Skip to content

Commit 3a97ae1

Browse files
author
Ajay Kannan
committed
Make role and permission strings to allow for service-specific values
1 parent 5fbb41c commit 3a97ae1

11 files changed

Lines changed: 108 additions & 205 deletions

File tree

‎gcloud-java-examples/src/main/java/com/google/gcloud/examples/resourcemanager/snippets/ModifyPolicy.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424

2525
import com.google.gcloud.Identity;
2626
import com.google.gcloud.resourcemanager.Policy;
27-
import com.google.gcloud.resourcemanager.Policy.Role;
27+
import com.google.gcloud.resourcemanager.Policy.ProjectRole;
2828
import com.google.gcloud.resourcemanager.Project;
2929
import com.google.gcloud.resourcemanager.ResourceManager;
3030
import com.google.gcloud.resourcemanager.ResourceManagerOptions;
@@ -49,7 +49,7 @@ public static void main(String... args) {
4949
// Add a viewer
5050
Policy.Builder modifiedPolicy = policy.toBuilder();
5151
Identity newViewer = Identity.user("<insert user's email address here>");
52-
modifiedPolicy.addIdentity(Role.viewer(), newViewer);
52+
modifiedPolicy.addIdentity(ProjectRole.VIEWER.value(), newViewer);
5353

5454
// Write policy
5555
Policy updatedPolicy = project.replacePolicy(modifiedPolicy.build());

‎gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/Policy.java‎

Lines changed: 32 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,11 @@
2323
import com.google.gcloud.IamPolicy;
2424
import com.google.gcloud.Identity;
2525

26-
import java.io.Serializable;
2726
import java.util.ArrayList;
2827
import java.util.HashMap;
2928
import java.util.LinkedList;
3029
import java.util.List;
3130
import java.util.Map;
32-
import java.util.Objects;
3331
import java.util.Set;
3432

3533
/**
@@ -42,120 +40,63 @@
4240
*
4341
* @see <a href="https://cloud.google.com/iam/reference/rest/v1/Policy">Policy</a>
4442
*/
45-
public class Policy extends IamPolicy<Policy.Role> {
43+
public class Policy extends IamPolicy<String> {
4644

4745
private static final long serialVersionUID = -5573557282693961850L;
4846

4947
/**
50-
* Represents legacy roles in an IAM Policy.
48+
* The project-level roles in an IAM policy. This enum is not an exhaustive list of all roles
49+
* you can use in an IAM policy. You can also use service-specific roles (e.g.
50+
* <i>roles/pubsub.editor</i>). See the <i>Supported Cloud Platform Services</i> page for links
51+
* to service-specific roles.
52+
*
53+
* @see <a href="https://cloud.google.com/iam/#supported_cloud_platform_services">Supported Cloud
54+
* Platform Services</a>
5155
*/
52-
public static class Role implements Serializable {
56+
public enum ProjectRole {
5357

5458
/**
55-
* The recognized roles in a Project's IAM policy.
59+
* Permissions for read-only actions that preserve state.
5660
*/
57-
public enum Type {
58-
59-
/**
60-
* Permissions for read-only actions that preserve state.
61-
*/
62-
VIEWER,
63-
64-
/**
65-
* All viewer permissions and permissions for actions that modify state.
66-
*/
67-
EDITOR,
68-
69-
/**
70-
* All editor permissions and permissions for the following actions:
71-
* <ul>
72-
* <li>Manage access control for a resource.
73-
* <li>Set up billing (for a project).
74-
* </ul>
75-
*/
76-
OWNER
77-
}
78-
79-
private static final long serialVersionUID = 2421978909244287488L;
80-
81-
private final String value;
82-
private final Type type;
83-
84-
private Role(String value, Type type) {
85-
this.value = value;
86-
this.type = type;
87-
}
88-
89-
String value() {
90-
return value;
91-
}
61+
VIEWER("roles/viewer"),
9262

9363
/**
94-
* Returns the type of role (editor, owner, or viewer). Returns {@code null} if the role type
95-
* is unrecognized.
64+
* All viewer permissions and permissions for actions that modify state.
9665
*/
97-
public Type type() {
98-
return type;
99-
}
66+
EDITOR("roles/editor"),
10067

10168
/**
102-
* Returns a {@code Role} of type {@link Type#VIEWER VIEWER}.
69+
* All editor permissions and permissions for the following actions:
70+
* <ul>
71+
* <li>Manage access control for a resource.
72+
* <li>Set up billing (for a project).
73+
* </ul>
10374
*/
104-
public static Role viewer() {
105-
return new Role("roles/viewer", Type.VIEWER);
106-
}
75+
OWNER("roles/owner");
10776

108-
/**
109-
* Returns a {@code Role} of type {@link Type#EDITOR EDITOR}.
110-
*/
111-
public static Role editor() {
112-
return new Role("roles/editor", Type.EDITOR);
77+
String value;
78+
79+
private ProjectRole(String value) {
80+
this.value = value;
11381
}
11482

11583
/**
116-
* Returns a {@code Role} of type {@link Type#OWNER OWNER}.
84+
* Returns the string value associated with the role.
11785
*/
118-
public static Role owner() {
119-
return new Role("roles/owner", Type.OWNER);
120-
}
121-
122-
static Role rawRole(String roleStr) {
123-
return new Role(roleStr, null);
124-
}
125-
126-
static Role fromStr(String roleStr) {
127-
try {
128-
Type type = Type.valueOf(roleStr.split("/")[1].toUpperCase());
129-
return new Role(roleStr, type);
130-
} catch (Exception ex) {
131-
return new Role(roleStr, null);
132-
}
133-
}
134-
135-
@Override
136-
public final int hashCode() {
137-
return Objects.hash(value, type);
138-
}
139-
140-
@Override
141-
public final boolean equals(Object obj) {
142-
if (!(obj instanceof Role)) {
143-
return false;
144-
}
145-
Role other = (Role) obj;
146-
return Objects.equals(value, other.value()) && Objects.equals(type, other.type());
86+
public String value() {
87+
return value;
14788
}
14889
}
14990

15091
/**
15192
* Builder for an IAM Policy.
15293
*/
153-
public static class Builder extends IamPolicy.Builder<Role, Builder> {
94+
public static class Builder extends IamPolicy.Builder<String, Builder> {
15495

15596
private Builder() {}
15697

15798
@VisibleForTesting
158-
Builder(Map<Role, Set<Identity>> bindings, String etag, Integer version) {
99+
Builder(Map<String, Set<Identity>> bindings, String etag, Integer version) {
159100
bindings(bindings).etag(etag).version(version);
160101
}
161102

@@ -188,10 +129,10 @@ com.google.api.services.cloudresourcemanager.model.Policy toPb() {
188129
new com.google.api.services.cloudresourcemanager.model.Policy();
189130
List<com.google.api.services.cloudresourcemanager.model.Binding> bindingPbList =
190131
new LinkedList<>();
191-
for (Map.Entry<Role, Set<Identity>> binding : bindings().entrySet()) {
132+
for (Map.Entry<String, Set<Identity>> binding : bindings().entrySet()) {
192133
com.google.api.services.cloudresourcemanager.model.Binding bindingPb =
193134
new com.google.api.services.cloudresourcemanager.model.Binding();
194-
bindingPb.setRole(binding.getKey().value());
135+
bindingPb.setRole(binding.getKey());
195136
bindingPb.setMembers(
196137
Lists.transform(
197138
new ArrayList<>(binding.getValue()),
@@ -211,11 +152,11 @@ public String apply(Identity identity) {
211152

212153
static Policy fromPb(
213154
com.google.api.services.cloudresourcemanager.model.Policy policyPb) {
214-
Map<Role, Set<Identity>> bindings = new HashMap<>();
155+
Map<String, Set<Identity>> bindings = new HashMap<>();
215156
for (com.google.api.services.cloudresourcemanager.model.Binding bindingPb :
216157
policyPb.getBindings()) {
217158
bindings.put(
218-
Role.fromStr(bindingPb.getRole()),
159+
bindingPb.getRole(),
219160
ImmutableSet.copyOf(
220161
Lists.transform(
221162
bindingPb.getMembers(),

‎gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/Project.java‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,6 @@
1818

1919
import static com.google.common.base.Preconditions.checkNotNull;
2020

21-
import com.google.gcloud.resourcemanager.ResourceManager.Permission;
22-
2321
import java.io.IOException;
2422
import java.io.ObjectInputStream;
2523
import java.util.List;
@@ -235,16 +233,21 @@ public Policy replacePolicy(Policy newPolicy) {
235233
* if you're using Google Cloud Platform directly to manage permissions. This method is intended
236234
* for integration with your proprietary software, such as a customized graphical user interface.
237235
* For example, the Cloud Platform Console tests IAM permissions internally to determine which UI
238-
* should be available to the logged-in user.
236+
* should be available to the logged-in user. Each service that supports IAM lists the possible
237+
* permissions; see the <i>Supported Cloud Platform services</i> page below for links to these
238+
* lists.
239239
*
240240
* @return a list of booleans representing whether the caller has the permissions specified (in
241241
* the order of the given permissions)
242242
* @throws ResourceManagerException upon failure
243243
* @see <a href=
244244
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
245245
* Resource Manager testIamPermissions</a>
246+
* @see <a href=
247+
* "https://cloud.google.com/iam/#supported_cloud_platform_services">Supported Cloud Platform
248+
* Services</a>
246249
*/
247-
List<Boolean> testPermissions(List<Permission> permissions) {
250+
List<Boolean> testPermissions(List<String> permissions) {
248251
return resourceManager.testPermissions(projectId(), permissions);
249252
}
250253

@@ -253,17 +256,22 @@ List<Boolean> testPermissions(List<Permission> permissions) {
253256
* if you're using Google Cloud Platform directly to manage permissions. This method is intended
254257
* for integration with your proprietary software, such as a customized graphical user interface.
255258
* For example, the Cloud Platform Console tests IAM permissions internally to determine which UI
256-
* should be available to the logged-in user.
259+
* should be available to the logged-in user. Each service that supports IAM lists the possible
260+
* permissions; see the <i>Supported Cloud Platform services</i> page below for links to these
261+
* lists.
257262
*
258263
* @return a list of booleans representing whether the caller has the permissions specified (in
259264
* the order of the given permissions)
260265
* @throws ResourceManagerException upon failure
261266
* @see <a href=
262267
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
263268
* Resource Manager testIamPermissions</a>
269+
* @see <a href=
270+
* "https://cloud.google.com/iam/#supported_cloud_platform_services">Supported Cloud Platform
271+
* Services</a>
264272
*/
265-
List<Boolean> testPermissions(Permission first, Permission... others) {
266-
return resourceManager.testPermissions(projectId(), first, others);
273+
List<Boolean> testPermissions(String firstPermission, String... otherPermissions) {
274+
return resourceManager.testPermissions(projectId(), firstPermission, otherPermissions);
267275
}
268276

269277
@Override

‎gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/ResourceManager.java‎

Lines changed: 15 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -169,38 +169,6 @@ public static ProjectListOption fields(ProjectField... fields) {
169169
}
170170
}
171171

172-
/**
173-
* The permissions associated with a Google Cloud project. These values can be used when calling
174-
* {@link #testPermissions}.
175-
*
176-
* @see <a href=
177-
* "https://cloud.google.com/resource-manager/docs/access-control-proj#project-level_roles">
178-
* Project-level roles</a>
179-
*/
180-
enum Permission {
181-
DELETE("delete"),
182-
GET("get"),
183-
GET_POLICY("getIamPolicy"),
184-
REPLACE("update"),
185-
REPLACE_POLICY("setIamPolicy"),
186-
UNDELETE("undelete");
187-
188-
private static final String PREFIX = "resourcemanager.projects.";
189-
190-
private final String value;
191-
192-
Permission(String suffix) {
193-
this.value = PREFIX + suffix;
194-
}
195-
196-
/**
197-
* Returns the string representation of the permission.
198-
*/
199-
public String value() {
200-
return value;
201-
}
202-
}
203-
204172
/**
205173
* Creates a new project.
206174
*
@@ -358,30 +326,41 @@ public String value() {
358326
* this method if you're using Google Cloud Platform directly to manage permissions. This method
359327
* is intended for integration with your proprietary software, such as a customized graphical user
360328
* interface. For example, the Cloud Platform Console tests IAM permissions internally to
361-
* determine which UI should be available to the logged-in user.
329+
* determine which UI should be available to the logged-in user. Each service that supports IAM
330+
* lists the possible permissions; see the <i>Supported Cloud Platform services</i> page below for
331+
* links to these lists.
362332
*
363333
* @return A list of booleans representing whether the caller has the permissions specified (in
364334
* the order of the given permissions)
365335
* @throws ResourceManagerException upon failure
366336
* @see <a href=
367337
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
368338
* Resource Manager testIamPermissions</a>
339+
* @see <a href=
340+
* "https://cloud.google.com/iam/#supported_cloud_platform_services">Supported Cloud Platform
341+
* Services</a>
369342
*/
370-
List<Boolean> testPermissions(String projectId, List<Permission> permissions);
343+
List<Boolean> testPermissions(String projectId, List<String> permissions);
371344

372345
/**
373346
* Returns the permissions that a caller has on the specified project. You typically don't call
374347
* this method if you're using Google Cloud Platform directly to manage permissions. This method
375348
* is intended for integration with your proprietary software, such as a customized graphical user
376349
* interface. For example, the Cloud Platform Console tests IAM permissions internally to
377-
* determine which UI should be available to the logged-in user.
350+
* determine which UI should be available to the logged-in user. Each service that supports IAM
351+
* lists the possible permissions; see the <i>Supported Cloud Platform services</i> page below for
352+
* links to these lists.
378353
*
379354
* @return A list of booleans representing whether the caller has the permissions specified (in
380355
* the order of the given permissions)
381356
* @throws ResourceManagerException upon failure
382357
* @see <a href=
383358
* "https://cloud.google.com/resource-manager/reference/rest/v1beta1/projects/testIamPermissions">
384359
* Resource Manager testIamPermissions</a>
360+
* @see <a href=
361+
* "https://cloud.google.com/iam/#supported_cloud_platform_services">Supported Cloud Platform
362+
* Services</a>
385363
*/
386-
List<Boolean> testPermissions(String projectId, Permission first, Permission... others);
364+
List<Boolean> testPermissions(
365+
String projectId, String firstPermission, String... otherPermissions);
387366
}

‎gcloud-java-resourcemanager/src/main/java/com/google/gcloud/resourcemanager/ResourceManagerImpl.java‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -216,19 +216,13 @@ public com.google.api.services.cloudresourcemanager.model.Policy call() {
216216
}
217217

218218
@Override
219-
public List<Boolean> testPermissions(final String projectId, final List<Permission> permissions) {
219+
public List<Boolean> testPermissions(final String projectId, final List<String> permissions) {
220220
try {
221221
return runWithRetries(
222222
new Callable<List<Boolean>>() {
223223
@Override
224224
public List<Boolean> call() {
225-
return resourceManagerRpc.testPermissions(projectId,
226-
Lists.transform(permissions, new Function<Permission, String>() {
227-
@Override
228-
public String apply(Permission permission) {
229-
return permission.value();
230-
}
231-
}));
225+
return resourceManagerRpc.testPermissions(projectId, permissions);
232226
}
233227
}, options().retryParams(), EXCEPTION_HANDLER);
234228
} catch (RetryHelperException ex) {
@@ -237,8 +231,9 @@ public String apply(Permission permission) {
237231
}
238232

239233
@Override
240-
public List<Boolean> testPermissions(String projectId, Permission first, Permission... others) {
241-
return testPermissions(projectId, Lists.asList(first, others));
234+
public List<Boolean> testPermissions(
235+
String projectId, String firstPermission, String... otherPermissions) {
236+
return testPermissions(projectId, Lists.asList(firstPermission, otherPermissions));
242237
}
243238

244239
private Map<ResourceManagerRpc.Option, ?> optionMap(Option... options) {

0 commit comments

Comments
 (0)