Add verification status method option (#183)

* Add verification_status option to MethodOptions and apply to services

Introduce VerificationStatus enum on MethodOptions to enforce client
verification requirements at the method level. Apply VERIFIED status to
CreateLimitOrder and all AccountService methods. Fix typo in enum value
(VEFRIFIED -> VERIFIED).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add GetGroupClient method and fix swapped request message comments

- Add GetGroupClient RPC to ClientService for looking up a client by
  its owning group resource name
- Fix swapped comments on GetClientRequest and CreateClientRequest
  message definitions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: BRBussy

go/option/method_options/v1/method_options.pb.go

@@ -46,6 +46,23 @@ service ClientService {
     };
   }
 
+  // GetGroupClient retrieves the client compliance profile associated with a specific group.
+  //
+  // This allows fetching the compliance details of the client that is owned by
+  // the specified group, using the group's resource name as the lookup key.
+  rpc GetGroupClient(GetGroupClientRequest) returns (meshtrade.compliance.client.v1.Client) {
+    option (meshtrade.option.method_options.v1.method_options) = {
+      type: METHOD_TYPE_READ
+      access_level: METHOD_ACCESS_LEVEL_AUTHORISED
+      roles: [
+        ROLE_COMPLIANCE_ADMIN,
+        ROLE_COMPLIANCE_VIEWER,
+        ROLE_COMPLIANCE_CLIENT_ADMIN,
+        ROLE_COMPLIANCE_CLIENT_VIEWER
+      ]
+    };
+  }
+
   // ListClients retrieves a collection of client compliance profiles.
   //
   // This method is useful for fetching multiple client records at once.
@@ -64,7 +81,7 @@ service ClientService {
   }
 }
 
-// CreateClientRequest is the message used to create a single client resource.
+// GetClientRequest is the message used to request a single client resource.
 message GetClientRequest {
   // The unique resource name of the client to be retrieved.
   // The name serves as the primary identifier for the client resource.
@@ -78,12 +95,25 @@ message GetClientRequest {
   }];
 }
 
-// GetClientRequest is the message used to request a single client resource.
+// CreateClientRequest is the message used to create a single client resource.
 message CreateClientRequest {
   // Client is the client resource to create.
   meshtrade.compliance.client.v1.Client client = 1 [(buf.validate.field) = {required: true}];
 }
 
+// GetGroupClientRequest is the message used to request a client resource by its owning group.
+message GetGroupClientRequest {
+  // The resource name of the group whose client is to be retrieved.
+  // Format: "groups/{group_id}"
+  string group = 1 [(buf.validate.field) = {
+    required: true
+    string: {
+      len: 33
+      pattern: "^groups/[0123456789ABCDEFGHJKMNPQRSTVWXYZ]{26}$"
+    }
+  }];
+}
+
 // ListClientsRequest is the message used to request a list of client resources.
 message ListClientsRequest {}
 

go/trading/limit_order/v1/service.pb.go

@@ -66,6 +66,22 @@ enum MethodAccessLevel {
   METHOD_ACCESS_LEVEL_AUTHORISED = 2;
 }
 
+/*
+   VerificationStatus defines what client verification status is required for access to a method.
+*/
+enum VerificationStatus {
+  /*
+     Default value, should not be used.
+  */
+  VERIFICATION_STATUS_UNSPECIFIED = 0;
+
+  /*
+     Service only accessible if the verification status of the client to which the executing (API)User
+     is Verified.
+  */
+  VERIFICATION_STATUS_VERIFIED = 1;
+}
+
 /*
    MethodOptions consolidates three authorization dimensions for RPC methods.
 */
@@ -84,8 +100,15 @@ message MethodOptions {
   /*
      Roles that grant access to this method.
      Used for access control checking if group header is required and/or given.
+     Optional: Only required when access level is AUTHORISED.
   */
   repeated meshtrade.iam.role.v1.Role roles = 3;
+
+  /*
+     Verification status defines what client verification status is required for access to a method.
+     Optional: If not specified on a method then the method is accessible with any verification status.
+  */
+  VerificationStatus verification_status = 4;
 }
 
 /*

go/wallet/account/v1/service.pb.go

@@ -34,6 +34,7 @@ service LimitOrderService {
         ROLE_TRADING_ADMIN,
         ROLE_TRADING_LIMIT_ORDER_ADMIN
       ]
+      verification_status: VERIFICATION_STATUS_VERIFIED
     };
   }