feat: usergrant (#489)

* fix: search usergrants only for allowed projects

* fix: check permissions

* fix: check permissions

* fix: check permissions

* Update internal/management/repository/eventsourcing/eventstore/project.go

Co-authored-by: Silvan <[email protected]>

* fix: merge request changes

* fix: variable name

Co-authored-by: Silvan <[email protected]>

pkg/grpc/management/management.pb.authoptions.go

@@ -321,7 +321,7 @@ var ManagementService_AuthMethods = authz.MethodMapping{
 
 	"/caos.zitadel.management.api.v1.ManagementService/SearchGrantedProjects": authz.Option{
 		Permission: "project.read",
-		CheckParam: "ProjectId",
+		CheckParam: "",
 	},
 
 	"/caos.zitadel.management.api.v1.ManagementService/GetGrantedProjectByID": authz.Option{
@@ -494,6 +494,16 @@ var ManagementService_AuthMethods = authz.MethodMapping{
 		CheckParam: "",
 	},
 
+	"/caos.zitadel.management.api.v1.ManagementService/CreateUserGrant": authz.Option{
+		Permission: "user.grant.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/UpdateUserGrant": authz.Option{
+		Permission: "user.grant.write",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/DeactivateUserGrant": authz.Option{
 		Permission: "user.grant.write",
 		CheckParam: "",

pkg/grpc/management/management.pb.gw.go

@@ -2839,6 +2839,87 @@ func request_ManagementService_UserGrantByID_0(ctx context.Context, marshaler ru
 
 }
 
+func request_ManagementService_CreateUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantCreate
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["user_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "user_id")
+	}
+
+	protoReq.UserId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "user_id", err)
+	}
+
+	msg, err := client.CreateUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_UpdateUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantUpdate
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["user_id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "user_id")
+	}
+
+	protoReq.UserId, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "user_id", err)
+	}
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.UpdateUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_DeactivateUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq UserGrantID
 	var metadata runtime.ServerMetadata
@@ -5606,6 +5687,46 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se
 
 	})
 
+	mux.Handle("POST", pattern_ManagementService_CreateUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_CreateUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_CreateUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("PUT", pattern_ManagementService_UpdateUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_UpdateUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_UpdateUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("PUT", pattern_ManagementService_DeactivateUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -6128,6 +6249,10 @@ var (
 
 	pattern_ManagementService_UserGrantByID_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"users", "user_id", "grants", "id"}, ""))
 
+	pattern_ManagementService_CreateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2}, []string{"users", "user_id", "grants"}, ""))
+
+	pattern_ManagementService_UpdateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"users", "user_id", "grants", "id"}, ""))
+
 	pattern_ManagementService_DeactivateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"users", "user_id", "grants", "id", "_deactivate"}, ""))
 
 	pattern_ManagementService_ReactivateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"users", "user_id", "grants", "id", "_reactivate"}, ""))
@@ -6360,6 +6485,10 @@ var (
 
 	forward_ManagementService_UserGrantByID_0 = runtime.ForwardResponseMessage
 
+	forward_ManagementService_CreateUserGrant_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_UpdateUserGrant_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_DeactivateUserGrant_0 = runtime.ForwardResponseMessage
 
 	forward_ManagementService_ReactivateUserGrant_0 = runtime.ForwardResponseMessage

pkg/grpc/management/mock/management.proto.mock.go

@@ -517,6 +517,26 @@ func (mr *MockManagementServiceClientMockRecorder) CreateUser(arg0, arg1 interfa
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateUser", reflect.TypeOf((*MockManagementServiceClient)(nil).CreateUser), varargs...)
 }
 
+// CreateUserGrant mocks base method
+func (m *MockManagementServiceClient) CreateUserGrant(arg0 context.Context, arg1 *management.UserGrantCreate, arg2 ...grpc.CallOption) (*management.UserGrant, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "CreateUserGrant", varargs...)
+	ret0, _ := ret[0].(*management.UserGrant)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CreateUserGrant indicates an expected call of CreateUserGrant
+func (mr *MockManagementServiceClientMockRecorder) CreateUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).CreateUserGrant), varargs...)
+}
+
 // DeactivateApplication mocks base method
 func (m *MockManagementServiceClient) DeactivateApplication(arg0 context.Context, arg1 *management.ApplicationID, arg2 ...grpc.CallOption) (*management.Application, error) {
 	m.ctrl.T.Helper()
@@ -2257,6 +2277,26 @@ func (mr *MockManagementServiceClientMockRecorder) UpdateUserAddress(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateUserAddress", reflect.TypeOf((*MockManagementServiceClient)(nil).UpdateUserAddress), varargs...)
 }
 
+// UpdateUserGrant mocks base method
+func (m *MockManagementServiceClient) UpdateUserGrant(arg0 context.Context, arg1 *management.UserGrantUpdate, arg2 ...grpc.CallOption) (*management.UserGrant, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "UpdateUserGrant", varargs...)
+	ret0, _ := ret[0].(*management.UserGrant)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateUserGrant indicates an expected call of UpdateUserGrant
+func (mr *MockManagementServiceClientMockRecorder) UpdateUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).UpdateUserGrant), varargs...)
+}
+
 // UpdateUserProfile mocks base method
 func (m *MockManagementServiceClient) UpdateUserProfile(arg0 context.Context, arg1 *management.UpdateUserProfileRequest, arg2 ...grpc.CallOption) (*management.UserProfile, error) {
 	m.ctrl.T.Helper()

pkg/grpc/management/proto/management.proto

@@ -722,7 +722,6 @@ service ManagementService {
 
         option (caos.zitadel.utils.v1.auth_option) = {
             permission: "project.read"
-            check_field_name: "ProjectId"
         };
     }
 
@@ -1112,6 +1111,28 @@ service ManagementService {
         };
     }
 
+    rpc CreateUserGrant(UserGrantCreate) returns (UserGrant) {
+        option (google.api.http) = {
+            post: "/users/{user_id}/grants"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.write"
+        };
+    }
+
+    rpc UpdateUserGrant(UserGrantUpdate) returns (UserGrant) {
+        option (google.api.http) = {
+            put: "/users/{user_id}/grants/{id}"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.write"
+        };
+    }
+
     rpc DeactivateUserGrant(UserGrantID) returns (UserGrant) {
         option (google.api.http) = {
             put: "/users/{user_id}/grants/{id}/_deactivate"
@@ -1159,6 +1180,7 @@ service ManagementService {
     // search user grants based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc SearchProjectUserGrants(ProjectUserGrantSearchRequest) returns (UserGrantSearchResponse) {
+        option deprecated = true;
         option (google.api.http) = {
             post: "/projects/{project_id}/users/grants/_search"
             body: "*"
@@ -1173,6 +1195,7 @@ service ManagementService {
     // get user grant based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc ProjectUserGrantByID(ProjectUserGrantID) returns (UserGrantView) {
+        option deprecated = true;
         option (google.api.http) = {
             get: "/projects/{project_id}/users/{user_id}/grants/{id}"
         };
@@ -1186,6 +1209,7 @@ service ManagementService {
     // create user grant based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc CreateProjectUserGrant(UserGrantCreate) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             post: "/projects/{project_id}/users/{user_id}/grants"
             body: "*"
@@ -1200,6 +1224,7 @@ service ManagementService {
     // update user grant based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc UpdateProjectUserGrant(ProjectUserGrantUpdate) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projects/{project_id}/users/{user_id}/grants/{id}"
             body: "*"
@@ -1214,6 +1239,7 @@ service ManagementService {
     // deactivate user grant based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc DeactivateProjectUserGrant(ProjectUserGrantID) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projects/{project_id}/users/{user_id}/grants/{id}/_deactivate"
             body: "*"
@@ -1228,6 +1254,7 @@ service ManagementService {
     // reactivate user grant based on a project
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc ReactivateProjectUserGrant(ProjectUserGrantID) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projects/{project_id}/users/{user_id}/grants/{id}/_reactivate"
             body: "*"
@@ -1242,6 +1269,7 @@ service ManagementService {
     // search user grants based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc SearchProjectGrantUserGrants(ProjectGrantUserGrantSearchRequest) returns (UserGrantSearchResponse) {
+        option deprecated = true;
         option (google.api.http) = {
             post: "/projectgrants/{project_grant_id}/users/grants/_search"
             body: "*"
@@ -1256,6 +1284,7 @@ service ManagementService {
     // get user grant based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc ProjectGrantUserGrantByID(ProjectGrantUserGrantID) returns (UserGrantView) {
+        option deprecated = true;
         option (google.api.http) = {
             get: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}"
         };
@@ -1269,6 +1298,7 @@ service ManagementService {
     // create user grant based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc CreateProjectGrantUserGrant(ProjectGrantUserGrantCreate) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             post: "/projectgrants/{project_grant_id}/users/{user_id}/grants"
             body: "*"
@@ -1283,6 +1313,7 @@ service ManagementService {
     // update user grant based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc UpdateProjectGrantUserGrant(ProjectGrantUserGrantUpdate) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}"
             body: "*"
@@ -1297,6 +1328,7 @@ service ManagementService {
     // deactivate user grant based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc DeactivateProjectGrantUserGrant(ProjectGrantUserGrantID) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}/_deactivate"
             body: "*"
@@ -1311,6 +1343,7 @@ service ManagementService {
     // reactivate user grant based on a projectgrant
     // This request is required that the user authorizations of zitadel can be differentiated
     rpc ReactivateProjectGrantUserGrant(ProjectGrantUserGrantID) returns (UserGrant) {
+        option deprecated = true;
         option (google.api.http) = {
             put: "/projectgrants/{project_grant_id}/users/{user_id}/grants/{id}/_reactivate"
             body: "*"