Skip to content

Commit f38a8ec

Browse files
kolea2kolea2
authored
feat: backup level IAM (#450)
* feat: backup level IAM * docs * extract out common logic * code feedback * lint
1 parent 93b9c62 commit f38a8ec

File tree

3 files changed

+373
-35
lines changed

3 files changed

+373
-35
lines changed

‎google-cloud-bigtable/src/main/java/com/google/cloud/bigtable/admin/v2/BigtableTableAdminClient.java

+223-34
Original file line numberDiff line numberDiff line change
@@ -1319,21 +1319,8 @@ public Policy getIamPolicy(String tableId) {
13191319
*/
13201320
@SuppressWarnings("WeakerAccess")
13211321
public ApiFuture<Policy> getIamPolicyAsync(String tableId) {
1322-
String name = NameUtil.formatTableName(projectId, instanceId, tableId);
1323-
1324-
GetIamPolicyRequest request = GetIamPolicyRequest.newBuilder().setResource(name).build();
1325-
1326-
final IamPolicyMarshaller marshaller = new IamPolicyMarshaller();
1327-
1328-
return ApiFutures.transform(
1329-
stub.getIamPolicyCallable().futureCall(request),
1330-
new ApiFunction<com.google.iam.v1.Policy, Policy>() {
1331-
@Override
1332-
public Policy apply(com.google.iam.v1.Policy proto) {
1333-
return marshaller.fromPb(proto);
1334-
}
1335-
},
1336-
MoreExecutors.directExecutor());
1322+
String tableName = NameUtil.formatTableName(projectId, instanceId, tableId);
1323+
return getResourceIamPolicy(tableName);
13371324
}
13381325

13391326
/**
@@ -1391,24 +1378,8 @@ public Policy setIamPolicy(String tableId, Policy policy) {
13911378
*/
13921379
@SuppressWarnings("WeakerAccess")
13931380
public ApiFuture<Policy> setIamPolicyAsync(String tableId, Policy policy) {
1394-
String name = NameUtil.formatTableName(projectId, instanceId, tableId);
1395-
final IamPolicyMarshaller marshaller = new IamPolicyMarshaller();
1396-
1397-
SetIamPolicyRequest request =
1398-
SetIamPolicyRequest.newBuilder()
1399-
.setResource(name)
1400-
.setPolicy(marshaller.toPb(policy))
1401-
.build();
1402-
1403-
return ApiFutures.transform(
1404-
stub.setIamPolicyCallable().futureCall(request),
1405-
new ApiFunction<com.google.iam.v1.Policy, Policy>() {
1406-
@Override
1407-
public Policy apply(com.google.iam.v1.Policy proto) {
1408-
return marshaller.fromPb(proto);
1409-
}
1410-
},
1411-
MoreExecutors.directExecutor());
1381+
String tableName = NameUtil.formatTableName(projectId, instanceId, tableId);
1382+
return setResourceIamPolicy(policy, tableName);
14121383
}
14131384

14141385
/**
@@ -1463,9 +1434,227 @@ public List<String> testIamPermission(String tableId, String... permissions) {
14631434
*/
14641435
@SuppressWarnings({"WeakerAccess"})
14651436
public ApiFuture<List<String>> testIamPermissionAsync(String tableId, String... permissions) {
1437+
String tableName = NameUtil.formatTableName(projectId, instanceId, tableId);
1438+
return testResourceIamPermissions(tableName, permissions);
1439+
}
1440+
1441+
/**
1442+
* Gets the IAM access control policy for the specified backup.
1443+
*
1444+
* <p>Sample code:
1445+
*
1446+
* <pre>{@code
1447+
* Policy policy = client.getBackupIamPolicy("my-cluster-id", "my-backup-id");
1448+
* for(Map.Entry<Role, Set<Identity>> entry : policy.getBindings().entrySet()) {
1449+
* System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
1450+
* }
1451+
* }</pre>
1452+
*
1453+
* @see <a
1454+
* href="https://cloud.google.com/bigtable/docs/access-control#iam-management-table">Table-level
1455+
* IAM management</a>
1456+
*/
1457+
@SuppressWarnings("WeakerAccess")
1458+
public Policy getBackupIamPolicy(String clusterId, String backupId) {
1459+
return ApiExceptions.callAndTranslateApiException(getBackupIamPolicyAsync(clusterId, backupId));
1460+
}
1461+
1462+
/**
1463+
* Asynchronously gets the IAM access control policy for the specified backup.
1464+
*
1465+
* <p>Sample code:
1466+
*
1467+
* <pre>{@code
1468+
* ApiFuture<Policy> policyFuture = client.getBackupIamPolicyAsync("my-cluster-id", "my-backup-id");
1469+
*
1470+
* ApiFutures.addCallback(policyFuture,
1471+
* new ApiFutureCallback<Policy>() {
1472+
* public void onSuccess(Policy policy) {
1473+
* for (Entry<Role, Set<Identity>> entry : policy.getBindings().entrySet()) {
1474+
* System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
1475+
* }
1476+
* }
1477+
*
1478+
* public void onFailure(Throwable t) {
1479+
* t.printStackTrace();
1480+
* }
1481+
* },
1482+
* MoreExecutors.directExecutor());
1483+
* }</pre>
1484+
*
1485+
* @see <a
1486+
* href="https://cloud.google.com/bigtable/docs/access-control#iam-management-table">Table-level
1487+
* IAM management</a>
1488+
*/
1489+
@SuppressWarnings("WeakerAccess")
1490+
public ApiFuture<Policy> getBackupIamPolicyAsync(String clusterId, String backupId) {
1491+
String backupName = NameUtil.formatBackupName(projectId, instanceId, clusterId, backupId);
1492+
return getResourceIamPolicy(backupName);
1493+
}
1494+
1495+
/**
1496+
* Replaces the IAM policy associated with the specified backup.
1497+
*
1498+
* <p>Sample code:
1499+
*
1500+
* <pre>{@code
1501+
* Policy newPolicy = client.setBackupIamPolicy("my-cluster-id", "my-backup-id",
1502+
* Policy.newBuilder()
1503+
* .addIdentity(Role.of("bigtable.user"), Identity.user("someone@example.com"))
1504+
* .addIdentity(Role.of("bigtable.admin"), Identity.group("admins@example.com"))
1505+
* .build());
1506+
* }</pre>
1507+
*
1508+
* @see <a
1509+
* href="https://cloud.google.com/bigtable/docs/access-control#iam-management-table">Table-level
1510+
* IAM management</a>
1511+
*/
1512+
@SuppressWarnings("WeakerAccess")
1513+
public Policy setBackupIamPolicy(String clusterId, String backupId, Policy policy) {
1514+
return ApiExceptions.callAndTranslateApiException(
1515+
setBackupIamPolicyAsync(clusterId, backupId, policy));
1516+
}
1517+
1518+
/**
1519+
* Asynchronously replaces the IAM policy associated with the specified backup.
1520+
*
1521+
* <p>Sample code:
1522+
*
1523+
* <pre>{@code
1524+
* ApiFuture<Policy> newPolicyFuture = client.setBackupIamPolicyAsync("my-cluster-id", "my-backup-id",
1525+
* Policy.newBuilder()
1526+
* .addIdentity(Role.of("bigtable.user"), Identity.user("someone@example.com"))
1527+
* .addIdentity(Role.of("bigtable.admin"), Identity.group("admins@example.com"))
1528+
* .build());
1529+
*
1530+
* ApiFutures.addCallback(newPolicyFuture,
1531+
* new ApiFutureCallback<Policy>() {
1532+
* public void onSuccess(Policy policy) {
1533+
* for (Entry<Role, Set<Identity>> entry : policy.getBindings().entrySet()) {
1534+
* System.out.printf("Role: %s Identities: %s\n", entry.getKey(), entry.getValue());
1535+
* }
1536+
* }
1537+
*
1538+
* public void onFailure(Throwable t) {
1539+
* t.printStackTrace();
1540+
* }
1541+
* },
1542+
* MoreExecutors.directExecutor());
1543+
* }</pre>
1544+
*
1545+
* @see <a
1546+
* href="https://cloud.google.com/bigtable/docs/access-control#iam-management-table">Table-level
1547+
* IAM management</a>
1548+
*/
1549+
@SuppressWarnings("WeakerAccess")
1550+
public ApiFuture<Policy> setBackupIamPolicyAsync(
1551+
String clusterId, String backupId, Policy policy) {
1552+
String backupName = NameUtil.formatBackupName(projectId, instanceId, clusterId, backupId);
1553+
return setResourceIamPolicy(policy, backupName);
1554+
}
1555+
1556+
/**
1557+
* Tests whether the caller has the given permissions for the specified backup. Returns a subset
1558+
* of the specified permissions that the caller has.
1559+
*
1560+
* <p>Sample code:
1561+
*
1562+
* <pre>{@code
1563+
* List<String> grantedPermissions = client.testBackupIamPermission("my-cluster-id", "my-backup-id",
1564+
* "bigtable.backups.restore", "bigtable.backups.delete");
1565+
* }</pre>
1566+
*
1567+
* System.out.println("Has restore access: " +
1568+
* grantedPermissions.contains("bigtable.backups.restore"));
1569+
*
1570+
* <p>System.out.println("Has delete access: " +
1571+
* grantedPermissions.contains("bigtable.backups.delete"));
1572+
*
1573+
* @see <a href="https://cloud.google.com/bigtable/docs/access-control#permissions">Cloud Bigtable
1574+
* permissions</a>
1575+
*/
1576+
@SuppressWarnings({"WeakerAccess"})
1577+
public List<String> testBackupIamPermission(
1578+
String clusterId, String backupId, String... permissions) {
1579+
return ApiExceptions.callAndTranslateApiException(
1580+
testBackupIamPermissionAsync(clusterId, backupId, permissions));
1581+
}
1582+
1583+
/**
1584+
* Asynchronously tests whether the caller has the given permissions for the specified backup.
1585+
* Returns a subset of the specified permissions that the caller has.
1586+
*
1587+
* <p>Sample code:
1588+
*
1589+
* <pre>{@code
1590+
* ApiFuture<List<String>> grantedPermissionsFuture = client.testBackupIamPermissionAsync("my-cluster-id", "my-backup-id",
1591+
* "bigtable.backups.restore", "bigtable.backups.delete");
1592+
*
1593+
* ApiFutures.addCallback(grantedPermissionsFuture,
1594+
* new ApiFutureCallback<List<String>>() {
1595+
* public void onSuccess(List<String> grantedPermissions) {
1596+
* System.out.println("Has restore access: " + grantedPermissions.contains("bigtable.backups.restore"));
1597+
* System.out.println("Has delete access: " + grantedPermissions.contains("bigtable.backups.delete"));
1598+
* }
1599+
*
1600+
* public void onFailure(Throwable t) {
1601+
* t.printStackTrace();
1602+
* }
1603+
* },
1604+
* MoreExecutors.directExecutor());
1605+
* }</pre>
1606+
*
1607+
* @see <a href="https://cloud.google.com/bigtable/docs/access-control#permissions">Cloud Bigtable
1608+
* permissions</a>
1609+
*/
1610+
@SuppressWarnings({"WeakerAccess"})
1611+
public ApiFuture<List<String>> testBackupIamPermissionAsync(
1612+
String clusterId, String backupId, String... permissions) {
1613+
String backupName = NameUtil.formatBackupName(projectId, instanceId, clusterId, backupId);
1614+
return testResourceIamPermissions(backupName, permissions);
1615+
}
1616+
1617+
private ApiFuture<Policy> getResourceIamPolicy(String name) {
1618+
GetIamPolicyRequest request = GetIamPolicyRequest.newBuilder().setResource(name).build();
1619+
1620+
final IamPolicyMarshaller marshaller = new IamPolicyMarshaller();
1621+
1622+
return ApiFutures.transform(
1623+
stub.getIamPolicyCallable().futureCall(request),
1624+
new ApiFunction<com.google.iam.v1.Policy, Policy>() {
1625+
@Override
1626+
public Policy apply(com.google.iam.v1.Policy proto) {
1627+
return marshaller.fromPb(proto);
1628+
}
1629+
},
1630+
MoreExecutors.directExecutor());
1631+
}
1632+
1633+
private ApiFuture<Policy> setResourceIamPolicy(Policy policy, String name) {
1634+
final IamPolicyMarshaller marshaller = new IamPolicyMarshaller();
1635+
1636+
SetIamPolicyRequest request =
1637+
SetIamPolicyRequest.newBuilder()
1638+
.setResource(name)
1639+
.setPolicy(marshaller.toPb(policy))
1640+
.build();
1641+
1642+
return ApiFutures.transform(
1643+
stub.setIamPolicyCallable().futureCall(request),
1644+
new ApiFunction<com.google.iam.v1.Policy, Policy>() {
1645+
@Override
1646+
public Policy apply(com.google.iam.v1.Policy proto) {
1647+
return marshaller.fromPb(proto);
1648+
}
1649+
},
1650+
MoreExecutors.directExecutor());
1651+
}
1652+
1653+
private ApiFuture<List<String>> testResourceIamPermissions(
1654+
String resourceName, String[] permissions) {
14661655
TestIamPermissionsRequest request =
14671656
TestIamPermissionsRequest.newBuilder()
1468-
.setResource(NameUtil.formatTableName(projectId, instanceId, tableId))
1657+
.setResource(resourceName)
14691658
.addAllPermissions(Arrays.asList(permissions))
14701659
.build();
14711660

0 commit comments

Comments
 (0)