feat(list-users): ListUsers with Excluded Users

assets/tests/consolidated_1_1_tests.yaml

@@ -6517,7 +6517,9 @@ tests:
               object: document:1
               relation: can_view
             expectation:
-              - user:* # TODO but user:bob doesn't have access
+              - user:*
+            expectedExcludedUsers:
+              - user:bob
           - request:
               filters:
                 - user

internal/test/listusers/listusers.go

@@ -11,11 +11,12 @@ import (
 )
 
 type Assertion struct {
-	Request          *TestListUsersRequest
-	ContextualTuples []*openfgav1.TupleKey `json:"contextualTuples"`
-	Context          *structpb.Struct
-	Expectation      []string
-	ErrorCode        int `json:"errorCode"` // If ErrorCode is non-zero then we expect that the ListUsers call failed.
+	Request               *TestListUsersRequest
+	ContextualTuples      []*openfgav1.TupleKey `json:"contextualTuples"`
+	Context               *structpb.Struct
+	Expectation           []string
+	ExpectedExcludedUsers []string `json:"expectedExcludedUsers"`
+	ErrorCode             int      `json:"errorCode"` // If ErrorCode is non-zero then we expect that the ListUsers call failed.
 }
 
 type TestListUsersRequest struct {
@@ -28,14 +29,23 @@ func (t *TestListUsersRequest) ToString() string {
 	return fmt.Sprintf("object=%s, relation=%s, filters=%v", t.Object, t.Relation, strings.Join(t.Filters, ", "))
 }
 
-func FromProtoResponse(r *openfgav1.ListUsersResponse) []string {
+func FromUsersProto(r []*openfgav1.User) []string {
 	var users []string
-	for _, user := range r.GetUsers() {
+	for _, user := range r {
 		users = append(users, tuple.UserProtoToString(user))
 	}
 	return users
 }
 
+func FromObjectOrUsersetProto(u []*openfgav1.ObjectOrUserset) []string {
+	var users []string
+	for _, user := range u {
+		users = append(users, tuple.FromObjectOrUsersetProto(user))
+	}
+
+	return users
+}
+
 func (t *TestListUsersRequest) ToProtoRequest() *openfgav1.ListUsersRequest {
 	var protoFilters []*openfgav1.UserTypeFilter
 

pkg/server/commands/listusers/list_users.go

@@ -95,8 +95,9 @@ func (r *internalListUsersRequest) GetContext() *structpb.Struct {
 }
 
 type listUsersResponse struct {
-	Users    []*openfgav1.User
-	Metadata listUsersResponseMetadata
+	Users         []*openfgav1.User
+	ExcludedUsers []*openfgav1.ObjectOrUserset
+	Metadata      listUsersResponseMetadata
 }
 
 type listUsersResponseMetadata struct {
@@ -110,6 +111,13 @@ func (r *listUsersResponse) GetUsers() []*openfgav1.User {
 	return r.Users
 }
 
+func (r *listUsersResponse) GetExcludedUsers() []*openfgav1.ObjectOrUserset {
+	if r == nil {
+		return []*openfgav1.ObjectOrUserset{}
+	}
+	return r.ExcludedUsers
+}
+
 func (r *listUsersResponse) GetMetadata() listUsersResponseMetadata {
 	if r == nil {
 		return listUsersResponseMetadata{}