abac.proto

syntax = "proto3";
package begonia.org.sdk;
option go_package = "github.com/begonia-org/go-sdk/api/v1";

import "google/protobuf/descriptor.proto";
import "google/protobuf/timestamp.proto";
import "google/protobuf/field_mask.proto";
import "google/api/annotations.proto";
import "begonia/api/v1/options.proto";
// Resource is a resource that can be accessed by a user.
// A resource is defined by ABAC (Attribute-Based Access Control) model.
message Resource {
	// @gotags: doc:"resource id" gorm:"primaryKey;autoIncrement;comment:自增id"
	string id = 1;
	// @gotags: doc:"resource name" gorm:"column:name;type:varchar(255);index;comment:资源名称"
	string name = 2;
	// @gotags: doc:"resource description" gorm:"column:description;type:text;comment:资源描述"
	string description = 3;
	// @gotags: doc:"resource type" gorm:"column:type;type:varchar(255);index;comment:资源类型"
	string type = 4;
	// @gotags: doc:"resource parent id" gorm:"column:parent_id;type:varchar(255);index;comment:资源父级id"
	string parent_id = 5;
	// @gotags: doc:"resource owner" gorm:"column:owner;type:varchar(255);index;comment:资源拥有者"
	string owner = 6;

    google.protobuf.Timestamp created_at = 12;
    // @gotags: doc:"更新时间" gorm:"autoUpdateTime;column:updated_at;type:datetime;serializer:timepb;comment:定时任务的更新时间"
    google.protobuf.Timestamp updated_at = 13;
	// @gotags: gorm:"-" json:"update_mask"
	google.protobuf.FieldMask update_mask = 18;
}
enum Effect {
	// Default value. Do not use.
	EFFECT_UNSPECIFIED = 0;
	// Allow access.
	ALLOW = 1;
	// Deny access.
	DENY = 2;
}
enum  ConditionOperator{
	OPERATOR_UNSPECIFIED = 0;
	StringEquals = 1;
	StringNotEquals = 2;
	StringEqualsIgnoreCase = 3;
	StringNotEqualsIgnoreCase = 4;
	StringLike = 5;
	StringNotLike = 6;
	NumericEquals = 7;
	NumericNotEquals = 8;
	NumericLessThan = 9;
	NumericLessThanEquals = 10;
	NumericGreaterThan = 11;
	NumericGreaterThanEquals = 12;
	BOOL = 13;
	DateEquals = 14;
	DateNotEquals = 15;
	DateLessThan = 16;
	DateLessThanEquals = 17;
	DateGreaterThan = 18;
	DateGreaterThanEquals = 19;
	IpAddress=20;
	NotIpAddress=21;
}
message ConditionKV{
	string key = 1;
	repeated string value = 2;
}
message Condition{
	map<string,  ConditionKV> kv = 1;
}
message Policy {
repeated string actions = 1;
 string resource = 2;
Effect effect = 3;
repeated Condition conditions = 4;
string principal = 5;
string unique_key = 6[json_name="unique_key"];
}
message PutPolicyRequest{
// @gotags: validate:"required"
repeated string actions = 1;
// @gotags: validate:"required"
 string resource = 2;
 // @gotags: validate:"required,oneof=1 2"
Effect effect = 3;

repeated Condition conditions = 4;
// @gotags: validate:"required"
string principal = 5;
google.protobuf.FieldMask mask = 18[json_name="-"];

}
message AccessEnv {
	string ip=1;
	string user_agent=2[json_name="user_agent"];
	string referer=3;
	string request_id=4[json_name="request_id"];
    google.protobuf.Timestamp created_at = 12[json_name="created_at"];
}
message FailReason {
	// string code = 1;
	string message = 1;
	string key=2;
    repeated string except=3;
	string actual=4;
	string operator=5;
}
message AccessContext {
	// @gotags: doc:"principal id" gorm:"column:principal;type:varchar(255);index;comment:主体id"
	string principal = 1;
	repeated string resource = 2;
	string action = 3;
	map<string, string> context = 4;
	AccessEnv env = 5;
	FailReason fail = 6;

}

message AccessResponse {
	bool pass = 1;
	string message = 2;
	FailReason fail = 3;
}
message PolicyRequest{
	string unique_key = 1[json_name="unique_key"];
}
message PutPolicyResponse{
	string unique_key = 1[json_name="unique_key"];

}
message PatchPolicyResponse{

}
service ABACService {
	option (.begonia.api.v1.auth_reqiured)=true;
	option (.begonia.api.v1.http_response)="begonia.api.v1.HttpResponse";
	rpc Auth (AccessContext) returns (AccessResponse) {
		option (google.api.http) = {
			post: "/v1/abac/authz"
			body: "*"
		};
	}
	rpc PolicyPut (PutPolicyRequest) returns (PutPolicyResponse) {
		option (google.api.http) = {
			put: "/v1/abac/policy"
			body: "*"
		};
	}
	rpc PolicyPatch (PutPolicyRequest) returns (PatchPolicyResponse) {
		option (google.api.http) = {
			patch: "/v1/abac/policy"
			body: "*"
		};
	}
	rpc PolicyDelete (PolicyRequest) returns (Policy) {
		option (google.api.http) = {
			delete: "/v1/abac/policy/{unique_key}"
		};
	}
	rpc PolicyGet (PolicyRequest) returns (Policy) {
		option (google.api.http) = {
			get: "/v1/abac/policy/{unique_key}"
		};
	}
	rpc PolicyList (Policy) returns (Policy) {
		option (google.api.http) = {
			get: "/v1/abac/policy/list"
		};
	}
}