Class: Google::Cloud::Pubsub::Policy

Inherits:
Object
  • Object
show all
Defined in:
lib/google/cloud/pubsub/policy.rb

Overview

# Policy

Represents a Cloud IAM Policy for the Pub/Sub service.

A common pattern for updating a resource’s metadata, such as its Policy, is to read the current data from the service, update the data locally, and then send the modified data for writing. This pattern may result in a conflict if two or more processes attempt the sequence simultaneously. IAM solves this problem with the #etag property, which is used to verify whether the policy has changed since the last request. When you make a request to with an ‘etag` value, Cloud IAM compares the `etag` value in the request with the existing `etag` value associated with the policy. It writes the policy only if the `etag` values match.

When you update a policy, first read the policy (and its current ‘etag`) from the service, then modify the policy locally, and then write the modified policy to the service. See Topic#policy and Topic#policy=.

Examples:

require "google/cloud"

gcloud = Google::Cloud.new
pubsub = gcloud.pubsub
topic = pubsub.topic "my-topic"

policy = topic.policy # API call

policy.remove "roles/owner", "user:[email protected]" # Local call
policy.add "roles/owner", "user:[email protected]" # Local call
policy.roles["roles/viewer"] = ["allUsers"] # Local call

topic.policy = policy # API call

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(etag, roles) ⇒ Policy

Returns a new instance of Policy.



78
79
80
81
 
# File 'lib/google/cloud/pubsub/policy.rb', line 78

def initialize etag, roles
  @etag = etag
  @roles = roles
end

Instance Attribute Details

#etag ⇒ String

Used to verify whether the policy has changed since the last request. The policy will be written only if the ‘etag` values match.

Returns:

  • (String) —

    the current value of etag



73
74
75
 
# File 'lib/google/cloud/pubsub/policy.rb', line 73

def etag
  @etag
end

#roles ⇒ Hash{String => Array<String>}

The bindings that associate roles with an array of members. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/pubsub/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Returns:

  • (Hash{String => Array<String>}) —

    the current value of roles



73
74
75
 
# File 'lib/google/cloud/pubsub/policy.rb', line 73

def roles
  @roles
end

Class Method Details

.from_grpc(grpc) ⇒ Object 



200
201
202
203
204
205
 
# File 'lib/google/cloud/pubsub/policy.rb', line 200

def self.from_grpc grpc
  roles = grpc.bindings.each_with_object({}) do |binding, memo|
    memo[binding.role] = binding.members.to_a
  end
  new grpc.etag, roles
end

Instance Method Details

#add(role_name, member) ⇒ Object

Convenience method for adding a member to a binding on this policy. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/pubsub/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "google/cloud"

gcloud = Google::Cloud.new
pubsub = gcloud.pubsub
topic = pubsub.topic "my-topic"

policy = topic.policy # API call

policy.add "roles/owner", "user:[email protected]" # Local call

topic.policy = policy # API call

Parameters:

  • role_name (String) —

    A Cloud IAM role, such as ‘“roles/pubsub.admin”`.

  • member (String) —

    A Cloud IAM identity, such as ‘“user:[email protected]”`.



109
110
111
 
# File 'lib/google/cloud/pubsub/policy.rb', line 109

def add role_name, member
  role(role_name) << member
end

#deep_dup ⇒ Policy

Returns a deep copy of the policy.

Returns:



174
175
176
177
178
179
180
181
 
# File 'lib/google/cloud/pubsub/policy.rb', line 174

def deep_dup
  dup.tap do |p|
    roles_dup = p.roles.each_with_object({}) do |(k, v), memo|
      memo[k] = v.dup rescue value
    end
    p.instance_variable_set "@roles", roles_dup
  end
end

#remove(role_name, member) ⇒ Object

Convenience method for removing a member from a binding on this policy. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/pubsub/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "google/cloud"

gcloud = Google::Cloud.new
pubsub = gcloud.pubsub
topic = pubsub.topic "my-topic"

policy = topic.policy # API call

policy.remove "roles/owner", "user:[email protected]" # Local call

topic.policy = policy # API call

Parameters:

  • role_name (String) —

    A Cloud IAM role, such as ‘“roles/pubsub.admin”`.

  • member (String) —

    A Cloud IAM identity, such as ‘“user:[email protected]”`.



139
140
141
 
# File 'lib/google/cloud/pubsub/policy.rb', line 139

def remove role_name, member
  role(role_name).delete member
end

#role(role_name) ⇒ Array<String>

Convenience method returning the array of members bound to a role in this policy, or an empty array if no value is present for the role in #roles. See [Understanding Roles](cloud.google.com/iam/docs/understanding-roles) for a listing of primitive and curated roles. See [Binding](cloud.google.com/pubsub/reference/rpc/google.iam.v1#binding) for a listing of values and patterns for members.

Examples:

require "google/cloud"

gcloud = Google::Cloud.new
pubsub = gcloud.pubsub
topic = pubsub.topic "my-topic"

policy = topic.policy

policy.role("roles/viewer") << "user:[email protected]"

Returns:

  • (Array<String>) —

    The members strings, or an empty array.



165
166
167
 
# File 'lib/google/cloud/pubsub/policy.rb', line 165

def role role_name
  roles[role_name] ||= []
end

#to_grpc ⇒ Object 



185
186
187
188
189
190
191
192
193
194
195
196
 
# File 'lib/google/cloud/pubsub/policy.rb', line 185

def to_grpc
  Google::Iam::V1::Policy.new(
    etag: etag,
    bindings: roles.keys.map do |role_name|
      next if roles[role_name].empty?
      Google::Iam::V1::Binding.new(
        role: role_name,
        members: roles[role_name]
      )
    end
  )
end