authzv1

type ScopeExtractor struct {

	// Object type of the authorization model the scope id resolves to. Either a hierarchy scope
	// (`cluster` / `account` / `project`) or a per-resource
	// object type registered in the authorization model (`vpc_network`,
	// `storage_volume`, `iam_group`, `iam_role`, ...). The api-gateway authz
	// middleware builds the FGA Check object as `<object_type>:<id>` where the
	// id is taken from `from_request_field`. Must be non-empty.
	ObjectType string `protobuf:"bytes,1,opt,name=object_type,json=objectType,proto3" json:"object_type,omitempty"`
	// Name of the proto request field from which the scope id is taken. Must be
	// a top-level field on the request message and a non-empty string.
	FromRequestField string `protobuf:"bytes,2,opt,name=from_request_field,json=fromRequestField,proto3" json:"from_request_field,omitempty"`
	// Name of the proto request field from which the *object type* is
	// derived at request time (scope-polymorphic RPCs). When set + non-empty,
	// the api-gateway authz middleware reads this top-level string field off the
	// request and uses its value as the FGA Check object type instead of the
	// static `object_type` above. The static `object_type` then serves only as
	// the fallback when the field is absent/empty.
	//
	// Used by AccessBindingService.ListByScope, where the bound resource scope
	// (project|account|cluster) is carried by the request `resource_type` field —
	// a single fixed `object_type` cannot express it (a hardcoded `project` made
	// account/cluster-scoped reads check `project:<id>` → 403). Empty for the
	// overwhelming majority of RPCs, which have a fixed scope type.
	ObjectTypeFromRequestField string `` /* 145-byte string literal not displayed */
	// contains filtered or unexported fields
}