Test IAM permissions
This page describes how to programmatically test IAM permissions against an Image API resource. This is especially useful to check whether the currently authenticated identity is allowed to perform a specific action. Testing permissions is also used in Permission-Aware UIs to hide action items from the user interface, e.g. if a user is not allowed to delete a resource the delete button won't be rendered in the UI.
Permissions
The list of permissions that can be tested against Image API resources can be found in the reference page for IAM permissions.
Sample
The following code sample shows how to test a set of permissions against an album.
Replace [ALBUM] with the resource name of the album that the permissions should be tested against, e.g. users/123/albums/456.
tip
Tip: do not forget to replace CLIENT-ID and CLIENT-SECRET with valid IAM Service Account client credentials.
- Golang
package main
import (
"context"
"log"
"golang.org/x/oauth2/clientcredentials"
"google.golang.org/api/option"
"google.golang.org/genproto/googleapis/iam/v1"
gapic "github.com/animeapis/api-go-client/image/v1alpha1"
)
var (
Album = "[ALBUM]"
TestPermissions = []string{
"image.albums.get",
"image.albums.create",
"image.albums.setIamPolicy",
"image.images.get",
"image.images.upload",
}
ClientID = "[CLIENT-ID]"
ClientSecret = "[CLIENT-SECRET]"
)
var (
TokenURL = "https://accounts.animeshon.com/o/oauth2/token"
Endpoint = "image.animeapis.com:443"
)
func main() {
ctx := context.Background()
config := &clientcredentials.Config{
ClientID: ClientID,
ClientSecret: ClientSecret,
TokenURL: TokenURL,
}
options := []option.ClientOption{
option.WithEndpoint(Endpoint),
option.WithTokenSource(config.TokenSource(ctx)),
}
client, err := gapic.NewClient(ctx, options...)
if err != nil {
log.Fatalf("NewClient: %s", err)
}
request := &iam.TestIamPermissionsRequest{
Resource: Album,
Permissions: TestPermissions,
}
response, err := client.TestIamPermissions(ctx, request)
if err != nil {
log.Fatalf("TestIamPermissions: %s", err)
}
log.Printf("resource : %s", Album)
log.Printf("allowed permissions: %v", response.GetPermissions())
}