var (
	AllowAccessState_name = map[int32]string{
		0: "ALLOW_ACCESS_STATE_UNSPECIFIED",
		1: "ALLOW_ACCESS_STATE_GRANTED",
		2: "ALLOW_ACCESS_STATE_NOT_GRANTED",
		3: "ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL",
		4: "ALLOW_ACCESS_STATE_UNKNOWN_INFO",
	}
	AllowAccessState_value = map[string]int32{
		"ALLOW_ACCESS_STATE_UNSPECIFIED":         0,
		"ALLOW_ACCESS_STATE_GRANTED":             1,
		"ALLOW_ACCESS_STATE_NOT_GRANTED":         2,
		"ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL": 3,
		"ALLOW_ACCESS_STATE_UNKNOWN_INFO":        4,
	}
)

var (
	DenyAccessState_name = map[int32]string{
		0: "DENY_ACCESS_STATE_UNSPECIFIED",
		1: "DENY_ACCESS_STATE_DENIED",
		2: "DENY_ACCESS_STATE_NOT_DENIED",
		3: "DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL",
		4: "DENY_ACCESS_STATE_UNKNOWN_INFO",
	}
	DenyAccessState_value = map[string]int32{
		"DENY_ACCESS_STATE_UNSPECIFIED":         0,
		"DENY_ACCESS_STATE_DENIED":              1,
		"DENY_ACCESS_STATE_NOT_DENIED":          2,
		"DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL": 3,
		"DENY_ACCESS_STATE_UNKNOWN_INFO":        4,
	}
)

var (
	RolePermissionInclusionState_name = map[int32]string{
		0: "ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED",
		1: "ROLE_PERMISSION_INCLUDED",
		2: "ROLE_PERMISSION_NOT_INCLUDED",
		3: "ROLE_PERMISSION_UNKNOWN_INFO",
	}
	RolePermissionInclusionState_value = map[string]int32{
		"ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED": 0,
		"ROLE_PERMISSION_INCLUDED":                    1,
		"ROLE_PERMISSION_NOT_INCLUDED":                2,
		"ROLE_PERMISSION_UNKNOWN_INFO":                3,
	}
)

var (
	PermissionPatternMatchingState_name = map[int32]string{
		0: "PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED",
		1: "PERMISSION_PATTERN_MATCHED",
		2: "PERMISSION_PATTERN_NOT_MATCHED",
	}
	PermissionPatternMatchingState_value = map[string]int32{
		"PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED": 0,
		"PERMISSION_PATTERN_MATCHED":                    1,
		"PERMISSION_PATTERN_NOT_MATCHED":                2,
	}
)

var (
	MembershipMatchingState_name = map[int32]string{
		0: "MEMBERSHIP_MATCHING_STATE_UNSPECIFIED",
		1: "MEMBERSHIP_MATCHED",
		2: "MEMBERSHIP_NOT_MATCHED",
		3: "MEMBERSHIP_UNKNOWN_INFO",
		4: "MEMBERSHIP_UNKNOWN_UNSUPPORTED",
	}
	MembershipMatchingState_value = map[string]int32{
		"MEMBERSHIP_MATCHING_STATE_UNSPECIFIED": 0,
		"MEMBERSHIP_MATCHED":                    1,
		"MEMBERSHIP_NOT_MATCHED":                2,
		"MEMBERSHIP_UNKNOWN_INFO":               3,
		"MEMBERSHIP_UNKNOWN_UNSUPPORTED":        4,
	}
)

var (
	HeuristicRelevance_name = map[int32]string{
		0: "HEURISTIC_RELEVANCE_UNSPECIFIED",
		1: "HEURISTIC_RELEVANCE_NORMAL",
		2: "HEURISTIC_RELEVANCE_HIGH",
	}
	HeuristicRelevance_value = map[string]int32{
		"HEURISTIC_RELEVANCE_UNSPECIFIED": 0,
		"HEURISTIC_RELEVANCE_NORMAL":      1,
		"HEURISTIC_RELEVANCE_HIGH":        2,
	}
)

var (
	TroubleshootIamPolicyResponse_OverallAccessState_name = map[int32]string{
		0: "OVERALL_ACCESS_STATE_UNSPECIFIED",
		1: "CAN_ACCESS",
		2: "CANNOT_ACCESS",
		3: "UNKNOWN_INFO",
		4: "UNKNOWN_CONDITIONAL",
	}
	TroubleshootIamPolicyResponse_OverallAccessState_value = map[string]int32{
		"OVERALL_ACCESS_STATE_UNSPECIFIED": 0,
		"CAN_ACCESS":                       1,
		"CANNOT_ACCESS":                    2,
		"UNKNOWN_INFO":                     3,
		"UNKNOWN_CONDITIONAL":              4,
	}
)

var File_google_cloud_policytroubleshooter_iam_v3_troubleshooter_proto protoreflect.FileDescriptor

type AccessTuple struct {

	// Required. The email address of the principal whose access you want to
	// check. For example, `alice@example.com` or
	// `my-service-account@my-project.iam.gserviceaccount.com`.
	//
	// The principal must be a Google Account or a service account. Other types of
	// principals are not supported.
	Principal string `protobuf:"bytes,1,opt,name=principal,proto3" json:"principal,omitempty"`
	// Required. The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// Required. The IAM permission to check for, either in the `v1` permission
	// format or the `v2` permission format.
	//
	// For a complete list of IAM permissions in the `v1` format, see
	// https://cloud.google.com/iam/help/permissions/reference.
	//
	// For a list of IAM permissions in the `v2` format, see
	// https://cloud.google.com/iam/help/deny/supported-permissions.
	//
	// For a complete list of predefined IAM roles and the permissions in each
	// role, see https://cloud.google.com/iam/help/roles/reference.
	Permission string `protobuf:"bytes,3,opt,name=permission,proto3" json:"permission,omitempty"`
	// Output only. The permission that Policy Troubleshooter checked for, in
	// the `v2` format.
	PermissionFqdn string `protobuf:"bytes,4,opt,name=permission_fqdn,json=permissionFqdn,proto3" json:"permission_fqdn,omitempty"`
	// Optional. Additional context for the request, such as the request time or
	// IP address. This context allows Policy Troubleshooter to troubleshoot
	// conditional role bindings and deny rules.
	ConditionContext *ConditionContext `protobuf:"bytes,5,opt,name=condition_context,json=conditionContext,proto3" json:"condition_context,omitempty"`
	// contains filtered or unexported fields
}

type AllowAccessState int32

const (
	// Not specified.
	AllowAccessState_ALLOW_ACCESS_STATE_UNSPECIFIED AllowAccessState = 0
	// The allow policy gives the principal the permission.
	AllowAccessState_ALLOW_ACCESS_STATE_GRANTED AllowAccessState = 1
	// The allow policy doesn't give the principal the permission.
	AllowAccessState_ALLOW_ACCESS_STATE_NOT_GRANTED AllowAccessState = 2
	// The allow policy gives the principal the permission if a condition
	// expression evaluate to `true`. However, the sender of the request didn't
	// provide enough context for Policy Troubleshooter to evaluate the condition
	// expression.
	AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_CONDITIONAL AllowAccessState = 3
	// The sender of the request doesn't have access to all of the allow policies
	// that Policy Troubleshooter needs to evaluate the principal's access.
	AllowAccessState_ALLOW_ACCESS_STATE_UNKNOWN_INFO AllowAccessState = 4
)

type AllowBindingExplanation struct {

	// Required. Indicates whether _this role binding_ gives the specified
	// permission to the specified principal on the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission on the resource. There might be another role binding that
	// overrides this role binding. To determine whether the principal actually
	// has the permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	AllowAccessState AllowAccessState `protobuf:"varint,1,opt,name=allow_access_state,json=allowAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.AllowAccessState" json:"allow_access_state,omitempty"`
	// The role that this role binding grants. For example,
	// `roles/compute.admin`.
	//
	// For a complete list of predefined IAM roles, as well as the permissions in
	// each role, see https://cloud.google.com/iam/help/roles/reference.
	Role string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
	// Indicates whether the role granted by this role binding contains the
	// specified permission.
	RolePermission RolePermissionInclusionState `protobuf:"varint,3,opt,name=role_permission,json=rolePermission,proto3,enum=google.cloud.policytroubleshooter.iam.v3.RolePermissionInclusionState" json:"role_permission,omitempty"`
	// The relevance of the permission's existence, or nonexistence, in the role
	// to the overall determination for the entire policy.
	RolePermissionRelevance HeuristicRelevance `protobuf:"varint,4,opt,name=role_permission_relevance,json=rolePermissionRelevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"role_permission_relevance,omitempty"`
	// The combined result of all memberships. Indicates if the principal is
	// included in any role binding, either directly or indirectly.
	CombinedMembership *AllowBindingExplanation_AnnotatedAllowMembership `protobuf:"bytes,5,opt,name=combined_membership,json=combinedMembership,proto3" json:"combined_membership,omitempty"`
	// Indicates whether each role binding includes the principal specified in the
	// request, either directly or indirectly. Each key identifies a principal in
	// the role binding, and each value indicates whether the principal in the
	// role binding includes the principal in the request.
	//
	// For example, suppose that a role binding includes the following principals:
	//
	// * `user:alice@example.com`
	// * `group:product-eng@example.com`
	//
	// You want to troubleshoot access for `user:bob@example.com`. This user is a
	// member of the group `group:product-eng@example.com`.
	//
	// For the first principal in the role binding, the key is
	// `user:alice@example.com`, and the `membership` field in the value is set to
	// `NOT_INCLUDED`.
	//
	// For the second principal in the role binding, the key is
	// `group:product-eng@example.com`, and the `membership` field in the value is
	// set to `INCLUDED`.
	Memberships map[string]*AllowBindingExplanation_AnnotatedAllowMembership `protobuf:"bytes,6,rep,name=memberships,proto3" json:"memberships,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// The relevance of this role binding to the overall determination for the
	// entire policy.
	Relevance HeuristicRelevance `protobuf:"varint,7,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// A condition expression that specifies when the role binding grants access.
	//
	// To learn about IAM Conditions, see
	// https://cloud.google.com/iam/help/conditions/overview.
	Condition *expr.Expr `protobuf:"bytes,8,opt,name=condition,proto3" json:"condition,omitempty"`
	// Condition evaluation state for this role binding.
	ConditionExplanation *ConditionExplanation `protobuf:"bytes,9,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`
	// contains filtered or unexported fields
}

type AllowBindingExplanation_AnnotatedAllowMembership struct {

	// Indicates whether the role binding includes the principal.
	Membership MembershipMatchingState `protobuf:"varint,1,opt,name=membership,proto3,enum=google.cloud.policytroubleshooter.iam.v3.MembershipMatchingState" json:"membership,omitempty"`
	// The relevance of the principal's status to the overall determination for
	// the role binding.
	Relevance HeuristicRelevance `protobuf:"varint,2,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type AllowPolicyExplanation struct {

	// Indicates whether the principal has the specified permission for the
	// specified resource, based on evaluating all applicable IAM allow policies.
	AllowAccessState AllowAccessState `protobuf:"varint,1,opt,name=allow_access_state,json=allowAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.AllowAccessState" json:"allow_access_state,omitempty"`
	// List of IAM allow policies that were evaluated to check the principal's
	// permissions, with annotations to indicate how each policy contributed to
	// the final result.
	//
	// The list of policies includes the policy for the resource itself, as well
	// as allow policies that are inherited from higher levels of the resource
	// hierarchy, including the organization, the folder, and the project.
	//
	// To learn more about the resource hierarchy, see
	// https://cloud.google.com/iam/help/resource-hierarchy.
	ExplainedPolicies []*ExplainedAllowPolicy `protobuf:"bytes,2,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`
	// The relevance of the allow policy type to the overall access state.
	Relevance HeuristicRelevance `protobuf:"varint,3,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext struct {

	// Represents a target resource that is involved with a network activity.
	// If multiple resources are involved with an activity, this must be the
	// primary one.
	Resource *ConditionContext_Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
	// The destination of a network activity, such as accepting a TCP connection.
	// In a multi-hop network activity, the destination represents the receiver of
	// the last hop.
	Destination *ConditionContext_Peer `protobuf:"bytes,2,opt,name=destination,proto3" json:"destination,omitempty"`
	// Represents a network request, such as an HTTP request.
	Request *ConditionContext_Request `protobuf:"bytes,3,opt,name=request,proto3" json:"request,omitempty"`
	// Output only. The effective tags on the resource. The effective tags are
	// fetched during troubleshooting.
	EffectiveTags []*ConditionContext_EffectiveTag `protobuf:"bytes,4,rep,name=effective_tags,json=effectiveTags,proto3" json:"effective_tags,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_EffectiveTag struct {

	// Output only. Resource name for TagValue in the format `tagValues/456`.
	TagValue string `protobuf:"bytes,1,opt,name=tag_value,json=tagValue,proto3" json:"tag_value,omitempty"`
	// Output only. The namespaced name of the TagValue. Can be in the form
	// `{organization_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_id}/{tag_key_short_name}/{tag_value_short_name}` or
	// `{project_number}/{tag_key_short_name}/{tag_value_short_name}`.
	NamespacedTagValue string `protobuf:"bytes,2,opt,name=namespaced_tag_value,json=namespacedTagValue,proto3" json:"namespaced_tag_value,omitempty"`
	// Output only. The name of the TagKey, in the format `tagKeys/{id}`, such
	// as `tagKeys/123`.
	TagKey string `protobuf:"bytes,3,opt,name=tag_key,json=tagKey,proto3" json:"tag_key,omitempty"`
	// Output only. The namespaced name of the TagKey. Can be in the form
	// `{organization_id}/{tag_key_short_name}` or
	// `{project_id}/{tag_key_short_name}` or
	// `{project_number}/{tag_key_short_name}`.
	NamespacedTagKey string `protobuf:"bytes,4,opt,name=namespaced_tag_key,json=namespacedTagKey,proto3" json:"namespaced_tag_key,omitempty"`
	// The parent name of the tag key.
	// Must be in the format `organizations/{organization_id}` or
	// `projects/{project_number}`
	TagKeyParentName string `protobuf:"bytes,6,opt,name=tag_key_parent_name,json=tagKeyParentName,proto3" json:"tag_key_parent_name,omitempty"`
	// Output only. Indicates the inheritance status of a tag value
	// attached to the given resource. If the tag value is inherited from one of
	// the resource's ancestors, inherited will be true. If false, then the tag
	// value is directly attached to the resource, inherited will be false.
	Inherited bool `protobuf:"varint,5,opt,name=inherited,proto3" json:"inherited,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Peer struct {

	// The IPv4 or IPv6 address of the peer.
	Ip string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
	// The network port of the peer.
	Port int64 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Request struct {

	// Optional. The timestamp when the destination service receives the first
	// byte of the request.
	ReceiveTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=receive_time,json=receiveTime,proto3" json:"receive_time,omitempty"`
	// contains filtered or unexported fields
}

type ConditionContext_Resource struct {

	// The name of the service that this resource belongs to, such as
	// `compute.googleapis.com`. The service name might not match the DNS
	// hostname that actually serves the request.
	//
	// For a full list of resource service values, see
	// https://cloud.google.com/iam/help/conditions/resource-services
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// The stable identifier (name) of a resource on the `service`. A resource
	// can be logically identified as `//{resource.service}/{resource.name}`.
	// Unlike the resource URI, the resource name doesn't contain any protocol
	// and version information.
	//
	// For a list of full resource name formats, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// The type of the resource, in the format `{service}/{kind}`.
	//
	// For a full list of resource type values, see
	// https://cloud.google.com/iam/help/conditions/resource-types
	Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
	// contains filtered or unexported fields
}

type ConditionExplanation struct {

	// Value of the condition.
	Value *structpb.Value `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition expression.
	Errors []*status.Status `protobuf:"bytes,3,rep,name=errors,proto3" json:"errors,omitempty"`
	// The value of each statement of the condition expression. The value can be
	// `true`, `false`, or `null`. The value is `null` if the statement can't be
	// evaluated.
	EvaluationStates []*ConditionExplanation_EvaluationState `protobuf:"bytes,2,rep,name=evaluation_states,json=evaluationStates,proto3" json:"evaluation_states,omitempty"`
	// contains filtered or unexported fields
}

type ConditionExplanation_EvaluationState struct {

	// Start position of an expression in the condition, by character.
	Start int32 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
	// End position of an expression in the condition, by character,
	// end included, for example: the end position of the first part of
	// `a==b || c==d` would be 4.
	End int32 `protobuf:"varint,2,opt,name=end,proto3" json:"end,omitempty"`
	// Value of this expression.
	Value *structpb.Value `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
	// Any errors that prevented complete evaluation of the condition
	// expression.
	Errors []*status.Status `protobuf:"bytes,4,rep,name=errors,proto3" json:"errors,omitempty"`
	// contains filtered or unexported fields
}

type DenyAccessState int32

const (
	// Not specified.
	DenyAccessState_DENY_ACCESS_STATE_UNSPECIFIED DenyAccessState = 0
	// The deny policy denies the principal the permission.
	DenyAccessState_DENY_ACCESS_STATE_DENIED DenyAccessState = 1
	// The deny policy doesn't deny the principal the permission.
	DenyAccessState_DENY_ACCESS_STATE_NOT_DENIED DenyAccessState = 2
	// The deny policy denies the principal the permission if a condition
	// expression evaluates to `true`. However, the sender of the request didn't
	// provide enough context for Policy Troubleshooter to evaluate the condition
	// expression.
	DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_CONDITIONAL DenyAccessState = 3
	// The sender of the request does not have access to all of the deny policies
	// that Policy Troubleshooter needs to evaluate the principal's access.
	DenyAccessState_DENY_ACCESS_STATE_UNKNOWN_INFO DenyAccessState = 4
)

type DenyPolicyExplanation struct {

	// Indicates whether the principal is denied the specified permission for
	// the specified resource, based on evaluating all applicable IAM deny
	// policies.
	DenyAccessState DenyAccessState `protobuf:"varint,1,opt,name=deny_access_state,json=denyAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.DenyAccessState" json:"deny_access_state,omitempty"`
	// List of resources with IAM deny policies that were evaluated to check the
	// principal's denied permissions, with annotations to indicate how each
	// policy contributed to the final result.
	//
	// The list of resources includes the policy for the resource itself, as well
	// as policies that are inherited from higher levels of the resource
	// hierarchy, including the organization, the folder, and the project. The
	// order of the resources starts from the resource and climbs up the resource
	// hierarchy.
	//
	// To learn more about the resource hierarchy, see
	// https://cloud.google.com/iam/help/resource-hierarchy.
	ExplainedResources []*ExplainedDenyResource `protobuf:"bytes,2,rep,name=explained_resources,json=explainedResources,proto3" json:"explained_resources,omitempty"`
	// The relevance of the deny policy result to the overall access state.
	Relevance HeuristicRelevance `protobuf:"varint,3,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// Indicates whether the permission to troubleshoot is supported in deny
	// policies.
	PermissionDeniable bool `protobuf:"varint,4,opt,name=permission_deniable,json=permissionDeniable,proto3" json:"permission_deniable,omitempty"`
	// contains filtered or unexported fields
}

type DenyRuleExplanation struct {

	// Required. Indicates whether _this rule_ denies the specified permission to
	// the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal is actually denied on
	// the permission for the resource. There might be another rule that overrides
	// this rule. To determine whether the principal actually has the permission,
	// use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `protobuf:"varint,1,opt,name=deny_access_state,json=denyAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.DenyAccessState" json:"deny_access_state,omitempty"`
	// Indicates whether the permission in the request is listed as a denied
	// permission in the deny rule.
	CombinedDeniedPermission *DenyRuleExplanation_AnnotatedPermissionMatching `protobuf:"bytes,2,opt,name=combined_denied_permission,json=combinedDeniedPermission,proto3" json:"combined_denied_permission,omitempty"`
	// Lists all denied permissions in the deny rule and indicates whether each
	// permission matches the permission in the request.
	//
	// Each key identifies a denied permission in the rule, and each value
	// indicates whether the denied permission matches the permission in the
	// request.
	DeniedPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching `protobuf:"bytes,3,rep,name=denied_permissions,json=deniedPermissions,proto3" json:"denied_permissions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Indicates whether the permission in the request is listed as an exception
	// permission in the deny rule.
	CombinedExceptionPermission *DenyRuleExplanation_AnnotatedPermissionMatching `protobuf:"bytes,4,opt,name=combined_exception_permission,json=combinedExceptionPermission,proto3" json:"combined_exception_permission,omitempty"`
	// Lists all exception permissions in the deny rule and indicates whether each
	// permission matches the permission in the request.
	//
	// Each key identifies a exception permission in the rule, and each value
	// indicates whether the exception permission matches the permission in the
	// request.
	ExceptionPermissions map[string]*DenyRuleExplanation_AnnotatedPermissionMatching `protobuf:"bytes,5,rep,name=exception_permissions,json=exceptionPermissions,proto3" json:"exception_permissions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Indicates whether the principal is listed as a denied principal in the
	// deny rule, either directly or through membership in a principal set.
	CombinedDeniedPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching `protobuf:"bytes,6,opt,name=combined_denied_principal,json=combinedDeniedPrincipal,proto3" json:"combined_denied_principal,omitempty"`
	// Lists all denied principals in the deny rule and indicates whether each
	// principal matches the principal in the request, either directly or through
	// membership in a principal set.
	//
	// Each key identifies a denied principal in the rule, and each value
	// indicates whether the denied principal matches the principal in the
	// request.
	DeniedPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching `protobuf:"bytes,7,rep,name=denied_principals,json=deniedPrincipals,proto3" json:"denied_principals,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// Indicates whether the principal is listed as an exception principal in the
	// deny rule, either directly or through membership in a principal set.
	CombinedExceptionPrincipal *DenyRuleExplanation_AnnotatedDenyPrincipalMatching `protobuf:"bytes,8,opt,name=combined_exception_principal,json=combinedExceptionPrincipal,proto3" json:"combined_exception_principal,omitempty"`
	// Lists all exception principals in the deny rule and indicates whether each
	// principal matches the principal in the request, either directly or through
	// membership in a principal set.
	//
	// Each key identifies a exception principal in the rule, and each value
	// indicates whether the exception principal matches the principal in the
	// request.
	ExceptionPrincipals map[string]*DenyRuleExplanation_AnnotatedDenyPrincipalMatching `protobuf:"bytes,9,rep,name=exception_principals,json=exceptionPrincipals,proto3" json:"exception_principals,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
	// The relevance of this role binding to the overall determination for the
	// entire policy.
	Relevance HeuristicRelevance `protobuf:"varint,10,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// A condition expression that specifies when the deny rule denies the
	// principal access.
	//
	// To learn about IAM Conditions, see
	// https://cloud.google.com/iam/help/conditions/overview.
	Condition *expr.Expr `protobuf:"bytes,11,opt,name=condition,proto3" json:"condition,omitempty"`
	// Condition evaluation state for this role binding.
	ConditionExplanation *ConditionExplanation `protobuf:"bytes,12,opt,name=condition_explanation,json=conditionExplanation,proto3" json:"condition_explanation,omitempty"`
	// contains filtered or unexported fields
}

type DenyRuleExplanation_AnnotatedDenyPrincipalMatching struct {

	// Indicates whether the principal is listed as a denied principal in the
	// deny rule, either directly or through membership in a principal set.
	Membership MembershipMatchingState `protobuf:"varint,1,opt,name=membership,proto3,enum=google.cloud.policytroubleshooter.iam.v3.MembershipMatchingState" json:"membership,omitempty"`
	// The relevance of the principal's status to the overall determination for
	// the role binding.
	Relevance HeuristicRelevance `protobuf:"varint,2,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type DenyRuleExplanation_AnnotatedPermissionMatching struct {

	// Indicates whether the permission in the request is denied by the deny
	// rule.
	PermissionMatchingState PermissionPatternMatchingState `protobuf:"varint,1,opt,name=permission_matching_state,json=permissionMatchingState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.PermissionPatternMatchingState" json:"permission_matching_state,omitempty"`
	// The relevance of the permission status to the overall determination for
	// the rule.
	Relevance HeuristicRelevance `protobuf:"varint,2,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type ExplainedAllowPolicy struct {

	// Required. Indicates whether _this policy_ provides the specified permission
	// to the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	AllowAccessState AllowAccessState `protobuf:"varint,1,opt,name=allow_access_state,json=allowAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.AllowAccessState" json:"allow_access_state,omitempty"`
	// The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// Details about how each role binding in the policy affects the principal's
	// ability, or inability, to use the permission for the resource. The order of
	// the role bindings matches the role binding order in the policy.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	BindingExplanations []*AllowBindingExplanation `protobuf:"bytes,3,rep,name=binding_explanations,json=bindingExplanations,proto3" json:"binding_explanations,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `protobuf:"varint,4,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// The IAM allow policy attached to the resource.
	//
	// If the sender of the request does not have access to the policy, this field
	// is empty.
	Policy *iampb.Policy `protobuf:"bytes,5,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

type ExplainedDenyPolicy struct {

	// Required. Indicates whether _this policy_ denies the specified permission
	// to the specified principal for the specified resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `protobuf:"varint,1,opt,name=deny_access_state,json=denyAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.DenyAccessState" json:"deny_access_state,omitempty"`
	// The IAM deny policy attached to the resource.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Policy *iampb1.Policy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// Details about how each rule in the policy affects the principal's inability
	// to use the permission for the resource. The order of the deny rule matches
	// the order of the rules in the deny policy.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	RuleExplanations []*DenyRuleExplanation `protobuf:"bytes,3,rep,name=rule_explanations,json=ruleExplanations,proto3" json:"rule_explanations,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `protobuf:"varint,4,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type ExplainedDenyResource struct {

	// Required. Indicates whether any policies attached to _this resource_ deny
	// the specific permission to the specified principal for the specified
	// resource.
	//
	// This field does _not_ indicate whether the principal actually has the
	// permission for the resource. There might be another policy that overrides
	// this policy. To determine whether the principal actually has the
	// permission, use the `overall_access_state` field in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	DenyAccessState DenyAccessState `protobuf:"varint,1,opt,name=deny_access_state,json=denyAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.DenyAccessState" json:"deny_access_state,omitempty"`
	// The full resource name that identifies the resource. For example,
	// `//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-instance`.
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	//
	// For examples of full resource names for Google Cloud services, see
	// https://cloud.google.com/iam/help/troubleshooter/full-resource-names.
	FullResourceName string `protobuf:"bytes,2,opt,name=full_resource_name,json=fullResourceName,proto3" json:"full_resource_name,omitempty"`
	// List of IAM deny policies that were evaluated to check the principal's
	// denied permissions, with annotations to indicate how each policy
	// contributed to the final result.
	ExplainedPolicies []*ExplainedDenyPolicy `protobuf:"bytes,3,rep,name=explained_policies,json=explainedPolicies,proto3" json:"explained_policies,omitempty"`
	// The relevance of this policy to the overall access state in the
	// [TroubleshootIamPolicyResponse][google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse].
	//
	// If the sender of the request does not have access to the policy, this field
	// is omitted.
	Relevance HeuristicRelevance `protobuf:"varint,4,opt,name=relevance,proto3,enum=google.cloud.policytroubleshooter.iam.v3.HeuristicRelevance" json:"relevance,omitempty"`
	// contains filtered or unexported fields
}

type HeuristicRelevance int32

const (
	// Not specified.
	HeuristicRelevance_HEURISTIC_RELEVANCE_UNSPECIFIED HeuristicRelevance = 0
	// The data point has a limited effect on the result. Changing the data point
	// is unlikely to affect the overall determination.
	HeuristicRelevance_HEURISTIC_RELEVANCE_NORMAL HeuristicRelevance = 1
	// The data point has a strong effect on the result. Changing the data point
	// is likely to affect the overall determination.
	HeuristicRelevance_HEURISTIC_RELEVANCE_HIGH HeuristicRelevance = 2
)

type MembershipMatchingState int32

const (
	// Not specified.
	MembershipMatchingState_MEMBERSHIP_MATCHING_STATE_UNSPECIFIED MembershipMatchingState = 0
	// The principal in the request matches the principal in the policy. The
	// principal can be included directly or indirectly:
	//
	//   - A principal is included directly if that principal is listed in the
	//     role binding.
	//   - A principal is included indirectly if that principal is in a Google
	//     group, Google Workspace account, or Cloud Identity domain that is listed
	//     in the policy.
	MembershipMatchingState_MEMBERSHIP_MATCHED MembershipMatchingState = 1
	// The principal in the request doesn't match the principal in the policy.
	MembershipMatchingState_MEMBERSHIP_NOT_MATCHED MembershipMatchingState = 2
	// The principal in the policy is a group or domain, and the sender of the
	// request doesn't have permission to view whether the principal in the
	// request is a member of the group or domain.
	MembershipMatchingState_MEMBERSHIP_UNKNOWN_INFO MembershipMatchingState = 3
	// The principal is an unsupported type.
	MembershipMatchingState_MEMBERSHIP_UNKNOWN_UNSUPPORTED MembershipMatchingState = 4
)

type PermissionPatternMatchingState int32

const (
	// Not specified.
	PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHING_STATE_UNSPECIFIED PermissionPatternMatchingState = 0
	// The permission in the request matches the permission in the policy.
	PermissionPatternMatchingState_PERMISSION_PATTERN_MATCHED PermissionPatternMatchingState = 1
	// The permission in the request matches the permission in the policy.
	PermissionPatternMatchingState_PERMISSION_PATTERN_NOT_MATCHED PermissionPatternMatchingState = 2
)

type PolicyTroubleshooterClient interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(ctx context.Context, in *TroubleshootIamPolicyRequest, opts ...grpc.CallOption) (*TroubleshootIamPolicyResponse, error)
}

type PolicyTroubleshooterServer interface {
	// Checks whether a principal has a specific permission for a specific
	// resource, and explains why the principal does or doesn't have that
	// permission.
	TroubleshootIamPolicy(context.Context, *TroubleshootIamPolicyRequest) (*TroubleshootIamPolicyResponse, error)
}

type RolePermissionInclusionState int32

const (
	// Not specified.
	RolePermissionInclusionState_ROLE_PERMISSION_INCLUSION_STATE_UNSPECIFIED RolePermissionInclusionState = 0
	// The permission is included in the role.
	RolePermissionInclusionState_ROLE_PERMISSION_INCLUDED RolePermissionInclusionState = 1
	// The permission is not included in the role.
	RolePermissionInclusionState_ROLE_PERMISSION_NOT_INCLUDED RolePermissionInclusionState = 2
	// The sender of the request is not allowed to access the role definition.
	RolePermissionInclusionState_ROLE_PERMISSION_UNKNOWN_INFO RolePermissionInclusionState = 3
)

type TroubleshootIamPolicyRequest struct {

	// The information to use for checking whether a principal has a permission
	// for a resource.
	AccessTuple *AccessTuple `protobuf:"bytes,1,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`
	// contains filtered or unexported fields
}

type TroubleshootIamPolicyResponse struct {

	// Indicates whether the principal has the specified permission for the
	// specified resource, based on evaluating all types of the applicable IAM
	// policies.
	OverallAccessState TroubleshootIamPolicyResponse_OverallAccessState `protobuf:"varint,1,opt,name=overall_access_state,json=overallAccessState,proto3,enum=google.cloud.policytroubleshooter.iam.v3.TroubleshootIamPolicyResponse_OverallAccessState" json:"overall_access_state,omitempty"`
	// The access tuple from the request, including any provided context used to
	// evaluate the condition.
	AccessTuple *AccessTuple `protobuf:"bytes,2,opt,name=access_tuple,json=accessTuple,proto3" json:"access_tuple,omitempty"`
	// An explanation of how the applicable IAM allow policies affect the final
	// access state.
	AllowPolicyExplanation *AllowPolicyExplanation `protobuf:"bytes,3,opt,name=allow_policy_explanation,json=allowPolicyExplanation,proto3" json:"allow_policy_explanation,omitempty"`
	// An explanation of how the applicable IAM deny policies affect the final
	// access state.
	DenyPolicyExplanation *DenyPolicyExplanation `protobuf:"bytes,4,opt,name=deny_policy_explanation,json=denyPolicyExplanation,proto3" json:"deny_policy_explanation,omitempty"`
	// contains filtered or unexported fields
}

type TroubleshootIamPolicyResponse_OverallAccessState int32

const (
	// Not specified.
	TroubleshootIamPolicyResponse_OVERALL_ACCESS_STATE_UNSPECIFIED TroubleshootIamPolicyResponse_OverallAccessState = 0
	// The principal has the permission.
	TroubleshootIamPolicyResponse_CAN_ACCESS TroubleshootIamPolicyResponse_OverallAccessState = 1
	// The principal doesn't have the permission.
	TroubleshootIamPolicyResponse_CANNOT_ACCESS TroubleshootIamPolicyResponse_OverallAccessState = 2
	// The principal might have the permission, but the sender can't access all
	// of the information needed to fully evaluate the principal's access.
	TroubleshootIamPolicyResponse_UNKNOWN_INFO TroubleshootIamPolicyResponse_OverallAccessState = 3
	// The principal might have the permission, but Policy Troubleshooter can't
	// fully evaluate the principal's access because the sender didn't provide
	// the required context to evaluate the condition.
	TroubleshootIamPolicyResponse_UNKNOWN_CONDITIONAL TroubleshootIamPolicyResponse_OverallAccessState = 4
)

type UnimplementedPolicyTroubleshooterServer struct {
}