auditlistfilter

var Profile = listfiltergate.Profile{
	Service:    "iam",
	AnchorRoot: "internal/apps/kaname/api",

	PerPackage:     true,
	ReceiverSuffix: "Handler",

	ExtraReceivers: []string{"PublicHandler"},

	Filters: []string{"VisibleSet", "Visible", "requireGrantAuthority", "grantAuthorityVerdict"},

	Banned: []string{"ListAllowedIDs", "ListObjects"},

	EnumerationSources: []listfiltergate.EnumerationSource{
		{Dir: "internal/clients", Type: "RelationQueries"},
		{Dir: "internal/repo/kaname/pg/relverdict", Type: "Asker"},
	},

	SubjectScopers: []string{"ListForCaller", "listOp.Execute", "identityOfAuthenticatedCaller"},

	ProtoFiles: []string{
		"kaname/cloud/iam/v1/internal_cluster_service.proto",
		"kaname/cloud/iam/v1/membership_service.proto",
		"kaname/cloud/iam/v1/sa_key_service.proto",
		"kaname/cloud/iam/v1/user_token_service.proto",
	},
	FGAModel: "kaname/cloud/iam/v1/fga_model.fga",

	Listings: map[string]listfiltergate.Listing{

		"access_binding.List":        rowFilter,
		"access_binding.ListByScope": rowFilter,

		"access_binding.ListByAccount": rowFilter,
		"access_binding.ListByRole":    rowFilter,
		"account.List":                 rowFilter,
		"group.List":                   rowFilter,
		"project.List":                 rowFilter,
		"role.List":                    rowFilter,
		"service_account.List":         rowFilter,
		"user.List":                    rowFilter,

		"access_binding.ListOperations":  subjectScoped,
		"account.ListOperations":         subjectScoped,
		"group.ListOperations":           subjectScoped,
		"project.ListOperations":         subjectScoped,
		"role.ListOperations":            subjectScoped,
		"service_account.ListOperations": subjectScoped,
		"user.ListOperations":            subjectScoped,

		"identityquota.List": subjectScoped,

		"access_binding.ListSubjectPrivileges": rowFilter,

		"access_binding.ListBySubject": rowFilter,

		"access_binding.ListAssignableRoles": subjectGate("requireGrantAuthority"),

		"account.ListAllOperations":             subjectGate("requireAccountViewAuthority"),
		"internal_operations.ListIamOperations": subjectGate("requireClusterSystemAdmin"),
		"group.ListMembers":                     subjectGate("AllowsVerb"),
		"session_revocations.ListByUser":        subjectGate("authorizeListByUser"),

		"authorize.ListSubjects": {Shape: listfiltergate.StoreQuery, Gate: "authorizeCaller"},

		"cluster.ListAdmins": edgeGate("internal_cluster_service.proto", "*"),

		"sa_keys.List":     edgeGate("sa_key_service.proto", "service_account_id"),
		"user_tokens.List": edgeGate("user_token_service.proto", "user_id"),

		"membership.List": edgeGate("membership_service.proto", "account_id"),

		"permission_catalog.ListPermissionCatalog": {
			Shape: listfiltergate.ClusterScoped,
			Reason: "the permission catalog is the platform's own static list of RPCs and the " +
				"relations they require — global reference data with no per-object grants to " +
				"narrow to, and the caller must be authenticated to reach it. The exclusion " +
				"expires with its method: retire the RPC and this entry becomes a finding.",
		},

		"limit.List": {
			Shape: listfiltergate.ClusterScoped,
			Reason: "a resource-count ceiling is a CLUSTER-level administrative record: the row " +
				"carries a scope (DEFAULT/ACCOUNT/PROJECT) but no owner to grant against, so " +
				"there is no per-object grant to narrow the page to — RowFilter here would state " +
				"a check whose subject does not exist. What bounds the caller instead is the " +
				"surface: the RPC lives ONLY on InternalLimitService, is registered ONLY on the " +
				"cluster-internal listener (ban #6), and its catalog entry demands `system_admin` " +
				"on `cluster` — a relation defined `[user, service_account]` with NO `user:*` " +
				"member, so unlike `viewer` it is not satisfiable by a wildcard tuple and does " +
				"narrow. The exclusion expires with its subject twice over: retire the RPC and " +
				"this entry becomes a finding, and give the ceiling a per-object owner and the " +
				"reason above stops being true — at which point this must become RowFilter.",
		},
		"limit.ListChangedSince": {
			Shape: listfiltergate.ClusterScoped,
			Reason: "the incremental read owner services poll to refresh their ceiling cache. Its " +
				"caller is a MACHINE, not a tenant: the catalog entry demands `quota_reader` on " +
				"`cluster`, defined `[service_account, group#member] or system_admin` — no " +
				"`user:*` member, so it is not satisfiable by a wildcard tuple. The grant is held " +
				"by a GROUP rather than by enumerated subjects, so revoking one owner service is " +
				"one membership row (data-integrity.md B18). Narrowing this page per object would " +
				"be wrong, not merely absent: an owner service polls ceilings for every scope it " +
				"enforces, and a page filtered to what the MACHINE can see would silently drop " +
				"tenants whose limits it must apply. The exclusion expires with the RPC.",
		},
		"module.List": {
			Shape: listfiltergate.ClusterScoped,
			Reason: "the module catalog is the platform's own registry of modules, their " +
				"resources and verbs — the rows the rights model itself is keyed on. It carries " +
				"no project_id, account_id or owner column, so there is no per-object grant to " +
				"narrow the page to: RowFilter here would state a check whose subject does not " +
				"exist. What bounds the caller is the surface instead: the RPC lives ONLY on " +
				"InternalModuleService, is registered ONLY on the cluster-internal listener " +
				"(ban #6, pinned by register_module_internal_only_test.go), and its catalog entry " +
				"demands `system_admin` on `cluster` — a relation defined `[user, service_account]` " +
				"with NO `user:*` member, so unlike `viewer` it is not satisfiable by a wildcard " +
				"tuple. The same relation is re-checked in the handler as its first statement " +
				"(authz_order_test.go pins that order), because the internal listener carries no " +
				"authorization interceptor of its own. Add an owner column to the catalog rows and " +
				"the reason above stops being true — at which point this must become RowFilter. " +
				"The exclusion expires with its method: retire the RPC and this entry becomes a finding.",
		},
		"interactive_client.List": {
			Shape: listfiltergate.ClusterScoped,
			Reason: "an interactive-login client is a CLUSTER-level OAuth2 client registration: " +
				"the table carries no project_id, account_id or owner column, so there is no " +
				"per-object grant to narrow the page to — RowFilter here would state a check " +
				"whose subject does not exist. What bounds the caller instead is the surface " +
				"itself: the RPC lives ONLY on InternalInteractiveClientService, is registered " +
				"ONLY on the cluster-internal listener, and its catalog entry demands " +
				"`system_admin` on `cluster` — a relation defined `[user, service_account]` with " +
				"NO `user:*` member, so unlike `viewer` it is not satisfiable by a wildcard tuple " +
				"and does narrow. The exclusion expires with its subject twice over: retire the " +
				"RPC and this entry becomes a finding, and give the resource an owner column and " +
				"the reason above stops being true — at which point this must become RowFilter.",
		},
	},
}