Method hasExtraWorkspaceAdmin

backend/api/v1/user_service.go:566–596

(ctx context.Context, policy *storepb.IamPolicy, user *store.UserMessage)

}

func (s *UserService) hasExtraWorkspaceAdmin(ctx context.Context, policy *storepb.IamPolicy, user *store.UserMessage) (bool, error) {
	workspaceAdminRole := common.FormatRole(store.WorkspaceAdminRole)
	userMember := common.FormatUserEmail(user.Email)

	for _, binding := range policy.GetBindings() {
		if binding.GetRole() != workspaceAdminRole {
			continue
		}
		for _, member := range binding.GetMembers() {
			if member == userMember {
				continue
			}
			if member == common.AllUsers && !s.profile.SaaS {
				// allUsers means every user is an admin. Count all active end users
				// (not just workspace members) since allUsers includes everyone.
				count, err := s.store.CountActivePrincipals(ctx)
				if err != nil {
					return false, err
				}
				return count > 1, nil
			}
			users := utils.GetUsersByMember(ctx, s.store, common.GetWorkspaceIDFromContext(ctx), member)
			for _, user := range users {
				if !user.MemberDeleted && user.Type == storepb.PrincipalType_END_USER {
					return true, nil
				}
			}
		}
	}
	return false, nil
}

// UndeleteUser undeletes a user.
func (s *UserService) UndeleteUser(ctx context.Context, request *connect.Request[v1pb.UndeleteUserRequest]) (*connect.Response[v1pb.User], error) {