Add support for requiring reason for access requests

gravitational · Nov 18, 2024 · c5b9345 · c5b9345
1 parent 6d1cb64
commit c5b9345
Show file tree

Hide file tree

Showing 6 changed files with 2,835 additions and 2,294 deletions.
diff --git a/api/proto/teleport/legacy/types/types.proto b/api/proto/teleport/legacy/types/types.proto
@@ -3440,6 +3440,18 @@ message AccessRequestConditions {
     (gogoproto.nullable) = false,
     (gogoproto.jsontag) = "kubernetes_resources,omitempty"
   ];
+
+  // Reason defines settings for the reason for the access provided by the user.
+  AccessRequestConditionsReason Reason = 9 [(gogoproto.jsontag) = "reason,omitempty"];
+}
+
+// AccessRequestConditionsReason defines settings for the reason for the access provided by the
+// user.
+message AccessRequestConditionsReason {
+  // Required indicates that reason is required for all access requests requesting allowed roles or
+  // resources searchable with search_as_roles. It applies only to users who have this role
+  // assigned.
+  bool Required = 1 [(gogoproto.jsontag) = "required,omitempty"];
 }
 
 // AccessReviewConditions is a matcher for allow/deny restrictions on