diff --git a/proto/keyaccessgrants/key_access_grants.proto b/proto/keyaccessgrants/key_access_grants.proto index ceadb0f2ce..42cf74403b 100644 --- a/proto/keyaccessgrants/key_access_grants.proto +++ b/proto/keyaccessgrants/key_access_grants.proto @@ -2,7 +2,6 @@ syntax = "proto3"; package keyaccessgrants; -import "attributes/attributes.proto"; import "buf/validate/validate.proto"; import "common/common.proto"; import "google/api/annotations.proto"; @@ -36,9 +35,7 @@ message GetKeyAccessGrantResponse { KeyAccessGrants grants = 1; } -message ListKeyAccessGrantsRequest { - common.ResourceSelector selector = 1; -} +message ListKeyAccessGrantsRequest {} message ListKeyAccessGrantsResponse { repeated KeyAccessGrants grants = 1; } diff --git a/proto/resourcemapping/resource_mapping.proto b/proto/resourcemapping/resource_mapping.proto index 5439920bad..28c075be05 100644 --- a/proto/resourcemapping/resource_mapping.proto +++ b/proto/resourcemapping/resource_mapping.proto @@ -2,28 +2,48 @@ syntax = "proto3"; package resourcemapping; -import "attributes/attributes.proto"; import "buf/validate/validate.proto"; import "common/common.proto"; import "google/api/annotations.proto"; /* - Access Control Resource Encodings (ACRE). Structures supporting Resources and Attributes mappings + # Resource Mappings (aka Access Control Resource Encodings aka ACRE): Structures supporting Resources and Attributes mappings -*/ + ## Examples -/* - Map one or more domain specific terms (synonyms) to an attribute value by reference. + ### Where + + attributeId is an id of the following attribute + + FQN: http://demo.com/attr/Classification/value/Confidential + UUID: 12345678-1234-1234-1234-123456789012 + + ### Request - Example: - attributeValueRef: ref http://demo.com/attr/Classification/value/Confidential - synonymRef: - terms: ["CONFIDENTIAL", "CONTROLLED UNCLASSIFIED", "OFFICIAL-SENSITIVE", "CUI", "C"] + grpcurl -plaintext -d @ localhost:9000 resourcemapping.ResourceMappingService/CreateResourceMapping < [subjectValue] - - Example subject mapping of a subject with nationality = CZE entitled to attribute relto:ZCE - From Existing Policy: "http://demo.com/attr/relto/value/CZE": {"nationality": ["CZE"]} - To Subject Mapping Policy: + # Subject Mapping (aka Access Control Subject Encoding aka ACSE): Structures supporting the mapping of Subjects and Attributes (e.g. Entitlement) + + ## Examples + + ### Where: + + - attribute_value_id represents the following attribute + - FQN: "http://demo.com/attr/relto/value/CZE" + - UUID: "12345678-1234-1234-1234-123456789012" + + ### Request + + ```bash + grpcurl -plaintext -d '{ + "subject_mapping": { + "metadata": { + "description": "subject mapping 1", + "labels": { + "test-label": "test-value" + } + }, + "attribute_value_id": "12345678-1234-1234-1234-123456789012", + "subject_attribute": "nationality", + "subject_values": ["CZE"], + "operator": "IN" + } + }' localhost:8080 SubjectMappingService.CreateSubjectMapping + ``` + + ### Response + + ``` { - attributeValueFQN: "http://demo.com/attr/relto/value/CZE" - subjectAttribute: "nationality" - subjectValues: ["CZE"] - operator: "IN" + "subject_mapping": { + "metadata": { + "id": "12345678-2222-1234-1234-123456789012", + "description": "subject mapping 1", + "labels": { + "test-label": "test-value" + } + }, + "attribute_value_id": "12345678-1234-1234-1234-123456789012", + "subject_attribute": "nationality", + "subject_values": ["CZE"], + "operator": "IN" + } } + ``` */ message SubjectMapping { @@ -55,15 +86,13 @@ message SubjectMapping { } message GetSubjectMappingRequest { - int32 id = 1 [(buf.validate.field).required = true]; + string id = 1 [(buf.validate.field).required = true]; } message GetSubjectMappingResponse { SubjectMapping subject_mapping = 1; } -message ListSubjectMappingsRequest { - common.ResourceSelector selector = 1; -} +message ListSubjectMappingsRequest {} message ListSubjectMappingsResponse { repeated SubjectMapping subject_mappings = 1; } @@ -74,39 +103,39 @@ message CreateSubjectMappingRequest { message CreateSubjectMappingResponse {} message UpdateSubjectMappingRequest { - int32 id = 1 [(buf.validate.field).required = true]; + string id = 1 [(buf.validate.field).required = true]; SubjectMapping subject_mapping = 2 [(buf.validate.field).required = true]; } message UpdateSubjectMappingResponse {} message DeleteSubjectMappingRequest { - int32 id = 1 [(buf.validate.field).required = true]; + string id = 1 [(buf.validate.field).required = true]; } message DeleteSubjectMappingResponse {} -service SubjectEncodingService { +service SubjectMappingService { rpc ListSubjectMappings(ListSubjectMappingsRequest) returns (ListSubjectMappingsResponse) { - option (google.api.http) = {get: "/v1/encoding/subject/mappings"}; + option (google.api.http) = {get: "/subject-mappings"}; } rpc GetSubjectMapping(GetSubjectMappingRequest) returns (GetSubjectMappingResponse) { - option (google.api.http) = {get: "/v1/encoding/subject/mappings/{id}"}; + option (google.api.http) = {get: "/subject-mappings/{id}"}; } rpc CreateSubjectMapping(CreateSubjectMappingRequest) returns (CreateSubjectMappingResponse) { option (google.api.http) = { - post: "/v1/encoding/subject/mappings" + post: "/subject-mappings" body: "subject_mapping" }; } rpc UpdateSubjectMapping(UpdateSubjectMappingRequest) returns (UpdateSubjectMappingResponse) { option (google.api.http) = { - post: "/v1/encoding/subject/mappings/{id}" + post: "/subject-mappings/{id}" body: "subject_mapping" }; } rpc DeleteSubjectMapping(DeleteSubjectMappingRequest) returns (DeleteSubjectMappingResponse) { - option (google.api.http) = {delete: "/v1/encoding/subjects/mappings/{id}"}; + option (google.api.http) = {delete: "/subject-mappings/{id}"}; } }