gcloud_googleapis/google.iam.v1.rs
1// This file is @generated by prost-build.
2/// Encapsulates settings provided to GetIamPolicy.
3#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
4pub struct GetPolicyOptions {
5 /// Optional. The maximum policy version that will be used to format the
6 /// policy.
7 ///
8 /// Valid values are 0, 1, and 3. Requests specifying an invalid value will be
9 /// rejected.
10 ///
11 /// Requests for policies with any conditional role bindings must specify
12 /// version 3. Policies with no conditional role bindings may specify any valid
13 /// value or leave the field unset.
14 ///
15 /// The policy in the response might use the policy version that you specified,
16 /// or it might use a lower policy version. For example, if you specify version
17 /// 3, but the policy has no conditional role bindings, the response uses
18 /// version 1.
19 ///
20 /// To learn which resources support conditions in their IAM policies, see the
21 /// [IAM
22 /// documentation](<https://cloud.google.com/iam/help/conditions/resource-policies>).
23 #[prost(int32, tag = "1")]
24 pub requested_policy_version: i32,
25}
26/// An Identity and Access Management (IAM) policy, which specifies access
27/// controls for Google Cloud resources.
28///
29/// A `Policy` is a collection of `bindings`. A `binding` binds one or more
30/// `members`, or principals, to a single `role`. Principals can be user
31/// accounts, service accounts, Google groups, and domains (such as G Suite). A
32/// `role` is a named list of permissions; each `role` can be an IAM predefined
33/// role or a user-created custom role.
34///
35/// For some types of Google Cloud resources, a `binding` can also specify a
36/// `condition`, which is a logical expression that allows access to a resource
37/// only if the expression evaluates to `true`. A condition can add constraints
38/// based on attributes of the request, the resource, or both. To learn which
39/// resources support conditions in their IAM policies, see the
40/// [IAM
41/// documentation](<https://cloud.google.com/iam/help/conditions/resource-policies>).
42///
43/// **JSON example:**
44///
45/// ```text,
46/// {
47/// "bindings": [
48/// {
49/// "role": "roles/resourcemanager.organizationAdmin",
50/// "members": [
51/// "user:mike@example.com",
52/// "group:admins@example.com",
53/// "domain:google.com",
54/// "serviceAccount:my-project-id@appspot.gserviceaccount.com"
55/// ]
56/// },
57/// {
58/// "role": "roles/resourcemanager.organizationViewer",
59/// "members": [
60/// "user:eve@example.com"
61/// ],
62/// "condition": {
63/// "title": "expirable access",
64/// "description": "Does not grant access after Sep 2020",
65/// "expression": "request.time <
66/// timestamp('2020-10-01T00:00:00.000Z')",
67/// }
68/// }
69/// ],
70/// "etag": "BwWWja0YfJA=",
71/// "version": 3
72/// }
73/// ```
74///
75/// **YAML example:**
76///
77/// ```text,
78/// bindings:
79/// - members:
80/// - user:mike@example.com
81/// - group:admins@example.com
82/// - domain:google.com
83/// - serviceAccount:my-project-id@appspot.gserviceaccount.com
84/// role: roles/resourcemanager.organizationAdmin
85/// - members:
86/// - user:eve@example.com
87/// role: roles/resourcemanager.organizationViewer
88/// condition:
89/// title: expirable access
90/// description: Does not grant access after Sep 2020
91/// expression: request.time < timestamp('2020-10-01T00:00:00.000Z')
92/// etag: BwWWja0YfJA=
93/// version: 3
94/// ```
95///
96/// For a description of IAM and its features, see the
97/// [IAM documentation](<https://cloud.google.com/iam/docs/>).
98#[derive(Clone, PartialEq, ::prost::Message)]
99pub struct Policy {
100 /// Specifies the format of the policy.
101 ///
102 /// Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
103 /// are rejected.
104 ///
105 /// Any operation that affects conditional role bindings must specify version
106 /// `3`. This requirement applies to the following operations:
107 ///
108 /// * Getting a policy that includes a conditional role binding
109 /// * Adding a conditional role binding to a policy
110 /// * Changing a conditional role binding in a policy
111 /// * Removing any role binding, with or without a condition, from a policy
112 /// that includes conditions
113 ///
114 /// **Important:** If you use IAM Conditions, you must include the `etag` field
115 /// whenever you call `setIamPolicy`. If you omit this field, then IAM allows
116 /// you to overwrite a version `3` policy with a version `1` policy, and all of
117 /// the conditions in the version `3` policy are lost.
118 ///
119 /// If a policy does not include any conditions, operations on that policy may
120 /// specify any valid version or leave the field unset.
121 ///
122 /// To learn which resources support conditions in their IAM policies, see the
123 /// [IAM
124 /// documentation](<https://cloud.google.com/iam/help/conditions/resource-policies>).
125 #[prost(int32, tag = "1")]
126 pub version: i32,
127 /// Associates a list of `members`, or principals, with a `role`. Optionally,
128 /// may specify a `condition` that determines how and when the `bindings` are
129 /// applied. Each of the `bindings` must contain at least one principal.
130 ///
131 /// The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
132 /// of these principals can be Google groups. Each occurrence of a principal
133 /// counts towards these limits. For example, if the `bindings` grant 50
134 /// different roles to `user:alice@example.com`, and not to any other
135 /// principal, then you can add another 1,450 principals to the `bindings` in
136 /// the `Policy`.
137 #[prost(message, repeated, tag = "4")]
138 pub bindings: ::prost::alloc::vec::Vec<Binding>,
139 /// Specifies cloud audit logging configuration for this policy.
140 #[prost(message, repeated, tag = "6")]
141 pub audit_configs: ::prost::alloc::vec::Vec<AuditConfig>,
142 /// `etag` is used for optimistic concurrency control as a way to help
143 /// prevent simultaneous updates of a policy from overwriting each other.
144 /// It is strongly suggested that systems make use of the `etag` in the
145 /// read-modify-write cycle to perform policy updates in order to avoid race
146 /// conditions: An `etag` is returned in the response to `getIamPolicy`, and
147 /// systems are expected to put that etag in the request to `setIamPolicy` to
148 /// ensure that their change will be applied to the same version of the policy.
149 ///
150 /// **Important:** If you use IAM Conditions, you must include the `etag` field
151 /// whenever you call `setIamPolicy`. If you omit this field, then IAM allows
152 /// you to overwrite a version `3` policy with a version `1` policy, and all of
153 /// the conditions in the version `3` policy are lost.
154 #[prost(bytes = "vec", tag = "3")]
155 pub etag: ::prost::alloc::vec::Vec<u8>,
156}
157/// Associates `members`, or principals, with a `role`.
158#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
159pub struct Binding {
160 /// Role that is assigned to the list of `members`, or principals.
161 /// For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
162 #[prost(string, tag = "1")]
163 pub role: ::prost::alloc::string::String,
164 /// Specifies the principals requesting access for a Google Cloud resource.
165 /// `members` can have the following values:
166 ///
167 /// * `allUsers`: A special identifier that represents anyone who is
168 /// on the internet; with or without a Google account.
169 ///
170 /// * `allAuthenticatedUsers`: A special identifier that represents anyone
171 /// who is authenticated with a Google account or a service account.
172 ///
173 /// * `user:{emailid}`: An email address that represents a specific Google
174 /// account. For example, `alice@example.com` .
175 ///
176 /// * `serviceAccount:{emailid}`: An email address that represents a service
177 /// account. For example, `my-other-app@appspot.gserviceaccount.com`.
178 ///
179 /// * `group:{emailid}`: An email address that represents a Google group.
180 /// For example, `admins@example.com`.
181 ///
182 /// * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
183 /// identifier) representing a user that has been recently deleted. For
184 /// example, `alice@example.com?uid=123456789012345678901`. If the user is
185 /// recovered, this value reverts to `user:{emailid}` and the recovered user
186 /// retains the role in the binding.
187 ///
188 /// * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
189 /// unique identifier) representing a service account that has been recently
190 /// deleted. For example,
191 /// `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`.
192 /// If the service account is undeleted, this value reverts to
193 /// `serviceAccount:{emailid}` and the undeleted service account retains the
194 /// role in the binding.
195 ///
196 /// * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
197 /// identifier) representing a Google group that has been recently
198 /// deleted. For example, `admins@example.com?uid=123456789012345678901`. If
199 /// the group is recovered, this value reverts to `group:{emailid}` and the
200 /// recovered group retains the role in the binding.
201 ///
202 /// * `domain:{domain}`: The G Suite domain (primary) that represents all the
203 /// users of that domain. For example, `google.com` or `example.com`.
204 #[prost(string, repeated, tag = "2")]
205 pub members: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
206 /// The condition that is associated with this binding.
207 ///
208 /// If the condition evaluates to `true`, then this binding applies to the
209 /// current request.
210 ///
211 /// If the condition evaluates to `false`, then this binding does not apply to
212 /// the current request. However, a different role binding might grant the same
213 /// role to one or more of the principals in this binding.
214 ///
215 /// To learn which resources support conditions in their IAM policies, see the
216 /// [IAM
217 /// documentation](<https://cloud.google.com/iam/help/conditions/resource-policies>).
218 #[prost(message, optional, tag = "3")]
219 pub condition: ::core::option::Option<super::super::r#type::Expr>,
220}
221/// Specifies the audit configuration for a service.
222/// The configuration determines which permission types are logged, and what
223/// identities, if any, are exempted from logging.
224/// An AuditConfig must have one or more AuditLogConfigs.
225///
226/// If there are AuditConfigs for both `allServices` and a specific service,
227/// the union of the two AuditConfigs is used for that service: the log_types
228/// specified in each AuditConfig are enabled, and the exempted_members in each
229/// AuditLogConfig are exempted.
230///
231/// Example Policy with multiple AuditConfigs:
232///
233/// ```text
234/// {
235/// "audit_configs": [
236/// {
237/// "service": "allServices",
238/// "audit_log_configs": [
239/// {
240/// "log_type": "DATA_READ",
241/// "exempted_members": [
242/// "user:jose@example.com"
243/// ]
244/// },
245/// {
246/// "log_type": "DATA_WRITE"
247/// },
248/// {
249/// "log_type": "ADMIN_READ"
250/// }
251/// ]
252/// },
253/// {
254/// "service": "sampleservice.googleapis.com",
255/// "audit_log_configs": [
256/// {
257/// "log_type": "DATA_READ"
258/// },
259/// {
260/// "log_type": "DATA_WRITE",
261/// "exempted_members": [
262/// "user:aliya@example.com"
263/// ]
264/// }
265/// ]
266/// }
267/// ]
268/// }
269/// ```
270///
271/// For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
272/// logging. It also exempts `jose@example.com` from DATA_READ logging, and
273/// `aliya@example.com` from DATA_WRITE logging.
274#[derive(Clone, PartialEq, ::prost::Message)]
275pub struct AuditConfig {
276 /// Specifies a service that will be enabled for audit logging.
277 /// For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
278 /// `allServices` is a special value that covers all services.
279 #[prost(string, tag = "1")]
280 pub service: ::prost::alloc::string::String,
281 /// The configuration for logging of each type of permission.
282 #[prost(message, repeated, tag = "3")]
283 pub audit_log_configs: ::prost::alloc::vec::Vec<AuditLogConfig>,
284}
285/// Provides the configuration for logging a type of permissions.
286/// Example:
287///
288/// ```text
289/// {
290/// "audit_log_configs": [
291/// {
292/// "log_type": "DATA_READ",
293/// "exempted_members": [
294/// "user:jose@example.com"
295/// ]
296/// },
297/// {
298/// "log_type": "DATA_WRITE"
299/// }
300/// ]
301/// }
302/// ```
303///
304/// This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
305/// jose@example.com from DATA_READ logging.
306#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
307pub struct AuditLogConfig {
308 /// The log type that this config enables.
309 #[prost(enumeration = "audit_log_config::LogType", tag = "1")]
310 pub log_type: i32,
311 /// Specifies the identities that do not cause logging for this type of
312 /// permission.
313 /// Follows the same format of
314 /// \[Binding.members\]\[google.iam.v1.Binding.members\].
315 #[prost(string, repeated, tag = "2")]
316 pub exempted_members: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
317}
318/// Nested message and enum types in `AuditLogConfig`.
319pub mod audit_log_config {
320 /// The list of valid permission types for which logging can be configured.
321 /// Admin writes are always logged, and are not configurable.
322 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
323 #[repr(i32)]
324 pub enum LogType {
325 /// Default case. Should never be this.
326 Unspecified = 0,
327 /// Admin reads. Example: CloudIAM getIamPolicy
328 AdminRead = 1,
329 /// Data writes. Example: CloudSQL Users create
330 DataWrite = 2,
331 /// Data reads. Example: CloudSQL Users list
332 DataRead = 3,
333 }
334 impl LogType {
335 /// String value of the enum field names used in the ProtoBuf definition.
336 ///
337 /// The values are not transformed in any way and thus are considered stable
338 /// (if the ProtoBuf definition does not change) and safe for programmatic use.
339 pub fn as_str_name(&self) -> &'static str {
340 match self {
341 Self::Unspecified => "LOG_TYPE_UNSPECIFIED",
342 Self::AdminRead => "ADMIN_READ",
343 Self::DataWrite => "DATA_WRITE",
344 Self::DataRead => "DATA_READ",
345 }
346 }
347 /// Creates an enum from field names used in the ProtoBuf definition.
348 pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
349 match value {
350 "LOG_TYPE_UNSPECIFIED" => Some(Self::Unspecified),
351 "ADMIN_READ" => Some(Self::AdminRead),
352 "DATA_WRITE" => Some(Self::DataWrite),
353 "DATA_READ" => Some(Self::DataRead),
354 _ => None,
355 }
356 }
357 }
358}
359/// The difference delta between two policies.
360#[derive(Clone, PartialEq, ::prost::Message)]
361pub struct PolicyDelta {
362 /// The delta for Bindings between two policies.
363 #[prost(message, repeated, tag = "1")]
364 pub binding_deltas: ::prost::alloc::vec::Vec<BindingDelta>,
365 /// The delta for AuditConfigs between two policies.
366 #[prost(message, repeated, tag = "2")]
367 pub audit_config_deltas: ::prost::alloc::vec::Vec<AuditConfigDelta>,
368}
369/// One delta entry for Binding. Each individual change (only one member in each
370/// entry) to a binding will be a separate entry.
371#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
372pub struct BindingDelta {
373 /// The action that was performed on a Binding.
374 /// Required
375 #[prost(enumeration = "binding_delta::Action", tag = "1")]
376 pub action: i32,
377 /// Role that is assigned to `members`.
378 /// For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
379 /// Required
380 #[prost(string, tag = "2")]
381 pub role: ::prost::alloc::string::String,
382 /// A single identity requesting access for a Google Cloud resource.
383 /// Follows the same format of Binding.members.
384 /// Required
385 #[prost(string, tag = "3")]
386 pub member: ::prost::alloc::string::String,
387 /// The condition that is associated with this binding.
388 #[prost(message, optional, tag = "4")]
389 pub condition: ::core::option::Option<super::super::r#type::Expr>,
390}
391/// Nested message and enum types in `BindingDelta`.
392pub mod binding_delta {
393 /// The type of action performed on a Binding in a policy.
394 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
395 #[repr(i32)]
396 pub enum Action {
397 /// Unspecified.
398 Unspecified = 0,
399 /// Addition of a Binding.
400 Add = 1,
401 /// Removal of a Binding.
402 Remove = 2,
403 }
404 impl Action {
405 /// String value of the enum field names used in the ProtoBuf definition.
406 ///
407 /// The values are not transformed in any way and thus are considered stable
408 /// (if the ProtoBuf definition does not change) and safe for programmatic use.
409 pub fn as_str_name(&self) -> &'static str {
410 match self {
411 Self::Unspecified => "ACTION_UNSPECIFIED",
412 Self::Add => "ADD",
413 Self::Remove => "REMOVE",
414 }
415 }
416 /// Creates an enum from field names used in the ProtoBuf definition.
417 pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
418 match value {
419 "ACTION_UNSPECIFIED" => Some(Self::Unspecified),
420 "ADD" => Some(Self::Add),
421 "REMOVE" => Some(Self::Remove),
422 _ => None,
423 }
424 }
425 }
426}
427/// One delta entry for AuditConfig. Each individual change (only one
428/// exempted_member in each entry) to a AuditConfig will be a separate entry.
429#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
430pub struct AuditConfigDelta {
431 /// The action that was performed on an audit configuration in a policy.
432 /// Required
433 #[prost(enumeration = "audit_config_delta::Action", tag = "1")]
434 pub action: i32,
435 /// Specifies a service that was configured for Cloud Audit Logging.
436 /// For example, `storage.googleapis.com`, `cloudsql.googleapis.com`.
437 /// `allServices` is a special value that covers all services.
438 /// Required
439 #[prost(string, tag = "2")]
440 pub service: ::prost::alloc::string::String,
441 /// A single identity that is exempted from "data access" audit
442 /// logging for the `service` specified above.
443 /// Follows the same format of Binding.members.
444 #[prost(string, tag = "3")]
445 pub exempted_member: ::prost::alloc::string::String,
446 /// Specifies the log_type that was be enabled. ADMIN_ACTIVITY is always
447 /// enabled, and cannot be configured.
448 /// Required
449 #[prost(string, tag = "4")]
450 pub log_type: ::prost::alloc::string::String,
451}
452/// Nested message and enum types in `AuditConfigDelta`.
453pub mod audit_config_delta {
454 /// The type of action performed on an audit configuration in a policy.
455 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord, ::prost::Enumeration)]
456 #[repr(i32)]
457 pub enum Action {
458 /// Unspecified.
459 Unspecified = 0,
460 /// Addition of an audit configuration.
461 Add = 1,
462 /// Removal of an audit configuration.
463 Remove = 2,
464 }
465 impl Action {
466 /// String value of the enum field names used in the ProtoBuf definition.
467 ///
468 /// The values are not transformed in any way and thus are considered stable
469 /// (if the ProtoBuf definition does not change) and safe for programmatic use.
470 pub fn as_str_name(&self) -> &'static str {
471 match self {
472 Self::Unspecified => "ACTION_UNSPECIFIED",
473 Self::Add => "ADD",
474 Self::Remove => "REMOVE",
475 }
476 }
477 /// Creates an enum from field names used in the ProtoBuf definition.
478 pub fn from_str_name(value: &str) -> ::core::option::Option<Self> {
479 match value {
480 "ACTION_UNSPECIFIED" => Some(Self::Unspecified),
481 "ADD" => Some(Self::Add),
482 "REMOVE" => Some(Self::Remove),
483 _ => None,
484 }
485 }
486 }
487}
488/// Request message for `SetIamPolicy` method.
489#[derive(Clone, PartialEq, ::prost::Message)]
490pub struct SetIamPolicyRequest {
491 /// REQUIRED: The resource for which the policy is being specified.
492 /// See the operation documentation for the appropriate value for this field.
493 #[prost(string, tag = "1")]
494 pub resource: ::prost::alloc::string::String,
495 /// REQUIRED: The complete policy to be applied to the `resource`. The size of
496 /// the policy is limited to a few 10s of KB. An empty policy is a
497 /// valid policy but certain Cloud Platform services (such as Projects)
498 /// might reject them.
499 #[prost(message, optional, tag = "2")]
500 pub policy: ::core::option::Option<Policy>,
501 /// OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
502 /// the fields in the mask will be modified. If no mask is provided, the
503 /// following default mask is used:
504 ///
505 /// `paths: "bindings, etag"`
506 #[prost(message, optional, tag = "3")]
507 pub update_mask: ::core::option::Option<::prost_types::FieldMask>,
508}
509/// Request message for `GetIamPolicy` method.
510#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
511pub struct GetIamPolicyRequest {
512 /// REQUIRED: The resource for which the policy is being requested.
513 /// See the operation documentation for the appropriate value for this field.
514 #[prost(string, tag = "1")]
515 pub resource: ::prost::alloc::string::String,
516 /// OPTIONAL: A `GetPolicyOptions` object for specifying options to
517 /// `GetIamPolicy`.
518 #[prost(message, optional, tag = "2")]
519 pub options: ::core::option::Option<GetPolicyOptions>,
520}
521/// Request message for `TestIamPermissions` method.
522#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
523pub struct TestIamPermissionsRequest {
524 /// REQUIRED: The resource for which the policy detail is being requested.
525 /// See the operation documentation for the appropriate value for this field.
526 #[prost(string, tag = "1")]
527 pub resource: ::prost::alloc::string::String,
528 /// The set of permissions to check for the `resource`. Permissions with
529 /// wildcards (such as '*' or 'storage.*') are not allowed. For more
530 /// information see
531 /// [IAM Overview](<https://cloud.google.com/iam/docs/overview#permissions>).
532 #[prost(string, repeated, tag = "2")]
533 pub permissions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
534}
535/// Response message for `TestIamPermissions` method.
536#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
537pub struct TestIamPermissionsResponse {
538 /// A subset of `TestPermissionsRequest.permissions` that the caller is
539 /// allowed.
540 #[prost(string, repeated, tag = "1")]
541 pub permissions: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
542}
543/// Generated client implementations.
544pub mod iam_policy_client {
545 #![allow(
546 unused_variables,
547 dead_code,
548 missing_docs,
549 clippy::wildcard_imports,
550 clippy::let_unit_value
551 )]
552 use tonic::codegen::http::Uri;
553 use tonic::codegen::*;
554 /// API Overview
555 ///
556 /// Manages Identity and Access Management (IAM) policies.
557 ///
558 /// Any implementation of an API that offers access control features
559 /// implements the google.iam.v1.IAMPolicy interface.
560 ///
561 /// ## Data model
562 ///
563 /// Access control is applied when a principal (user or service account), takes
564 /// some action on a resource exposed by a service. Resources, identified by
565 /// URI-like names, are the unit of access control specification. Service
566 /// implementations can choose the granularity of access control and the
567 /// supported permissions for their resources.
568 /// For example one database service may allow access control to be
569 /// specified only at the Table level, whereas another might allow access control
570 /// to also be specified at the Column level.
571 ///
572 /// ## Policy Structure
573 ///
574 /// See google.iam.v1.Policy
575 ///
576 /// This is intentionally not a CRUD style API because access control policies
577 /// are created and deleted implicitly with the resources to which they are
578 /// attached.
579 #[derive(Debug, Clone)]
580 pub struct IamPolicyClient<T> {
581 inner: tonic::client::Grpc<T>,
582 }
583 impl IamPolicyClient<tonic::transport::Channel> {
584 /// Attempt to create a new client by connecting to a given endpoint.
585 pub async fn connect<D>(dst: D) -> Result<Self, tonic::transport::Error>
586 where
587 D: TryInto<tonic::transport::Endpoint>,
588 D::Error: Into<StdError>,
589 {
590 let conn = tonic::transport::Endpoint::new(dst)?.connect().await?;
591 Ok(Self::new(conn))
592 }
593 }
594 impl<T> IamPolicyClient<T>
595 where
596 T: tonic::client::GrpcService<tonic::body::Body>,
597 T::Error: Into<StdError>,
598 T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
599 <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
600 {
601 pub fn new(inner: T) -> Self {
602 let inner = tonic::client::Grpc::new(inner);
603 Self { inner }
604 }
605 pub fn with_origin(inner: T, origin: Uri) -> Self {
606 let inner = tonic::client::Grpc::with_origin(inner, origin);
607 Self { inner }
608 }
609 pub fn with_interceptor<F>(inner: T, interceptor: F) -> IamPolicyClient<InterceptedService<T, F>>
610 where
611 F: tonic::service::Interceptor,
612 T::ResponseBody: Default,
613 T: tonic::codegen::Service<
614 http::Request<tonic::body::Body>,
615 Response = http::Response<<T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody>,
616 >,
617 <T as tonic::codegen::Service<http::Request<tonic::body::Body>>>::Error:
618 Into<StdError> + std::marker::Send + std::marker::Sync,
619 {
620 IamPolicyClient::new(InterceptedService::new(inner, interceptor))
621 }
622 /// Compress requests with the given encoding.
623 ///
624 /// This requires the server to support it otherwise it might respond with an
625 /// error.
626 #[must_use]
627 pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
628 self.inner = self.inner.send_compressed(encoding);
629 self
630 }
631 /// Enable decompressing responses.
632 #[must_use]
633 pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
634 self.inner = self.inner.accept_compressed(encoding);
635 self
636 }
637 /// Limits the maximum size of a decoded message.
638 ///
639 /// Default: `4MB`
640 #[must_use]
641 pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
642 self.inner = self.inner.max_decoding_message_size(limit);
643 self
644 }
645 /// Limits the maximum size of an encoded message.
646 ///
647 /// Default: `usize::MAX`
648 #[must_use]
649 pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
650 self.inner = self.inner.max_encoding_message_size(limit);
651 self
652 }
653 /// Sets the access control policy on the specified resource. Replaces any
654 /// existing policy.
655 ///
656 /// Can return `NOT_FOUND`, `INVALID_ARGUMENT`, and `PERMISSION_DENIED` errors.
657 pub async fn set_iam_policy(
658 &mut self,
659 request: impl tonic::IntoRequest<super::SetIamPolicyRequest>,
660 ) -> std::result::Result<tonic::Response<super::Policy>, tonic::Status> {
661 self.inner
662 .ready()
663 .await
664 .map_err(|e| tonic::Status::unknown(format!("Service was not ready: {}", e.into())))?;
665 let codec = tonic_prost::ProstCodec::default();
666 let path = http::uri::PathAndQuery::from_static("/google.iam.v1.IAMPolicy/SetIamPolicy");
667 let mut req = request.into_request();
668 req.extensions_mut()
669 .insert(GrpcMethod::new("google.iam.v1.IAMPolicy", "SetIamPolicy"));
670 self.inner.unary(req, path, codec).await
671 }
672 /// Gets the access control policy for a resource.
673 /// Returns an empty policy if the resource exists and does not have a policy
674 /// set.
675 pub async fn get_iam_policy(
676 &mut self,
677 request: impl tonic::IntoRequest<super::GetIamPolicyRequest>,
678 ) -> std::result::Result<tonic::Response<super::Policy>, tonic::Status> {
679 self.inner
680 .ready()
681 .await
682 .map_err(|e| tonic::Status::unknown(format!("Service was not ready: {}", e.into())))?;
683 let codec = tonic_prost::ProstCodec::default();
684 let path = http::uri::PathAndQuery::from_static("/google.iam.v1.IAMPolicy/GetIamPolicy");
685 let mut req = request.into_request();
686 req.extensions_mut()
687 .insert(GrpcMethod::new("google.iam.v1.IAMPolicy", "GetIamPolicy"));
688 self.inner.unary(req, path, codec).await
689 }
690 /// Returns permissions that a caller has on the specified resource.
691 /// If the resource does not exist, this will return an empty set of
692 /// permissions, not a `NOT_FOUND` error.
693 ///
694 /// Note: This operation is designed to be used for building permission-aware
695 /// UIs and command-line tools, not for authorization checking. This operation
696 /// may "fail open" without warning.
697 pub async fn test_iam_permissions(
698 &mut self,
699 request: impl tonic::IntoRequest<super::TestIamPermissionsRequest>,
700 ) -> std::result::Result<tonic::Response<super::TestIamPermissionsResponse>, tonic::Status> {
701 self.inner
702 .ready()
703 .await
704 .map_err(|e| tonic::Status::unknown(format!("Service was not ready: {}", e.into())))?;
705 let codec = tonic_prost::ProstCodec::default();
706 let path = http::uri::PathAndQuery::from_static("/google.iam.v1.IAMPolicy/TestIamPermissions");
707 let mut req = request.into_request();
708 req.extensions_mut()
709 .insert(GrpcMethod::new("google.iam.v1.IAMPolicy", "TestIamPermissions"));
710 self.inner.unary(req, path, codec).await
711 }
712 }
713}