|
|
@@ -110,7 +110,7 @@ message PermissionMatrixCell {
|
|
|
optional bool allow_permitted = 5;
|
|
|
}
|
|
|
|
|
|
-// Permission matrix for one role within a scope page.
|
|
|
+// Complete permission matrix for one role at the matching scopes.
|
|
|
message RolePermissionMatrix {
|
|
|
// Role name.
|
|
|
string role_name = 1;
|
|
|
@@ -124,27 +124,27 @@ message RolePermissionMatrix {
|
|
|
|
|
|
// Request one role's permission matrix.
|
|
|
message GetRolePermissionMatrixRequest {
|
|
|
+ reserved 3;
|
|
|
+ reserved "page";
|
|
|
// Stable role name.
|
|
|
string role_name = 1 [(buf.validate.field).string.min_len = 1];
|
|
|
// Include the direct-message scope column. Defaults to false so an older
|
|
|
// client does not receive a scope kind that it cannot interpret.
|
|
|
bool include_direct_message_scope = 2;
|
|
|
- // Scope page. Default 20 scopes, maximum 100. Offsets count scopes, not decisions.
|
|
|
- chatto.api.v1.PageRequest page = 3;
|
|
|
- // Optional exact scope filter. Missing or inaccessible scopes produce an empty page.
|
|
|
+ // Optional exact scope filter. Omit to read all scopes. Missing or inaccessible scopes produce an empty matrix.
|
|
|
// SERVER and DM require an empty ID; GROUP and ROOM require an ID.
|
|
|
PermissionScope scope = 4;
|
|
|
}
|
|
|
|
|
|
// Response containing one role's permission matrix.
|
|
|
message GetRolePermissionMatrixResponse {
|
|
|
+ reserved 2;
|
|
|
+ reserved "page";
|
|
|
// Requested matrix.
|
|
|
RolePermissionMatrix matrix = 1;
|
|
|
- // Total matching scopes and whether another scope page exists.
|
|
|
- chatto.api.v1.PageInfo page = 2;
|
|
|
}
|
|
|
|
|
|
-// Permission matrix for one user within a scope page.
|
|
|
+// Complete permission matrix for one user at the matching scopes.
|
|
|
message UserPermissionMatrix {
|
|
|
// User ID.
|
|
|
string user_id = 1;
|
|
|
@@ -294,24 +294,24 @@ message ExplainPermissionsResponse {
|
|
|
|
|
|
// Request one user's permission matrix.
|
|
|
message GetUserPermissionMatrixRequest {
|
|
|
+ reserved 3;
|
|
|
+ reserved "page";
|
|
|
// User ID.
|
|
|
string user_id = 1 [(buf.validate.field).string.min_len = 1];
|
|
|
// Include the direct-message scope column. Defaults to false so an older
|
|
|
// client does not receive a scope kind that it cannot interpret.
|
|
|
bool include_direct_message_scope = 2;
|
|
|
- // Scope page. Default 20 scopes, maximum 100. Offsets count scopes, not decisions.
|
|
|
- chatto.api.v1.PageRequest page = 3;
|
|
|
- // Optional exact scope filter. Missing or inaccessible scopes produce an empty page.
|
|
|
+ // Optional exact scope filter. Omit to read all scopes. Missing or inaccessible scopes produce an empty matrix.
|
|
|
// SERVER and DM require an empty ID; GROUP and ROOM require an ID.
|
|
|
PermissionScope scope = 4;
|
|
|
}
|
|
|
|
|
|
// Response containing one user's permission matrix.
|
|
|
message GetUserPermissionMatrixResponse {
|
|
|
+ reserved 2;
|
|
|
+ reserved "page";
|
|
|
// Requested matrix.
|
|
|
UserPermissionMatrix matrix = 1;
|
|
|
- // Total matching scopes and whether another scope page exists.
|
|
|
- chatto.api.v1.PageInfo page = 2;
|
|
|
}
|
|
|
|
|
|
// Request to set one role permission state.
|
|
|
@@ -357,10 +357,10 @@ message SetUserPermissionResponse {
|
|
|
}
|
|
|
|
|
|
// Provides permission reads and admin permission writes.
|
|
|
-// Matrix and decision pages use the same scope order: SERVER, DM, then each GROUP
|
|
|
-// followed by its ROOM scopes. Groups and rooms within each group use ascending
|
|
|
-// resource IDs. Only requested scopes are evaluated.
|
|
|
-// Pages are live reads; layout or visibility changes can shift offsets. Keep the
|
|
|
+// Matrices return all matching scopes. Decision lists return scope pages.
|
|
|
+// Both use the order SERVER, DM, then each GROUP followed by its ROOM scopes.
|
|
|
+// Groups and rooms follow the configured sidebar order. Only matching scopes are evaluated.
|
|
|
+// Decision pages are live reads; layout or visibility changes can shift offsets. Keep the
|
|
|
// same filters on each request and advance by the number of returned scopes.
|
|
|
// A scope filter of DM selects DM even when include_direct_message_scope is false.
|
|
|
service AdminPermissionService {
|
|
|
@@ -368,13 +368,13 @@ service AdminPermissionService {
|
|
|
// role.manage; group and room scopes require role.manage or effective
|
|
|
// room.manage at the requested resource.
|
|
|
rpc GetRolePermissionTierMatrix(GetRolePermissionTierMatrixRequest) returns (GetRolePermissionTierMatrixResponse);
|
|
|
- // Gets one page of a role's permission matrix. Requires role.manage. Returns
|
|
|
+ // Gets a complete role permission matrix. Requires role.manage. Returns
|
|
|
// NOT_FOUND when the role does not exist.
|
|
|
rpc GetRolePermissionMatrix(GetRolePermissionMatrixRequest) returns (GetRolePermissionMatrixResponse);
|
|
|
// Lists one role's permission decisions as resource-oriented rows. Requires
|
|
|
// role.manage. Returns NOT_FOUND when the role does not exist.
|
|
|
rpc ListRolePermissionDecisions(ListRolePermissionDecisionsRequest) returns (ListRolePermissionDecisionsResponse);
|
|
|
- // Gets one page of a user's permission matrix. Human targets require
|
|
|
+ // Gets a complete user permission matrix. Human targets require
|
|
|
// user.manage-permissions; bot targets require ownership or bot.manage.
|
|
|
// Returns NOT_FOUND when the user does not exist.
|
|
|
rpc GetUserPermissionMatrix(GetUserPermissionMatrixRequest) returns (GetUserPermissionMatrixResponse);
|
the-codemancer