Function checkProjectIAMPolicyWithExpr

frontend/src/utils/v1/iam.ts:221–250

(
  user: User,
  project: Project,
  requiredPermissions: QueryPermission[],
  bindingExprCheck: (expr?: Expr) => boolean
)

// policy + roles) via the util bridge — relocated from the deleted Pinia
// `projectIamPolicy` store, whose data was never populated in the React shell.
const checkProjectIAMPolicyWithExpr = (
  user: User,
  project: Project,
  requiredPermissions: QueryPermission[],
  bindingExprCheck: (expr?: Expr) => boolean
): boolean => {
  const policy = appStoreUtilBridge()?.getProjectIamPolicy(project.name);
  if (!policy) {
    return false;
  }
  for (const binding of policy.bindings) {
    const nameList = getUserListInBinding({ binding, ignoreGroup: false });
    if (
      !nameList.includes(getUserFullNameByType(user)) &&
      !nameList.includes(`${userNamePrefix}${ALL_USERS_USER_EMAIL}`)
    ) {
      continue;
    }
    const permissions =
      appStoreUtilBridge()?.getRoleByName(binding.role)?.permissions || [];
    for (const permission of permissions) {
      if (requiredPermissions.includes(permission as QueryPermission)) {
        if (bindingExprCheck(binding.parsedExpr)) {
          return true;
        }
      }
    }
  }
  return false;
};

export const checkQuerierPermission = (
  database: Database,