andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-12 17:15:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add resourceowner to check for project in project grant (#8785)

Browse Source 
# Which Problems Are Solved

Resource owner can be different than expected if the provided
x-zitadel-orgid header is provided.

# How the Problems Are Solved

Check that the project is only checked with the correct resource owner
to avoid unexpected situations.

# Additional Changes

None

# Additional Context

Closes #8685

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Stefan Benz
2024-10-30 08:53:00 +00:00
committed by GitHub
co-authored by Livio Spring
parent cff4fe5dfd
commit 6780c5a07c
4 changed files with 114 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/project_grant_model.go
+14 -1
View File
@@ -121,8 +121,9 @@ type ProjectGrantPreConditionReadModel struct {
ExistingRoleKeys []string
}
func NewProjectGrantPreConditionReadModel(projectID, grantedOrgID string) *ProjectGrantPreConditionReadModel {
func NewProjectGrantPreConditionReadModel(projectID, grantedOrgID, resourceOwner string) *ProjectGrantPreConditionReadModel {
return &ProjectGrantPreConditionReadModel{
WriteModel: eventstore.WriteModel{ResourceOwner: resourceOwner},
ProjectID: projectID,
GrantedOrgID: grantedOrgID,
}
@@ -132,12 +133,24 @@ func (wm *ProjectGrantPreConditionReadModel) Reduce() error {
for _, event := range wm.Events {
switch e := event.(type) {
case *project.ProjectAddedEvent:
if e.Aggregate().ResourceOwner != wm.ResourceOwner {
continue
}
wm.ProjectExists = true
case *project.ProjectRemovedEvent:
if e.Aggregate().ResourceOwner != wm.ResourceOwner {
continue
}
wm.ProjectExists = false
case *project.RoleAddedEvent:
if e.Aggregate().ResourceOwner != wm.ResourceOwner {
continue
}
wm.ExistingRoleKeys = append(wm.ExistingRoleKeys, e.Key)
case *project.RoleRemovedEvent:
if e.Aggregate().ResourceOwner != wm.ResourceOwner {
continue
}
for i, key := range wm.ExistingRoleKeys {
if key == e.Key {
copy(wm.ExistingRoleKeys[i:], wm.ExistingRoleKeys[i+1:])