Method OrganizationPermissionsForUser

admin/permissions.go:12–37

OrganizationPermissionsForUser resolves organization permissions for a user.

(ctx context.Context, orgID, userID string)

// OrganizationPermissionsForUser resolves organization permissions for a user.
func (s *Service) OrganizationPermissionsForUser(ctx context.Context, orgID, userID string) (*adminv1.OrganizationPermissions, error) {
	roles, err := s.DB.ResolveOrganizationRolesForUser(ctx, userID, orgID)
	if err != nil {
		return nil, err
	}

	composite := &adminv1.OrganizationPermissions{}
	for _, role := range roles {
		composite = UnionOrgRoles(composite, role)
	}

	// If the org has a public project, all users get read access to it.
	if !composite.ReadOrg {
		ok, err := s.DB.CheckOrganizationHasPublicProjects(ctx, orgID)
		if err != nil {
			return nil, err
		}
		if ok {
			composite.Guest = true
			composite.ReadOrg = true
			composite.ReadProjects = true
		}
	}

	return composite, nil
}

// OrganizationPermissionsForService resolves organization permissions for a service.
// If the service has roles, it uses those roles to determine permissions. If no role is found, it falls back to the legacy behavior of giving full permissions to services in their org.