Method RequestProjectAccess

admin/server/projects.go:1549–1619

(ctx context.Context, req *adminv1.RequestProjectAccessRequest)

}

func (s *Server) RequestProjectAccess(ctx context.Context, req *adminv1.RequestProjectAccessRequest) (*adminv1.RequestProjectAccessResponse, error) {
	observability.AddRequestAttributes(ctx,
		attribute.String("args.org", req.Org),
		attribute.String("args.project", req.Project),
	)

	proj, err := s.admin.DB.FindProjectByName(ctx, req.Org, req.Project)
	if err != nil {
		return nil, err
	}

	claims := auth.GetClaims(ctx)
	projectPermissions := claims.ProjectPermissions(ctx, proj.OrganizationID, proj.ID)
	if (req.Role != database.ProjectRoleNameAdmin && projectPermissions.ReadProject) ||
		(req.Role == database.ProjectRoleNameAdmin && projectPermissions.ManageProject) {
		return nil, status.Error(codes.FailedPrecondition, "already have access to project")
	}

	if claims.OwnerType() != auth.OwnerTypeUser {
		return nil, status.Error(codes.PermissionDenied, "only users can request access")
	}

	user, err := s.admin.DB.FindUser(ctx, claims.OwnerID())
	if err != nil {
		return nil, err
	}

	org, err := s.admin.DB.FindOrganization(ctx, proj.OrganizationID)
	if err != nil {
		return nil, err
	}

	existing, err := s.admin.DB.FindProjectAccessRequest(ctx, proj.ID, user.ID)
	if err != nil && !errors.Is(err, database.ErrNotFound) {
		return nil, err
	}
	if existing != nil {
		return nil, status.Error(codes.AlreadyExists, "have already requested access to project")
	}

	accessReq, err := s.admin.DB.InsertProjectAccessRequest(ctx, &database.InsertProjectAccessRequestOptions{
		UserID:    user.ID,
		ProjectID: proj.ID,
	})
	if err != nil {
		return nil, err
	}

	admins, err := s.admin.DB.FindOrganizationMembersWithManageUsersRole(ctx, proj.OrganizationID)
	if err != nil {
		return nil, err
	}

	for _, u := range admins {
		err = s.admin.Email.SendProjectAccessRequest(&email.ProjectAccessRequest{
			ToEmail:     u.Email,
			ToName:      u.DisplayName,
			Email:       user.Email,