getApproversForRole retrieves the list of users who have the specified role for the given project. It queries both project and workspace IAM policies. Only returns END_USER type principals (excludes service accounts, system bots, etc).
(ctx context.Context, stores *store.Store, projectID string, role string)
| 1024 | // for the given project. It queries both project and workspace IAM policies. |
| 1025 | // Only returns END_USER type principals (excludes service accounts, system bots, etc). |
| 1026 | func getApproversForRole(ctx context.Context, stores *store.Store, projectID string, role string) ([]webhook.User, error) { |
| 1027 | // Get project to determine workspace |
| 1028 | project, err := stores.GetProjectByResourceID(ctx, projectID) |
| 1029 | if err != nil { |
| 1030 | return nil, errors.Wrap(err, "failed to get project") |
| 1031 | } |
| 1032 | if project == nil { |
| 1033 | return nil, errors.Errorf("project %s not found", projectID) |
| 1034 | } |
| 1035 | |
| 1036 | // Get project IAM policy |
| 1037 | projectIAM, err := stores.GetProjectIamPolicy(ctx, project.Workspace, projectID) |
| 1038 | if err != nil { |
| 1039 | return nil, errors.Wrap(err, "failed to get project IAM policy") |
| 1040 | } |
| 1041 | |
| 1042 | // Get workspace IAM policy |
| 1043 | workspaceIAM, err := stores.GetWorkspaceIamPolicy(ctx, project.Workspace) |
| 1044 | if err != nil { |
| 1045 | return nil, errors.Wrap(err, "failed to get workspace IAM policy") |
| 1046 | } |
| 1047 | |
| 1048 | // Get all users with the specified role |
| 1049 | users := utils.GetUsersByRoleInIAMPolicy( |
| 1050 | ctx, |
| 1051 | stores, |
| 1052 | project.Workspace, |
| 1053 | role, |
| 1054 | // TODO(ed): tmp hack |
| 1055 | // It's not allowed set AllUsers in the IAM, so will not break the new SaaS workflow. |
| 1056 | true, |
| 1057 | projectIAM.Policy, |
| 1058 | workspaceIAM.Policy, |
| 1059 | ) |
| 1060 | |
| 1061 | // Convert to webhook.User format, filtering by END_USER principal type |
| 1062 | approvers := make([]webhook.User, 0, len(users)) |
| 1063 | for _, user := range users { |
| 1064 | // Only include END_USER principals as approvers |
| 1065 | if user.Type != storepb.PrincipalType_END_USER { |
| 1066 | continue |
| 1067 | } |
| 1068 | approvers = append(approvers, webhook.User{ |
| 1069 | Name: user.Name, |
| 1070 | Email: user.Email, |
| 1071 | Phone: user.Phone, |
| 1072 | }) |
| 1073 | } |
| 1074 | |
| 1075 | return approvers, nil |
| 1076 | } |
| 1077 | |
| 1078 | // NotifyApprovalRequested sends the ISSUE_APPROVAL_REQUESTED webhook event for the next pending approval stage. |
| 1079 | // It finds the next pending role, retrieves approvers for that role, and triggers the webhook. |
no test coverage detected