Method buildIssueMessage

backend/api/v1/issue_service.go:434–577

(ctx context.Context, project *store.ProjectMessage, userEmail string, request *v1pb.CreateIssueRequest, labels []string)

}

func (s *IssueService) buildIssueMessage(ctx context.Context, project *store.ProjectMessage, userEmail string, request *v1pb.CreateIssueRequest, labels []string) (*store.IssueMessage, error) {
	var planUID *int64
	var roleGrant *storepb.RoleGrant
	var title, description string

	// Type-specific validation and preparation
	switch request.Issue.Type {
	case v1pb.Issue_DATABASE_EXPORT:
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("data export issue creation is no longer supported"))

	case v1pb.Issue_ROLE_GRANT:
		// Title is required for role grant requests.
		if strings.TrimSpace(request.Issue.Title) == "" {
			return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("issue title is required"))
		}

		// Check if role grant workflow feature is enabled.
		if err := s.licenseService.IsFeatureEnabled(ctx, common.GetWorkspaceIDFromContext(ctx), v1pb.PlanFeature_FEATURE_REQUEST_ROLE_WORKFLOW); err != nil {
			return nil, connect.NewError(connect.CodePermissionDenied,
				errors.Errorf("role request requires approval workflow feature (available in Enterprise plan)"))
		}

		// Validate role grant fields.
		if request.Issue.RoleGrant.GetRole() == "" {
			return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("expect role grant role"))
		}
		if request.Issue.RoleGrant.GetUser() == "" {
			return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("expect role grant user"))
		}

		// Validate CEL expression if it's not empty.
		if expression := request.Issue.RoleGrant.GetCondition().GetExpression(); expression != "" {
			e, err := cel.NewEnv(common.IAMPolicyConditionCELAttributes...)
			if err != nil {
				return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to create cel environment"))
			}
			if _, issues := e.Compile(expression); issues != nil {
				return nil, connect.NewError(connect.CodeInvalidArgument, errors.Errorf("found issues in role grant condition expression, issues: %v", issues.String()))
			}
		}

		// Enforce the workspace maximum request expiration cap (project owner is
		// exempt), mirroring SetIamPolicy. The role grant's condition carries the
		// `request.time < timestamp(...)` clause that becomes the IAM binding, so
		// validating it here also rejects a missing expiration when a cap is set.
		if request.Issue.RoleGrant.GetRole() != fmt.Sprintf("roles/%s", store.ProjectOwnerRole) {
			workspaceProfileSetting, err := s.store.GetWorkspaceProfileSetting(ctx, common.GetWorkspaceIDFromContext(ctx))
			if err != nil {
				return nil, connect.NewError(connect.CodeInternal, errors.New("failed to get workspace profile setting"))
			}
			if maximumRequestExpiration := workspaceProfileSetting.GetMaximumRequestExpiration(); maximumRequestExpiration != nil {
				if err := validateExpirationInExpression(request.Issue.RoleGrant.GetCondition().GetExpression(), maximumRequestExpiration); err != nil {
					return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrapf(err, "failed to validate role expiration"))
				}
			}
		}

		roleGrantUserEmail, err := common.GetUserEmail(request.Issue.RoleGrant.User)