andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-14 18:05:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: add resourceowner to check for project in project grant (#8785)

Browse Source 
# Which Problems Are Solved

Resource owner can be different than expected if the provided
x-zitadel-orgid header is provided.

# How the Problems Are Solved

Check that the project is only checked with the correct resource owner
to avoid unexpected situations.

# Additional Changes

None

# Additional Context

Closes #8685

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Stefan Benz
2024-10-30 08:53:00 +00:00
committed by GitHub
co-authored by Livio Spring
parent cff4fe5dfd
commit 6780c5a07c
4 changed files with 114 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/project_grant_test.go
+90
View File
@@ -79,6 +79,50 @@ func TestCommandSide_AddProjectGrant(t *testing.T) {
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project not existing in org, precondition error",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "otherorg").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(),
&org.NewAggregate("grantedorg1").Aggregate,
"granted org",
),
),
eventFromEventPusher(
project.NewRoleAddedEvent(context.Background(),
&project.NewAggregate("project1", "otherorg").Aggregate,
"key1",
"key",
"",
),
),
),
),
},
args: args{
ctx: context.Background(),
projectGrant: &domain.ProjectGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "project1",
},
GrantedOrgID: "grantedorg1",
},
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "granted org not existing, precondition error",
fields: fields{
@@ -325,6 +369,52 @@ func TestCommandSide_ChangeProjectGrant(t *testing.T) {
err: zerrors.IsPreconditionFailed,
},
},
{
name: "project not existing in org, precondition error",
fields: fields{
eventstore: eventstoreExpect(
t,
expectFilter(
eventFromEventPusher(project.NewGrantAddedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"projectgrant1",
"grantedorg1",
[]string{"key1"},
)),
),
expectFilter(
eventFromEventPusher(
project.NewProjectAddedEvent(context.Background(),
&project.NewAggregate("project1", "otherorg").Aggregate,
"projectname1", true, true, true,
domain.PrivateLabelingSettingUnspecified,
),
),
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(),
&org.NewAggregate("grantedorg1").Aggregate,
"granted org",
),
),
),
),
},
args: args{
ctx: context.Background(),
projectGrant: &domain.ProjectGrant{
ObjectRoot: models.ObjectRoot{
AggregateID: "project1",
},
GrantID: "projectgrant1",
GrantedOrgID: "grantedorg1",
RoleKeys: []string{"key1"},
},
resourceOwner: "org1",
},
res: res{
err: zerrors.IsPreconditionFailed,
},
},
{
name: "granted org not existing, precondition error",
fields: fields{