fix(eventstore): add owners to unique constraints (#12740)

# Which Problems Are Solved Bulk unique-constraint deletes (org, IDP with many links, user, project) reconstruct every uniqueness key in Go and emit N `DELETE`s. That can OOM on large tenants. A one-shot owner backfill is also not enough: during a rolling deploy, older binaries still insert `owners = '{}'`, so a later owner-only delete would miss those rows. Owner-only org/user/grant delete only matches rows whose `owners` bag contains that tag. Several grant and member types stamped the aggregate resource owner, which is not always the user’s home org or the granted org. Username-scope rewrites also dropped `user:` tags, so owner-only user delete could miss rewritten username rows. Command must not switch to owner-only delete on the first 79 of a version, because leftover `'{}'` rows from rolling-update overlap are only backfilled on a later 79. A failed 79 must not turn owner-delete on, and backfill joins must not stamp the wrong org (unverified domains, org-scoped usernames colliding with instance-scoped ones). # How the Problems Are Solved Uniqueness stays the existing primary key `(instance_id, unique_type, unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`, `user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`). - Add `owners TEXT[] NOT NULL DEFAULT '{}'` on `eventstore.unique_constraints` (init SQL for greenfield, setup 78 for existing clusters). - Create `unique_constraints_owners_gin` with `CREATE INDEX CONCURRENTLY` **outside a transaction** (same pattern as step 76). Built-in `GIN (owners)` only; no `btree_gin`. - Stamp `WithOwners` on **add** events. Field-level removes ignore owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2 pushers run `DELETE … WHERE instance_id = $1 AND owners @> ARRAY[$tag]::text[]`. - Setup 79 backfills `owners` from projections via numbered `cmd/setup/79/*.sql` files. Table names are interpolated from `internal/query/projection` constants. Matches use `unique_field IN (x, lower(x))` so the primary key can be used. Missing projection tables (`42P01`) are skipped. - Org domains are tagged only when `is_verified`. Instance-scoped usernames join only users that are not org-scoped (organization settings or domain policy `user_login_must_be_domain`). Every username row still gets `org:` + `user:` of that user. - 79 is a **repeatable** migration. `Check` re-runs when `lastRun["version"]` changed or when setup-only `ForceFinalize` is set and `lastRun["finalized"]` is still false. `Finalized` is written only after Execute succeeds. - Failed setup events keep the last successful `lastRun`. Command reads `finalized` only from `system.migration.repeatable.done`. - Org / user / project remove skip N-key event replay **when that `finalized` bit is true**. Otherwise they keep today’s N-key lists **and** still emit `RemoveByOwner`. The “ready” result is cached in memory once true. Setup writes `finalized` on the 79 repeatable.done payload: - First 79 of a version: backfill only, `finalized=false` (unless `ForceFinalize` is already set). - Later 79: version change or `BackfillUniqueConstraintOwners.ForceFinalize` / `ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling update is done. That run backfills leftovers and writes `finalized=true`. Member and grant owner bags now include every org that should delete the row: - Instance, org, and project members also stamp `org:<user_resource_owner>`. - User grants stamp grant, user, project, and granted orgs. - Project grant members stamp the project org, user org, and granted org. - Project grants stamp both orgs plus `grant:<id>`. Grant remove emits `RemoveByOwner(grant)`. - Username-scope rewrites keep `user:<id>` as well as `org:`. - User/grant orgs are carried as unexported add-event fields (not persisted JSON). `WithOwners` skips empty and duplicate tags. # Additional Changes - Table-driven owner-tag tests, including project grant (two `org:` tags plus `grant:`), cross-org members, user grants, and username-scope rewrite `user:` tags. - Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version change, sequential version bumps, ForceFinalize restart, and already-finalized skip. - Command tests: a failed 79 event with `finalized=true` does not enable owner-delete. - Integration fixtures (verified vs unverified org domain; instance-scoped `bob` vs org-scoped `bob`). - Instance-only and global unique types stay untagged (`'{}'`). Instance wipe still uses `UniqueConstraintInstanceRemove`. - Pusher owner cases live in `eventstore_pusher_owners_test.go` so `eventstore_pusher_test.go` stays under 1k lines. # Additional Context A later cleanup can delete the N-key replay helpers once a release that ran 79 a second time (or an operator who set `ForceFinalize`) is in production. That is not required for correctness.  <div><a href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div> --------- Co-authored-by: Cursor Agent <[email protected]> Co-authored-by: Silvan <[email protected]>
2026-10-27 01:32:15 +00:00 · 2026-09-18 15:08:42 +02:00
parent 9e1b85fa91
commit 3ff4fbc7e4
95 changed files with 2411 additions and 207 deletions
@@ -0,0 +1,8 @@
+-- unique_field: username+resourceOwner (user.NewAddUsernameUniqueConstraint, org-scoped)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || u.resource_owner, 'user:' || u.id]
+FROM {{.users}} u
+WHERE uc.unique_type = 'usernames'
+	AND uc.instance_id = u.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (u.username || u.resource_owner, lower(u.username || u.resource_owner));
@@ -0,0 +1,16 @@
+-- unique_field: username (user.NewAddUsernameUniqueConstraint, instance-scoped)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || u.resource_owner, 'user:' || u.id]
+FROM {{.users}} u
+LEFT JOIN {{.organization_settings}} s
+	ON s.instance_id = u.instance_id AND s.id = u.resource_owner
+LEFT JOIN {{.domain_policies}} org_pol
+	ON org_pol.instance_id = u.instance_id AND org_pol.id = u.resource_owner
+LEFT JOIN {{.domain_policies}} inst_pol
+	ON inst_pol.instance_id = u.instance_id AND inst_pol.is_default
+WHERE uc.unique_type = 'usernames'
+	AND uc.instance_id = u.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (u.username, lower(u.username))
+	AND NOT COALESCE(s.organization_scoped_usernames, false)
+	AND NOT COALESCE(org_pol.user_login_must_be_domain, inst_pol.user_login_must_be_domain, false);
@@ -0,0 +1,8 @@
+-- unique_field: idpConfigID+externalUserID (user.NewAddUserIDPLinkUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || l.resource_owner, 'idp:' || l.idp_id, 'user:' || l.user_id]
+FROM {{.idp_user_links}} l
+WHERE uc.unique_type = 'external_idps'
+	AND uc.instance_id = l.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (l.idp_id || l.external_user_id, lower(l.idp_id || l.external_user_id));
@@ -0,0 +1,8 @@
+-- unique_field: org name (org.NewAddOrgNameUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || o.id]
+FROM {{.orgs}} o
+WHERE uc.unique_type = 'org_name'
+	AND uc.instance_id = o.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (o.name, lower(o.name));
@@ -0,0 +1,9 @@
+-- unique_field: domain (org.NewAddOrgDomainUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || d.org_id]
+FROM {{.org_domains}} d
+WHERE uc.unique_type = 'org_domain'
+	AND uc.instance_id = d.instance_id
+	AND uc.owners = '{}'
+	AND d.is_verified
+	AND uc.unique_field IN (d.domain, lower(d.domain));
@@ -0,0 +1,8 @@
+-- unique_field: name+resourceOwner (project.NewAddProjectNameUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || p.resource_owner, 'project:' || p.id]
+FROM {{.projects}} p
+WHERE uc.unique_type = 'project_names'
+	AND uc.instance_id = p.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (p.name || p.resource_owner, lower(p.name || p.resource_owner));
@@ -0,0 +1,8 @@
+-- unique_field: name:projectID (project.NewAddApplicationUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || a.resource_owner, 'project:' || a.project_id]
+FROM {{.apps}} a
+WHERE uc.unique_type = 'appname'
+	AND uc.instance_id = a.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (a.name || ':' || a.project_id, lower(a.name || ':' || a.project_id));
@@ -0,0 +1,8 @@
+-- unique_field: roleKey:projectID (project.NewAddProjectRoleUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || r.resource_owner, 'project:' || r.project_id]
+FROM {{.project_roles}} r
+WHERE uc.unique_type = 'project_role'
+	AND uc.instance_id = r.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (r.role_key || ':' || r.project_id, lower(r.role_key || ':' || r.project_id));
@@ -0,0 +1,9 @@
+-- unique_field: entityID (project.NewAddSAMLConfigEntityIDUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || a.resource_owner, 'project:' || a.project_id]
+FROM {{.apps}} a
+JOIN {{.apps_saml}} s ON s.app_id = a.id AND s.instance_id = a.instance_id
+WHERE uc.unique_type = 'entity_ids'
+	AND uc.instance_id = a.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (s.entity_id, lower(s.entity_id));
@@ -0,0 +1,9 @@
+-- unique_field: grantedOrgID:projectID (project.NewAddProjectGrantUniqueConstraint)
+-- resource_owner is the project org and granted_org_id is the granted org; they differ
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || g.resource_owner, 'org:' || g.granted_org_id, 'project:' || g.project_id, 'grant:' || g.grant_id]
+FROM {{.project_grants}} g
+WHERE uc.unique_type = 'project_grant'
+	AND uc.instance_id = g.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (g.granted_org_id || ':' || g.project_id, lower(g.granted_org_id || ':' || g.project_id));
@@ -0,0 +1,11 @@
+-- unique_field: projectID:userID:grantID (project.NewAddProjectGrantMemberUniqueConstraint)
+-- resource_owner is the project org; also stamp the user's home org and the granted org
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || m.resource_owner, 'org:' || m.user_resource_owner, 'user:' || m.user_id, 'project:' || m.project_id]
+	|| CASE WHEN COALESCE(m.granted_org, '') <> '' THEN ARRAY['org:' || m.granted_org] ELSE ARRAY[]::text[] END
+	|| CASE WHEN COALESCE(m.grant_id, '') <> '' THEN ARRAY['grant:' || m.grant_id] ELSE ARRAY[]::text[] END
+FROM {{.project_grant_members}} m
+WHERE uc.unique_type = 'project_grant_member'
+	AND uc.instance_id = m.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (m.project_id || ':' || m.user_id || ':' || m.grant_id, lower(m.project_id || ':' || m.user_id || ':' || m.grant_id));
@@ -0,0 +1,11 @@
+-- unique_field: resourceOwner:userID:projectID:grantID (usergrant.NewAddUserGrantUniqueConstraint)
+-- grant resource_owner is not always the user's org; stamp user, project, and granted orgs
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || g.resource_owner, 'org:' || g.resource_owner_user, 'org:' || g.resource_owner_project, 'user:' || g.user_id, 'project:' || g.project_id]
+	|| CASE WHEN COALESCE(g.granted_org, '') <> '' THEN ARRAY['org:' || g.granted_org] ELSE ARRAY[]::text[] END
+	|| CASE WHEN COALESCE(g.grant_id, '') <> '' THEN ARRAY['grant:' || g.grant_id] ELSE ARRAY[]::text[] END
+FROM {{.user_grants}} g
+WHERE uc.unique_type = 'user_grant'
+	AND uc.instance_id = g.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (g.resource_owner || ':' || g.user_id || ':' || g.project_id || ':' || g.grant_id, lower(g.resource_owner || ':' || g.user_id || ':' || g.project_id || ':' || g.grant_id));
@@ -0,0 +1,9 @@
+-- unique_field: orgID:userID (member.NewAddMemberUniqueConstraint, org aggregate)
+-- stamp both the membership org and the user's home org (they differ for cross-org members)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || m.org_id, 'org:' || m.user_resource_owner, 'user:' || m.user_id]
+FROM {{.org_members}} m
+WHERE uc.unique_type = 'member'
+	AND uc.instance_id = m.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (m.org_id || ':' || m.user_id, lower(m.org_id || ':' || m.user_id));
@@ -0,0 +1,9 @@
+-- unique_field: projectID:userID (member.NewAddMemberUniqueConstraint, project aggregate)
+-- stamp the project org and the user's home org (they differ for cross-org members)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || m.resource_owner, 'org:' || m.user_resource_owner, 'user:' || m.user_id, 'project:' || m.project_id]
+FROM {{.project_members}} m
+WHERE uc.unique_type = 'member'
+	AND uc.instance_id = m.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (m.project_id || ':' || m.user_id, lower(m.project_id || ':' || m.user_id));
@@ -0,0 +1,9 @@
+-- unique_field: instanceID:userID (member.NewAddMemberUniqueConstraint, instance aggregate)
+-- instance members live on the instance aggregate, so also stamp the user's home org
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['user:' || m.user_id, 'org:' || m.user_resource_owner]
+FROM {{.instance_members}} m
+WHERE uc.unique_type = 'member'
+	AND uc.instance_id = m.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (m.id || ':' || m.user_id, lower(m.id || ':' || m.user_id));
@@ -0,0 +1,8 @@
+-- unique_field: name:resourceOwner (group.NewAddGroupNameUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || g.resource_owner]
+FROM {{.groups}} g
+WHERE uc.unique_type = 'group_name'
+	AND uc.instance_id = g.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (g.name || ':' || g.resource_owner, lower(g.name || ':' || g.resource_owner));
@@ -0,0 +1,8 @@
+-- unique_field: name:resourceOwner (action.NewAddActionNameUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || a.resource_owner]
+FROM {{.actions}} a
+WHERE uc.unique_type = 'action_names'
+	AND uc.instance_id = a.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (a.name || ':' || a.resource_owner, lower(a.name || ':' || a.resource_owner));
@@ -0,0 +1,8 @@
+-- unique_field: name+resourceOwner (idpconfig.NewAddIDPConfigNameUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || i.resource_owner, 'idp:' || i.id]
+FROM {{.idps}} i
+WHERE uc.unique_type = 'idp_config_names'
+	AND uc.instance_id = i.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (i.name || i.resource_owner, lower(i.name || i.resource_owner));
@@ -0,0 +1,8 @@
+-- unique_field: name+resourceOwner (idpconfig.NewAddIDPConfigNameUniqueConstraint, templates)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || t.resource_owner, 'idp:' || t.id]
+FROM {{.idp_templates}} t
+WHERE uc.unique_type = 'idp_config_names'
+	AND uc.instance_id = t.instance_id
+	AND uc.owners = '{}'
+	AND uc.unique_field IN (t.name || t.resource_owner, lower(t.name || t.resource_owner));
@@ -0,0 +1,9 @@
+-- unique_field: aggregateID:mailTextType:language (policy.NewAddMailTextUniqueConstraint)
+UPDATE eventstore.unique_constraints uc
+SET owners = ARRAY['org:' || t.aggregate_id]
+FROM {{.message_texts}} t
+WHERE uc.unique_type = 'mail_text'
+	AND uc.instance_id = t.instance_id
+	AND uc.owners = '{}'
+	AND t.aggregate_id <> t.instance_id
+	AND uc.unique_field IN (t.aggregate_id || ':' || t.type || ':' || t.language, lower(t.aggregate_id || ':' || t.type || ':' || t.language));