userCountGuard checks seat limits before adding a new IAM member (e.g. SSO login). Uses >= because the new user has not been counted yet. If policy is nil, reads the current workspace IAM policy.
(ctx context.Context, s *store.Store, licenseService *enterprise.LicenseService, workspaceID string, policy *storepb.IamPolicy, saas bool)
| 920 | // Uses >= because the new user has not been counted yet. |
| 921 | // If policy is nil, reads the current workspace IAM policy. |
| 922 | func userCountGuard(ctx context.Context, s *store.Store, licenseService *enterprise.LicenseService, workspaceID string, policy *storepb.IamPolicy, saas bool) error { |
| 923 | if policy == nil { |
| 924 | p, err := s.GetWorkspaceIamPolicy(ctx, workspaceID) |
| 925 | if err != nil { |
| 926 | return connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to get workspace IAM policy")) |
| 927 | } |
| 928 | policy = p.Policy |
| 929 | } |
| 930 | userLimit := licenseService.GetUserLimit(ctx, workspaceID) |
| 931 | count, err := countUsersInIamPolicy(ctx, s, workspaceID, policy, saas) |
| 932 | if err != nil { |
| 933 | return connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to count users in IAM policy")) |
| 934 | } |
| 935 | if count >= userLimit { |
| 936 | return connect.NewError(connect.CodeResourceExhausted, errors.Errorf("workspace has %d users, reaching the limit of %d", count, userLimit)) |
| 937 | } |
| 938 | return nil |
| 939 | } |
| 940 | |
| 941 | // preAddUserGuard checks seat limits before creating a principal. |
| 942 | // Only enforces when the IAM policy contains allUsers, because without allUsers |
no test coverage detected