Method SetIamPolicy

backend/api/v1/workspace_service.go:371–468

(ctx context.Context, req *connect.Request[v1pb.SetIamPolicyRequest])

}

func (s *WorkspaceService) SetIamPolicy(ctx context.Context, req *connect.Request[v1pb.SetIamPolicyRequest]) (*connect.Response[v1pb.IamPolicy], error) {
	request := req.Msg

	workspaceID := common.GetWorkspaceIDFromContext(ctx)
	policyMessage, err := s.store.GetWorkspaceIamPolicy(ctx, workspaceID)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to find workspace iam policy"))
	}
	if request.Etag != "" && request.Etag != policyMessage.Etag {
		return nil, connect.NewError(connect.CodeAborted, errors.New("there is concurrent update to the workspace iam policy, please refresh and try again"))
	}

	if err := validateIAMPolicy(ctx, s.store, !s.profile.SaaS, request, policyMessage); err != nil {
		return nil, err
	}

	iamPolicy, err := convertToStoreIamPolicy(request.Policy)
	if err != nil {
		return nil, err
	}

	users := utils.GetUsersByRoleInIAMPolicy(
		ctx,
		s.store,
		common.GetWorkspaceIDFromContext(ctx),
		store.WorkspaceAdminRole,
		!s.profile.SaaS,
		iamPolicy,
	)
	if !containsActiveEndUser(users) {
		return nil, connect.NewError(connect.CodeInvalidArgument, errors.New("workspace must have at least one admin"))
	}

	// Guard: count user seats in the new policy BEFORE saving. Only reject when this
	// change increases the user seat count beyond the limit. Over-limit workspaces (e.g.
	// after a license downgrade) may still hold steady or reduce seats, and seat-neutral
	// edits such as adding a service account or workload identity are always allowed
	// because those members do not occupy a seat.
	userLimit := s.licenseService.GetUserLimit(ctx, workspaceID)
	newCount, err := countUsersInIamPolicy(ctx, s.store, workspaceID, iamPolicy, s.profile.SaaS)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to count users in IAM policy"))
	}
	if newCount > userLimit {
		oldCount, err := countUsersInIamPolicy(ctx, s.store, workspaceID, policyMessage.Policy, s.profile.SaaS)
		if err != nil {
			return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err, "failed to count users in current IAM policy"))
		}
		if newCount > oldCount {
			return nil, connect.NewError(connect.CodeResourceExhausted, errors.Errorf("workspace has %d users, exceeding the limit of %d", newCount, userLimit))
		}
	}

	payloadBytes, err := protojson.Marshal(iamPolicy)
	if err != nil {
		return nil, connect.NewError(connect.CodeInternal, errors.Wrapf(err, "failed to marshal iam policy"))
	}
	patch := &store.UpdatePolicyMessage{