Method preAddUserGuard

backend/api/v1/user_service.go:944–953

preAddUserGuard checks seat limits before creating a principal. Only enforces when the IAM policy contains allUsers, because without allUsers a new principal does not occupy a seat until explicitly added to IAM.

(ctx context.Context, workspaceID string)

// Only enforces when the IAM policy contains allUsers, because without allUsers
// a new principal does not occupy a seat until explicitly added to IAM.
func (s *UserService) preAddUserGuard(ctx context.Context, workspaceID string) error {
	p, err := s.store.GetWorkspaceIamPolicy(ctx, workspaceID)
	if err != nil {
		return connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to get workspace IAM policy"))
	}
	if !policyContainsAllUsers(p.Policy) {
		return nil
	}
	return userCountGuard(ctx, s.store, s.licenseService, workspaceID, p.Policy, s.profile.SaaS)
}

// preUndeleteUserGuard checks seat limits before reactivating a principal.
// A soft-deleted principal does not occupy a seat, so undeleting one that is