Function validateIAMPolicy

backend/api/v1/project_service.go:1070–1129

(
	ctx context.Context,
	stores *store.Store,
	allowAllUsers bool,
	msg *v1pb.SetIamPolicyRequest,
	oldPolicyMessage *store.IamPolicyMessage,
)

}

func validateIAMPolicy(
	ctx context.Context,
	stores *store.Store,
	allowAllUsers bool,
	msg *v1pb.SetIamPolicyRequest,
	oldPolicyMessage *store.IamPolicyMessage,
) error {
	if msg.Policy == nil {
		return connect.NewError(connect.CodeInvalidArgument, errors.New("IAM Policy is required"))
	}
	if len(msg.Policy.Bindings) == 0 {
		return connect.NewError(connect.CodeInvalidArgument, errors.New("IAM Binding is empty"))
	}

	workspaceProfileSetting, err := stores.GetWorkspaceProfileSetting(ctx, common.GetWorkspaceIDFromContext(ctx))
	if err != nil {
		return connect.NewError(connect.CodeInternal, errors.New("failed to get workspace profile setting"))
	}
	var maximumRequestExpiration *durationpb.Duration
	if workspaceProfileSetting != nil {
		maximumRequestExpiration = workspaceProfileSetting.MaximumRequestExpiration
	}

	roleMessages, err := stores.ListRoles(ctx, &store.FindRoleMessage{Workspace: common.GetWorkspaceIDFromContext(ctx)})
	if err != nil {
		return connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to list roles"))
	}

	existingBindings := make(map[string]bool)
	for _, oldBinding := range oldPolicyMessage.Policy.Bindings {
		identifier := getBindingIdentifier(oldBinding.Role, oldBinding.Condition)
		existingBindings[identifier] = true
	}

	bindings := []*v1pb.Binding{}
	for _, binding := range msg.Policy.Bindings {
		if len(binding.Members) == 0 {
			continue
		}

		identifier := getBindingIdentifier(binding.Role, binding.Condition)
		if !existingBindings[identifier] {
			bindings = append(bindings, binding)
		}
	}

	// If allUsers is not allowed in IAM policies, members must be explicitly added.
	if !allowAllUsers {
		for _, binding := range bindings {
			for _, member := range binding.Members {
				if member == common.AllUsers {
					return connect.NewError(connect.CodeInvalidArgument,
						errors.New("allUsers is not allowed in workspace IAM policy in SaaS mode, add members explicitly"))
				}
			}
		}
	}