Method verifyWorkspaceMembership

backend/api/auth/auth.go:233–272

verifyWorkspaceMembership checks that the account is a member of the workspace.

(ctx context.Context, workspaceID string, account *store.AccountMessage)

// verifyWorkspaceMembership checks that the account is a member of the workspace.
func (in *APIAuthInterceptor) verifyWorkspaceMembership(ctx context.Context, workspaceID string, account *store.AccountMessage) error {
	switch account.Type {
	case storepb.PrincipalType_SERVICE_ACCOUNT, storepb.PrincipalType_WORKLOAD_IDENTITY:
		// Service accounts and workload identities have workspace on their record.
		if account.Workspace != workspaceID {
			return errs.Errorf("principal %q does not belong to workspace %q", account.Email, workspaceID)
		}
		return nil

	case storepb.PrincipalType_END_USER:
		// END_USER membership is verified via workspace IAM policy.
		// Check direct membership, group membership, and allUsers.
		iamPolicy, err := in.store.GetWorkspaceIamPolicy(ctx, workspaceID)
		if err != nil {
			return errs.Wrap(err, "failed to get workspace IAM policy")
		}
		userMember := common.FormatUserEmail(account.Email)
		for _, binding := range iamPolicy.Policy.Bindings {
			for _, member := range binding.Members {
				if member == userMember {
					return nil
				}
				if member == common.AllUsers && !in.profile.SaaS {
					return nil
				}
				// Check group membership.
				if strings.HasPrefix(member, common.GroupPrefix) {
					groupMembers, _ := in.store.GetGroupMembersSnapshot(ctx, workspaceID, member)
					if groupMembers != nil && groupMembers[userMember] {
						return nil
					}
				}
			}
		}
		return errs.Errorf("user %q is not a member of workspace %q", account.Email, workspaceID)

	default:
		return errs.Errorf("unknown principal type %v", account.Type)
	}
}

// authenticateConnect is a ConnectRPC-specific version that returns ConnectRPC errors.
func (in *APIAuthInterceptor) authenticateConnect(ctx context.Context, accessTokenStr string) (*store.UserMessage, *claimsMessage, error) {