1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
// @generated
// This file is @generated by prost-build.
/// A column referenced by a policy, together with the alias it is bound to in the
/// row-filter or column-mask function invocation.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct MatchColumn {
/// The name of the alias the column is bound to when invoking the row-filter or
/// column-mask function.
#[prost(string, tag="1")]
pub alias: ::prost::alloc::string::String,
/// The condition on the column, e.g. its name, that must match for this binding to apply.
#[prost(string, tag="2")]
pub condition: ::prost::alloc::string::String,
}
/// An argument passed to a row-filter or column-mask function.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct FunctionArg {
#[prost(oneof="function_arg::Value", tags="1, 2")]
pub value: ::core::option::Option<function_arg::Value>,
}
/// Nested message and enum types in `FunctionArg`.
pub mod function_arg {
#[cfg_attr(feature = "python", ::pyo3::pyclass)]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Oneof)]
pub enum Value {
/// References a column via its `MatchColumn.alias`.
#[prost(string, tag="1")]
Alias(::prost::alloc::string::String),
/// A literal constant value, passed as-is to the function.
#[prost(string, tag="2")]
Constant(::prost::alloc::string::String),
}
}
/// A reference to the SQL function that implements a row-filter or column-mask policy,
/// together with the arguments it is invoked with.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct FunctionRef {
/// Fully qualified name of the function (catalog.schema.function) to invoke.
#[prost(string, tag="1")]
pub function_name: ::prost::alloc::string::String,
/// The arguments passed to the function, in declaration order.
#[prost(message, repeated, tag="2")]
pub using: ::prost::alloc::vec::Vec<FunctionArg>,
}
/// A row-filter or column-mask policy bound to principals and scoped to a securable.
///
/// Policies are read as whole documents; enforcement is performed by the query engine,
/// not by this service. `when_condition` is stored and returned opaque — this service does
/// not parse or evaluate it.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct PolicyInfo {
/// The name of the policy. Unique within the securable it is defined on.
#[prost(string, tag="1")]
pub name: ::prost::alloc::string::String,
/// Server-assigned unique identifier for the policy.
#[prost(string, optional, tag="2")]
pub id: ::core::option::Option<::prost::alloc::string::String>,
/// The type of securable the policy is defined on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="3")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable the policy is defined on.
#[prost(string, tag="4")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// The kind of enforcement this policy applies.
#[prost(enumeration="PolicyType", tag="5")]
pub policy_type: i32,
/// The principals the policy applies to. Empty means "all principals".
#[prost(string, repeated, tag="6")]
pub to_principals: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
/// The principals explicitly excluded from the policy, even if matched by to_principals.
#[prost(string, repeated, tag="7")]
pub except_principals: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
/// An opaque condition expression, e.g. "hasTagValue('env','prod')", evaluated by the
/// query engine at enforcement time. Stored and returned as-is; not parsed server-side.
#[prost(string, optional, tag="8")]
pub when_condition: ::core::option::Option<::prost::alloc::string::String>,
/// The columns referenced by the row-filter or column-mask function, and the aliases
/// they are bound to.
#[prost(message, repeated, tag="9")]
pub match_columns: ::prost::alloc::vec::Vec<MatchColumn>,
/// User-provided free-form text description of the policy.
#[prost(string, optional, tag="12")]
pub comment: ::core::option::Option<::prost::alloc::string::String>,
/// Time at which this policy was created, in epoch milliseconds.
#[prost(int64, optional, tag="13")]
pub created_at: ::core::option::Option<i64>,
/// Time at which this policy was last updated, in epoch milliseconds.
#[prost(int64, optional, tag="14")]
pub updated_at: ::core::option::Option<i64>,
#[prost(oneof="policy_info::Function", tags="10, 11")]
pub function: ::core::option::Option<policy_info::Function>,
}
/// Nested message and enum types in `PolicyInfo`.
pub mod policy_info {
#[cfg_attr(feature = "python", ::pyo3::pyclass)]
#[derive(Clone, PartialEq, ::prost::Oneof)]
pub enum Function {
/// The row-filter function to invoke. Set only when policy_type is POLICY_TYPE_ROW_FILTER.
#[prost(message, tag="10")]
RowFilter(super::FunctionRef),
/// The column-mask function to invoke. Set only when policy_type is POLICY_TYPE_COLUMN_MASK.
#[prost(message, tag="11")]
ColumnMask(super::FunctionRef),
}
}
/// The kind of enforcement a policy applies.
#[cfg_attr(feature = "python", ::pyo3::pyclass)]
#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
#[repr(i32)]
pub enum PolicyType {
Unspecified = 0,
/// Filters rows returned from the securable based on the when_condition and match_columns.
RowFilter = 1,
/// Masks a column's values for callers matched by the when_condition.
ColumnMask = 2,
}
impl PolicyType {
/// String value of the enum field names used in the ProtoBuf definition.
///
/// The values are not transformed in any way and thus are considered stable
/// (if the ProtoBuf definition does not change) and safe for programmatic use.
pub fn as_str_name(&self) -> &'static str {
match self {
Self::Unspecified => "POLICY_TYPE_UNSPECIFIED",
Self::RowFilter => "POLICY_TYPE_ROW_FILTER",
Self::ColumnMask => "POLICY_TYPE_COLUMN_MASK",
}
}
/// Creates an enum from field names used in the ProtoBuf definition.
pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
match value {
"POLICY_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
"POLICY_TYPE_ROW_FILTER" => Some(Self::RowFilter),
"POLICY_TYPE_COLUMN_MASK" => Some(Self::ColumnMask),
_ => None,
}
}
}
/// List policies defined on a securable.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct ListPoliciesRequest {
/// The type of the securable to list policies on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="1")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable to list policies on.
#[prost(string, tag="2")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// When true, also return policies defined on the securable's ancestors
/// (e.g. for a table: its schema and catalog). Each returned PolicyInfo still
/// carries its own on_securable_type / on_securable_fullname, so callers can see
/// where it was defined.
#[prost(bool, optional, tag="3")]
pub include_inherited: ::core::option::Option<bool>,
/// The maximum number of results per page that should be returned.
#[prost(int32, optional, tag="4")]
pub max_results: ::core::option::Option<i32>,
/// Opaque pagination token to go to next page based on previous query.
#[prost(string, optional, tag="5")]
pub page_token: ::core::option::Option<::prost::alloc::string::String>,
}
/// List policies response.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct ListPoliciesResponse {
/// The policies returned.
#[prost(message, repeated, tag="1")]
pub policies: ::prost::alloc::vec::Vec<PolicyInfo>,
/// The next_page_token value to include in the next List request.
#[prost(string, optional, tag="2")]
pub next_page_token: ::core::option::Option<::prost::alloc::string::String>,
}
/// Create a new policy on a securable.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct CreatePolicyRequest {
/// The type of the securable to create the policy on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="1")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable to create the policy on.
#[prost(string, tag="2")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// The policy to create.
#[prost(message, optional, tag="3")]
pub policy_info: ::core::option::Option<PolicyInfo>,
}
/// Get a policy defined on a securable.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct GetPolicyRequest {
/// The type of the securable the policy is defined on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="1")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable the policy is defined on.
#[prost(string, tag="2")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// The name of the policy.
#[prost(string, tag="3")]
pub name: ::prost::alloc::string::String,
}
/// Update a policy defined on a securable.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct UpdatePolicyRequest {
/// The type of the securable the policy is defined on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="1")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable the policy is defined on.
#[prost(string, tag="2")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// The name of the policy to update.
#[prost(string, tag="3")]
pub name: ::prost::alloc::string::String,
/// The policy with the updated fields.
#[prost(message, optional, tag="4")]
pub policy_info: ::core::option::Option<PolicyInfo>,
/// The list of fields to update, as a comma-separated string.
#[prost(string, optional, tag="5")]
pub update_mask: ::core::option::Option<::prost::alloc::string::String>,
}
/// Delete a policy defined on a securable.
#[cfg_attr(feature = "python", ::pyo3::pyclass(get_all, set_all))]
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct DeletePolicyRequest {
/// The type of the securable the policy is defined on.
///
/// Supported values: catalogs, schemas, tables.
#[prost(string, tag="1")]
pub on_securable_type: ::prost::alloc::string::String,
/// The fully qualified name of the securable the policy is defined on.
#[prost(string, tag="2")]
pub on_securable_fullname: ::prost::alloc::string::String,
/// The name of the policy to delete.
#[prost(string, tag="3")]
pub name: ::prost::alloc::string::String,
}
include!("unitycatalog.policies.v1.serde.rs");
// @@protoc_insertion_point(module)