List Google Analytics subproperties in access reviews

listProperties filtered properties with parent:accounts/{id}, which returns
only properties whose direct parent is the account and silently drops
subproperties and roll-up properties (parented to another property). A member
holding a binding only on such a subproperty was omitted from the review.
Switch to the ancestor:accounts/{id} filter, which walks the whole account
hierarchy and is a strict superset, so no property is lost.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/google_analytics.go

@@ -143,13 +143,16 @@ func (d *GoogleAnalyticsDriver) collectBindings(ctx context.Context, members map
 	return fmt.Errorf("cannot list all google analytics access bindings: %w", ErrPaginationLimitReached)
 }
 
-// listProperties returns the numeric IDs of every property directly beneath the
-// account.
+// listProperties returns the numeric IDs of every property under the account,
+// including subproperties and roll-up properties. The ancestor filter walks the
+// whole account hierarchy (parent: would return only properties whose direct
+// parent is the account, silently dropping subproperties parented to another
+// property, and with them any subproperty-only members).
 func (d *GoogleAnalyticsDriver) listProperties(ctx context.Context) ([]string, error) {
 	var propertyIDs []string
 
 	pageToken := ""
-	filter := url.Values{"filter": {"parent:accounts/" + d.accountID}}
+	filter := url.Values{"filter": {"ancestor:accounts/" + d.accountID}}
 
 	for range maxPaginationPages {
 		endpoint, err := googleAnalyticsURL(pageToken, filter, "v1alpha", "properties")

pkg/accessreview/drivers/testdata/google_analytics.yaml

@@ -45,13 +45,13 @@ interactions:
         host: analyticsadmin.googleapis.com
         form:
             filter:
-                - parent:accounts/123456
+                - ancestor:accounts/123456
             pageSize:
                 - "200"
         headers:
             Accept:
                 - application/json
-        url: https://analyticsadmin.googleapis.com/v1alpha/properties?filter=parent%3Aaccounts%2F123456&pageSize=200
+        url: https://analyticsadmin.googleapis.com/v1alpha/properties?filter=ancestor%3Aaccounts%2F123456&pageSize=200
         method: GET
       response:
         proto: HTTP/2.0