|
| 1 | +package caiasset |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "strings" |
| 6 | + "time" |
| 7 | +) |
| 8 | + |
| 9 | +// Asset is the CAI representation of a resource. |
| 10 | +type Asset struct { |
| 11 | + // The name, in a peculiar format: `\\<api>.googleapis.com/<self_link>` |
| 12 | + Name string `json:"name"` |
| 13 | + // The type name in `google.<api>.<resourcename>` format. |
| 14 | + Type string `json:"assetType"` |
| 15 | + Resource *AssetResource `json:"resource,omitempty"` |
| 16 | + IAMPolicy *IAMPolicy `json:"iamPolicy,omitempty"` |
| 17 | + OrgPolicy []*OrgPolicy `json:"orgPolicy,omitempty"` |
| 18 | + V2OrgPolicies []*V2OrgPolicies `json:"v2_org_policies,omitempty"` |
| 19 | + Ancestors []string `json:"ancestors"` |
| 20 | + TfplanAddress []string `json:"tfplanAddress,omitempty"` |
| 21 | +} |
| 22 | + |
| 23 | +// IAMPolicy is the representation of a Cloud IAM policy set on a cloud resource. |
| 24 | +type IAMPolicy struct { |
| 25 | + Bindings []IAMBinding `json:"bindings"` |
| 26 | +} |
| 27 | + |
| 28 | +// IAMBinding binds a role to a set of members. |
| 29 | +type IAMBinding struct { |
| 30 | + Role string `json:"role"` |
| 31 | + Members []string `json:"members"` |
| 32 | +} |
| 33 | + |
| 34 | +// AssetResource is nested within the Asset type. |
| 35 | +type AssetResource struct { |
| 36 | + Version string `json:"version"` |
| 37 | + DiscoveryDocumentURI string `json:"discoveryDocumentUri"` |
| 38 | + DiscoveryName string `json:"discoveryName"` |
| 39 | + Parent string `json:"parent"` |
| 40 | + Data map[string]interface{} `json:"data"` |
| 41 | + Location string `json:"location,omitempty"` |
| 42 | +} |
| 43 | + |
| 44 | +// OrgPolicy is for managing organization policies. |
| 45 | +type OrgPolicy struct { |
| 46 | + Constraint string `json:"constraint,omitempty"` |
| 47 | + ListPolicy *ListPolicy `json:"list_policy,omitempty"` |
| 48 | + BooleanPolicy *BooleanPolicy `json:"boolean_policy,omitempty"` |
| 49 | + RestoreDefault *RestoreDefault `json:"restore_default,omitempty"` |
| 50 | + UpdateTime *Timestamp `json:"update_time,omitempty"` |
| 51 | +} |
| 52 | + |
| 53 | +// V2OrgPolicies is the represtation of V2OrgPolicies |
| 54 | +type V2OrgPolicies struct { |
| 55 | + Name string `json:"name"` |
| 56 | + PolicySpec *PolicySpec `json:"spec,omitempty"` |
| 57 | +} |
| 58 | + |
| 59 | +// Spec is the representation of Spec for Custom Org Policy |
| 60 | +type PolicySpec struct { |
| 61 | + Etag string `json:"etag,omitempty"` |
| 62 | + UpdateTime *Timestamp `json:"update_time,omitempty"` |
| 63 | + PolicyRules []*PolicyRule `json:"rules,omitempty"` |
| 64 | + InheritFromParent bool `json:"inherit_from_parent,omitempty"` |
| 65 | + Reset bool `json:"reset,omitempty"` |
| 66 | +} |
| 67 | + |
| 68 | +type PolicyRule struct { |
| 69 | + Values *StringValues `json:"values,omitempty"` |
| 70 | + AllowAll bool `json:"allow_all,omitempty"` |
| 71 | + DenyAll bool `json:"deny_all,omitempty"` |
| 72 | + Enforce bool `json:"enforce,omitempty"` |
| 73 | + Condition *Expr `json:"condition,omitempty"` |
| 74 | +} |
| 75 | + |
| 76 | +type StringValues struct { |
| 77 | + AllowedValues []string `json:"allowed_values,omitempty"` |
| 78 | + DeniedValues []string `json:"denied_values,omitempty"` |
| 79 | +} |
| 80 | + |
| 81 | +type Expr struct { |
| 82 | + Expression string `json:"expression,omitempty"` |
| 83 | + Title string `json:"title,omitempty"` |
| 84 | + Description string `json:"description,omitempty"` |
| 85 | + Location string `json:"location,omitempty"` |
| 86 | +} |
| 87 | + |
| 88 | +type Timestamp struct { |
| 89 | + Seconds int64 `json:"seconds,omitempty"` |
| 90 | + Nanos int64 `json:"nanos,omitempty"` |
| 91 | +} |
| 92 | + |
| 93 | +func (t Timestamp) MarshalJSON() ([]byte, error) { |
| 94 | + return []byte(`"` + time.Unix(0, t.Nanos).UTC().Format(time.RFC3339Nano) + `"`), nil |
| 95 | +} |
| 96 | + |
| 97 | +func (t *Timestamp) UnmarshalJSON(b []byte) error { |
| 98 | + p, err := time.Parse(time.RFC3339Nano, strings.Trim(string(b), `"`)) |
| 99 | + if err != nil { |
| 100 | + return fmt.Errorf("bad Timestamp: %v", err) |
| 101 | + } |
| 102 | + t.Seconds = p.Unix() |
| 103 | + t.Nanos = p.UnixNano() |
| 104 | + return nil |
| 105 | +} |
| 106 | + |
| 107 | +// ListPolicyAllValues is used to set `Policies` that apply to all possible |
| 108 | +// configuration values rather than specific values in `allowed_values` or |
| 109 | +// `denied_values`. |
| 110 | +type ListPolicyAllValues int32 |
| 111 | + |
| 112 | +// ListPolicy can define specific values and subtrees of Cloud Resource |
| 113 | +// Manager resource hierarchy (`Organizations`, `Folders`, `Projects`) that |
| 114 | +// are allowed or denied by setting the `allowed_values` and `denied_values` |
| 115 | +// fields. |
| 116 | +type ListPolicy struct { |
| 117 | + AllowedValues []string `json:"allowed_values,omitempty"` |
| 118 | + DeniedValues []string `json:"denied_values,omitempty"` |
| 119 | + AllValues ListPolicyAllValues `json:"all_values,omitempty"` |
| 120 | + SuggestedValue string `json:"suggested_value,omitempty"` |
| 121 | + InheritFromParent bool `json:"inherit_from_parent,omitempty"` |
| 122 | +} |
| 123 | + |
| 124 | +// BooleanPolicy If `true`, then the `Policy` is enforced. If `false`, |
| 125 | +// then any configuration is acceptable. |
| 126 | +type BooleanPolicy struct { |
| 127 | + Enforced bool `json:"enforced,omitempty"` |
| 128 | +} |
| 129 | + |
| 130 | +// RestoreDefault determines if the default values of the `Constraints` are active for the |
| 131 | +// resources. |
| 132 | +type RestoreDefault struct { |
| 133 | +} |
0 commit comments