Bump cloud-api to v0.17.0

crates/client/src/grpc.rs

@@ -1844,6 +1844,9 @@ proxier! {
     (create_custom_role, cloudreq::CreateCustomRoleRequest, cloudreq::CreateCustomRoleResponse);
     (update_custom_role, cloudreq::UpdateCustomRoleRequest, cloudreq::UpdateCustomRoleResponse);
     (delete_custom_role, cloudreq::DeleteCustomRoleRequest, cloudreq::DeleteCustomRoleResponse);
+    (get_user_namespace_assignments, cloudreq::GetUserNamespaceAssignmentsRequest, cloudreq::GetUserNamespaceAssignmentsResponse);
+    (get_service_account_namespace_assignments, cloudreq::GetServiceAccountNamespaceAssignmentsRequest, cloudreq::GetServiceAccountNamespaceAssignmentsResponse);
+    (get_user_group_namespace_assignments, cloudreq::GetUserGroupNamespaceAssignmentsRequest, cloudreq::GetUserGroupNamespaceAssignmentsResponse);
 }
 
 proxier! {

crates/protos/protos/api_cloud_upstream/README.md

@@ -1,6 +1,6 @@
 # Temporal Cloud Operations API (Public Preview)
 
-> aka the Cloud Ops API  
+> aka the Cloud Ops API
 > These apis (proto files) are currently offered as a Public Preview. While they are production worthy, they are subject to change. Please reach out to Temporal Support if you have questions.
 
 ## How to use
@@ -15,7 +15,7 @@ To use the Cloud Ops API in your project, preform the following 4 steps:
 
 The client is expected to pass in a `temporal-cloud-api-version` header with the api version identifier with every request it makes to the apis. The backend will use the version to safely mutate resources. The `temporal:versioning:min_version` label specifies the minimum version of the API that supports the field.
 
-Current Version `v0.16.0`
+Current Version `v0.17.0`
 
 ### URL
 
@@ -27,10 +27,10 @@ saas-api.tmprl.cloud:443
 ## Samples
 
 Refer to the [cloud-samples-go](https://github.com/temporalio/cloud-samples-go/blob/main/cmd/worker/README.md) sample repository for how to use the cloud ops api in Go.
-> This sample demonstrates how to automate Temporal Cloud operations using Temporal Workflows that make Cloud Ops API requests within Workflow Activities ([Worker Sample README](https://github.com/temporalio/cloud-samples-go/tree/main/cmd/worker)).  
+> This sample demonstrates how to automate Temporal Cloud operations using Temporal Workflows that make Cloud Ops API requests within Workflow Activities ([Worker Sample README](https://github.com/temporalio/cloud-samples-go/tree/main/cmd/worker)).
 > See [here](https://github.com/temporalio/cloud-samples-go/blob/60d5cbca8696c87fb184efc56f5ae117561213d2/client/api/client.go#L16) for a quick reference showing you how to connect to Temporal Cloud with an API Key for the Cloud Ops API in Go.
 
-Refer to the [temporal-cloud-api-client-typescript](https://github.com/steveandroulakis/temporal-cloud-api-client-typescript) sample repository for how to use the cloud ops api in Typescript.  
-Refer to the [temporal-cloud-api-client-java](https://github.com/steveandroulakis/temporal-cloud-api-client-java) sample repository for how to use the cloud ops api in Java.  
+Refer to the [temporal-cloud-api-client-typescript](https://github.com/steveandroulakis/temporal-cloud-api-client-typescript) sample repository for how to use the cloud ops api in Typescript.
+Refer to the [temporal-cloud-api-client-java](https://github.com/steveandroulakis/temporal-cloud-api-client-java) sample repository for how to use the cloud ops api in Java.
 Refer to the [temporal-cloud-api-client-kotlin](https://github.com/steveandroulakis/temporal-cloud-api-client-kotlin) sample repository for how to use the cloud ops api in Kotlin.
 > The Java, Typescript, and Kotlin sample apps all provide a simple HTML UI that demonstrates how to use the Cloud Ops API to CRUD Namespaces and Users.

crates/protos/protos/api_cloud_upstream/VERSION

@@ -1 +1 @@
-v0.16.0
+v0.17.0

crates/protos/protos/api_cloud_upstream/temporal/api/cloud/cloudservice/v1/request_response.proto

@@ -1168,3 +1168,54 @@ message DeleteCustomRoleResponse {
     // The async operation.
     temporal.api.cloud.operation.v1.AsyncOperation async_operation = 1;
 }
+
+message GetUserNamespaceAssignmentsRequest {
+    // The namespace to get users for.
+    string namespace = 1;
+    // The requested size of the page to retrieve - optional.
+    // Cannot exceed 1000. Defaults to 100.
+    int32 page_size = 2;
+    // The page token if this is continuing from another response - optional.
+    string page_token = 3;
+}
+
+message GetUserNamespaceAssignmentsResponse {
+    // The list of users with access to the namespace.
+    repeated temporal.api.cloud.identity.v1.UserNamespaceAssignment users = 1;
+    // The next page's token.
+    string next_page_token = 2;
+}
+
+message GetServiceAccountNamespaceAssignmentsRequest {
+    // The namespace to get service accounts for.
+    string namespace = 1;
+    // The requested size of the page to retrieve - optional.
+    // Cannot exceed 1000. Defaults to 100.
+    int32 page_size = 2;
+    // The page token if this is continuing from another response - optional.
+    string page_token = 3;
+}
+
+message GetServiceAccountNamespaceAssignmentsResponse {
+    // The list of service accounts with access to the namespace.
+    repeated temporal.api.cloud.identity.v1.ServiceAccountNamespaceAssignment service_accounts = 1;
+    // The next page's token.
+    string next_page_token = 2;
+}
+
+message GetUserGroupNamespaceAssignmentsRequest {
+    // The namespace to get user groups for.
+    string namespace = 1;
+    // The requested size of the page to retrieve - optional.
+    // Cannot exceed 1000. Defaults to 100.
+    int32 page_size = 2;
+    // The page token if this is continuing from another response - optional.
+    string page_token = 3;
+}
+
+message GetUserGroupNamespaceAssignmentsResponse {
+    // The list of user groups with access to the namespace.
+    repeated temporal.api.cloud.identity.v1.UserGroupNamespaceAssignment groups = 1;
+    // The next page's token.
+    string next_page_token = 2;
+}

crates/protos/protos/api_cloud_upstream/temporal/api/cloud/cloudservice/v1/service.proto

@@ -1133,7 +1133,7 @@ service CloudService {
             body: "*"
         };
         option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-            tags: ["Account"];
+            tags: ["Billing"];
             summary: "Create a billing report";
             description: "Creates a billing report for the account";
             external_docs: {
@@ -1149,7 +1149,7 @@ service CloudService {
             get: "/cloud/billing-reports/{billing_report_id}"
         };
         option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
-            tags: ["Account"];
+            tags: ["Billing"];
             summary: "Get a billing report";
             description: "Gets an existing billing report for the account";
             external_docs: {
@@ -1240,4 +1240,52 @@ service CloudService {
             };
         };
     }
+
+    // Get users with access to a namespace
+    rpc GetUserNamespaceAssignments(GetUserNamespaceAssignmentsRequest) returns (GetUserNamespaceAssignmentsResponse) {
+        option (google.api.http) = {
+            get: "/cloud/namespaces/{namespace}/user-assignments",
+        };
+        option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+            tags: ["Users"];
+            summary: "Get users with access to a namespace";
+            description: "Returns the users that have access to the namespace, including each user's namespace-level access.";
+            external_docs: {
+                url: "https://docs.temporal.io/cloud/users";
+                description: "Users documentation";
+            };
+        };
+    }
+
+    // Get service accounts with access to a namespace
+    rpc GetServiceAccountNamespaceAssignments(GetServiceAccountNamespaceAssignmentsRequest) returns (GetServiceAccountNamespaceAssignmentsResponse) {
+        option (google.api.http) = {
+            get: "/cloud/namespaces/{namespace}/service-account-assignments",
+        };
+        option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+            tags: ["Service Accounts"];
+            summary: "List service accounts with access to a namespace";
+            description: "Returns the service accounts that have access to the namespace, including each service account's namespace-level access.";
+            external_docs: {
+                url: "https://docs.temporal.io/cloud/service-accounts";
+                description: "Service Accounts documentation";
+            };
+        };
+    }
+
+    // Get user groups with access to a namespace
+    rpc GetUserGroupNamespaceAssignments(GetUserGroupNamespaceAssignmentsRequest) returns (GetUserGroupNamespaceAssignmentsResponse) {
+        option (google.api.http) = {
+            get: "/cloud/namespaces/{namespace}/user-group-assignments",
+        };
+        option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+            tags: ["Groups"];
+            summary: "List user groups with access to a namespace";
+            description: "Returns the user groups that have access to the namespace, including each group's namespace-level access.";
+            external_docs: {
+                url: "https://docs.temporal.io/cloud/user-groups";
+                description: "User groups documentation";
+            };
+        };
+    }
 }

crates/protos/protos/api_cloud_upstream/temporal/api/cloud/identity/v1/message.proto

@@ -347,3 +347,42 @@ message CustomRole {
     // Will not be set if the custom role has never been modified.
     google.protobuf.Timestamp last_modified_time = 7;
 }
+
+message UserNamespaceAssignment {
+    // The ID of the user.
+    string id = 1;
+    // The email of the user.
+    string email = 2;
+    // The access assigned to the user at the namespace level.
+    NamespaceAccess namespace_access = 3;
+    // True if the user has inherited access to the namespace through an account or project role.
+    bool inherited_access = 4;
+    // The current resource version of the user.
+    string resource_version = 5;
+}
+
+message ServiceAccountNamespaceAssignment {
+    // The ID of the service account.
+    string id = 1;
+    // The name of the service account.
+    string name = 2;
+    // The access assigned to the service account at the namespace level.
+    NamespaceAccess namespace_access = 3;
+    // True if the service account has inherited access to the namespace through an account or project role.
+    bool inherited_access = 4;
+    // The current resource version of the service account.
+    string resource_version = 5;
+}
+
+message UserGroupNamespaceAssignment {
+    // The ID of the group.
+    string id = 1;
+    // The display name of the group.
+    string display_name = 2;
+    // The access assigned to the group at the namespace level.
+    NamespaceAccess namespace_access = 3;
+    // True if the group has inherited access to the namespace through an account or project role.
+    bool inherited_access = 4;
+    // The current resource version of the group.
+    string resource_version = 5;
+}

crates/sdk-core-c-bridge/src/client.rs

@@ -1289,6 +1289,25 @@ async fn call_cloud_service(
         "DeleteCustomRole" => {
             rpc_call_on_trait!(client, call, CloudService, delete_custom_role)
         }
+        "GetUserNamespaceAssignments" => {
+            rpc_call_on_trait!(client, call, CloudService, get_user_namespace_assignments)
+        }
+        "GetServiceAccountNamespaceAssignments" => {
+            rpc_call_on_trait!(
+                client,
+                call,
+                CloudService,
+                get_service_account_namespace_assignments
+            )
+        }
+        "GetUserGroupNamespaceAssignments" => {
+            rpc_call_on_trait!(
+                client,
+                call,
+                CloudService,
+                get_user_group_namespace_assignments
+            )
+        }
         rpc => Err(anyhow::anyhow!("Unknown RPC call {rpc}")),
     }
 }