gcpiam

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 43 Imported by: 0

README

Cloud IAM

Parity grade: B · SDK cloud.google.com/go/iam@v1.11.0 · last audited 2026-10-19 (880da1baa)

Coverage

Metric Value
PARITY entries audited 31 (28 ok, 3 partial)
Feature families 6 (2 ok, 3 partial, 1 gap)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • Predefined role permission lists are representative, not Google's complete lists.
  • System-managed signing keys are not rotated.
  • SetIamPolicy ignores update_mask; TestIamPermissions grants everything requested.
  • Condition lint is syntactic only (no CEL parsing, no policy-level lint).
  • Deleted-service-account and deleted-role retention windows (30 and 7/37 days) are the documented figures, not verified against the live service.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8125

DefaultPort is the dedicated gRPC listener's default TCP port.

Variables

View Source 
var ErrNilAppContext = errors.New("gcpiam: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ConfigProvider 

type ConfigProvider interface {
	GetGCPIAMSettings() Settings
}

ConfigProvider extracts Cloud IAM configuration from the AppContext Config.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port int
	// contains filtered or unexported fields
}

Handler serves the Cloud IAM admin gRPC API on a dedicated listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port from Settings.

func (*Handler) API 

func (h *Handler) API() adminpb.IAMServer

API exposes the IAM admin service for in-process callers (dashboard proxy).

func (*Handler) Addr 

func (h *Handler) Addr() string

Addr returns the bound listener address, or "" before StartWorker.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(*echo.Context) string

ExtractOperation is unused: requests never reach the shared router.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(*echo.Context) string

ExtractResource is unused: requests never reach the shared router.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported gRPC methods.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns a 404 handler; the real API is gRPC on the dedicated port.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Cloud IAM runs on its own gRPC listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the gRPC server.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds service accounts, keys, custom roles and policies under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) CreateRole 

func (b *InMemoryBackend) CreateRole(req *adminpb.CreateRoleRequest) (*adminpb.Role, error)

CreateRole creates a custom role at project or organization level.

func (*InMemoryBackend) CreateServiceAccount 

func (b *InMemoryBackend) CreateServiceAccount(
	req *adminpb.CreateServiceAccountRequest,
) (*adminpb.ServiceAccount, error)

CreateServiceAccount creates a service account with a unique id and a project-scoped email.

func (*InMemoryBackend) CreateServiceAccountKey 

func (b *InMemoryBackend) CreateServiceAccountKey(
	req *adminpb.CreateServiceAccountKeyRequest,
) (*adminpb.ServiceAccountKey, error)

CreateServiceAccountKey generates a real RSA key; the private part is returned only here.

func (*InMemoryBackend) DeleteRole 

func (b *InMemoryBackend) DeleteRole(req *adminpb.DeleteRoleRequest) (*adminpb.Role, error)

DeleteRole soft-deletes a custom role; it can be undeleted for seven days.

func (*InMemoryBackend) DeleteServiceAccount 

func (b *InMemoryBackend) DeleteServiceAccount(name string) error

DeleteServiceAccount soft-deletes an account (undeletable for 30 days) and removes its keys.

func (*InMemoryBackend) DeleteServiceAccountKey 

func (b *InMemoryBackend) DeleteServiceAccountKey(name string) (*emptypb.Empty, error)

DeleteServiceAccountKey removes a user-managed key.

func (*InMemoryBackend) GetIamPolicy 

func (b *InMemoryBackend) GetIamPolicy(resource string) (*iampb.Policy, error)

GetIamPolicy returns a service account's IAM policy, or an empty one with the initial etag.

func (*InMemoryBackend) GetRole 

func (b *InMemoryBackend) GetRole(name string) (*adminpb.Role, error)

GetRole returns a predefined or custom role, including its permissions.

func (*InMemoryBackend) GetServiceAccount 

func (b *InMemoryBackend) GetServiceAccount(name string) (*adminpb.ServiceAccount, error)

GetServiceAccount returns an active service account.

func (*InMemoryBackend) GetServiceAccountKey 

func (b *InMemoryBackend) GetServiceAccountKey(
	req *adminpb.GetServiceAccountKeyRequest,
) (*adminpb.ServiceAccountKey, error)

GetServiceAccountKey returns key metadata plus the public key in the requested format.

func (*InMemoryBackend) LintPolicy 

func (b *InMemoryBackend) LintPolicy(req *adminpb.LintPolicyRequest) (*adminpb.LintPolicyResponse, error)

LintPolicy checks a condition expression: non-empty, balanced brackets/quotes, size and operator limits.

func (*InMemoryBackend) ListRoles 

func (b *InMemoryBackend) ListRoles(req *adminpb.ListRolesRequest) ([]*adminpb.Role, string, error)

ListRoles lists predefined roles (empty parent) or the custom roles of a project/organization.

func (*InMemoryBackend) ListServiceAccountKeys 

func (b *InMemoryBackend) ListServiceAccountKeys(
	req *adminpb.ListServiceAccountKeysRequest,
) ([]*adminpb.ServiceAccountKey, error)

ListServiceAccountKeys lists user- and/or system-managed keys without key material.

func (*InMemoryBackend) ListServiceAccounts 

func (b *InMemoryBackend) ListServiceAccounts(
	req *adminpb.ListServiceAccountsRequest,
) ([]*adminpb.ServiceAccount, string, error)

ListServiceAccounts lists a project's active service accounts sorted by name.

func (*InMemoryBackend) PatchServiceAccount 

func (b *InMemoryBackend) PatchServiceAccount(
	req *adminpb.PatchServiceAccountRequest,
) (*adminpb.ServiceAccount, error)

PatchServiceAccount updates the fields named in update_mask; an empty mask updates all mutable fields.

func (*InMemoryBackend) QueryAuditableServices 

func (b *InMemoryBackend) QueryAuditableServices(
	req *adminpb.QueryAuditableServicesRequest,
) (*adminpb.QueryAuditableServicesResponse, error)

QueryAuditableServices lists services that write audit logs for a resource.

func (*InMemoryBackend) QueryGrantableRoles 

func (b *InMemoryBackend) QueryGrantableRoles(
	req *adminpb.QueryGrantableRolesRequest,
) ([]*adminpb.Role, string, error)

QueryGrantableRoles lists the roles grantable on a resource.

func (*InMemoryBackend) QueryTestablePermissions 

func (b *InMemoryBackend) QueryTestablePermissions(
	req *adminpb.QueryTestablePermissionsRequest,
) ([]*adminpb.Permission, string, error)

QueryTestablePermissions lists the permissions that can be tested on a resource.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) SetIamPolicy 

func (b *InMemoryBackend) SetIamPolicy(req *iampb.SetIamPolicyRequest) (*iampb.Policy, error)

SetIamPolicy replaces a service account's policy; a non-empty etag must match the stored one.

func (*InMemoryBackend) SetServiceAccountDisabled 

func (b *InMemoryBackend) SetServiceAccountDisabled(name string, disabled bool) error

SetServiceAccountDisabled enables or disables an account.

func (*InMemoryBackend) SetServiceAccountKeyDisabled 

func (b *InMemoryBackend) SetServiceAccountKeyDisabled(name string, disabled bool) (*emptypb.Empty, error)

SetServiceAccountKeyDisabled enables or disables a user-managed key.

func (*InMemoryBackend) SignBlob 

func (b *InMemoryBackend) SignBlob(name string, data []byte) (string, []byte, error)

SignBlob signs bytes with RSASSA-PKCS1-v1_5 over SHA-256 using the account's system-managed key.

func (*InMemoryBackend) SignJwt 

func (b *InMemoryBackend) SignJwt(name, payload string) (string, string, error)

SignJwt signs a JWT claim set as RS256; a missing exp claim defaults to one hour from now.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises accounts (with keys and policies) and custom roles. Private keys of system-managed keys are included so signatures stay verifiable across restarts.

func (*InMemoryBackend) TestIamPermissions 

func (b *InMemoryBackend) TestIamPermissions(
	req *iampb.TestIamPermissionsRequest,
) (*iampb.TestIamPermissionsResponse, error)

TestIamPermissions reports every requested permission as granted: the emulator performs no authorization.

func (*InMemoryBackend) UndeleteRole 

func (b *InMemoryBackend) UndeleteRole(req *adminpb.UndeleteRoleRequest) (*adminpb.Role, error)

UndeleteRole restores a custom role deleted less than seven days ago.

func (*InMemoryBackend) UndeleteServiceAccount 

func (b *InMemoryBackend) UndeleteServiceAccount(name string) (*adminpb.ServiceAccount, error)

UndeleteServiceAccount restores a soft-deleted account by unique id.

func (*InMemoryBackend) UpdateRole 

func (b *InMemoryBackend) UpdateRole(req *adminpb.UpdateRoleRequest) (*adminpb.Role, error)

UpdateRole patches the masked fields of a custom role; a non-empty etag must match.

func (*InMemoryBackend) UpdateServiceAccount 

func (b *InMemoryBackend) UpdateServiceAccount(in *adminpb.ServiceAccount) (*adminpb.ServiceAccount, error)

UpdateServiceAccount replaces the mutable fields (display_name, description) of an account.

func (*InMemoryBackend) UploadServiceAccountKey 

func (b *InMemoryBackend) UploadServiceAccountKey(
	req *adminpb.UploadServiceAccountKeyRequest,
) (*adminpb.ServiceAccountKey, error)

UploadServiceAccountKey registers a caller-supplied RSA public key wrapped in an X.509 certificate.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Google Cloud IAM admin API. It serves gRPC on its own listener and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type Settings 

type Settings struct {
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 171-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI as CLI.GCPIAM.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.