realms

type Binding struct {

	// Name of the role to assign.
	//
	// Can either be a predefined role (if starts with "role/") or a custom role
	// (if starts with "customRole/"). See TODO for a list of predefined roles
	// and their meanings.
	//
	// A custom role must be defined somewhere in this realms.cfg file.
	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	// A set of principals to assign the role to.
	//
	// Each entry can either be an identity string (like "user:<email>") or a
	// LUCI group reference "group:<name>".
	Principals []string `protobuf:"bytes,2,rep,name=principals,proto3" json:"principals,omitempty"`
	// A list of conditions ANDed together that define when the binding is active.
	//
	// If empty, the binding is active all the time.
	Conditions []*Condition `protobuf:"bytes,3,rep,name=conditions,proto3" json:"conditions,omitempty"`
	// contains filtered or unexported fields
}

type Condition struct {

	// Types that are assignable to Op:
	//
	//	*Condition_Restrict
	Op isCondition_Op `protobuf_oneof:"op"`
	// contains filtered or unexported fields
}

type Condition_AttributeRestriction struct {
	Attribute string   `protobuf:"bytes,1,opt,name=attribute,proto3" json:"attribute,omitempty"`
	Values    []string `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"`
	// contains filtered or unexported fields
}

type Condition_Restrict struct {
	Restrict *Condition_AttributeRestriction `protobuf:"bytes,1,opt,name=restrict,proto3,oneof"`
}

type CustomRole struct {

	// Name of this custom role, must start with "customRole/".
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional list of roles whose permissions will be included in this role.
	//
	// Each entry can either be a predefined role (if starts with "role/") or
	// another custom role defined in this realms.cfg (if starts with
	// "customRole/").
	//
	// To keep the mental model simple, cycles aren't allowed (i.e. a custom role
	// is not allowed to directly or indirectly extend itself). The LUCI Config
	// service will reject realms.cfg that contains cycles during the config
	// validation phase.
	Extends []string `protobuf:"bytes,2,rep,name=extends,proto3" json:"extends,omitempty"`
	// Optional list of permissions to include in the role.
	//
	// Each permission is a symbol that has form "<service>.<subject>.<verb>",
	// which describes some elementary action ("<verb>") that can be done to some
	// category of resources ("<subject>"), managed by some particular kind of
	// LUCI service ("<service>").
	//
	// Examples of permissions:
	//   - buildbucket.build.create
	//   - swarming.pool.listBots
	//   - swarming.task.cancel
	//
	// See TODO for a list of all possible permissions.
	Permissions []string `protobuf:"bytes,3,rep,name=permissions,proto3" json:"permissions,omitempty"`
	// contains filtered or unexported fields
}

type Realm struct {

	// Name of the realm.
	//
	// Must match `^[a-z0-9_\.\-/]{1,400}$` or be literals "@root" or "@legacy".
	//
	// Realm names must be unique within a project.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional list of realms whose permissions will be included in this realm.
	//
	// All realms implicitly extend "@root" realm (if it is defined), i.e. all
	// permissions specified in the "@root" realm are propagated to all realms in
	// the project.
	//
	// To keep the mental model simple, cycles aren't allowed (i.e. a realm is not
	// allowed to directly or indirectly extend itself). The LUCI Config service
	// will reject realms.cfg that contains cycles during the config validation
	// phase.
	Extends []string `protobuf:"bytes,2,rep,name=extends,proto3" json:"extends,omitempty"`
	// List of bindings that define who can do what to resources in this realm.
	Bindings []*Binding `protobuf:"bytes,3,rep,name=bindings,proto3" json:"bindings,omitempty"`
	// A list of LUCI service IDs that should enforce this realm's permissions.
	//
	// Children realms inherit and extend this list.
	//
	// Used only during Realms migration to gradually roll out the enforcement
	// realm by realm, service by service.
	EnforceInService []string `protobuf:"bytes,4,rep,name=enforce_in_service,json=enforceInService,proto3" json:"enforce_in_service,omitempty"`
	// contains filtered or unexported fields
}

type RealmsCfg struct {

	// List of all realms in the project in arbitrary order.
	Realms []*Realm `protobuf:"bytes,1,rep,name=realms,proto3" json:"realms,omitempty"`
	// Optional list of custom roles that can be referenced from Bindings in this
	// project.
	CustomRoles []*CustomRole `protobuf:"bytes,2,rep,name=custom_roles,json=customRoles,proto3" json:"custom_roles,omitempty"`
	// contains filtered or unexported fields
}