Add support for mapping permission names to urls when creating the roles

gen/openapi/proto/rpc/authz/authz.swagger.json

@@ -85,10 +85,6 @@
         "obj": {
           "type": "string",
           "title": "Resource for which the access is needed"
-        },
-        "act": {
-          "type": "string",
-          "title": "Action, read/write; * for both read+write"
         }
       }
     },

gen/openapi/proto/rpc/sentry/kubeconfig.swagger.json

@@ -675,7 +675,7 @@
     },
     "/v2/sentry/kubeconfig/{opts.urlScope_1}/setting": {
       "get": {
-        "operationId": "KubeConfig_GetOrganizationSetting",
+        "operationId": "KubeConfig_GetUserSetting",
         "responses": {
           "200": {
             "description": "A successful response.",
@@ -703,12 +703,12 @@
         },
         "parameters": [
           {
-            "name": "opts.urlScope",
+            "name": "opts.urlScope_1",
             "description": "urlScope is supposed to be passed in the URL as kind/HashID(value)",
             "in": "path",
             "required": true,
             "type": "string",
-            "pattern": "organization/[^/]+"
+            "pattern": "user/[^/]+"
           },
           {
             "name": "opts.name",
@@ -917,7 +917,7 @@
     },
     "/v2/sentry/kubeconfig/{opts.urlScope_2}/setting": {
       "get": {
-        "operationId": "KubeConfig_GetOrganizationSetting",
+        "operationId": "KubeConfig_GetSSOUserSetting",
         "responses": {
           "200": {
             "description": "A successful response.",
@@ -945,12 +945,12 @@
         },
         "parameters": [
           {
-            "name": "opts.urlScope",
+            "name": "opts.urlScope_2",
             "description": "urlScope is supposed to be passed in the URL as kind/HashID(value)",
             "in": "path",
             "required": true,
             "type": "string",
-            "pattern": "organization/[^/]+"
+            "pattern": "ssouser/[^/]+"
           },
           {
             "name": "opts.name",

main.go

@@ -230,7 +230,9 @@ func setup() {
 	pps = service.NewProjectService(db)
 
 	// authz services
-	gormDb, err := gorm.Open(postgres.Open(dsn), &gorm.Config{})
+	gormDb, err := gorm.Open(postgres.New(postgres.Config{
+		Conn: sqldb,
+	}), &gorm.Config{})
 	if err != nil {
 		_log.Fatalw("unable to create db connection", "error", err)
 	}
@@ -238,7 +240,7 @@ func setup() {
 	if err != nil {
 		_log.Fatalw("unable to init enforcer", "error", err)
 	}
-	as = service.NewAuthzService(gormDb, enforcer)
+	as = service.NewAuthzService(db, enforcer)
 
 	// users and role management services
 	us = service.NewUserService(providers.NewKratosAuthProvider(kc), db, as)

pkg/enforcer/enforcer.go

@@ -29,17 +29,17 @@ func (e *casbinEnforcer) Init() (*casbin.CachedEnforcer, error) {
 r = sub, ns, proj, org, obj, act
 
 [policy_definition]
-p = sub, ns, proj, org, obj, act
+p = sub, ns, proj, org, obj
 
 [role_definition]
-g = _, _
+g = _, _, _
 g2 = _, _
 
 [policy_effect]
 e = some(where (p.eft == allow))
 
 [matchers]
-m = g2(r.sub, p.sub) && globMatch(r.ns, p.ns) && globMatch(r.proj, p.proj) && r.org == p.org && g(r.obj, p.obj) && globMatch(r.act, p.act)
+m = g2(r.sub, p.sub) && globMatch(r.ns, p.ns) && globMatch(r.proj, p.proj) && r.org == p.org && g(r.obj, p.obj, r.act)
 `
 	m, err := model.NewModelFromString(modelText)
 	if err != nil {

pkg/gateway/testdata/test.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: pkg/gateway/testdata/test.proto
 
 package testdata

pkg/gateway/testdata/test_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: pkg/gateway/testdata/test.proto
 
 package testdata
 

pkg/service/authz.go

@@ -4,11 +4,13 @@ import (
 	"context"
 	"fmt"
 
+	"github.com/RafaySystems/rcloud-base/internal/models"
+	"github.com/RafaySystems/rcloud-base/internal/persistence/provider/pg"
 	authzpbv1 "github.com/RafaySystems/rcloud-base/proto/types/authz"
 	"github.com/casbin/casbin/v2"
+	"github.com/uptrace/bun"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"gorm.io/gorm"
 )
 
 type AuthzService interface {
@@ -25,13 +27,14 @@ type AuthzService interface {
 }
 
 type authzService struct {
-	db       *gorm.DB
-	enforcer *casbin.CachedEnforcer
+	dao          pg.EntityDAO
+	enforcer     *casbin.CachedEnforcer
+	mappingCache map[string][]rpmUrlAction
 }
 
-func NewAuthzService(db *gorm.DB, en *casbin.CachedEnforcer) AuthzService {
+func NewAuthzService(db *bun.DB, en *casbin.CachedEnforcer) AuthzService {
 	return &authzService{
-		db:       db,
+		dao:      pg.NewEntityDAO(db),
 		enforcer: en,
 	}
 }
@@ -41,6 +44,52 @@ const (
 	roleGtype  = "g"
 )
 
+type rpmUrlAction struct {
+	url     string
+	methods []string
+}
+
+func (s *authzService) cacheResourceRolePermissions(ctx context.Context) error {
+	var items []models.ResourcePermission
+	entities, err := s.dao.ListAll(ctx, &items)
+	if err != nil {
+		return err
+	}
+	if rpms, ok := entities.(*[]models.ResourcePermission); ok {
+		for _, rpm := range *rpms {
+			if perm, ok := s.mappingCache[rpm.Name]; ok {
+				urls := []rpmUrlAction{}
+				for _, rurl := range rpm.ResourceUrls {
+					tmp := rpmUrlAction{
+						url: rpm.BaseUrl,
+					}
+					if url, ok := rurl["url"].(string); ok {
+						tmp.url = tmp.url + url
+					}
+					if methods, ok := rurl["methods"].([]string); ok {
+						tmp.methods = methods
+					}
+					urls = append(urls, tmp)
+				}
+				for _, raurl := range rpm.ResourceActionUrls {
+					tmp := rpmUrlAction{
+						url: rpm.BaseUrl,
+					}
+					if url, ok := raurl["url"].(string); ok {
+						tmp.url = tmp.url + url
+					}
+					if methods, ok := raurl["methods"].([]string); ok {
+						tmp.methods = methods
+					}
+					urls = append(urls, tmp)
+				}
+				s.mappingCache[rpm.Name] = append(perm, urls...)
+			}
+		}
+	}
+	return nil
+}
+
 func (s *authzService) toPolicies(policies [][]string) *authzpbv1.Policies {
 	if len(policies) == 0 {
 		return &authzpbv1.Policies{}
@@ -55,7 +104,6 @@ func (s *authzService) toPolicies(policies [][]string) *authzpbv1.Policies {
 			Proj: policies[i][2],
 			Org:  policies[i][3],
 			Obj:  policies[i][4],
-			Act:  policies[i][5],
 		}
 	}
 	return res
@@ -64,7 +112,7 @@ func (s *authzService) toPolicies(policies [][]string) *authzpbv1.Policies {
 func (s *authzService) fromPolicies(policies *authzpbv1.Policies) ([][]string, error) {
 	res := [][]string{}
 	for i, p := range policies.GetPolicies() {
-		rule := []string{p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj(), p.GetAct()}
+		rule := []string{p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj()}
 		for _, field := range rule {
 			if field == "" {
 				return res, fmt.Errorf(fmt.Sprintf("index %d: policy elements do not meet definition", i))
@@ -132,17 +180,27 @@ func (s *authzService) toRolePermissionMappingList(r [][]string) *authzpbv1.Role
 	return res
 }
 
-func (s *authzService) fromRolePermissionMappingList(r *authzpbv1.RolePermissionMappingList) ([][]string, error) {
+func (s *authzService) fromRolePermissionMappingList(ctx context.Context, r *authzpbv1.RolePermissionMappingList) ([][]string, error) {
+	if len(s.mappingCache) == 0 {
+		s.cacheResourceRolePermissions(ctx)
+	}
+
 	res := [][]string{}
 	for i, mapping := range r.GetRolePermissionMappingList() {
 		for _, permission := range mapping.GetPermission() {
-			rule := []string{permission, mapping.Role}
-			for _, field := range rule {
-				if field == "" {
-					return res, fmt.Errorf(fmt.Sprintf("index %d: mapping elements do not meet definition", i))
+			rules := [][]string{}
+			for _, rpm := range s.mappingCache[permission] {
+				for _, method := range rpm.methods {
+					rule := []string{rpm.url, mapping.GetRole(), method}
+					for _, field := range rule {
+						if field == "" {
+							return res, fmt.Errorf(fmt.Sprintf("index %d: mapping elements do not meet definition", i))
+						}
+					}
+					rules = append(rules, rule)
 				}
 			}
-			res = append(res, rule)
+			res = append(res, rules...)
 		}
 	}
 	return res, nil
@@ -165,7 +223,7 @@ func (s *authzService) Enforce(ctx context.Context, req *authzpbv1.EnforceReques
 }
 
 func (s *authzService) ListPolicies(ctx context.Context, p *authzpbv1.Policy) (*authzpbv1.Policies, error) {
-	return s.toPolicies(s.enforcer.GetFilteredPolicy(0, p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj(), p.GetAct())), nil
+	return s.toPolicies(s.enforcer.GetFilteredPolicy(0, p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj())), nil
 }
 
 func (s *authzService) CreatePolicies(ctx context.Context, p *authzpbv1.Policies) (*authzpbv1.BoolReply, error) {
@@ -187,7 +245,7 @@ func (s *authzService) CreatePolicies(ctx context.Context, p *authzpbv1.Policies
 
 func (s *authzService) DeletePolicies(ctx context.Context, p *authzpbv1.Policy) (*authzpbv1.BoolReply, error) {
 	// err could be from db, policy assertions, cache; dispatcher, watcher updates (not pertinent)
-	res, err := s.enforcer.RemoveFilteredPolicy(0, p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj(), p.GetAct())
+	res, err := s.enforcer.RemoveFilteredPolicy(0, p.GetSub(), p.GetNs(), p.GetProj(), p.GetOrg(), p.GetObj())
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, err.Error())
 	}
@@ -234,12 +292,11 @@ func (s *authzService) ListRolePermissionMappings(ctx context.Context, p *authzp
 }
 
 func (s *authzService) CreateRolePermissionMappings(ctx context.Context, p *authzpbv1.RolePermissionMappingList) (*authzpbv1.BoolReply, error) {
-	// TODO: Change permissions to a list of urls (one to many)
 	if len(p.GetRolePermissionMappingList()) == 0 {
 		return &authzpbv1.BoolReply{Res: false}, nil
 	}
 
-	rpms, err := s.fromRolePermissionMappingList(p)
+	rpms, err := s.fromRolePermissionMappingList(ctx, p)
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, err.Error())
 	}
@@ -253,7 +310,6 @@ func (s *authzService) CreateRolePermissionMappings(ctx context.Context, p *auth
 }
 
 func (s *authzService) DeleteRolePermissionMappings(ctx context.Context, p *authzpbv1.FilteredRolePermissionMapping) (*authzpbv1.BoolReply, error) {
-	// TODO: Change permissions to a list of urls (one to many)
 	res, err := s.enforcer.RemoveFilteredNamedGroupingPolicy(roleGtype, 1, p.GetRole())
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, err.Error())

pkg/service/group.go

@@ -130,7 +130,6 @@ func (s *groupService) createGroupRoleRelations(ctx context.Context, group *user
 				Proj: project,
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		case project != "":
 			projectId, err := s.l.GetProjectId(ctx, project)
@@ -154,7 +153,6 @@ func (s *groupService) createGroupRoleRelations(ctx context.Context, group *user
 				Proj: project,
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		default:
 			gr := models.GroupRole{
@@ -172,7 +170,6 @@ func (s *groupService) createGroupRoleRelations(ctx context.Context, group *user
 				Proj: "*",
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		}
 	}

pkg/service/user.go

@@ -148,7 +148,6 @@ func (s *userService) createUserRoleRelations(ctx context.Context, user *userv3.
 				Proj: project,
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		case project != "":
 			projectId, err := s.l.GetProjectId(ctx, project)
@@ -175,7 +174,6 @@ func (s *userService) createUserRoleRelations(ctx context.Context, user *userv3.
 				Proj: project,
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		default:
 			ar := models.AccountResourcerole{
@@ -197,7 +195,6 @@ func (s *userService) createUserRoleRelations(ctx context.Context, user *userv3.
 				Proj: "*",
 				Org:  org,
 				Obj:  role,
-				Act:  "*",
 			})
 		}
 	}

proto/rpc/authz/authz.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/authz/authz.proto
 
 package authzv1

proto/rpc/authz/authz_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/authz/authz.proto
 
 package authzv1
 

proto/rpc/role/role.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/role/role.proto
 
 package rpcv3

proto/rpc/role/role_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/role/role.proto
 
 package rpcv3
 

proto/rpc/role/rolepermission.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/role/rolepermission.proto
 
 package rpcv3

proto/rpc/role/rolepermission_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/role/rolepermission.proto
 
 package rpcv3
 

proto/rpc/scheduler/cluster.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/scheduler/cluster.proto
 
 package rpcv3

proto/rpc/scheduler/cluster_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/scheduler/cluster.proto
 
 package rpcv3
 

proto/rpc/sentry/audit_info.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/audit_info.proto
 
 package sentry

proto/rpc/sentry/audit_info_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/audit_info.proto
 
 package sentry
 

proto/rpc/sentry/bootstrap.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/bootstrap.proto
 
 package sentry

proto/rpc/sentry/bootstrap_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/bootstrap.proto
 
 package sentry
 

proto/rpc/sentry/cluster_authz.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/cluster_authz.proto
 
 package sentry

proto/rpc/sentry/cluster_authz_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/cluster_authz.proto
 
 package sentry
 

proto/rpc/sentry/kubeconfig.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/kubeconfig.proto
 
 package sentry

proto/rpc/sentry/kubeconfig_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/kubeconfig.proto
 
 package sentry
 

proto/rpc/sentry/kubectl_cluster.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/kubectl_cluster.proto
 
 package sentry

proto/rpc/sentry/kubectl_cluster_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/kubectl_cluster.proto
 
 package sentry
 

proto/rpc/sentry/relaypeer.pb.go

@@ -3,7 +3,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/sentry/relaypeer.proto
 
 package sentry

proto/rpc/sentry/relaypeer_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/sentry/relaypeer.proto
 
 package sentry
 

proto/rpc/system/idp.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/idp.proto
 
 package rpcv3

proto/rpc/system/idp_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/idp.proto
 
 package rpcv3
 

proto/rpc/system/metro.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/metro.proto
 
 package rpcv3

proto/rpc/system/metro_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/metro.proto
 
 package rpcv3
 

proto/rpc/system/oidc_provider.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/oidc_provider.proto
 
 package rpcv3

proto/rpc/system/oidc_provider_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/oidc_provider.proto
 
 package rpcv3
 

proto/rpc/system/organization.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/organization.proto
 
 package rpcv3

proto/rpc/system/organization_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/organization.proto
 
 package rpcv3
 

proto/rpc/system/partner.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/partner.proto
 
 package rpcv3

proto/rpc/system/partner_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/partner.proto
 
 package rpcv3
 

proto/rpc/system/project.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/system/project.proto
 
 package rpcv3

proto/rpc/system/project_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/system/project.proto
 
 package rpcv3
 

proto/rpc/user/group.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/user/group.proto
 
 package rpcv3

proto/rpc/user/group_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/user/group.proto
 
 package rpcv3
 

proto/rpc/user/user.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/user/user.proto
 
 package rpcv3

proto/rpc/user/user_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/user/user.proto
 
 package rpcv3
 

proto/rpc/v3/auth.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/rpc/v3/auth.proto
 
 package rpcv3

proto/rpc/v3/auth_grpc.pb.go

@@ -1,8 +1,4 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             (unknown)
-// source: proto/rpc/v3/auth.proto
 
 package rpcv3
 

proto/types/authz/authz.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/authz/authz.proto
 
 package authzv1
@@ -82,8 +82,6 @@ type Policy struct {
 	Org string `protobuf:"bytes,4,opt,name=org,proto3" json:"org,omitempty"`
 	// Resource for which the access is needed
 	Obj string `protobuf:"bytes,5,opt,name=obj,proto3" json:"obj,omitempty"`
-	// Action, read/write; * for both read+write
-	Act string `protobuf:"bytes,6,opt,name=act,proto3" json:"act,omitempty"`
 }
 
 func (x *Policy) Reset() {
@@ -153,13 +151,6 @@ func (x *Policy) GetObj() string {
 	return ""
 }
 
-func (x *Policy) GetAct() string {
-	if x != nil {
-		return x.Act
-	}
-	return ""
-}
-
 type Policies struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -514,62 +505,61 @@ var file_proto_types_authz_authz_proto_rawDesc = []byte{
 	0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x76, 0x31, 0x22, 0x28, 0x0a, 0x0e, 0x45, 0x6e, 0x66,
 	0x6f, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x70,
 	0x61, 0x72, 0x61, 0x6d, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x70, 0x61, 0x72,
-	0x61, 0x6d, 0x73, 0x22, 0x74, 0x0a, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x10, 0x0a,
+	0x61, 0x6d, 0x73, 0x22, 0x62, 0x0a, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x10, 0x0a,
 	0x03, 0x73, 0x75, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x75, 0x62, 0x12,
 	0x0e, 0x0a, 0x02, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x6e, 0x73, 0x12,
 	0x12, 0x0a, 0x04, 0x70, 0x72, 0x6f, 0x6a, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70,
 	0x72, 0x6f, 0x6a, 0x12, 0x10, 0x0a, 0x03, 0x6f, 0x72, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x03, 0x6f, 0x72, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6f, 0x62, 0x6a, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6f, 0x62, 0x6a, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x63, 0x74, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x61, 0x63, 0x74, 0x22, 0x48, 0x0a, 0x08, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x3c, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x72, 0x61, 0x66, 0x61, 0x79, 0x2e,
+	0x28, 0x09, 0x52, 0x03, 0x6f, 0x62, 0x6a, 0x22, 0x48, 0x0a, 0x08, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x69, 0x65, 0x73, 0x12, 0x3c, 0x0a, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x72, 0x61, 0x66, 0x61, 0x79, 0x2e, 0x64, 0x65,
+	0x76, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x76, 0x31,
+	0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65,
+	0x73, 0x22, 0x31, 0x0a, 0x09, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x12,
+	0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x73,
+	0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x67, 0x72, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x67, 0x72, 0x70, 0x22, 0x52, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x12, 0x44, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x72, 0x61, 0x66, 0x61, 0x79, 0x2e,
 	0x64, 0x65, 0x76, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x2e,
-	0x76, 0x31, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x69, 0x65, 0x73, 0x22, 0x31, 0x0a, 0x09, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
-	0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x75, 0x73, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x67, 0x72, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x67, 0x72, 0x70, 0x22, 0x52, 0x0a, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72,
-	0x6f, 0x75, 0x70, 0x73, 0x12, 0x44, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x72, 0x61, 0x66, 0x61,
-	0x79, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68,
-	0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x0a,
-	0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x4b, 0x0a, 0x15, 0x52, 0x6f,
-	0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x65, 0x72,
-	0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x8d, 0x01, 0x0a, 0x19, 0x52, 0x6f, 0x6c, 0x65,
+	0x76, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x0a, 0x75, 0x73,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x4b, 0x0a, 0x15, 0x52, 0x6f, 0x6c, 0x65,
 	0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x70, 0x0a, 0x1c, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x70, 0x65,
-	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x5f, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x72, 0x61,
-	0x66, 0x61, 0x79, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x61, 0x75,
-	0x74, 0x68, 0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x19, 0x72, 0x6f,
-	0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x4c, 0x69, 0x73, 0x74, 0x22, 0x33, 0x0a, 0x1d, 0x46, 0x69, 0x6c, 0x74, 0x65,
-	0x72, 0x65, 0x64, 0x52, 0x6f, 0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x22, 0x1d, 0x0a, 0x09,
-	0x42, 0x6f, 0x6f, 0x6c, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x65, 0x73,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x72, 0x65, 0x73, 0x42, 0xee, 0x01, 0x0a, 0x1c,
-	0x63, 0x6f, 0x6d, 0x2e, 0x72, 0x61, 0x66, 0x61, 0x79, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x74, 0x79,
-	0x70, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x76, 0x31, 0x42, 0x0a, 0x41, 0x75,
-	0x74, 0x68, 0x7a, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x52, 0x61, 0x66, 0x61, 0x79, 0x53, 0x79, 0x73, 0x74,
-	0x65, 0x6d, 0x73, 0x2f, 0x72, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x62, 0x61, 0x73, 0x65, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x61, 0x75, 0x74, 0x68,
-	0x7a, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x76, 0x31, 0xa2, 0x02, 0x04, 0x52, 0x44, 0x54, 0x41,
-	0xaa, 0x02, 0x18, 0x52, 0x61, 0x66, 0x61, 0x79, 0x2e, 0x44, 0x65, 0x76, 0x2e, 0x54, 0x79, 0x70,
-	0x65, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x18, 0x52, 0x61,
-	0x66, 0x61, 0x79, 0x5c, 0x44, 0x65, 0x76, 0x5c, 0x54, 0x79, 0x70, 0x65, 0x73, 0x5c, 0x41, 0x75,
-	0x74, 0x68, 0x7a, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x24, 0x52, 0x61, 0x66, 0x61, 0x79, 0x5c, 0x44,
-	0x65, 0x76, 0x5c, 0x54, 0x79, 0x70, 0x65, 0x73, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x5c, 0x56,
-	0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1c,
-	0x52, 0x61, 0x66, 0x61, 0x79, 0x3a, 0x3a, 0x44, 0x65, 0x76, 0x3a, 0x3a, 0x54, 0x79, 0x70, 0x65,
-	0x73, 0x3a, 0x3a, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x67, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x72, 0x6f, 0x6c, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x65, 0x72, 0x6d, 0x69,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x8d, 0x01, 0x0a, 0x19, 0x52, 0x6f, 0x6c, 0x65, 0x50, 0x65,
+	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4c,
+	0x69, 0x73, 0x74, 0x12, 0x70, 0x0a, 0x1c, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x70, 0x65, 0x72, 0x6d,
+	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x5f, 0x6c,
+	0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x72, 0x61, 0x66, 0x61,
+	0x79, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x61, 0x75, 0x74, 0x68,
+	0x7a, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x6f, 0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x19, 0x72, 0x6f, 0x6c, 0x65,
+	0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x4c, 0x69, 0x73, 0x74, 0x22, 0x33, 0x0a, 0x1d, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x65,
+	0x64, 0x52, 0x6f, 0x6c, 0x65, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x22, 0x1d, 0x0a, 0x09, 0x42, 0x6f,
+	0x6f, 0x6c, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x65, 0x73, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x72, 0x65, 0x73, 0x42, 0xee, 0x01, 0x0a, 0x1c, 0x63, 0x6f,
+	0x6d, 0x2e, 0x72, 0x61, 0x66, 0x61, 0x79, 0x2e, 0x64, 0x65, 0x76, 0x2e, 0x74, 0x79, 0x70, 0x65,
+	0x73, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x76, 0x31, 0x42, 0x0a, 0x41, 0x75, 0x74, 0x68,
+	0x7a, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x52, 0x61, 0x66, 0x61, 0x79, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d,
+	0x73, 0x2f, 0x72, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x62, 0x61, 0x73, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x3b,
+	0x61, 0x75, 0x74, 0x68, 0x7a, 0x76, 0x31, 0xa2, 0x02, 0x04, 0x52, 0x44, 0x54, 0x41, 0xaa, 0x02,
+	0x18, 0x52, 0x61, 0x66, 0x61, 0x79, 0x2e, 0x44, 0x65, 0x76, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x73,
+	0x2e, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x18, 0x52, 0x61, 0x66, 0x61,
+	0x79, 0x5c, 0x44, 0x65, 0x76, 0x5c, 0x54, 0x79, 0x70, 0x65, 0x73, 0x5c, 0x41, 0x75, 0x74, 0x68,
+	0x7a, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x24, 0x52, 0x61, 0x66, 0x61, 0x79, 0x5c, 0x44, 0x65, 0x76,
+	0x5c, 0x54, 0x79, 0x70, 0x65, 0x73, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x5c, 0x56, 0x31, 0x5c,
+	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1c, 0x52, 0x61,
+	0x66, 0x61, 0x79, 0x3a, 0x3a, 0x44, 0x65, 0x76, 0x3a, 0x3a, 0x54, 0x79, 0x70, 0x65, 0x73, 0x3a,
+	0x3a, 0x41, 0x75, 0x74, 0x68, 0x7a, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (

proto/types/authz/authz.proto

@@ -16,8 +16,6 @@ message Policy {
   string org = 4;
   // Resource for which the access is needed
   string obj = 5;
-  // Action, read/write; * for both read+write
-  string act = 6;
 }
 
 message Policies {

proto/types/commonpb/v3/artifacts.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/commonpb/v3/artifacts.proto
 
 package commonv3

proto/types/commonpb/v3/auth.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/commonpb/v3/auth.proto
 
 package commonv3

proto/types/commonpb/v3/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/commonpb/v3/common.proto
 
 package commonv3

proto/types/controller/cluster_controller.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/controller/cluster_controller.proto
 
 package controller
@@ -31,8 +31,8 @@ type StepObject struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3,embedded=objectMeta" json:"objectMeta,omitempty"`
+	TypeMeta   *v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ObjectMeta *v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3" json:"objectMeta,omitempty"`
 	Name       string         `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
 	Raw        []byte         `protobuf:"bytes,4,opt,name=raw,proto3" json:"raw,omitempty"`
 }
@@ -69,6 +69,20 @@ func (*StepObject) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{0}
 }
 
+func (x *StepObject) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *StepObject) GetObjectMeta() *v1.ObjectMeta {
+	if x != nil {
+		return x.ObjectMeta
+	}
+	return nil
+}
+
 func (x *StepObject) GetName() string {
 	if x != nil {
 		return x.Name
@@ -529,8 +543,8 @@ type Tasklet struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3,embedded=objectMeta" json:"objectMeta,omitempty"`
+	TypeMeta   *v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ObjectMeta *v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3" json:"objectMeta,omitempty"`
 	Spec       *TaskletSpec   `protobuf:"bytes,3,opt,name=spec,proto3" json:"spec,omitempty"`
 	Status     *TaskletStatus `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
 }
@@ -567,6 +581,20 @@ func (*Tasklet) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{6}
 }
 
+func (x *Tasklet) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *Tasklet) GetObjectMeta() *v1.ObjectMeta {
+	if x != nil {
+		return x.ObjectMeta
+	}
+	return nil
+}
+
 func (x *Tasklet) GetSpec() *TaskletSpec {
 	if x != nil {
 		return x.Spec
@@ -588,8 +616,8 @@ type TaskletList struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3,embedded=listMeta" json:"listMeta,omitempty"`
+	TypeMeta *v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ListMeta *v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3" json:"listMeta,omitempty"`
 	Items    []*Tasklet   `protobuf:"bytes,3,rep,name=items,proto3" json:"items,omitempty"`
 }
 
@@ -625,6 +653,20 @@ func (*TaskletList) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{7}
 }
 
+func (x *TaskletList) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *TaskletList) GetListMeta() *v1.ListMeta {
+	if x != nil {
+		return x.ListMeta
+	}
+	return nil
+}
+
 func (x *TaskletList) GetItems() []*Tasklet {
 	if x != nil {
 		return x.Items
@@ -917,8 +959,8 @@ type Task struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3,embedded=objectMeta" json:"objectMeta,omitempty"`
+	TypeMeta   *v1.TypeMeta   `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ObjectMeta *v1.ObjectMeta `protobuf:"bytes,2,opt,name=objectMeta,proto3" json:"objectMeta,omitempty"`
 	Spec       *TaskSpec      `protobuf:"bytes,3,opt,name=spec,proto3" json:"spec,omitempty"`
 	Status     *TaskStatus    `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
 }
@@ -955,6 +997,20 @@ func (*Task) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{12}
 }
 
+func (x *Task) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *Task) GetObjectMeta() *v1.ObjectMeta {
+	if x != nil {
+		return x.ObjectMeta
+	}
+	return nil
+}
+
 func (x *Task) GetSpec() *TaskSpec {
 	if x != nil {
 		return x.Spec
@@ -976,8 +1032,8 @@ type TaskList struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3,embedded=listMeta" json:"listMeta,omitempty"`
+	TypeMeta *v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ListMeta *v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3" json:"listMeta,omitempty"`
 	Items    []*Task      `protobuf:"bytes,3,rep,name=items,proto3" json:"items,omitempty"`
 }
 
@@ -1013,6 +1069,20 @@ func (*TaskList) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{13}
 }
 
+func (x *TaskList) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *TaskList) GetListMeta() *v1.ListMeta {
+	if x != nil {
+		return x.ListMeta
+	}
+	return nil
+}
+
 func (x *TaskList) GetItems() []*Task {
 	if x != nil {
 		return x.Items
@@ -1263,8 +1333,8 @@ type Namespace struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta     `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ObjectMeta   `protobuf:"bytes,2,opt,name=objectMeta,proto3,embedded=objectMeta" json:"objectMeta,omitempty"`
+	TypeMeta   *v1.TypeMeta     `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ObjectMeta *v1.ObjectMeta   `protobuf:"bytes,2,opt,name=objectMeta,proto3" json:"objectMeta,omitempty"`
 	Spec       *NamespaceSpec   `protobuf:"bytes,3,opt,name=spec,proto3" json:"spec,omitempty"`
 	Status     *NamespaceStatus `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
 }
@@ -1301,6 +1371,20 @@ func (*Namespace) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{17}
 }
 
+func (x *Namespace) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *Namespace) GetObjectMeta() *v1.ObjectMeta {
+	if x != nil {
+		return x.ObjectMeta
+	}
+	return nil
+}
+
 func (x *Namespace) GetSpec() *NamespaceSpec {
 	if x != nil {
 		return x.Spec
@@ -1322,8 +1406,8 @@ type NamespaceList struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3,embedded=typeMeta" json:"typeMeta,omitempty"`
-	v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3,embedded=listMeta" json:"listMeta,omitempty"`
+	TypeMeta *v1.TypeMeta `protobuf:"bytes,1,opt,name=typeMeta,proto3" json:"typeMeta,omitempty"`
+	ListMeta *v1.ListMeta `protobuf:"bytes,2,opt,name=listMeta,proto3" json:"listMeta,omitempty"`
 	Items    []*Namespace `protobuf:"bytes,3,rep,name=items,proto3" json:"items,omitempty"`
 }
 
@@ -1359,6 +1443,20 @@ func (*NamespaceList) Descriptor() ([]byte, []int) {
 	return file_proto_types_controller_cluster_controller_proto_rawDescGZIP(), []int{18}
 }
 
+func (x *NamespaceList) GetTypeMeta() *v1.TypeMeta {
+	if x != nil {
+		return x.TypeMeta
+	}
+	return nil
+}
+
+func (x *NamespaceList) GetListMeta() *v1.ListMeta {
+	if x != nil {
+		return x.ListMeta
+	}
+	return nil
+}
+
 func (x *NamespaceList) GetItems() []*Namespace {
 	if x != nil {
 		return x.Items

proto/types/infrapb/v3/cluster.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/infrapb/v3/cluster.proto
 
 package infrav3

proto/types/rolepb/v3/role.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/rolepb/v3/role.proto
 
 package rolev3

proto/types/rolepb/v3/rolepermission.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/rolepb/v3/rolepermission.proto
 
 package rolev3

proto/types/scheduler/namespace.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/scheduler/namespace.proto
 
 package scheduler

proto/types/sentry/account_permission.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/sentry/account_permission.proto
 
 package sentry

proto/types/sentry/group_permission.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/sentry/group_permission.proto
 
 package sentry

proto/types/sentry/kubeconfig_setting.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/sentry/kubeconfig_setting.proto
 
 package sentry

proto/types/sentry/kubectl_cluster_setting.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/sentry/kubectl_cluster_setting.proto
 
 package sentry

proto/types/sentry/sentry.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/sentry/sentry.proto
 
 package sentry

proto/types/systempb/v3/idp.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/systempb/v3/idp.proto
 
 package systemv3

proto/types/systempb/v3/oidc_provider.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/systempb/v3/oidc_provider.proto
 
 package systemv3

proto/types/systempb/v3/organization.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/systempb/v3/organization.proto
 
 package systemv3

proto/types/systempb/v3/partner.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/systempb/v3/partner.proto
 
 package systemv3

proto/types/systempb/v3/project.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/systempb/v3/project.proto
 
 package systemv3

proto/types/userpb/v3/group.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/userpb/v3/group.proto
 
 package userv3

proto/types/userpb/v3/user.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.27.1
-// 	protoc        (unknown)
+// 	protoc        v3.18.1
 // source: proto/types/userpb/v3/user.proto
 
 package userv3