resolveWorkspaceForLogin determines the workspace for a login token. For SA/WI: looks up the account record to get workspace. For END_USER: resolution order: 1. preferredWorkspaceID (from the login request's ?workspace= hint, e.g. invite links) 2. Last login workspace (from user profile) 3. First wo
(ctx context.Context, user *store.UserMessage, preferredWorkspaceID string)
| 1086 | // |
| 1087 | // Each candidate is validated for membership before use. |
| 1088 | func (s *AuthService) resolveWorkspaceForLogin(ctx context.Context, user *store.UserMessage, preferredWorkspaceID string) (string, error) { |
| 1089 | // Determine member name format based on user type. |
| 1090 | switch user.Type { |
| 1091 | case storepb.PrincipalType_SERVICE_ACCOUNT: |
| 1092 | // SA has workspace on its record — look it up directly. |
| 1093 | sa, err := s.store.GetServiceAccountByEmail(ctx, user.Email) |
| 1094 | if err != nil { |
| 1095 | return "", errors.Wrap(err, "failed to get service account") |
| 1096 | } |
| 1097 | if sa != nil { |
| 1098 | return sa.Workspace, nil |
| 1099 | } |
| 1100 | return "", errors.Errorf("service account %q not found", user.Email) |
| 1101 | case storepb.PrincipalType_END_USER: |
| 1102 | includeAllUser := !s.profile.SaaS |
| 1103 | |
| 1104 | // Prefer the workspace from the login request hint (e.g. invite link). |
| 1105 | if preferredWorkspaceID != "" { |
| 1106 | ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{ |
| 1107 | WorkspaceID: &preferredWorkspaceID, |
| 1108 | Email: user.Email, |
| 1109 | IncludeAllUser: includeAllUser, |
| 1110 | }) |
| 1111 | if err != nil { |
| 1112 | return "", errors.Wrap(err, "failed to find workspace") |
| 1113 | } |
| 1114 | if ws != nil { |
| 1115 | return ws.ResourceID, nil |
| 1116 | } |
| 1117 | // Not a member of preferred workspace — fall through. |
| 1118 | } |
| 1119 | |
| 1120 | // Prefer the last login workspace if it's still valid. |
| 1121 | if lastWS := user.Profile.GetLastLoginWorkspace(); lastWS != "" { |
| 1122 | ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{ |
| 1123 | WorkspaceID: &lastWS, |
| 1124 | Email: user.Email, |
| 1125 | IncludeAllUser: includeAllUser, |
| 1126 | }) |
| 1127 | if err != nil { |
| 1128 | return "", errors.Wrap(err, "failed to find workspace") |
| 1129 | } |
| 1130 | if ws != nil { |
| 1131 | return ws.ResourceID, nil |
| 1132 | } |
| 1133 | // Last login workspace no longer valid — fall through to default. |
| 1134 | } |
| 1135 | |
| 1136 | // Use the first workspace the user is a member of. |
| 1137 | ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{ |
| 1138 | Email: user.Email, |
| 1139 | IncludeAllUser: includeAllUser, |
| 1140 | }) |
| 1141 | if err != nil { |
| 1142 | return "", errors.Wrap(err, "failed to find workspace") |
| 1143 | } |
| 1144 | if ws == nil { |
| 1145 | return "", nil |
no test coverage detected