v1alpha1

type Binding struct {
	// Members is a list of IAM principals, limited to list of users.
	// For example ["user:alice@example.com"].
	Members []string `yaml:"members,omitempty"`

	// Role to be assigned to Members. Basic roles, including Owner (roles/owner),
	// Editor (roles/editor), and Viewer (roles/viewer) are not allowed since
	// conditional role bindings do not work with basic roles.
	Role string `yaml:"role,omitempty"`
}

type CLIRequest struct {
	// Tool name such as gcloud.
	Tool string `yaml:"cli,omitempty"`

	// List of commands without tool name.
	Do []string `yaml:"do,omitempty"`

	// List of cleanup commands without tool name to run after "do" is completed.
	Cleanup []string `yaml:"cleanup,omitempty"`
}

type IAMRequest struct {
	// List of ResourcePolicy, each specifies the IAM principals/members to role
	// bindings to be added for a GCP resource IAM policy.
	ResourcePolicies []*ResourcePolicy `yaml:"policies,omitempty"`
}

type IAMRequestWrapper struct {
	// IAMRequest contains IAM binding information.
	*IAMRequest

	// Duration feild used as IAM binding condition to specify expiration.
	// This will not override role bindings with no conditions.
	Duration time.Duration

	// Start time of the IAM permission lifecycle, StartTime + Duration is when
	// the permission will expire.
	StartTime time.Time
}

type IAMResponse struct {
	// IAM policy of the resource.
	Policy *iampb.Policy

	// Resource represents one of GCP organization, folder, and project.
	Resource string
}

type ResourcePolicy struct {
	// Resource represents one of GCP organization, folder, and project.
	Resource string `yaml:"resource,omitempty"`

	// Bindings contains a list of IAM principals/members to role bindings.
	Bindings []*Binding `yaml:"bindings,omitempty"`
}