From 42de253d44b59918ea73915e4b9ff4e4151258d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Sat, 11 Jul 2026 18:07:29 +0200
Subject: [PATCH] Extract Crisp admin check into a helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IsAdmin was the one derived AccountRecord field computed inline in the
struct literal, while Crisp's roles and full name already go through
helpers and the sibling Yousign driver uses a yousignIsAdmin helper. Move
it to crispIsAdmin for consistency; behaviour is unchanged (only the
website owner is an administrator).

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/accessreview/drivers/crisp.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkg/accessreview/drivers/crisp.go b/pkg/accessreview/drivers/crisp.go
index 567d500f0..e4f3a26b3 100644
--- a/pkg/accessreview/drivers/crisp.go
+++ b/pkg/accessreview/drivers/crisp.go
@@ -140,7 +140,7 @@ func (d *CrispDriver) ListAccounts(ctx context.Context) ([]AccountRecord, error)
 			FullName:    crispFullName(details, email),
 			Roles:       crispRoles(details.Role),
 			JobTitle:    strings.TrimSpace(details.Title),
-			IsAdmin:     strings.EqualFold(strings.TrimSpace(details.Role), "owner"),
+			IsAdmin:     crispIsAdmin(details.Role),
 			MFAStatus:   coredata.MFAStatusUnknown,
 			AuthMethod:  coredata.AccessReviewEntryAuthMethodUnknown,
 			AccountType: coredata.AccessReviewEntryAccountTypeUser,
@@ -235,3 +235,9 @@ func crispRoles(role string) []string {
 		return []string{}
 	}
 }
+
+// crispIsAdmin reports whether a Crisp operator role grants administrative
+// access. Only the website owner is an administrator; members are not.
+func crispIsAdmin(role string) bool {
+	return strings.EqualFold(strings.TrimSpace(role), "owner")
+}