Function getUserListInBinding

frontend/src/utils/v1/iam.ts:103–144

({
  binding,
  ignoreGroup,
  getGroupByIdentifier,
}: {
  binding: Binding;
  ignoreGroup: boolean;
  // Resolves a group from its binding member string. Defaults to the Pinia
  // group store; React callers pass a resolver backed by the app store so
  // group expansion reads from the same cache they populate.
  getGroupByIdentifier?: (identifier: string) => Group | undefined;
})

// - serviceAccounts/{email}
// - workloadIdentities/{email}
export const getUserListInBinding = ({
  binding,
  ignoreGroup,
  getGroupByIdentifier,
}: {
  binding: Binding;
  ignoreGroup: boolean;
  // Resolves a group from its binding member string. Defaults to the Pinia
  // group store; React callers pass a resolver backed by the app store so
  // group expansion reads from the same cache they populate.
  getGroupByIdentifier?: (identifier: string) => Group | undefined;
}): string[] => {
  if (isBindingPolicyExpired(binding)) {
    return [];
  }

  const resolveGroup =
    getGroupByIdentifier ??
    ((identifier: string) =>
      appStoreUtilBridge()?.getGroupByIdentifier(identifier));
  const fullnameList = [];

  for (const member of binding.members) {
    const fullname = convertMemberToFullname(member);
    if (fullname.startsWith(groupNamePrefix)) {
      if (ignoreGroup) {
        continue;
      }
      const group = resolveGroup(member);
      if (!group) {
        continue;
      }
      for (const groupMember of group.members) {
        // the group member MUST be human.
        fullnameList.push(ensureUserFullName(groupMember.member));
      }
    } else {
      fullnameList.push(fullname);
    }
  }
  return uniq(fullnameList);
};

// memberMapToRolesInProjectIAM return the Map<users/{email}, Set<roles/{role}>>
// the user could includes users/ALL_USERS_USER_EMAIL