listForNamespace method

@override Future<List<NamespaceMember>> listForNamespace(String namespace, { Set<String> excludeEnrollmentIds = const {}, })

The enrollments authorised for namespace (the caller's own enrollment must hold at least read access — the atServer gates the verb), each with the key package to seal to. excludeEnrollmentIds drops revoked enrollments before they ever enter a roster.

Implementation

@override
Future<List<NamespaceMember>> listForNamespace(
  String namespace, {
  Set<String> excludeEnrollmentIds = const {},
}) async {
  final String? raw = await atClient
      .getRemoteSecondary()
      ?.executeCommand('enroll:listns:$namespace\n', auth: true);
  final decoded = _data(raw);
  if (decoded is! List) {
    return const [];
  }
  final members = <NamespaceMember>[];
  for (final e in decoded) {
    if (e is! Map) continue;
    final enrollmentId = e['enrollmentId'];
    final access = e['access'];
    if (enrollmentId is! String || access is! String) continue;
    if (excludeEnrollmentIds.contains(enrollmentId)) continue;
    KeyPackage? keyPackage;
    final apkamPubKey = e['apkamPubKey'];
    final metadata = e['metadata'];
    if (metadata is Map) {
      final pkg = metadata['keyPackage'];
      if (pkg != null) {
        try {
          keyPackage = KeyPackage.fromPayload(
            pkg,
            enrollmentId: enrollmentId,
            apkamId: apkamPubKey is String ? apkamPubKey : null,
          );
        } catch (_) {
          // skip a malformed/unknown-format package; a newer client may
          // have written one this version doesn't understand
        }
      }
    }
    members.add(NamespaceMember(
      enrollmentId: enrollmentId,
      access: access,
      keyPackage: keyPackage,
    ));
  }
  return members;
}