Test IAM permissions

This page describes how to programmatically test IAM permissions against a Library API resource. This is especially useful to check whether the currently authenticated identity is allowed to perform a specific action. Testing permissions is also used in Permission-Aware UIs to hide action items from the user interface, e.g. if a user is not allowed to delete a resource the delete button won't be rendered in the UI.

Permissions

The list of permissions that can be tested against Library API resources can be found in the reference page for IAM permissions.

Sample

The following code sample shows how to test a set of permissions against a playlist.

Replace [PLAYLIST] with the resource name of the playlist that the permissions should be tested against, e.g. users/123/playlists/456.

tip

Tip: do not forget to replace CLIENT-ID and CLIENT-SECRET with valid IAM Service Account client credentials.

Golang

package main

import (
	"context"
	"log"

	"golang.org/x/oauth2/clientcredentials"

	"google.golang.org/api/option"
	"google.golang.org/genproto/googleapis/iam/v1"

	gapic "github.com/animeapis/api-go-client/library/v1alpha1"
)

var (
	Playlist = "[PLAYLIST]"

	TestPermissions = []string{
		"library.playlists.get",
		"library.playlists.create",
		"library.playlists.setIamPolicy",
	}

	ClientID     = "[CLIENT-ID]"
	ClientSecret = "[CLIENT-SECRET]"
)

var (
	TokenURL = "https://accounts.animeshon.com/o/oauth2/token"
	Endpoint = "library.animeapis.com:443"
)

func main() {
	ctx := context.Background()

	config := &clientcredentials.Config{
		ClientID:     ClientID,
		ClientSecret: ClientSecret,
		TokenURL:     TokenURL,
	}

	options := []option.ClientOption{
		option.WithEndpoint(Endpoint),
		option.WithTokenSource(config.TokenSource(ctx)),
	}

	client, err := gapic.NewClient(ctx, options...)
	if err != nil {
		log.Fatalf("NewClient: %s", err)
	}

	request := &iam.TestIamPermissionsRequest{
		Resource:    Playlist,
		Permissions: TestPermissions,
	}

	response, err := client.TestIamPermissions(ctx, request)
	if err != nil {
		log.Fatalf("TestIamPermissions: %s", err)
	}

	log.Printf("resource           : %s", Playlist)
	log.Printf("allowed permissions: %v", response.GetPermissions())
}

View on GitHub