MemberContainsUser checks if a member (user, service account, workload identity, or group) contains the specified user. The member should be in users/{email}, serviceAccounts/{email}, workloadIdentities/{email}, or groups/{email} format.
(ctx context.Context, stores *store.Store, workspace string, member string, user *store.UserMessage)
| 220 | // MemberContainsUser checks if a member (user, service account, workload identity, or group) contains the specified user. |
| 221 | // The member should be in users/{email}, serviceAccounts/{email}, workloadIdentities/{email}, or groups/{email} format. |
| 222 | func MemberContainsUser(ctx context.Context, stores *store.Store, workspace string, member string, user *store.UserMessage) bool { |
| 223 | if member == common.AllUsers { |
| 224 | return true |
| 225 | } |
| 226 | |
| 227 | // Check if member is a user |
| 228 | if strings.HasPrefix(member, common.UserNamePrefix) { |
| 229 | memberEmail, err := common.GetUserEmail(member) |
| 230 | if err != nil { |
| 231 | slog.Error("failed to parse user email", slog.String("member", member), log.BBError(err)) |
| 232 | return false |
| 233 | } |
| 234 | return memberEmail == user.Email |
| 235 | } |
| 236 | |
| 237 | // Check if member is a service account |
| 238 | if strings.HasPrefix(member, common.ServiceAccountNamePrefix) { |
| 239 | memberEmail, err := common.GetServiceAccountEmail(member) |
| 240 | if err != nil { |
| 241 | slog.Error("failed to parse service account email", slog.String("member", member), log.BBError(err)) |
| 242 | return false |
| 243 | } |
| 244 | return memberEmail == user.Email |
| 245 | } |
| 246 | |
| 247 | // Check if member is a workload identity |
| 248 | if strings.HasPrefix(member, common.WorkloadIdentityNamePrefix) { |
| 249 | memberEmail, err := common.GetWorkloadIdentityEmail(member) |
| 250 | if err != nil { |
| 251 | slog.Error("failed to parse workload identity email", slog.String("member", member), log.BBError(err)) |
| 252 | return false |
| 253 | } |
| 254 | return memberEmail == user.Email |
| 255 | } |
| 256 | |
| 257 | // Check if member is a group |
| 258 | if strings.HasPrefix(member, common.GroupPrefix) { |
| 259 | group, err := stores.GetGroupByName(ctx, workspace, member) |
| 260 | if err != nil { |
| 261 | slog.Error("failed to get group", slog.String("group", member), log.BBError(err)) |
| 262 | return false |
| 263 | } |
| 264 | if group == nil { |
| 265 | slog.Error("cannot find group", slog.String("group", member)) |
| 266 | return false |
| 267 | } |
| 268 | userMemberName := formatMemberNameByType(user) |
| 269 | for _, groupMember := range group.Payload.Members { |
| 270 | if userMemberName == groupMember.Member { |
| 271 | return true |
| 272 | } |
| 273 | } |
| 274 | } |
| 275 | |
| 276 | return false |
| 277 | } |
| 278 | |
| 279 | // GetUserRolesInIamPolicy returns the `uniq`ed roles of a user, including workspace roles and the roles in the projects. |
no test coverage detected