Method getResourceRestrictionsForUser

admin/server/deployment.go:908–940

getResourceRestrictionsForUser returns resource restrictions for a given user and project.

(ctx context.Context, projID, userID string)

// getResourceRestrictionsForUser returns resource restrictions for a given user and project.
func (s *Server) getResourceRestrictionsForUser(ctx context.Context, projID, userID string) (bool, []database.ResourceName, error) {
	mu, err := s.admin.DB.FindProjectMemberUser(ctx, projID, userID)
	if err != nil && !errors.Is(err, database.ErrNotFound) {
		return false, nil, err
	}
	mug, err := s.admin.DB.FindProjectMemberUsergroupsForUser(ctx, projID, userID)
	if err != nil {
		return false, nil, err
	}
	restrictResources := mu != nil || len(mug) > 0
	var resources []database.ResourceName
	if mu != nil {
		restrictResources = restrictResources && mu.RestrictResources
		resources = append(resources, mu.Resources...)
	}
	if len(mug) > 0 {
		for _, g := range mug {
			restrictResources = restrictResources && g.RestrictResources
			resources = append(resources, g.Resources...)
		}
	}

	var mergedResources []database.ResourceName
	seen := make(map[database.ResourceName]struct{})
	for _, r := range resources {
		if _, ok := seen[r]; !ok {
			seen[r] = struct{}{}
			mergedResources = append(mergedResources, r)
		}
	}

	return restrictResources, mergedResources, nil
}

// subjectForExternalUser generates a safe subject from an external user ID accessing a deployment in the specified project.
// The result is safe to use as a JWT subject and in telemetry (where we need to avoid collisions and PII).