docs: Add more details for BidiReadObjectRedirectedError and BidiWriteObjectRedirectedError

Google APIs · copybara-github · commit b795b2b094a0 · 2025-07-07T13:53:01.000-07:00
docs: Add more information for AppendObjectSpec fields
fix!: Remove field `restricted` within encryption enforcement config.
feat: Add new field `restriction_mode` for encryption enforcement config in message Bucket

PiperOrigin-RevId: 780246504
diff --git a/google/storage/v2/storage.proto b/google/storage/v2/storage.proto
@@ -1076,30 +1076,35 @@ message BidiReadObjectResponse {
   BidiReadHandle read_handle = 7;
 }
 
-// Error proto containing details for a redirected read. This error is only
-// returned on initial open in case of a redirect.
+// Error proto containing details for a redirected read. This error may be
+// attached as details for an ABORTED response to BidiReadObject.
 message BidiReadObjectRedirectedError {
-  // The read handle for the redirected read. The client can use this for the
-  // subsequent open.
+  // The read handle for the redirected read. If set, the client may use this in
+  // the BidiReadObjectSpec when retrying the read stream.
   BidiReadHandle read_handle = 1;
 
-  // The routing token that should be used when reopening the read stream.
+  // The routing token the client must use when retrying the read stream.
+  // This value must be provided in the header `x-goog-request-params`, with key
+  // `routing_token` and this string verbatim as the value.
   optional string routing_token = 2;
 }
 
-// Error proto containing details for a redirected write. This error is only
-// returned on initial open in case of a redirect.
+// Error proto containing details for a redirected write. This error may be
+// attached as details for an ABORTED response to BidiWriteObject.
 message BidiWriteObjectRedirectedError {
-  // The routing token that should be used when reopening the write stream.
+  // The routing token the client must use when retrying the write stream.
+  // This value must be provided in the header `x-goog-request-params`, with key
+  // `routing_token` and this string verbatim as the value.
   optional string routing_token = 1;
 
-  // Opaque value describing a previous write.
+  // Opaque value describing a previous write. If set, the client must use this
+  // in an AppendObjectSpec first_message when retrying the write stream. If not
+  // set, clients may retry the original request.
   optional BidiWriteHandle write_handle = 2;
 
-  // The generation of the object that triggered the redirect.
-  // Note that if this error was returned as part of an appendable object
-  // create, this object generation is now successfully created and
-  // append_object_spec should be used when reconnecting.
+  // The generation of the object that triggered the redirect. This will be set
+  // iff write_handle is set. If set, the client must use this in an
+  // AppendObjectSpec first_message when retrying the write stream.
   optional int64 generation = 3;
 }
 
@@ -1309,10 +1314,16 @@ message AppendObjectSpec {
 
   // Makes the operation conditional on whether the object's current
   // metageneration matches the given value.
+  //
+  // Note that metageneration preconditions are only checked if `write_handle`
+  // is empty.
   optional int64 if_metageneration_match = 4;
 
   // Makes the operation conditional on whether the object's current
   // metageneration does not match the given value.
+  //
+  // Note that metageneration preconditions are only checked if `write_handle`
+  // is empty.
   optional int64 if_metageneration_not_match = 5;
 
   // An optional routing token that influences request routing for the stream.
@@ -1321,6 +1332,9 @@ message AppendObjectSpec {
 
   // An optional write handle returned from a previous BidiWriteObjectResponse
   // message or a BidiWriteObjectRedirectedError error.
+  //
+  // Note that metageneration preconditions are only checked if `write_handle`
+  // is empty.
   optional BidiWriteHandle write_handle = 7;
 }
 
@@ -2000,38 +2014,42 @@ message Bucket {
   message Encryption {
     // Google Managed Encryption (GMEK) enforcement config of a bucket.
     message GoogleManagedEncryptionEnforcementConfig {
-      // Whether Google Managed Encryption (GMEK) is restricted for new
-      // objects within the bucket.
-      // If true, new objects can't be created using GMEK encryption.
-      // If false or unset, creation of new objects with GMEK encryption is
-      // allowed.
-      optional bool restricted = 1;
+      // Restriction mode for google-managed encryption for new objects within
+      // the bucket. Valid values are: "NotRestricted", "FullyRestricted".
+      // If `NotRestricted` or unset, creation of new objects with
+      // google-managed encryption is allowed.
+      // If `FullyRestricted`, new objects can't be created using google-managed
+      // encryption.
+      optional string restriction_mode = 3;
 
       // Time from which the config was effective. This is service-provided.
       optional google.protobuf.Timestamp effective_time = 2;
     }
 
     // Customer Managed Encryption (CMEK) enforcement config of a bucket.
     message CustomerManagedEncryptionEnforcementConfig {
-      // Whether Customer Managed Encryption (CMEK) is restricted for new
-      // objects within the bucket.
-      // If true, new objects can't be created using CMEK encryption.
-      // If false or unset, creation of new objects with CMEK encryption is
-      // allowed.
-      optional bool restricted = 1;
+      // Restriction mode for customer-managed encryption for new objects within
+      // the bucket. Valid values are: "NotRestricted", "FullyRestricted".
+      // If `NotRestricted` or unset, creation of new objects with
+      // customer-managed encryption is allowed.
+      // If `FullyRestricted`, new objects can't be created using
+      // customer-managed encryption.
+      optional string restriction_mode = 3;
 
       // Time from which the config was effective. This is service-provided.
       optional google.protobuf.Timestamp effective_time = 2;
     }
 
     // Customer Supplied Encryption (CSEK) enforcement config of a bucket.
     message CustomerSuppliedEncryptionEnforcementConfig {
-      // Whether Customer Supplied Encryption (CSEK) is restricted for new
-      // objects within the bucket.
-      // If true, new objects can't be created using CSEK encryption.
-      // If false or unset, creation of new objects with CSEK encryption is
-      // allowed.
-      optional bool restricted = 1;
+      // Restriction mode for customer-supplied encryption for new objects
+      // within the bucket. Valid values are: "NotRestricted",
+      // "FullyRestricted".
+      // If `NotRestricted` or unset, creation of new objects with
+      // customer-supplied encryption is allowed.
+      // If `FullyRestricted`, new objects can't be created using
+      // customer-supplied encryption.
+      optional string restriction_mode = 3;
 
       // Time from which the config was effective. This is service-provided.
       optional google.protobuf.Timestamp effective_time = 2;
