Examples with Policy com.google.api.services.healthcare.v1.model.Policy used on opensource projects

Example 36 with Policy

use of com.google.api.services.healthcare.v1.model.Policy in project terra-cloud-resource-lib by DataBiosphere.

the class AIPlatformNotebooksCowTest method setGetTestIamPolicyNotebookInstance.

@Test
public void setGetTestIamPolicyNotebookInstance() throws Exception {
    InstanceName instanceName = defaultInstanceName().instanceId("set-get-iam").build();
    createInstance(instanceName);
    String userEmail = IntegrationCredentials.getUserGoogleCredentialsOrDie().getClientEmail();
    Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("serviceAccount:" + userEmail));
    Policy policy = notebooks.instances().getIamPolicy(instanceName).execute();
    policy.setBindings(ImmutableList.of(binding));
    Policy updatedPolicy = notebooks.instances().setIamPolicy(instanceName, new SetIamPolicyRequest().setPolicy(policy)).execute();
    assertThat(updatedPolicy.getBindings(), Matchers.hasItem(binding));
    Policy secondRetrieval = notebooks.instances().getIamPolicy(instanceName).execute();
    assertThat(secondRetrieval.getBindings(), Matchers.hasItem(binding));
    // Test the permissions of the user for which the IAM policy was set.
    AIPlatformNotebooksCow userNotebooks = AIPlatformNotebooksCow.create(IntegrationUtils.DEFAULT_CLIENT_CONFIG, IntegrationCredentials.getUserGoogleCredentialsOrDie());
    // Notebook get permission from "roles/notebooks.viewer".
    String getNotebookPermission = "notebooks.instances.get";
    TestIamPermissionsResponse iamResponse = userNotebooks.instances().testIamPermissions(instanceName, new TestIamPermissionsRequest().setPermissions(ImmutableList.of(getNotebookPermission))).execute();
    assertThat(iamResponse.getPermissions(), Matchers.contains(getNotebookPermission));
    notebooks.instances().delete(instanceName).execute();
}

Example 37 with Policy

use of com.google.api.services.healthcare.v1.model.Policy in project terra-cloud-resource-lib by DataBiosphere.

the class AIPlatformNotebooksCowTest method instanceSetIamPolicySerialize.

@Test
public void instanceSetIamPolicySerialize() throws Exception {
    Binding binding = new Binding().setRole("roles/notebooks.viewer").setMembers(ImmutableList.of("userEmail:foo@gmail.com"));
    SetIamPolicyRequest request = new SetIamPolicyRequest().setPolicy(new Policy().setBindings(ImmutableList.of(binding)));
    assertEquals("{\"projectId\":\"my-project\",\"locations\":\"us-east1-b\"," + "\"instanceId\":\"my-id\",\"content\":{\"policy\":{" + "\"bindings\":[{\"members\":[\"userEmail:foo@gmail.com\"]," + "\"role\":\"roles/notebooks.viewer\"}]}}}", notebooks.instances().setIamPolicy(InstanceName.builder().projectId("my-project").location("us-east1-b").instanceId("my-id").build(), request).serialize().toString());
}

Example 38 with Policy

use of com.google.api.services.healthcare.v1.model.Policy in project terra-cli by DataBiosphere.

the class Workspace method grantBreakGlass.

/**
 * Grant break-glass access to a user of this workspace. The Editor and Project IAM Admin roles
 * are granted to the user's proxy group.
 *
 * @param granteeEmail email of the workspace user requesting break-glass access
 * @param userProjectsAdminCredentials credentials for a SA that has permission to set IAM policy
 *     on workspace projects in this WSM deployment (e.g. WSM application SA)
 * @return the proxy group email of the workspace user that was granted break-glass access
 */
public String grantBreakGlass(String granteeEmail, ServiceAccountCredentials userProjectsAdminCredentials) {
    // fetch the user's proxy group email from SAM
    String granteeProxyGroupEmail = SamService.fromContext().getProxyGroupEmail(granteeEmail);
    logger.debug("granteeProxyGroupEmail: {}", granteeProxyGroupEmail);
    // grant the Editor role to the user's proxy group email on the workspace project
    CloudResourceManagerCow resourceManagerCow = CrlUtils.createCloudResourceManagerCow(userProjectsAdminCredentials);
    try {
        Policy policy = resourceManagerCow.projects().getIamPolicy(googleProjectId, new GetIamPolicyRequest()).execute();
        List<Binding> updatedBindings = Optional.ofNullable(policy.getBindings()).orElse(new ArrayList<>());
        updatedBindings.add(new Binding().setRole("roles/editor").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        updatedBindings.add(new Binding().setRole("roles/resourcemanager.projectIamAdmin").setMembers(ImmutableList.of("group:" + granteeProxyGroupEmail)));
        policy.setBindings(updatedBindings);
        resourceManagerCow.projects().setIamPolicy(googleProjectId, new SetIamPolicyRequest().setPolicy(policy)).execute();
    } catch (IOException ioEx) {
        throw new SystemException("Error granting the Editor and Project IAM Admin roles to the user's proxy group.", ioEx);
    }
    return granteeProxyGroupEmail;
}

Example 39 with Policy

use of com.google.api.services.healthcare.v1.model.Policy in project terra-workspace-manager by DataBiosphere.

the class CreateGcpContextFlightTest method assertPolicyGroupsSynced.

/**
 * Asserts that Sam groups are granted their appropriate IAM roles on a GCP project.
 */
private void assertPolicyGroupsSynced(UUID workspaceId, Project project) throws Exception {
    Map<WsmIamRole, String> roleToSamGroup = Arrays.stream(WsmIamRole.values()).filter(role -> !role.equals(WsmIamRole.MANAGER)).collect(Collectors.toMap(Function.identity(), role -> "group:" + SamRethrow.onInterrupted(() -> mockSamService.syncWorkspacePolicy(workspaceId, role, userAccessUtils.defaultUserAuthRequest()), "syncWorkspacePolicy")));
    Policy currentPolicy = crl.getCloudResourceManagerCow().projects().getIamPolicy(project.getProjectId(), new GetIamPolicyRequest()).execute();
    for (WsmIamRole role : WsmIamRole.values()) {
        // Don't check MANAGER role, which isn't synced to GCP.
        if (role.equals(WsmIamRole.MANAGER)) {
            continue;
        }
        assertRoleBindingInPolicy(role, roleToSamGroup.get(role), currentPolicy, project.getProjectId());
    }
}