feat: implement Log action for custom role permissions.

api/org-unit-role.proto

@@ -12,7 +12,7 @@ option go_package = "github.com/go-core-stack/auth-gateway/api";
 
 // Service provided to manage org unit roles
 service OrgUnitRole {
-  // Get List of available org unit roles, for specifc orgranisation
+  // Get List of available org unit roles (both built-in and custom), for specific organisation
   rpc ListOrgUnitRoles(OrgUnitRolesListReq) returns (OrgUnitRolesListResp) {
     option (google.api.http) = {
       get: "/api/auth/v1/ou/{ou}/roles"
@@ -23,6 +23,56 @@ service OrgUnitRole {
       verb: "list"
     };
   }
+
+  // Create a new custom role for the organization unit
+  rpc CreateCustomRole(CreateCustomRoleReq) returns (CreateCustomRoleResp) {
+    option (google.api.http) = {
+      post: "/api/auth/v1/ou/{ou}/role"
+      body: "*"
+    };
+    option (api.role) = {
+      resource: "org-unit-role"
+      scope: "ou"
+      verb: "create"
+    };
+  }
+
+  // Update an existing custom role for the organization unit
+  rpc UpdateCustomRole(UpdateCustomRoleReq) returns (UpdateCustomRoleResp) {
+    option (google.api.http) = {
+      put: "/api/auth/v1/ou/{ou}/role/{name}"
+      body: "*"
+    };
+    option (api.role) = {
+      resource: "org-unit-role"
+      scope: "ou"
+      verb: "update"
+    };
+  }
+
+  // Get details of a specific custom role
+  rpc GetCustomRole(GetCustomRoleReq) returns (GetCustomRoleResp) {
+    option (google.api.http) = {
+      get: "/api/auth/v1/ou/{ou}/role/{name}"
+    };
+    option (api.role) = {
+      resource: "org-unit-role"
+      scope: "ou"
+      verb: "get"
+    };
+  }
+
+  // Delete (soft delete) a custom role from the organization unit
+  rpc DeleteCustomRole(DeleteCustomRoleReq) returns (DeleteCustomRoleResp) {
+    option (google.api.http) = {
+      delete: "/api/auth/v1/ou/{ou}/role/{name}"
+    };
+    option (api.role) = {
+      resource: "org-unit-role"
+      scope: "ou"
+      verb: "delete"
+    };
+  }
 }
 
 // org unit roles list request
@@ -37,9 +87,18 @@ message OrgUnitRolesListEntry {
 
   // role description, provding details about the role
   string desc = 2;
+
+  // role type: "built-in" for system roles (admin, auditor) or "custom" for user-defined roles
+  string type = 3;
+
+  // creation timestamp for custom roles (only applicable for custom roles)
+  int64 created = 4;
+
+  // user who created the role for custom roles (only applicable for custom roles)
+  string createdBy = 5;
 }
 
-// org unit roles list response
+// org unit roles list response - includes both built-in and custom roles
 message OrgUnitRolesListResp {
   // eventually if we start working with longer list of roles
   // keep first index for count to provide pagination
@@ -48,3 +107,148 @@ message OrgUnitRolesListResp {
   // list of roles available as part of the response
   repeated OrgUnitRolesListEntry items = 2;
 }
+
+// Matching criteria types for resource-based permissions
+message ResourceMatchCriteriaDefs {
+  enum Criteria {
+    // Unspecified/default (treated as deny for security)
+    Unspecified = 0;
+    // Matches all resources (wildcard)
+    Any = 1;
+    // Exact resource name match
+    Exact = 2;
+    // Resource name starts with the pattern
+    Prefix = 3;
+    // Resource name ends with the pattern
+    Suffix = 4;
+    // Resource name matches the regex pattern
+    Regex = 5;
+  }
+}
+
+// Action types for role permissions
+message RolePermissionActionDefs {
+  enum Action {
+    // Unspecified action (invalid, will be denied)
+    Unspecified = 0;
+    // Allow the specified verbs on the resource
+    Allow = 1;
+    // Deny the specified verbs on the resource (takes precedence over Allow)
+    Deny = 2;
+    // Log the specified verbs on the resource (allows access but logs for audit)
+    Log = 3;
+  }
+}
+
+// Resource matching criteria for fine-grained permission control
+message ResourceMatch {
+  // Matching criteria type
+  ResourceMatchCriteriaDefs.Criteria criteria = 1;
+
+  // The matching key/pattern based on criteria
+  // For wildcard: supports * (e.g., "bucket-*", "*-prod", "*")
+  // For regex: valid regex pattern
+  // For exact/prefix/suffix: literal string
+  string key = 2;
+}
+
+// Permission definition for custom roles
+message RolePermission {
+  // Resource name this permission applies to
+  string resource = 1;
+
+  // Resource matching criteria (optional, defaults to wildcard with key="*")
+  ResourceMatch match = 2;
+
+  // List of allowed verbs/actions for this resource (supports "*" for all verbs)
+  repeated string verbs = 3;
+
+  // Action type: Allow, Deny, or Log
+  RolePermissionActionDefs.Action action = 4;
+}
+
+// Create custom role request
+message CreateCustomRoleReq {
+  // Organization unit ID
+  string ou = 1;
+
+  // Name of the custom role (must be unique within the org unit)
+  string name = 2;
+
+  // Description explaining the purpose of this custom role
+  string description = 3;
+
+  // List of permissions granted by this custom role
+  repeated RolePermission permissions = 4;
+}
+
+// Create custom role response
+message CreateCustomRoleResp {
+}
+
+// Update custom role request
+message UpdateCustomRoleReq {
+  // Organization unit ID
+  string ou = 1;
+
+  // Name of the custom role to update
+  string name = 2;
+
+  // Updated description explaining the purpose of this custom role
+  string description = 3;
+
+  // Updated list of permissions granted by this custom role
+  repeated RolePermission permissions = 4;
+}
+
+// Update custom role response
+message UpdateCustomRoleResp {
+}
+
+// Get custom role request
+message GetCustomRoleReq {
+  // Organization unit ID
+  string ou = 1;
+
+  // Name of the custom role to retrieve
+  string name = 2;
+}
+
+// Get custom role response
+message GetCustomRoleResp {
+  // Name of the custom role
+  string name = 1;
+
+  // Description explaining the purpose of this custom role
+  string description = 2;
+
+  // List of permissions granted by this custom role
+  repeated RolePermission permissions = 3;
+
+  // Timestamp when the role was created
+  int64 created = 4;
+
+  // User who created this custom role
+  string createdBy = 5;
+
+  // Timestamp when the role was last updated
+  int64 updated = 6;
+
+  // User who last updated this custom role
+  string updatedBy = 7;
+}
+
+// Delete custom role request
+message DeleteCustomRoleReq {
+  // Organization unit ID
+  string ou = 1;
+
+  // Name of the custom role to delete
+  string name = 2;
+}
+
+// Delete custom role response
+message DeleteCustomRoleResp {
+  // Confirmation message
+  string message = 1;
+}