}
155183

@@ -169,12 +197,18 @@ message CheckResourcesResponse {
169197
example: "\"album:photo\"",
170198
}];
171199
string policy_version = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
172-
description: "The policy version to use to evaluate this request. If not specified, will default to the server-configured default version."
200+
description:
201+
"The policy version to use to evaluate this request. "
202+
"If not specified, will default to the "
203+
"server-configured default version."
173204
pattern: "^[[:word:]]*$"
174205
example: "\"default\""
175206
}];
176207
string scope = 4 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
177-
description: "A dot-separated scope that describes the hierarchy this resource belongs to. This is used for determining policy inheritance."
208+
description:
209+
"A dot-separated scope that describes the hierarchy "
210+
"this resource belongs to. This is used for "
211+
"determining policy inheritance."
178212
pattern: "^([[:alnum:]][[:word:]\\-]*(\\.[[:word:]\\-]*)*)*$"
179213
example: "\"acme.corp\""
180214
}];
@@ -200,11 +234,18 @@ message CheckResourcesResponse {
200234
}
201235

202236
map<string, EffectMeta> actions = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
203-
description: "Metadata about the effect calculated for each action on this resource instance."
204-
example: "{\"view:*\":{\"matched_policy\": \"album:object:default\"},\"comment\":{\"matched_policy\": \"album:object:default\"}}"
237+
description:
238+
"Metadata about the effect calculated for each "
239+
"action on this resource instance."
240+
example:
241+
"{\"view:*\":{\"matched_policy\": "
242+
"\"album:object:default\"},\"comment\":{\"matched_"
243+
"policy\": \"album:object:default\"}}"
205244
}];
206245
repeated string effective_derived_roles = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
207-
description: "Derived roles that were effective during policy evaluation."
246+
description:
247+
"Derived roles that were effective during policy "
248+
"evaluation."
208249
example: "[\"owner\"]"
209250
}];
210251
}
@@ -214,14 +255,24 @@ message CheckResourcesResponse {
214255
description: "Mapping of each action to an effect."
215256
example: "{\"view\":\"EFFECT_ALLOW\"}"
216257
}];
217-
repeated cerbos.schema.v1.ValidationError validation_errors = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "List of validation errors (if schema validation is enabled)"}];
258+
repeated cerbos.schema.v1.ValidationError validation_errors = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description:
259+
"List of validation errors (if schema validation is "
260+
"enabled)"
261+
}];
218262
Meta meta = 4 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
219263
description: "Metadata about policy evaluation"
220-
example: "{\"actions\": {\"view:*\":{\"matched_policy\": \"album:object:default\"},\"comment\":{\"matched_policy\": \"album:object:default\"}}, \"effective_derived_roles\": [\"owner\"]}"
264+
example:
265+
"{\"actions\": {\"view:*\":{\"matched_policy\": "
266+
"\"album:object:default\"},\"comment\":{\"matched_policy\":"
267+
" \"album:object:default\"}}, \"effective_derived_roles\": "
268+
"[\"owner\"]}"
221269
}];
222270
repeated cerbos.engine.v1.OutputEntry outputs = 5 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
223271
description: "Output for each rule with outputs configured"
224-
example: "[{\"src\": \"resource.expense.v1/acme#rule-001\", \"val\": \"view_allowed:alice\"}, {\"src\": \"resource.expense.v1/acme#rule-002\", \"val\": \"foo\"}]"
272+
example:
273+
"[{\"src\": \"resource.expense.v1/acme#rule-001\", "
274+
"\"val\": \"view_allowed:alice\"}, {\"src\": "
275+
"\"resource.expense.v1/acme#rule-002\", \"val\": \"foo\"}]"
225276
}];
226277
}
227278

@@ -231,7 +282,10 @@ message CheckResourcesResponse {
231282
}];
232283
repeated ResultEntry results = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
233284
description: "Result for each resource"
234-
example: "[{\"resource\": {\"Id\":\"XX125\", \"kind\":\"album:object\"}, \"actions\":{\"view\":\"EFFECT_ALLOW\",\"comment\":\"EFFECT_DENY\"}}]"
285+
example:
286+
"[{\"resource\": {\"Id\":\"XX125\", \"kind\":\"album:object\"}, "
287+
"\"actions\":{\"view\":\"EFFECT_ALLOW\",\"comment\":\"EFFECT_"
288+
"DENY\"}}]"
235289
}];
236290
string cerbos_call_id = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "Audit log call ID associated with this request"}];
237291
}
@@ -241,9 +295,16 @@ message PlaygroundFailure {
241295
json_schema: {description: "Playground response"}
242296
};
243297

298+
message ErrorDetails {
299+
uint32 line = 1;
300+
uint32 column = 2;
301+
string context = 3;
302+
}
303+
244304
message Error {
245305
string file = 1;
246306
string error = 2;
307+
ErrorDetails details = 3;
247308
}
248309

249310
repeated Error errors = 1;
@@ -379,6 +440,17 @@ message EnablePolicyResponse {
379440
uint32 enabled_policies = 1;
380441
}
381442

443+
message InspectPoliciesResponse {
444+
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
445+
json_schema: {description: "Inspect policies response"}
446+
};
447+
message Result {
448+
repeated string actions = 1;
449+
}
450+
451+
map<string, Result> results = 1;
452+
}
453+
382454
message AddOrUpdateSchemaResponse {
383455
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_schema) = {
384456
json_schema: {description: "Add/update schema response"}

‎proto/cerbos/svc/v1/svc.proto

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,19 @@ service CerbosAdminService {
116116
};
117117
}
118118

119+
rpc InspectPolicies(cerbos.request.v1.InspectPoliciesRequest) returns (cerbos.response.v1.InspectPoliciesResponse) {
120+
option (google.api.http) = {get: "/admin/policies/inspect"};
121+
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
122+
summary: "Inspect policies in the store",
123+
security: {
124+
security_requirement: {
125+
key: "BasicAuth";
126+
value: {};
127+
}
128+
}
129+
};
130+
}
131+
119132
rpc ListPolicies(cerbos.request.v1.ListPoliciesRequest) returns (cerbos.response.v1.ListPoliciesResponse) {
120133
option (google.api.http) = {get: "/admin/policies"};
121134
option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {

0 commit comments

Comments
 (0)