release_tracks: [ALPHA, BETA, GA]
help_text:
  brief: Add IAM policy binding to a topic.
  description: |
    Add an IAM policy binding to a Cloud Pub/Sub Topic.

  examples: |
    To add an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com'
    with topic 'my-topic', run:

      $ {command} my-topic --member='user:test-user@gmail.com' --role='roles/editor'

    For a service account test-proj1@example.domain.com, the following command
    will add an IAM policy binding for the role of 'roles/editor' to the given
    service account:

      $ {command} my-topic --member='serviceAccount:test-proj1@example.domain.com' --role='roles/editor'

    The following command will add an IAM policy binding for the role of
    'roles/editor' for all authenticated users on a topic with identifier
    'my-topic':

      $ {command} my-topic --member='allAuthenticatedUsers' --role='roles/editor'

    See https://cloud.google.com/iam/docs/managing-policies for details of
    policy role and member types.

request:
  collection: pubsub.projects.topics

arguments:
  resource:
    help_text: The topic to add the IAM policy binding.
    spec: !REF googlecloudsdk.command_lib.pubsub.resources:topic

ALPHA:
  help_text:
    brief: Add IAM policy binding to a topic.
    description: |
      Add an IAM policy binding to the IAM policy of a Cloud Pub/Sub Topic. One binding consists of a member,
      a role, and an optional condition.

    examples: |
      To add an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com'
      with topic 'my-topic', run:

        $ {command} my-topic --member='user:test-user@gmail.com' --role='roles/editor'
      For a service account test-proj1@example.domain.com, the following command
      will add an IAM policy binding for the role of 'roles/editor' to the given
      service account:

        $ {command} test-proj1@example.domain.com --member='serviceAccount:test-proj1@example.domain.com' --role='roles/editor'

      The following command will add an IAM policy binding for the role of
      'roles/editor' for all authenticated users on a topic with identifier
      'my-topic':

        $ {command} my-topic --member='allAuthenticatedUsers' --role='roles/editor'

      To add an IAM policy binding which expires at the end of the year 2018 for the role of
      'roles/pubsub.publisher' and the user 'test-user@gmail.com' with topic 'my-topic', run:

        $ {command} my-topic --member='user:test-user@gmail.com' --role='roles/pubsub.publisher' --condition='expression=request.time < timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2018,description=Expires at midnight on 2018-12-31'

      See https://cloud.google.com/iam/docs/managing-policies for details of
      policy role and member types.

  iam:
    enable_condition: true