mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
fix(eventstore): add owners to unique constraints (#12740)
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved
Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.
A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.
Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.
Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).
# How the Problems Are Solved
Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).
- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.
Setup writes `finalized` on the 79 repeatable.done payload:
- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.
Member and grant owner bags now include every org that should delete the
row:
- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.
# Additional Changes
- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.
# Additional Context
A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.
<!-- CURSOR_AGENT_PR_BODY_END -->
<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Silvan
co-authored by
Cursor Agent
Silvan
Cursor Agent
Silvan
parent
9e1b85fa91
commit
3ff4fbc7e4
@@ -0,0 +1,285 @@
|
||||
package eventstore_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"testing"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/database"
|
||||
"github.com/zitadel/zitadel/internal/eventstore"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
)
|
||||
|
||||
func TestEventstore_Push_UniqueConstraintOwners(t *testing.T) {
|
||||
for pusherName, pusher := range pushers {
|
||||
t.Run(pusherName, func(t *testing.T) {
|
||||
runUniqueConstraintOwnerCases(t, pusher, clients[pusherName])
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func runUniqueConstraintOwnerCases(t *testing.T, pusher eventstore.Pusher, client *database.DB) {
|
||||
t.Helper()
|
||||
db := eventstore.NewEventstore(&eventstore.Config{
|
||||
Querier: queriers["v2(inmemory)"],
|
||||
Pusher: pusher,
|
||||
})
|
||||
const instanceID = "owners-instance"
|
||||
for _, tc := range uniqueConstraintOwnerCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
t.Cleanup(cleanupEventstore(client))
|
||||
tc.run(t, db, client, instanceID)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type uniqueConstraintOwnerCase struct {
|
||||
name string
|
||||
run func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string)
|
||||
}
|
||||
|
||||
var uniqueConstraintOwnerCases = []uniqueConstraintOwnerCase{
|
||||
{
|
||||
name: "add stores owners",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-add", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateAddUniqueConstraint("usernames", "alice", "org:org-1", "user:user-1"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertOwners(t, client, instanceID, "usernames", "alice", []string{"org:org-1", "user:user-1"})
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "omit owners stores empty",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-empty", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateAddUniqueConstraint("usernames", "bob"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertOwners(t, client, instanceID, "usernames", "bob", nil)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "add duplicate already exists",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
cmd := func() eventstore.Command {
|
||||
return generateCommand("owners-dup", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateAddUniqueConstraint("usernames", "alice", "org:org-1"),
|
||||
)
|
||||
}
|
||||
if _, err := db.Push(context.Background(), cmd()); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), cmd())
|
||||
if !zerrors.IsErrorAlreadyExists(err) {
|
||||
t.Fatalf("expected already exists, got %v", err)
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "remove by field case insensitive",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "mixedcase", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-field-remove", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraint("usernames", "MixedCase"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 0)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "remove by owner org",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "alice", "org:org-x", "user:u1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "bob", "org:org-y", "user:u2"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-org-remove", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerOrg, "org-x"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 1)
|
||||
assertOwners(t, client, instanceID, "usernames", "bob", []string{"org:org-y", "user:u2"})
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "remove by owner user",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "alice", "org:org-1", "user:u1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "external_idps", "idp1ext1", "org:org-1", "idp:idp1", "user:u1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "bob", "org:org-1", "user:u2"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-user-remove", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerUser, "u1"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 1)
|
||||
assertOwners(t, client, instanceID, "usernames", "bob", []string{"org:org-1", "user:u2"})
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "remove by owner idp",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "external_idps", "idp1ext1", "org:org-1", "idp:idp-1", "user:u1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "external_idps", "idp2ext2", "org:org-1", "idp:idp-2", "user:u2"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-idp-remove", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerIDP, "idp-1"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 1)
|
||||
assertOwners(t, client, instanceID, "external_idps", "idp2ext2", []string{"org:org-1", "idp:idp-2", "user:u2"})
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "two org tags either org deletes grant",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "project_grant", "granted:project", "org:granting", "org:granted", "project:project"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-grant-org", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerOrg, "granted"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 0)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "instance remove deletes tagged rows",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "alice", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, "other", "usernames", "alice", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-instance-remove", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveInstanceUniqueConstraints(),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 0)
|
||||
assertUniqueCount(t, client, "other", 1)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "global and empty owners not deleted by owner",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, "", "instance_domain", "example.com"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "untagged"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "tagged", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-skip-empty", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerOrg, "org-1"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, "", 1)
|
||||
assertUniqueCount(t, client, instanceID, 1)
|
||||
assertOwners(t, client, instanceID, "usernames", "untagged", nil)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "mixed batch deletes then inserts",
|
||||
run: func(t *testing.T, db *eventstore.Eventstore, client *database.DB, instanceID string) {
|
||||
if err := insertUniqueConstraint(client, instanceID, "usernames", "old", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := insertUniqueConstraint(client, instanceID, "org_name", "acme", "org:org-1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := db.Push(context.Background(), generateCommand("owners-mixed", "1",
|
||||
withInstanceID(instanceID),
|
||||
generateAddUniqueConstraint("usernames", "new", "org:org-1", "user:u1"),
|
||||
generateRemoveUniqueConstraint("usernames", "old"),
|
||||
generateRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerOrg, "org-1"),
|
||||
))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
assertUniqueCount(t, client, instanceID, 1)
|
||||
assertOwners(t, client, instanceID, "usernames", "new", []string{"org:org-1", "user:u1"})
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
func assertUniqueCount(t *testing.T, db *database.DB, instanceID string, want int) {
|
||||
t.Helper()
|
||||
var count int
|
||||
err := db.QueryRow(func(row *sql.Row) error {
|
||||
return row.Scan(&count)
|
||||
}, "SELECT COUNT(*) FROM eventstore.unique_constraints WHERE instance_id = $1", instanceID)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if count != want {
|
||||
t.Errorf("unique count = %d, want %d", count, want)
|
||||
}
|
||||
}
|
||||
|
||||
func assertOwners(t *testing.T, db *database.DB, instanceID, uniqueType, uniqueField string, want []string) {
|
||||
t.Helper()
|
||||
var owners database.TextArray[string]
|
||||
err := db.QueryRow(func(row *sql.Row) error {
|
||||
return row.Scan(&owners)
|
||||
}, "SELECT owners FROM eventstore.unique_constraints WHERE instance_id = $1 AND unique_type = $2 AND unique_field = $3", instanceID, uniqueType, uniqueField)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(owners) != len(want) {
|
||||
t.Fatalf("owners = %v, want %v", []string(owners), want)
|
||||
}
|
||||
got := map[string]int{}
|
||||
for _, owner := range owners {
|
||||
got[owner]++
|
||||
}
|
||||
for _, owner := range want {
|
||||
if got[owner] == 0 {
|
||||
t.Fatalf("owners = %v, want %v", []string(owners), want)
|
||||
}
|
||||
got[owner]--
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user