mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-31 03:22:15 +00:00
fix(eventstore): add owners to unique constraints (#12740)
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved
Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.
A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.
Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.
Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).
# How the Problems Are Solved
Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).
- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.
Setup writes `finalized` on the 79 repeatable.done payload:
- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.
Member and grant owner bags now include every org that should delete the
row:
- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.
# Additional Changes
- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.
# Additional Context
A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.
<!-- CURSOR_AGENT_PR_BODY_END -->
<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Silvan
co-authored by
Cursor Agent
Silvan
Cursor Agent
Silvan
parent
9e1b85fa91
commit
3ff4fbc7e4
@@ -47,7 +47,7 @@ func (e *AddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddActionNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
|
||||
return []*eventstore.UniqueConstraint{NewAddActionNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ResourceOwner))}
|
||||
}
|
||||
|
||||
func NewAddedEvent(
|
||||
@@ -104,7 +104,7 @@ func (e *ChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
}
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveActionNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
|
||||
NewAddActionNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner),
|
||||
NewAddActionNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ResourceOwner)),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -47,7 +47,7 @@ func (g *GroupAddedEvent) Payload() any {
|
||||
}
|
||||
|
||||
func (g *GroupAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddGroupNameUniqueConstraint(g.Name, g.Aggregate().ResourceOwner)}
|
||||
return []*eventstore.UniqueConstraint{NewAddGroupNameUniqueConstraint(g.Name, g.Aggregate().ResourceOwner).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, g.Aggregate().ResourceOwner))}
|
||||
}
|
||||
|
||||
func NewAddGroupNameUniqueConstraint(groupName, organizationID string) *eventstore.UniqueConstraint {
|
||||
@@ -121,7 +121,7 @@ func (g *GroupChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
}
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveGroupNameUniqueConstraint(g.oldName, g.Aggregate().ResourceOwner),
|
||||
NewAddGroupNameUniqueConstraint(*g.Name, g.Aggregate().ResourceOwner)}
|
||||
NewAddGroupNameUniqueConstraint(*g.Name, g.Aggregate().ResourceOwner).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, g.Aggregate().ResourceOwner))}
|
||||
}
|
||||
|
||||
type GroupRemovedEvent struct {
|
||||
|
||||
@@ -55,8 +55,15 @@ func (e *IDPConfigAddedEvent) Payload() interface{} {
|
||||
return e
|
||||
}
|
||||
|
||||
func idpConfigOwnerTags(agg *eventstore.Aggregate, configID string) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerIDP, configID),
|
||||
}
|
||||
}
|
||||
|
||||
func (e *IDPConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddIDPConfigNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
|
||||
return []*eventstore.UniqueConstraint{NewAddIDPConfigNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner).WithOwners(idpConfigOwnerTags(e.Aggregate(), e.ConfigID)...)}
|
||||
}
|
||||
|
||||
func IDPConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
||||
@@ -92,7 +99,7 @@ func (e *IDPConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstrai
|
||||
}
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveIDPConfigNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
|
||||
NewAddIDPConfigNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner),
|
||||
NewAddIDPConfigNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner).WithOwners(idpConfigOwnerTags(e.Aggregate(), e.ConfigID)...),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -250,7 +257,10 @@ func (e *IDPConfigRemovedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *IDPConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewRemoveIDPConfigNameUniqueConstraint(e.name, e.Aggregate().ResourceOwner)}
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveIDPConfigNameUniqueConstraint(e.name, e.Aggregate().ResourceOwner),
|
||||
eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerIDP, e.ConfigID),
|
||||
}
|
||||
}
|
||||
|
||||
func IDPConfigRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
||||
|
||||
@@ -46,6 +46,11 @@ func NewMemberAddedEvent(
|
||||
}
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) WithUserResourceOwner(userResourceOwner string) *MemberAddedEvent {
|
||||
e.MemberAddedEvent.WithUserResourceOwner(userResourceOwner)
|
||||
return e
|
||||
}
|
||||
|
||||
func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
||||
e, err := member.MemberAddedEventMapper(event)
|
||||
if err != nil {
|
||||
|
||||
@@ -14,6 +14,9 @@ const (
|
||||
ChangedEventType = "member.changed"
|
||||
RemovedEventType = "member.removed"
|
||||
CascadeRemovedEventType = "member.cascade.removed"
|
||||
|
||||
orgAggregateType eventstore.AggregateType = "org"
|
||||
projectAggregateType eventstore.AggregateType = "project"
|
||||
)
|
||||
|
||||
// Field table and unique types
|
||||
@@ -42,14 +45,38 @@ type MemberAddedEvent struct {
|
||||
|
||||
Roles []string `json:"roles"`
|
||||
UserID string `json:"userId"`
|
||||
// userResourceOwner is the user's home org. It is not persisted in the event payload.
|
||||
userResourceOwner string
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) Payload() interface{} {
|
||||
return e
|
||||
}
|
||||
|
||||
func memberOwnerTags(agg *eventstore.Aggregate, userID, userResourceOwner string) []string {
|
||||
tags := []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, userID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, userResourceOwner),
|
||||
}
|
||||
switch agg.Type {
|
||||
case projectAggregateType:
|
||||
tags = append(tags,
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
||||
)
|
||||
case orgAggregateType:
|
||||
tags = append(tags, eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ID))
|
||||
}
|
||||
return tags
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddMemberUniqueConstraint(e.Aggregate().ID, e.UserID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddMemberUniqueConstraint(e.Aggregate().ID, e.UserID).WithOwners(memberOwnerTags(e.Aggregate(), e.UserID, e.userResourceOwner)...)}
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) WithUserResourceOwner(userResourceOwner string) *MemberAddedEvent {
|
||||
e.userResourceOwner = userResourceOwner
|
||||
return e
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) FieldOperations(prefix string) []*eventstore.FieldOperation {
|
||||
|
||||
@@ -191,7 +191,7 @@ func (e *DomainVerifiedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *DomainVerifiedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddOrgDomainUniqueConstraint(e.Domain)}
|
||||
return []*eventstore.UniqueConstraint{NewAddOrgDomainUniqueConstraint(e.Domain).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ID))}
|
||||
}
|
||||
|
||||
func (e *DomainVerifiedEvent) Fields() []*eventstore.FieldOperation {
|
||||
|
||||
@@ -45,6 +45,11 @@ func NewMemberAddedEvent(
|
||||
}
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) WithUserResourceOwner(userResourceOwner string) *MemberAddedEvent {
|
||||
e.MemberAddedEvent.WithUserResourceOwner(userResourceOwner)
|
||||
return e
|
||||
}
|
||||
|
||||
func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
||||
e, err := member.MemberAddedEventMapper(event)
|
||||
if err != nil {
|
||||
|
||||
@@ -47,7 +47,7 @@ func (e *OrgAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *OrgAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddOrgNameUniqueConstraint(e.Name)}
|
||||
return []*eventstore.UniqueConstraint{NewAddOrgNameUniqueConstraint(e.Name).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ID))}
|
||||
}
|
||||
|
||||
func (e *OrgAddedEvent) Fields() []*eventstore.FieldOperation {
|
||||
@@ -124,7 +124,7 @@ func (e *OrgChangedEvent) Payload() interface{} {
|
||||
func (e *OrgChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveOrgNameUniqueConstraint(e.oldName),
|
||||
NewAddOrgNameUniqueConstraint(e.Name),
|
||||
NewAddOrgNameUniqueConstraint(e.Name).WithOwners(eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ID)),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -291,6 +291,7 @@ func (e *OrgRemovedEvent) Payload() interface{} {
|
||||
func (e *OrgRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
constraints := []*eventstore.UniqueConstraint{
|
||||
NewRemoveOrgNameUniqueConstraint(e.name),
|
||||
eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerOrg, e.Aggregate().ID),
|
||||
}
|
||||
for _, name := range e.usernames {
|
||||
constraints = append(constraints, user.NewRemoveUsernameUniqueConstraint(name, e.Aggregate().ID, e.organizationScopedUsernames))
|
||||
|
||||
@@ -18,7 +18,7 @@ type OrganizationSettingsSetEvent struct {
|
||||
|
||||
OrganizationScopedUsernames bool `json:"organizationScopedUsernames,omitempty"`
|
||||
oldOrganizationScopedUsernames bool
|
||||
usernameChanges []string
|
||||
usernameChanges []user.UsernameChange
|
||||
}
|
||||
|
||||
func (e *OrganizationSettingsSetEvent) SetBaseEvent(b *eventstore.BaseEvent) {
|
||||
@@ -30,21 +30,13 @@ func (e *OrganizationSettingsSetEvent) Payload() any {
|
||||
}
|
||||
|
||||
func (e *OrganizationSettingsSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
if len(e.usernameChanges) == 0 || e.oldOrganizationScopedUsernames == e.OrganizationScopedUsernames {
|
||||
return []*eventstore.UniqueConstraint{}
|
||||
}
|
||||
changes := make([]*eventstore.UniqueConstraint, len(e.usernameChanges)*2)
|
||||
for i, username := range e.usernameChanges {
|
||||
changes[i*2] = user.NewRemoveUsernameUniqueConstraint(username, e.Aggregate().ResourceOwner, e.oldOrganizationScopedUsernames)
|
||||
changes[i*2+1] = user.NewAddUsernameUniqueConstraint(username, e.Aggregate().ResourceOwner, e.OrganizationScopedUsernames)
|
||||
}
|
||||
return changes
|
||||
return user.NewUsernameUniqueConstraints(e.usernameChanges, e.Aggregate().ResourceOwner, e.OrganizationScopedUsernames, e.oldOrganizationScopedUsernames)
|
||||
}
|
||||
|
||||
func NewOrganizationSettingsAddedEvent(
|
||||
ctx context.Context,
|
||||
aggregate *eventstore.Aggregate,
|
||||
usernameChanges []string,
|
||||
usernameChanges []user.UsernameChange,
|
||||
organizationScopedUsernames bool,
|
||||
oldOrganizationScopedUsernames bool,
|
||||
) *OrganizationSettingsSetEvent {
|
||||
@@ -63,7 +55,7 @@ type OrganizationSettingsRemovedEvent struct {
|
||||
|
||||
organizationScopedUsernames bool
|
||||
oldOrganizationScopedUsernames bool
|
||||
usernameChanges []string
|
||||
usernameChanges []user.UsernameChange
|
||||
}
|
||||
|
||||
func (e *OrganizationSettingsRemovedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
|
||||
@@ -81,7 +73,7 @@ func (e *OrganizationSettingsRemovedEvent) UniqueConstraints() []*eventstore.Uni
|
||||
func NewOrganizationSettingsRemovedEvent(
|
||||
ctx context.Context,
|
||||
aggregate *eventstore.Aggregate,
|
||||
usernameChanges []string,
|
||||
usernameChanges []user.UsernameChange,
|
||||
organizationScopedUsernames bool,
|
||||
oldOrganizationScopedUsernames bool,
|
||||
) *OrganizationSettingsRemovedEvent {
|
||||
|
||||
@@ -13,6 +13,8 @@ const (
|
||||
MailTextPolicyAddedEventType = mailTextPolicyPrefix + "added"
|
||||
MailTextPolicyChangedEventType = mailTextPolicyPrefix + "changed"
|
||||
MailTextPolicyRemovedEventType = mailTextPolicyPrefix + "removed"
|
||||
|
||||
mailTextOrgAggregateType eventstore.AggregateType = "org"
|
||||
)
|
||||
|
||||
func NewAddMailTextUniqueConstraint(aggregateID, mailTextType, langugage string) *eventstore.UniqueConstraint {
|
||||
@@ -28,6 +30,13 @@ func NewRemoveMailTextUniqueConstraint(aggregateID, mailTextType, langugage stri
|
||||
fmt.Sprintf("%v:%v:%v", aggregateID, mailTextType, langugage))
|
||||
}
|
||||
|
||||
func mailTextOwnerTags(agg *eventstore.Aggregate) []string {
|
||||
if agg.Type != mailTextOrgAggregateType {
|
||||
return nil
|
||||
}
|
||||
return []string{eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner)}
|
||||
}
|
||||
|
||||
type MailTextAddedEvent struct {
|
||||
eventstore.BaseEvent `json:"-"`
|
||||
|
||||
@@ -46,7 +55,7 @@ func (e *MailTextAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *MailTextAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddMailTextUniqueConstraint(e.Aggregate().ResourceOwner, e.MailTextType, e.Language)}
|
||||
return []*eventstore.UniqueConstraint{NewAddMailTextUniqueConstraint(e.Aggregate().ResourceOwner, e.MailTextType, e.Language).WithOwners(mailTextOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func NewMailTextAddedEvent(
|
||||
|
||||
@@ -124,7 +124,7 @@ func DomainPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, e
|
||||
type DomainPolicyRemovedEvent struct {
|
||||
eventstore.BaseEvent `json:"-"`
|
||||
|
||||
usernameChanges []string
|
||||
usernameChanges []user.UsernameChange
|
||||
userLoginMustBeDomain bool
|
||||
oldUserLoginMustBeDomain bool
|
||||
}
|
||||
@@ -149,7 +149,7 @@ func DomainPolicyRemovedEventMapper(event eventstore.Event) (eventstore.Event, e
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (e *DomainPolicyRemovedEvent) AddUniqueConstraintChanges(usernameChanges []string, userLoginMustBeDomain, oldUserLoginMustBeDomain bool) {
|
||||
func (e *DomainPolicyRemovedEvent) AddUniqueConstraintChanges(usernameChanges []user.UsernameChange, userLoginMustBeDomain, oldUserLoginMustBeDomain bool) {
|
||||
e.usernameChanges = usernameChanges
|
||||
e.userLoginMustBeDomain = userLoginMustBeDomain
|
||||
e.oldUserLoginMustBeDomain = oldUserLoginMustBeDomain
|
||||
|
||||
@@ -43,7 +43,7 @@ func (e *ApplicationAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *ApplicationAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID).WithOwners(projectOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func NewApplicationAddedEvent(
|
||||
@@ -91,7 +91,7 @@ func (e *ApplicationChangedEvent) Payload() interface{} {
|
||||
func (e *ApplicationChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveApplicationUniqueConstraint(e.oldName, e.Aggregate().ID),
|
||||
NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID),
|
||||
NewAddApplicationUniqueConstraint(e.Name, e.Aggregate().ID).WithOwners(projectOwnerTags(e.Aggregate())...),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -53,7 +53,7 @@ func (e *GrantAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *GrantAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectGrantUniqueConstraint(e.GrantedOrgID, e.Aggregate().ID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectGrantUniqueConstraint(e.GrantedOrgID, e.Aggregate().ID).WithOwners(grantOwnerTags(e.Aggregate(), e.GrantID, e.GrantedOrgID)...)}
|
||||
}
|
||||
|
||||
func (e *GrantAddedEvent) Fields() []*eventstore.FieldOperation {
|
||||
@@ -458,7 +458,10 @@ func (e *GrantRemovedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *GrantRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewRemoveProjectGrantUniqueConstraint(e.grantedOrgID, e.Aggregate().ID)}
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveProjectGrantUniqueConstraint(e.grantedOrgID, e.Aggregate().ID),
|
||||
eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerGrant, e.GrantID),
|
||||
}
|
||||
}
|
||||
|
||||
func (e *GrantRemovedEvent) Fields() []*eventstore.FieldOperation {
|
||||
|
||||
@@ -37,14 +37,34 @@ type GrantMemberAddedEvent struct {
|
||||
Roles []string `json:"roles"`
|
||||
UserID string `json:"userId"`
|
||||
GrantID string `json:"grantId"`
|
||||
// userResourceOwner and grantedOrg are not persisted in the event payload.
|
||||
userResourceOwner string
|
||||
grantedOrg string
|
||||
}
|
||||
|
||||
func (e *GrantMemberAddedEvent) Payload() interface{} {
|
||||
return e
|
||||
}
|
||||
|
||||
func grantMemberOwnerTags(agg *eventstore.Aggregate, userID, userResourceOwner, grantID, grantedOrg string) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, userResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, grantedOrg),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, userID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerGrant, grantID),
|
||||
}
|
||||
}
|
||||
|
||||
func (e *GrantMemberAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectGrantMemberUniqueConstraint(e.Aggregate().ID, e.UserID, e.GrantID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectGrantMemberUniqueConstraint(e.Aggregate().ID, e.UserID, e.GrantID).WithOwners(grantMemberOwnerTags(e.Aggregate(), e.UserID, e.userResourceOwner, e.GrantID, e.grantedOrg)...)}
|
||||
}
|
||||
|
||||
func (e *GrantMemberAddedEvent) WithOwnerOrgs(userResourceOwner, grantedOrg string) *GrantMemberAddedEvent {
|
||||
e.userResourceOwner = userResourceOwner
|
||||
e.grantedOrg = grantedOrg
|
||||
return e
|
||||
}
|
||||
|
||||
func NewProjectGrantMemberAddedEvent(
|
||||
|
||||
@@ -45,6 +45,11 @@ func NewProjectMemberAddedEvent(
|
||||
}
|
||||
}
|
||||
|
||||
func (e *MemberAddedEvent) WithUserResourceOwner(userResourceOwner string) *MemberAddedEvent {
|
||||
e.MemberAddedEvent.WithUserResourceOwner(userResourceOwner)
|
||||
return e
|
||||
}
|
||||
|
||||
func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
||||
e, err := member.MemberAddedEventMapper(event)
|
||||
if err != nil {
|
||||
|
||||
@@ -53,8 +53,24 @@ func (e *ProjectAddedEvent) Payload() interface{} {
|
||||
return e
|
||||
}
|
||||
|
||||
func projectOwnerTags(agg *eventstore.Aggregate) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
||||
}
|
||||
}
|
||||
|
||||
func grantOwnerTags(agg *eventstore.Aggregate, grantID, grantedOrgID string) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, grantedOrgID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerGrant, grantID),
|
||||
}
|
||||
}
|
||||
|
||||
func (e *ProjectAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner).WithOwners(projectOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func (e *ProjectAddedEvent) Fields() []*eventstore.FieldOperation {
|
||||
@@ -151,7 +167,7 @@ func (e *ProjectChangeEvent) UniqueConstraints() []*eventstore.UniqueConstraint
|
||||
if e.Name != nil {
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveProjectNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
|
||||
NewAddProjectNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner),
|
||||
NewAddProjectNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner).WithOwners(projectOwnerTags(e.Aggregate())...),
|
||||
}
|
||||
}
|
||||
return nil
|
||||
@@ -358,12 +374,11 @@ func (e *ProjectRemovedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *ProjectRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
constraints := []*eventstore.UniqueConstraint{NewRemoveProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner)}
|
||||
if e.entityIDUniqueContraints != nil {
|
||||
for _, constraint := range e.entityIDUniqueContraints {
|
||||
constraints = append(constraints, constraint)
|
||||
}
|
||||
constraints := []*eventstore.UniqueConstraint{
|
||||
NewRemoveProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner),
|
||||
eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerProject, e.Aggregate().ID),
|
||||
}
|
||||
constraints = append(constraints, e.entityIDUniqueContraints...)
|
||||
return constraints
|
||||
}
|
||||
|
||||
|
||||
@@ -48,7 +48,7 @@ func (e *RoleAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *RoleAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectRoleUniqueConstraint(e.Key, e.Aggregate().ID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddProjectRoleUniqueConstraint(e.Key, e.Aggregate().ID).WithOwners(projectOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func (e *RoleAddedEvent) Fields() []*eventstore.FieldOperation {
|
||||
|
||||
@@ -43,7 +43,7 @@ func NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID string) *eventstore.Un
|
||||
}
|
||||
|
||||
func (e *SAMLConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID).WithOwners(projectOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func NewSAMLConfigAddedEvent(
|
||||
@@ -104,7 +104,7 @@ func (e *SAMLConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstra
|
||||
if e.EntityID != "" {
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveSAMLConfigEntityIDUniqueConstraint(e.oldEntityID),
|
||||
NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID),
|
||||
NewAddSAMLConfigEntityIDUniqueConstraint(e.EntityID).WithOwners(projectOwnerTags(e.Aggregate())...),
|
||||
}
|
||||
}
|
||||
return nil
|
||||
|
||||
@@ -0,0 +1,234 @@
|
||||
package repository_test
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/eventstore"
|
||||
"github.com/zitadel/zitadel/internal/repository/action"
|
||||
"github.com/zitadel/zitadel/internal/repository/group"
|
||||
"github.com/zitadel/zitadel/internal/repository/idpconfig"
|
||||
"github.com/zitadel/zitadel/internal/repository/instance"
|
||||
"github.com/zitadel/zitadel/internal/repository/member"
|
||||
"github.com/zitadel/zitadel/internal/repository/org"
|
||||
"github.com/zitadel/zitadel/internal/repository/policy"
|
||||
"github.com/zitadel/zitadel/internal/repository/project"
|
||||
"github.com/zitadel/zitadel/internal/repository/target"
|
||||
"github.com/zitadel/zitadel/internal/repository/user"
|
||||
"github.com/zitadel/zitadel/internal/repository/usergrant"
|
||||
)
|
||||
|
||||
func TestUniqueConstraintOwners(t *testing.T) {
|
||||
ctx := t.Context()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
cmd eventstore.Command
|
||||
want [][]string
|
||||
}{
|
||||
{
|
||||
name: "username",
|
||||
cmd: &user.HumanAddedEvent{
|
||||
BaseEvent: eventstore.BaseEvent{Agg: agg(user.AggregateType, "user-1", "org-1")},
|
||||
UserName: "alice",
|
||||
},
|
||||
want: [][]string{{"org:org-1", "user:user-1"}},
|
||||
},
|
||||
{
|
||||
name: "external idp link",
|
||||
cmd: user.NewUserIDPLinkAddedEvent(ctx, agg(user.AggregateType, "user-1", "org-1"), "idp-1", "display", "ext-1"),
|
||||
want: [][]string{{"org:org-1", "idp:idp-1", "user:user-1"}},
|
||||
},
|
||||
{
|
||||
name: "org name",
|
||||
cmd: org.NewOrgAddedEvent(ctx, agg(org.AggregateType, "org-1", "org-1"), "acme"),
|
||||
want: [][]string{{"org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "org domain",
|
||||
cmd: org.NewDomainVerifiedEvent(ctx, agg(org.AggregateType, "org-1", "org-1"), "acme.example"),
|
||||
want: [][]string{{"org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "app name",
|
||||
cmd: project.NewApplicationAddedEvent(ctx, agg(project.AggregateType, "project-1", "org-1"), "app-1", "console"),
|
||||
want: [][]string{{"org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "project role",
|
||||
cmd: project.NewRoleAddedEvent(ctx, agg(project.AggregateType, "project-1", "org-1"), "role.key", "Role", "group"),
|
||||
want: [][]string{{"org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "saml entity id",
|
||||
cmd: project.NewSAMLConfigAddedEvent(ctx, agg(project.AggregateType, "project-1", "org-1"), "app-1", "https://sp.example", nil, "", 0, ""),
|
||||
want: [][]string{{"org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "project name",
|
||||
cmd: &project.ProjectAddedEvent{
|
||||
BaseEvent: eventstore.BaseEvent{Agg: agg(project.AggregateType, "project-1", "org-1")},
|
||||
Name: "docs",
|
||||
},
|
||||
want: [][]string{{"org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "project grant two orgs",
|
||||
cmd: project.NewGrantAddedEvent(ctx, agg(project.AggregateType, "project-1", "granting-org"), "grant-1", "granted-org", nil),
|
||||
want: [][]string{{"org:granting-org", "org:granted-org", "project:project-1", "grant:grant-1"}},
|
||||
},
|
||||
{
|
||||
name: "project grant member",
|
||||
cmd: project.NewProjectGrantMemberAddedEvent(ctx, agg(project.AggregateType, "project-1", "org-1"), "user-1", "grant-1", "ROLE").
|
||||
WithOwnerOrgs("user-org", "granted-org"),
|
||||
want: [][]string{{"org:org-1", "org:user-org", "org:granted-org", "user:user-1", "project:project-1", "grant:grant-1"}},
|
||||
},
|
||||
{
|
||||
name: "user grant",
|
||||
cmd: usergrant.NewUserGrantAddedEvent(ctx, agg(user.AggregateType, "grant-row", "org-1"), "user-1", "project-1", "grant-1", nil).
|
||||
WithOwnerOrgs("user-org", "project-org", "granted-org"),
|
||||
want: [][]string{{"org:org-1", "org:user-org", "org:project-org", "org:granted-org", "user:user-1", "project:project-1", "grant:grant-1"}},
|
||||
},
|
||||
{
|
||||
name: "org member",
|
||||
cmd: member.NewMemberAddedEvent(
|
||||
&eventstore.BaseEvent{Agg: agg(org.AggregateType, "org-1", "org-1")},
|
||||
"user-1",
|
||||
).WithUserResourceOwner("org-1"),
|
||||
want: [][]string{{"user:user-1", "org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "org member cross-org user",
|
||||
cmd: member.NewMemberAddedEvent(
|
||||
&eventstore.BaseEvent{Agg: agg(org.AggregateType, "org-1", "org-1")},
|
||||
"user-1",
|
||||
).WithUserResourceOwner("user-org"),
|
||||
want: [][]string{{"user:user-1", "org:user-org", "org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "project member",
|
||||
cmd: member.NewMemberAddedEvent(
|
||||
&eventstore.BaseEvent{Agg: agg(project.AggregateType, "project-1", "org-1")},
|
||||
"user-1",
|
||||
).WithUserResourceOwner("org-1"),
|
||||
want: [][]string{{"user:user-1", "org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "project member cross-org user",
|
||||
cmd: member.NewMemberAddedEvent(
|
||||
&eventstore.BaseEvent{Agg: agg(project.AggregateType, "project-1", "org-1")},
|
||||
"user-1",
|
||||
).WithUserResourceOwner("user-org"),
|
||||
want: [][]string{{"user:user-1", "org:user-org", "org:org-1", "project:project-1"}},
|
||||
},
|
||||
{
|
||||
name: "instance member",
|
||||
cmd: member.NewMemberAddedEvent(
|
||||
&eventstore.BaseEvent{Agg: agg(instance.AggregateType, "instance-1", "instance-1")},
|
||||
"user-1",
|
||||
).WithUserResourceOwner("user-org"),
|
||||
want: [][]string{{"user:user-1", "org:user-org"}},
|
||||
},
|
||||
{
|
||||
name: "group name",
|
||||
cmd: group.NewGroupAddedEvent(ctx, agg(group.AggregateType, "group-1", "org-1"), "engineering", ""),
|
||||
want: [][]string{{"org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "action name",
|
||||
cmd: action.NewAddedEvent(ctx, agg(action.AggregateType, "action-1", "org-1"), "notify", "", 0, false),
|
||||
want: [][]string{{"org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "idp config name",
|
||||
cmd: idpconfig.NewIDPConfigAddedEvent(&eventstore.BaseEvent{Agg: agg(org.AggregateType, "org-1", "org-1")}, "idp-1", "Google", 0, 0, false),
|
||||
want: [][]string{{"org:org-1", "idp:idp-1"}},
|
||||
},
|
||||
{
|
||||
name: "mail text org",
|
||||
cmd: policy.NewMailTextAddedEvent(&eventstore.BaseEvent{Agg: agg(org.AggregateType, "org-1", "org-1")}, "InitCode", "en", "", "", "", "", "", ""),
|
||||
want: [][]string{{"org:org-1"}},
|
||||
},
|
||||
{
|
||||
name: "mail text instance empty owners",
|
||||
cmd: policy.NewMailTextAddedEvent(&eventstore.BaseEvent{Agg: agg(instance.AggregateType, "instance-1", "instance-1")}, "InitCode", "en", "", "", "", "", "", ""),
|
||||
want: [][]string{nil},
|
||||
},
|
||||
{
|
||||
name: "instance domain global empty owners",
|
||||
cmd: instance.NewDomainAddedEvent(ctx, agg(instance.AggregateType, "instance-1", "instance-1"), "acme.example", true),
|
||||
want: [][]string{nil},
|
||||
},
|
||||
{
|
||||
name: "target instance only empty owners",
|
||||
cmd: target.NewAddedEvent(ctx, agg(target.AggregateType, "target-1", "instance-1"), "hook", 0, "", 0, false, nil, 0),
|
||||
want: [][]string{nil},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
constraints := tt.cmd.UniqueConstraints()
|
||||
require.Len(t, constraints, len(tt.want))
|
||||
for i, constraint := range constraints {
|
||||
assert.Equal(t, eventstore.UniqueConstraintAdd, constraint.Action)
|
||||
assert.ElementsMatch(t, tt.want[i], constraint.Owners)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBulkRemoveAlsoEmitsRemoveByOwner(t *testing.T) {
|
||||
ctx := t.Context()
|
||||
orgAgg := agg(org.AggregateType, "org-1", "org-1")
|
||||
orgConstraints := org.NewOrgRemovedEvent(ctx, orgAgg, "acme", nil, false, nil, nil, nil).UniqueConstraints()
|
||||
require.GreaterOrEqual(t, len(orgConstraints), 2)
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemoveByOwner, orgConstraints[1].Action)
|
||||
assert.Equal(t, []string{"org:org-1"}, orgConstraints[1].Owners)
|
||||
|
||||
userAgg := agg(user.AggregateType, "user-1", "org-1")
|
||||
userConstraints := user.NewUserRemovedEvent(ctx, userAgg, "alice", nil, false).UniqueConstraints()
|
||||
last := userConstraints[len(userConstraints)-1]
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemoveByOwner, last.Action)
|
||||
assert.Equal(t, []string{"user:user-1"}, last.Owners)
|
||||
|
||||
idpConstraints := idpconfig.NewIDPConfigRemovedEvent(&eventstore.BaseEvent{Agg: orgAgg}, "idp-1", "Google").UniqueConstraints()
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemoveByOwner, idpConstraints[1].Action)
|
||||
assert.Equal(t, []string{"idp:idp-1"}, idpConstraints[1].Owners)
|
||||
|
||||
projectAgg := agg(project.AggregateType, "project-1", "org-1")
|
||||
projectConstraints := project.NewProjectRemovedEvent(ctx, projectAgg, "docs", nil).UniqueConstraints()
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemoveByOwner, projectConstraints[1].Action)
|
||||
assert.Equal(t, []string{"project:project-1"}, projectConstraints[1].Owners)
|
||||
|
||||
grantConstraints := project.NewGrantRemovedEvent(ctx, projectAgg, "grant-1", "granted-org").UniqueConstraints()
|
||||
require.Len(t, grantConstraints, 2)
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemove, grantConstraints[0].Action)
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemoveByOwner, grantConstraints[1].Action)
|
||||
assert.Equal(t, []string{"grant:grant-1"}, grantConstraints[1].Owners)
|
||||
}
|
||||
|
||||
func TestUsernameScopeRewriteKeepsUserTag(t *testing.T) {
|
||||
constraints := user.NewUsernameUniqueConstraints(
|
||||
[]user.UsernameChange{{Username: "alice", UserID: "user-1"}},
|
||||
"org-1",
|
||||
true,
|
||||
false,
|
||||
)
|
||||
require.Len(t, constraints, 2)
|
||||
assert.Equal(t, eventstore.UniqueConstraintRemove, constraints[0].Action)
|
||||
assert.Equal(t, eventstore.UniqueConstraintAdd, constraints[1].Action)
|
||||
assert.ElementsMatch(t, []string{"org:org-1", "user:user-1"}, constraints[1].Owners)
|
||||
}
|
||||
|
||||
func agg(typ eventstore.AggregateType, id, resourceOwner string) *eventstore.Aggregate {
|
||||
return &eventstore.Aggregate{
|
||||
ID: id,
|
||||
Type: typ,
|
||||
ResourceOwner: resourceOwner,
|
||||
InstanceID: "instance-1",
|
||||
Version: "v1",
|
||||
}
|
||||
}
|
||||
@@ -65,7 +65,7 @@ func (e *HumanAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *HumanAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername)}
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername).WithOwners(usernameOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func (e *HumanAddedEvent) AddAddressData(
|
||||
@@ -176,7 +176,7 @@ func (e *HumanRegisteredEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *HumanRegisteredEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername)}
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername).WithOwners(usernameOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func (e *HumanRegisteredEvent) AddAddressData(
|
||||
|
||||
@@ -47,7 +47,7 @@ func (e *UserIDPLinkAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *UserIDPLinkAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddUserIDPLinkUniqueConstraint(e.IDPConfigID, e.ExternalUserID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddUserIDPLinkUniqueConstraint(e.IDPConfigID, e.ExternalUserID).WithOwners(idpLinkOwnerTags(e.Aggregate(), e.IDPConfigID)...)}
|
||||
}
|
||||
|
||||
func NewUserIDPLinkAddedEvent(
|
||||
|
||||
@@ -32,7 +32,7 @@ func (e *MachineAddedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *MachineAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername)}
|
||||
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername).WithOwners(usernameOwnerTags(e.Aggregate())...)}
|
||||
}
|
||||
|
||||
func NewMachineAddedEvent(
|
||||
|
||||
@@ -47,18 +47,42 @@ func NewRemoveUsernameUniqueConstraint(userName, resourceOwner string, orgScoped
|
||||
uniqueUserName)
|
||||
}
|
||||
|
||||
func NewUsernameUniqueConstraints(usernameChanges []string, resourceOwner string, orgScopedUsername, oldOrgScopedUsername bool) []*eventstore.UniqueConstraint {
|
||||
// UsernameChange is a username rewrite keyed by the owning user so owner tags stay intact.
|
||||
type UsernameChange struct {
|
||||
Username string
|
||||
UserID string
|
||||
}
|
||||
|
||||
func NewUsernameUniqueConstraints(usernameChanges []UsernameChange, resourceOwner string, orgScopedUsername, oldOrgScopedUsername bool) []*eventstore.UniqueConstraint {
|
||||
if len(usernameChanges) == 0 || oldOrgScopedUsername == orgScopedUsername {
|
||||
return []*eventstore.UniqueConstraint{}
|
||||
}
|
||||
changes := make([]*eventstore.UniqueConstraint, len(usernameChanges)*2)
|
||||
for i, username := range usernameChanges {
|
||||
changes[i*2] = NewRemoveUsernameUniqueConstraint(username, resourceOwner, oldOrgScopedUsername)
|
||||
changes[i*2+1] = NewAddUsernameUniqueConstraint(username, resourceOwner, orgScopedUsername)
|
||||
for i, change := range usernameChanges {
|
||||
changes[i*2] = NewRemoveUsernameUniqueConstraint(change.Username, resourceOwner, oldOrgScopedUsername)
|
||||
changes[i*2+1] = NewAddUsernameUniqueConstraint(change.Username, resourceOwner, orgScopedUsername).WithOwners(
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, resourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, change.UserID),
|
||||
)
|
||||
}
|
||||
return changes
|
||||
}
|
||||
|
||||
func usernameOwnerTags(agg *eventstore.Aggregate) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, agg.ID),
|
||||
}
|
||||
}
|
||||
|
||||
func idpLinkOwnerTags(agg *eventstore.Aggregate, idpConfigID string) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerIDP, idpConfigID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, agg.ID),
|
||||
}
|
||||
}
|
||||
|
||||
type UserLockedEvent struct {
|
||||
eventstore.BaseEvent `json:"-"`
|
||||
}
|
||||
@@ -184,13 +208,14 @@ func (e *UserRemovedEvent) Payload() interface{} {
|
||||
}
|
||||
|
||||
func (e *UserRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
events := make([]*eventstore.UniqueConstraint, 0)
|
||||
events := make([]*eventstore.UniqueConstraint, 0, 2+len(e.externalIDPs))
|
||||
if e.userName != "" {
|
||||
events = append(events, NewRemoveUsernameUniqueConstraint(e.userName, e.Aggregate().ResourceOwner, e.orgScopedUsername))
|
||||
}
|
||||
for _, idp := range e.externalIDPs {
|
||||
events = append(events, NewRemoveUserIDPLinkUniqueConstraint(idp.IDPConfigID, idp.ExternalUserID))
|
||||
}
|
||||
events = append(events, eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerUser, e.Aggregate().ID))
|
||||
return events
|
||||
}
|
||||
|
||||
@@ -385,7 +410,7 @@ func (e *DomainClaimedEvent) Payload() interface{} {
|
||||
func (e *DomainClaimedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveUsernameUniqueConstraint(e.oldUserName, e.Aggregate().ResourceOwner, e.orgScopedUsername),
|
||||
NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername),
|
||||
NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername).WithOwners(usernameOwnerTags(e.Aggregate())...),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -486,7 +511,7 @@ func (e *UsernameChangedEvent) UniqueConstraints() []*eventstore.UniqueConstrain
|
||||
|
||||
return []*eventstore.UniqueConstraint{
|
||||
NewRemoveUsernameUniqueConstraint(e.oldUserName, e.Aggregate().ResourceOwner, oldSetting),
|
||||
NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, newSetting),
|
||||
NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, newSetting).WithOwners(usernameOwnerTags(e.Aggregate())...),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -40,14 +40,37 @@ type UserGrantAddedEvent struct {
|
||||
ProjectID string `json:"projectId,omitempty"`
|
||||
ProjectGrantID string `json:"grantId,omitempty"`
|
||||
RoleKeys []string `json:"roleKeys,omitempty"`
|
||||
// owner orgs are not persisted in the event payload.
|
||||
userResourceOwner string
|
||||
projectResourceOwner string
|
||||
grantedOrg string
|
||||
}
|
||||
|
||||
func (e *UserGrantAddedEvent) Payload() interface{} {
|
||||
return e
|
||||
}
|
||||
|
||||
func userGrantOwnerTags(agg *eventstore.Aggregate, userID, userResourceOwner, projectID, projectResourceOwner, grantID, grantedOrg string) []string {
|
||||
return []string{
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, userResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, projectResourceOwner),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, grantedOrg),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerUser, userID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, projectID),
|
||||
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerGrant, grantID),
|
||||
}
|
||||
}
|
||||
|
||||
func (e *UserGrantAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
||||
return []*eventstore.UniqueConstraint{NewAddUserGrantUniqueConstraint(e.Aggregate().ResourceOwner, e.UserID, e.ProjectID, e.ProjectGrantID)}
|
||||
return []*eventstore.UniqueConstraint{NewAddUserGrantUniqueConstraint(e.Aggregate().ResourceOwner, e.UserID, e.ProjectID, e.ProjectGrantID).WithOwners(userGrantOwnerTags(e.Aggregate(), e.UserID, e.userResourceOwner, e.ProjectID, e.projectResourceOwner, e.ProjectGrantID, e.grantedOrg)...)}
|
||||
}
|
||||
|
||||
func (e *UserGrantAddedEvent) WithOwnerOrgs(userResourceOwner, projectResourceOwner, grantedOrg string) *UserGrantAddedEvent {
|
||||
e.userResourceOwner = userResourceOwner
|
||||
e.projectResourceOwner = projectResourceOwner
|
||||
e.grantedOrg = grantedOrg
|
||||
return e
|
||||
}
|
||||
|
||||
func NewUserGrantAddedEvent(
|
||||
|
||||
Reference in New Issue
Block a user