Method LeaveWorkspace

backend/api/v1/workspace_service.go:268–369

LeaveWorkspace removes the calling user from a workspace's IAM bindings, then switches to the next available workspace.

(ctx context.Context, req *connect.Request[v1pb.LeaveWorkspaceRequest])

// LeaveWorkspace removes the calling user from a workspace's IAM bindings,
// then switches to the next available workspace.
func (s *WorkspaceService) LeaveWorkspace(ctx context.Context, req *connect.Request[v1pb.LeaveWorkspaceRequest]) (*connect.Response[v1pb.LoginResponse], error) {
	user, ok := GetUserFromContext(ctx)
	if !ok || user == nil {
		return nil, connect.NewError(connect.CodeUnauthenticated, errors.New("user not found"))
	}

	workspaceID, err := common.GetWorkspaceID(req.Msg.Name)
	if err != nil {
		return nil, connect.NewError(connect.CodeInvalidArgument, err)
	}

	// Verify the user is a member of the target workspace.
	ws, err := s.store.FindWorkspace(ctx, &store.FindWorkspaceMessage{
		WorkspaceID: &workspaceID,
		Email:       user.Email,
	})
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to verify workspace membership"))
	}
	if ws == nil {
		return nil, connect.NewError(connect.CodeNotFound, errors.Errorf("not a member of workspace %q", workspaceID))
	}

	memberIdentifier := common.FormatUserEmail(user.Email)

	// Simulate removing the user from all direct IAM bindings and check
	// that at least one active admin would remain. We exclude the caller
	// from the admin list to also account for admin-via-group bindings.
	policyMessage, err := s.store.GetWorkspaceIamPolicy(ctx, workspaceID)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to get workspace IAM policy"))
	}
	simulatedPolicy := &storepb.IamPolicy{}
	for _, binding := range policyMessage.Policy.Bindings {
		var filtered []string
		for _, m := range binding.Members {
			if m != memberIdentifier {
				filtered = append(filtered, m)
			}
		}
		if len(filtered) > 0 {
			simulatedPolicy.Bindings = append(simulatedPolicy.Bindings, &storepb.Binding{
				Role:      binding.Role,
				Members:   filtered,
				Condition: binding.Condition,
			})
		}
	}
	admins := utils.GetUsersByRoleInIAMPolicy(ctx, s.store, workspaceID, store.WorkspaceAdminRole, !s.profile.SaaS, simulatedPolicy)
	// Filter out the caller — they may still appear as admin via group bindings
	// that haven't been removed yet.
	var otherAdmins []*store.UserMessage
	for _, admin := range admins {
		if admin.Email != user.Email {
			otherAdmins = append(otherAdmins, admin)
		}
	}
	if !containsActiveEndUser(otherAdmins) {