// Copyright 2023 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Generated by the C++ microgenerator.
// If you make any local changes, they will be lost.
// file:///workspace/generator/discovery/compute_public_google_rest_v1.json
// revision: 20231110

syntax = "proto3";

package google.cloud.cpp.compute.v1;

import "google/cloud/compute/v1/internal/common_031.proto";

// Specifies the audit configuration for a service. The configuration determines
// which permission types are logged, and what identities, if any, are exempted
// from logging. An AuditConfig must have one or more AuditLogConfigs. If there
// are AuditConfigs for both `allServices` and a specific service, the union of
// the two AuditConfigs is used for that service: the log_types specified in
// each AuditConfig are enabled, and the exempted_members in each AuditLogConfig
// are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [
// { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ",
// "exempted_members": [ "user:jose@example.com" ] }, { "log_type": "DATA_WRITE"
// }, { "log_type": "ADMIN_READ" } ] }, { "service":
// "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type":
// "DATA_READ" }, { "log_type": "DATA_WRITE", "exempted_members": [
// "user:aliya@example.com" ] } ] } ] } For sampleservice, this policy enables
// DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts
// jose@example.com from DATA_READ logging, and aliya@example.com from
// DATA_WRITE logging.
message AuditConfig {
  // The configuration for logging of each type of permission.
  repeated AuditLogConfig audit_log_configs = 1 [json_name = "auditLogConfigs"];

  // This is deprecated and has no effect. Do not use.
  repeated string exempted_members = 2 [json_name = "exemptedMembers"];

  // Specifies a service that will be enabled for audit logging. For example,
  // `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a
  // special value that covers all services.
  optional string service = 3 [json_name = "service"];
}

// Provides the configuration for logging a type of permissions. Example: {
// "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [
// "user:jose@example.com" ] }, { "log_type": "DATA_WRITE" } ] } This enables
// 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from
// DATA_READ logging.
message AuditLogConfig {
  // Specifies the identities that do not cause logging for this type of
  // permission. Follows the same format of Binding.members.
  repeated string exempted_members = 1 [json_name = "exemptedMembers"];

  // This is deprecated and has no effect. Do not use.
  optional bool ignore_child_exemptions = 2
      [json_name = "ignoreChildExemptions"];

  // The log type that this config enables.
  // ADMIN_READ: Admin reads. Example: CloudIAM getIamPolicy
  // DATA_READ: Data reads. Example: CloudSQL Users list
  // DATA_WRITE: Data writes. Example: CloudSQL Users create
  // LOG_TYPE_UNSPECIFIED: Default case. Should never be this.
  optional string log_type = 3 [json_name = "logType"];
}

// This is deprecated and has no effect. Do not use.
message AuthorizationLoggingOptions {
  // This is deprecated and has no effect. Do not use.
  // ADMIN_READ: This is deprecated and has no effect. Do not use.
  // ADMIN_WRITE: This is deprecated and has no effect. Do not use.
  // DATA_READ: This is deprecated and has no effect. Do not use.
  // DATA_WRITE: This is deprecated and has no effect. Do not use.
  // PERMISSION_TYPE_UNSPECIFIED: This is deprecated and has no effect. Do not
  // use.
  optional string permission_type = 1 [json_name = "permissionType"];
}

// Associates `members`, or principals, with a `role`.
message Binding {
  // This is deprecated and has no effect. Do not use.
  optional string binding_id = 1 [json_name = "bindingId"];

  // The condition that is associated with this binding. If the condition
  // evaluates to `true`, then this binding applies to the current request. If
  // the condition evaluates to `false`, then this binding does not apply to the
  // current request. However, a different role binding might grant the same
  // role to one or more of the principals in this binding. To learn which
  // resources support conditions in their IAM policies, see the [IAM
  // documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
  optional Expr condition = 2 [json_name = "condition"];

  // Specifies the principals requesting access for a Google Cloud resource.
  // `members` can have the following values: * `allUsers`: A special identifier
  // that represents anyone who is on the internet; with or without a Google
  // account. * `allAuthenticatedUsers`: A special identifier that represents
  // anyone who is authenticated with a Google account or a service account.
  // Does not include identities that come from external identity providers
  // (IdPs) through identity federation. * `user:{emailid}`: An email address
  // that represents a specific Google account. For example, `alice@example.com`
  // . * `serviceAccount:{emailid}`: An email address that represents a Google
  // service account. For example, `my-other-app@appspot.gserviceaccount.com`. *
  // `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An
  // identifier for a [Kubernetes service
  // account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts).
  // For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. *
  // `group:{emailid}`: An email address that represents a Google group. For
  // example, `admins@example.com`. * `domain:{domain}`: The G Suite domain
  // (primary) that represents all the users of that domain. For example,
  // `google.com` or `example.com`. * `deleted:user:{emailid}?uid={uniqueid}`:
  // An email address (plus unique identifier) representing a user that has been
  // recently deleted. For example,
  // `alice@example.com?uid=123456789012345678901`. If the user is recovered,
  // this value reverts to `user:{emailid}` and the recovered user retains the
  // role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`:
  // An email address (plus unique identifier) representing a service account
  // that has been recently deleted. For example,
  // `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If
  // the service account is undeleted, this value reverts to
  // `serviceAccount:{emailid}` and the undeleted service account retains the
  // role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email
  // address (plus unique identifier) representing a Google group that has been
  // recently deleted. For example,
  // `admins@example.com?uid=123456789012345678901`. If the group is recovered,
  // this value reverts to `group:{emailid}` and the recovered group retains the
  // role in the binding.
  repeated string members = 3 [json_name = "members"];

  // Role that is assigned to the list of `members`, or principals. For example,
  // `roles/viewer`, `roles/editor`, or `roles/owner`.
  optional string role = 4 [json_name = "role"];
}

// This is deprecated and has no effect. Do not use.
message Condition {
  // This is deprecated and has no effect. Do not use.
  // APPROVER: This is deprecated and has no effect. Do not use.
  // ATTRIBUTION: This is deprecated and has no effect. Do not use.
  // AUTHORITY: This is deprecated and has no effect. Do not use.
  // CREDENTIALS_TYPE: This is deprecated and has no effect. Do not use.
  // CREDS_ASSERTION: This is deprecated and has no effect. Do not use.
  // JUSTIFICATION_TYPE: This is deprecated and has no effect. Do not use.
  // NO_ATTR: This is deprecated and has no effect. Do not use.
  // SECURITY_REALM: This is deprecated and has no effect. Do not use.
  optional string iam = 1 [json_name = "iam"];

  // This is deprecated and has no effect. Do not use.
  // DISCHARGED: This is deprecated and has no effect. Do not use.
  // EQUALS: This is deprecated and has no effect. Do not use.
  // IN: This is deprecated and has no effect. Do not use.
  // NOT_EQUALS: This is deprecated and has no effect. Do not use.
  // NOT_IN: This is deprecated and has no effect. Do not use.
  // NO_OP: This is deprecated and has no effect. Do not use.
  optional string op = 2 [json_name = "op"];

  // This is deprecated and has no effect. Do not use.
  optional string svc = 3 [json_name = "svc"];

  // This is deprecated and has no effect. Do not use.
  // IP: This is deprecated and has no effect. Do not use.
  // NAME: This is deprecated and has no effect. Do not use.
  // NO_ATTR: This is deprecated and has no effect. Do not use.
  // REGION: This is deprecated and has no effect. Do not use.
  // SERVICE: This is deprecated and has no effect. Do not use.
  optional string sys = 4 [json_name = "sys"];

  // This is deprecated and has no effect. Do not use.
  repeated string values = 5 [json_name = "values"];
}

// This is deprecated and has no effect. Do not use.
message LogConfig {
  // This is deprecated and has no effect. Do not use.
  optional LogConfigCloudAuditOptions cloud_audit = 1
      [json_name = "cloudAudit"];

  // This is deprecated and has no effect. Do not use.
  optional LogConfigCounterOptions counter = 2 [json_name = "counter"];

  // This is deprecated and has no effect. Do not use.
  optional LogConfigDataAccessOptions data_access = 3
      [json_name = "dataAccess"];
}

// This is deprecated and has no effect. Do not use.
message LogConfigCloudAuditOptions {
  // This is deprecated and has no effect. Do not use.
  optional AuthorizationLoggingOptions authorization_logging_options = 1
      [json_name = "authorizationLoggingOptions"];

  // This is deprecated and has no effect. Do not use.
  // ADMIN_ACTIVITY: This is deprecated and has no effect. Do not use.
  // DATA_ACCESS: This is deprecated and has no effect. Do not use.
  // UNSPECIFIED_LOG_NAME: This is deprecated and has no effect. Do not use.
  optional string log_name = 2 [json_name = "logName"];
}

// This is deprecated and has no effect. Do not use.
message LogConfigCounterOptions {
  // This is deprecated and has no effect. Do not use.
  repeated LogConfigCounterOptionsCustomField custom_fields = 1
      [json_name = "customFields"];

  // This is deprecated and has no effect. Do not use.
  optional string field = 2 [json_name = "field"];

  // This is deprecated and has no effect. Do not use.
  optional string metric = 3 [json_name = "metric"];
}

// This is deprecated and has no effect. Do not use.
message LogConfigCounterOptionsCustomField {
  // This is deprecated and has no effect. Do not use.
  optional string name = 1 [json_name = "name"];

  // This is deprecated and has no effect. Do not use.
  optional string value = 2 [json_name = "value"];
}

// This is deprecated and has no effect. Do not use.
message LogConfigDataAccessOptions {
  // This is deprecated and has no effect. Do not use.
  // LOG_FAIL_CLOSED: This is deprecated and has no effect. Do not use.
  // LOG_MODE_UNSPECIFIED: This is deprecated and has no effect. Do not use.
  optional string log_mode = 1 [json_name = "logMode"];
}

// An Identity and Access Management (IAM) policy, which specifies access
// controls for Google Cloud resources. A `Policy` is a collection of
// `bindings`. A `binding` binds one or more `members`, or principals, to a
// single `role`. Principals can be user accounts, service accounts, Google
// groups, and domains (such as G Suite). A `role` is a named list of
// permissions; each `role` can be an IAM predefined role or a user-created
// custom role. For some types of Google Cloud resources, a `binding` can also
// specify a `condition`, which is a logical expression that allows access to a
// resource only if the expression evaluates to `true`. A condition can add
// constraints based on attributes of the request, the resource, or both. To
// learn which resources support conditions in their IAM policies, see the [IAM
// documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
// **JSON example:** ``` { "bindings": [ { "role":
// "roles/resourcemanager.organizationAdmin", "members": [
// "user:mike@example.com", "group:admins@example.com", "domain:google.com",
// "serviceAccount:my-project-id@appspot.gserviceaccount.com" ] }, { "role":
// "roles/resourcemanager.organizationViewer", "members": [
// "user:eve@example.com" ], "condition": { "title": "expirable access",
// "description": "Does not grant access after Sep 2020", "expression":
// "request.time < timestamp('2020-10-01T00:00:00.000Z')", } } ], "etag":
// "BwWWja0YfJA=", "version": 3 } ``` **YAML example:** ``` bindings: - members:
// - user:mike@example.com - group:admins@example.com - domain:google.com -
// serviceAccount:my-project-id@appspot.gserviceaccount.com role:
// roles/resourcemanager.organizationAdmin - members: - user:eve@example.com
// role: roles/resourcemanager.organizationViewer condition: title: expirable
// access description: Does not grant access after Sep 2020 expression:
// request.time < timestamp('2020-10-01T00:00:00.000Z') etag: BwWWja0YfJA=
// version: 3 ``` For a description of IAM and its features, see the [IAM
// documentation](https://cloud.google.com/iam/docs/).
message Policy {
  // Specifies cloud audit logging configuration for this policy.
  repeated AuditConfig audit_configs = 1 [json_name = "auditConfigs"];

  // Associates a list of `members`, or principals, with a `role`. Optionally,
  // may specify a `condition` that determines how and when the `bindings` are
  // applied. Each of the `bindings` must contain at least one principal. The
  // `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250 of
  // these principals can be Google groups. Each occurrence of a principal
  // counts towards these limits. For example, if the `bindings` grant 50
  // different roles to `user:alice@example.com`, and not to any other
  // principal, then you can add another 1,450 principals to the `bindings` in
  // the `Policy`.
  repeated Binding bindings = 2 [json_name = "bindings"];

  // `etag` is used for optimistic concurrency control as a way to help prevent
  // simultaneous updates of a policy from overwriting each other. It is
  // strongly suggested that systems make use of the `etag` in the
  // read-modify-write cycle to perform policy updates in order to avoid race
  // conditions: An `etag` is returned in the response to `getIamPolicy`, and
  // systems are expected to put that etag in the request to `setIamPolicy` to
  // ensure that their change will be applied to the same version of the policy.
  // **Important:** If you use IAM Conditions, you must include the `etag` field
  // whenever you call `setIamPolicy`. If you omit this field, then IAM allows
  // you to overwrite a version `3` policy with a version `1` policy, and all of
  // the conditions in the version `3` policy are lost.
  optional string etag = 3 [json_name = "etag"];

  // This is deprecated and has no effect. Do not use.
  repeated Rule rules = 4 [json_name = "rules"];

  // Specifies the format of the policy. Valid values are `0`, `1`, and `3`.
  // Requests that specify an invalid value are rejected. Any operation that
  // affects conditional role bindings must specify version `3`. This
  // requirement applies to the following operations: * Getting a policy that
  // includes a conditional role binding * Adding a conditional role binding to
  // a policy * Changing a conditional role binding in a policy * Removing any
  // role binding, with or without a condition, from a policy that includes
  // conditions **Important:** If you use IAM Conditions, you must include the
  // `etag` field whenever you call `setIamPolicy`. If you omit this field, then
  // IAM allows you to overwrite a version `3` policy with a version `1` policy,
  // and all of the conditions in the version `3` policy are lost. If a policy
  // does not include any conditions, operations on that policy may specify any
  // valid version or leave the field unset. To learn which resources support
  // conditions in their IAM policies, see the [IAM
  // documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
  optional int32 version = 5 [json_name = "version"];
}

// This is deprecated and has no effect. Do not use.
message Rule {
  // This is deprecated and has no effect. Do not use.
  // ALLOW: This is deprecated and has no effect. Do not use.
  // ALLOW_WITH_LOG: This is deprecated and has no effect. Do not use.
  // DENY: This is deprecated and has no effect. Do not use.
  // DENY_WITH_LOG: This is deprecated and has no effect. Do not use.
  // LOG: This is deprecated and has no effect. Do not use.
  // NO_ACTION: This is deprecated and has no effect. Do not use.
  optional string action = 1 [json_name = "action"];

  // This is deprecated and has no effect. Do not use.
  repeated Condition conditions = 2 [json_name = "conditions"];

  // This is deprecated and has no effect. Do not use.
  optional string description = 3 [json_name = "description"];

  // This is deprecated and has no effect. Do not use.
  repeated string ins = 4 [json_name = "ins"];

  // This is deprecated and has no effect. Do not use.
  repeated LogConfig log_configs = 5 [json_name = "logConfigs"];

  // This is deprecated and has no effect. Do not use.
  repeated string not_ins = 6 [json_name = "notIns"];

  // This is deprecated and has no effect. Do not use.
  repeated string permissions = 7 [json_name = "permissions"];
}
