rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Explain why the Google Analytics driver keys on email

Browse Source 
ExternalID is normally a stable provider-side ID, not an email. GA4 access
bindings identify a user only by email — no per-user ID and no display name
are exposed — so email is the only stable key available. Document that on
googleAnalyticsRecords so the choice reads as deliberate.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-12 19:54:25 +02:00
parent e4c5848759
commit b9680bf39c
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/accessreview/drivers/google_analytics.go
View File

@@ -270,7 +270,9 @@ func addGoogleAnalyticsBinding(members map[string]*googleAnalyticsMember, user s
}
// googleAnalyticsRecords turns the merged member map into a deterministically
// ordered slice of AccountRecords. Active is left nil: GA4 access bindings
// ordered slice of AccountRecords. GA4 access bindings identify a user only by
// email — there is no stable per-user ID and no display name exposed — so the
// email is used as both ExternalID and FullName. Active is left nil: bindings
// carry no account-status signal.
func googleAnalyticsRecords(members map[string]*googleAnalyticsMember) []AccountRecord {
emails := make([]string, 0, len(members))