feat: delete (#243)

* feat: project role remove

* feat: search queries

* feat: search queries

* feat: cascade remove/change project role

* fix: comment in project grant

* fix: remove projecr grant

* fix: only search usergrants of my org

* fix: delete usergrants

* fix: delete usergrants

* fix: check if role exists on project grant

* feat: bulk add project role

* fix: tests

* fix: update user grants on project update

* fix: return roles

* feat: add resourceowner name on project grants

* fix: migration number

* fix: tests

* fix: generate protos

* fix: some unnecessary code

pkg/management/api/grpc/generate.go

@@ -1,4 +1,4 @@
 package grpc
 
-//go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/zitadel/internal/protoc/protoc-gen-authoption --go_out=plugins=grpc:$GOPATH/src --grpc-gateway_out=logtostderr=true:$GOPATH/src --swagger_out=logtostderr=true:. --authoption_out=. ../proto/management.proto
+//go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/zitadel/internal/protoc/protoc-gen-authoption --go_out=plugins=grpc:$GOPATH/src --grpc-gateway_out=logtostderr=true,allow_delete_body=true:$GOPATH/src --swagger_out=logtostderr=true,allow_delete_body=true:. --authoption_out=:. ../proto/management.proto
 //go:generate mockgen -package api -destination ./mock/management.proto.mock.go github.com/caos/zitadel/pkg/management/api/grpc ManagementServiceClient

pkg/management/api/grpc/management.pb.authoptions.go

@@ -355,6 +355,11 @@ var ManagementService_AuthMethods = utils_auth.MethodMapping{
 		CheckParam: "Id",
 	},
 
+	"/caos.zitadel.management.api.v1.ManagementService/BulkAddProjectRole": utils_auth.Option{
+		Permission: "project.role.write",
+		CheckParam: "Id",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/ChangeProjectRole": utils_auth.Option{
 		Permission: "project.role.write",
 		CheckParam: "Id",
@@ -505,6 +510,21 @@ var ManagementService_AuthMethods = utils_auth.MethodMapping{
 		CheckParam: "",
 	},
 
+	"/caos.zitadel.management.api.v1.ManagementService/BulkCreateUserGrant": utils_auth.Option{
+		Permission: "user.grant.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/BulkUpdateUserGrant": utils_auth.Option{
+		Permission: "user.grant.write",
+		CheckParam: "",
+	},
+
+	"/caos.zitadel.management.api.v1.ManagementService/BulkRemoveUserGrant": utils_auth.Option{
+		Permission: "user.grant.delete",
+		CheckParam: "",
+	},
+
 	"/caos.zitadel.management.api.v1.ManagementService/SearchProjectUserGrants": utils_auth.Option{
 		Permission: "project.user.grant.read",
 		CheckParam: "ProjectId",

pkg/management/api/grpc/management.pb.gw.go

@@ -1844,6 +1844,41 @@ func request_ManagementService_AddProjectRole_0(ctx context.Context, marshaler r
 
 }
 
+func request_ManagementService_BulkAddProjectRole_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ProjectRoleAddBulk
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	var (
+		val string
+		ok  bool
+		err error
+		_   = err
+	)
+
+	val, ok = pathParams["id"]
+	if !ok {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	}
+
+	protoReq.Id, err = runtime.String(val)
+
+	if err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	}
+
+	msg, err := client.BulkAddProjectRole(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_ChangeProjectRole_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq ProjectRoleChange
 	var metadata runtime.ServerMetadata
@@ -3061,6 +3096,57 @@ func request_ManagementService_RemoveUserGrant_0(ctx context.Context, marshaler
 
 }
 
+func request_ManagementService_BulkCreateUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantCreateBulk
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.BulkCreateUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_BulkUpdateUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantUpdateBulk
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.BulkUpdateUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_BulkRemoveUserGrant_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UserGrantRemoveBulk
+	var metadata runtime.ServerMetadata
+
+	newReader, berr := utilities.IOReaderFactory(req.Body)
+	if berr != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", berr)
+	}
+	if err := marshaler.NewDecoder(newReader()).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.BulkRemoveUserGrant(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
 func request_ManagementService_SearchProjectUserGrants_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq ProjectUserGrantSearchRequest
 	var metadata runtime.ServerMetadata
@@ -5138,6 +5224,26 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se
 
 	})
 
+	mux.Handle("POST", pattern_ManagementService_BulkAddProjectRole_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_BulkAddProjectRole_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_BulkAddProjectRole_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("PUT", pattern_ManagementService_ChangeProjectRole_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -5738,6 +5844,66 @@ func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.Se
 
 	})
 
+	mux.Handle("POST", pattern_ManagementService_BulkCreateUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_BulkCreateUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_BulkCreateUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("PUT", pattern_ManagementService_BulkUpdateUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_BulkUpdateUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_BulkUpdateUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("DELETE", pattern_ManagementService_BulkRemoveUserGrant_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		rctx, err := runtime.AnnotateContext(ctx, mux, req)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_BulkRemoveUserGrant_0(rctx, inboundMarshaler, client, req, pathParams)
+		ctx = runtime.NewServerMetadataContext(ctx, md)
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_BulkRemoveUserGrant_0(ctx, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
 	mux.Handle("POST", pattern_ManagementService_SearchProjectUserGrants_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -6144,6 +6310,8 @@ var (
 
 	pattern_ManagementService_AddProjectRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2}, []string{"projects", "id", "roles"}, ""))
 
+	pattern_ManagementService_BulkAddProjectRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 2, 3}, []string{"projects", "id", "roles", "_bulk"}, ""))
+
 	pattern_ManagementService_ChangeProjectRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"projects", "id", "roles", "key"}, ""))
 
 	pattern_ManagementService_RemoveProjectRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"projects", "id", "roles", "key"}, ""))
@@ -6204,6 +6372,12 @@ var (
 
 	pattern_ManagementService_RemoveUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"users", "user_id", "grants", "id"}, ""))
 
+	pattern_ManagementService_BulkCreateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"usergrants", "_bulk"}, ""))
+
+	pattern_ManagementService_BulkUpdateUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"usergrants", "_bulk"}, ""))
+
+	pattern_ManagementService_BulkRemoveUserGrant_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"usersgrants", "_bulk"}, ""))
+
 	pattern_ManagementService_SearchProjectUserGrants_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 2, 3, 2, 4}, []string{"projects", "project_id", "users", "grants", "_search"}, ""))
 
 	pattern_ManagementService_ProjectUserGrantByID_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4, 1, 0, 4, 1, 5, 5}, []string{"projects", "project_id", "users", "user_id", "grants", "id"}, ""))
@@ -6374,6 +6548,8 @@ var (
 
 	forward_ManagementService_AddProjectRole_0 = runtime.ForwardResponseMessage
 
+	forward_ManagementService_BulkAddProjectRole_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_ChangeProjectRole_0 = runtime.ForwardResponseMessage
 
 	forward_ManagementService_RemoveProjectRole_0 = runtime.ForwardResponseMessage
@@ -6434,6 +6610,12 @@ var (
 
 	forward_ManagementService_RemoveUserGrant_0 = runtime.ForwardResponseMessage
 
+	forward_ManagementService_BulkCreateUserGrant_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_BulkUpdateUserGrant_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_BulkRemoveUserGrant_0 = runtime.ForwardResponseMessage
+
 	forward_ManagementService_SearchProjectUserGrants_0 = runtime.ForwardResponseMessage
 
 	forward_ManagementService_ProjectUserGrantByID_0 = runtime.ForwardResponseMessage

pkg/management/api/grpc/management.swagger.json

@@ -1496,8 +1496,41 @@
         ]
       }
     },
+    "/projects/{id}/roles/_bulk": {
+      "post": {
+        "operationId": "BulkAddProjectRole",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1ProjectRoleAddBulk"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
     "/projects/{id}/roles/{key}": {
       "delete": {
+        "summary": "RemoveProjectRole removes role from UserGrants, ProjectGrants and from Project",
         "operationId": "RemoveProjectRole",
         "responses": {
           "200": {
@@ -2580,6 +2613,56 @@
         ]
       }
     },
+    "/usergrants/_bulk": {
+      "post": {
+        "operationId": "BulkCreateUserGrant",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1UserGrantCreateBulk"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      },
+      "put": {
+        "operationId": "BulkUpdateUserGrant",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1UserGrantUpdateBulk"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
     "/users": {
       "post": {
         "operationId": "CreateUser",
@@ -3485,6 +3568,32 @@
         ]
       }
     },
+    "/usersgrants/_bulk": {
+      "delete": {
+        "operationId": "BulkRemoveUserGrant",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1UserGrantRemoveBulk"
+            }
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      }
+    },
     "/validate": {
       "get": {
         "operationId": "Validate",
@@ -5109,6 +5218,29 @@
         }
       }
     },
+    "v1ProjectGrantSearchKey": {
+      "type": "string",
+      "enum": [
+        "PROJECTGRANTSEARCHKEY_UNSPECIFIED",
+        "PROJECTGRANTSEARCHKEY_PROJECT_NAME",
+        "PROJECTGRANTSEARCHKEY_ROLE_KEY"
+      ],
+      "default": "PROJECTGRANTSEARCHKEY_UNSPECIFIED"
+    },
+    "v1ProjectGrantSearchQuery": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "$ref": "#/definitions/v1ProjectGrantSearchKey"
+        },
+        "method": {
+          "$ref": "#/definitions/v1SearchMethod"
+        },
+        "value": {
+          "type": "string"
+        }
+      }
+    },
     "v1ProjectGrantSearchRequest": {
       "type": "object",
       "properties": {
@@ -5122,6 +5254,12 @@
         "limit": {
           "type": "string",
           "format": "uint64"
+        },
+        "queries": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1ProjectGrantSearchQuery"
+          }
         }
       }
     },
@@ -5268,9 +5406,6 @@
         "granted_org_name": {
           "type": "string"
         },
-        "granted_org_domain": {
-          "type": "string"
-        },
         "role_keys": {
           "type": "array",
           "items": {
@@ -5294,6 +5429,12 @@
         "sequence": {
           "type": "string",
           "format": "uint64"
+        },
+        "resource_owner": {
+          "type": "string"
+        },
+        "resource_owner_name": {
+          "type": "string"
         }
       }
     },
@@ -5531,6 +5672,20 @@
         }
       }
     },
+    "v1ProjectRoleAddBulk": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "project_roles": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1ProjectRoleAdd"
+          }
+        }
+      }
+    },
     "v1ProjectRoleChange": {
       "type": "object",
       "properties": {
@@ -5818,7 +5973,12 @@
         "SEARCHMETHOD_CONTAINS",
         "SEARCHMETHOD_EQUALS_IGNORE_CASE",
         "SEARCHMETHOD_STARTS_WITH_IGNORE_CASE",
-        "SEARCHMETHOD_CONTAINS_IGNORE_CASE"
+        "SEARCHMETHOD_CONTAINS_IGNORE_CASE",
+        "SEARCHMETHOD_NOT_EQUALS",
+        "SEARCHMETHOD_GREATER_THAN",
+        "SEARCHMETHOD_LESS_THAN",
+        "SEARCHMETHOD_IS_ONE_OF",
+        "SEARCHMETHOD_LIST_CONTAINS"
       ],
       "default": "SEARCHMETHOD_EQUALS"
     },
@@ -6170,6 +6330,17 @@
         }
       }
     },
+    "v1UserGrantCreateBulk": {
+      "type": "object",
+      "properties": {
+        "user_grants": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1UserGrantCreate"
+          }
+        }
+      }
+    },
     "v1UserGrantID": {
       "type": "object",
       "properties": {
@@ -6181,13 +6352,25 @@
         }
       }
     },
+    "v1UserGrantRemoveBulk": {
+      "type": "object",
+      "properties": {
+        "ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "v1UserGrantSearchKey": {
       "type": "string",
       "enum": [
         "USERGRANTSEARCHKEY_UNSPECIFIED",
         "USERGRANTSEARCHKEY_PROJECT_ID",
         "USERGRANTSEARCHKEY_USER_ID",
-        "USERGRANTSEARCHKEY_ORG_ID"
+        "USERGRANTSEARCHKEY_ORG_ID",
+        "USERGRANTSEARCHKEY_ROLE_KEY"
       ],
       "default": "USERGRANTSEARCHKEY_UNSPECIFIED"
     },
@@ -6273,6 +6456,17 @@
         }
       }
     },
+    "v1UserGrantUpdateBulk": {
+      "type": "object",
+      "properties": {
+        "user_grants": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1UserGrantUpdate"
+          }
+        }
+      }
+    },
     "v1UserGrantView": {
       "type": "object",
       "properties": {

pkg/management/api/grpc/mock/management.proto.mock.go

@@ -177,6 +177,86 @@ func (mr *MockManagementServiceClientMockRecorder) ApplicationChanges(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ApplicationChanges", reflect.TypeOf((*MockManagementServiceClient)(nil).ApplicationChanges), varargs...)
 }
 
+// BulkAddProjectRole mocks base method
+func (m *MockManagementServiceClient) BulkAddProjectRole(arg0 context.Context, arg1 *grpc.ProjectRoleAddBulk, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "BulkAddProjectRole", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// BulkAddProjectRole indicates an expected call of BulkAddProjectRole
+func (mr *MockManagementServiceClientMockRecorder) BulkAddProjectRole(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BulkAddProjectRole", reflect.TypeOf((*MockManagementServiceClient)(nil).BulkAddProjectRole), varargs...)
+}
+
+// BulkCreateUserGrant mocks base method
+func (m *MockManagementServiceClient) BulkCreateUserGrant(arg0 context.Context, arg1 *grpc.UserGrantCreateBulk, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "BulkCreateUserGrant", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// BulkCreateUserGrant indicates an expected call of BulkCreateUserGrant
+func (mr *MockManagementServiceClientMockRecorder) BulkCreateUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BulkCreateUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).BulkCreateUserGrant), varargs...)
+}
+
+// BulkRemoveUserGrant mocks base method
+func (m *MockManagementServiceClient) BulkRemoveUserGrant(arg0 context.Context, arg1 *grpc.UserGrantRemoveBulk, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "BulkRemoveUserGrant", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// BulkRemoveUserGrant indicates an expected call of BulkRemoveUserGrant
+func (mr *MockManagementServiceClientMockRecorder) BulkRemoveUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BulkRemoveUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).BulkRemoveUserGrant), varargs...)
+}
+
+// BulkUpdateUserGrant mocks base method
+func (m *MockManagementServiceClient) BulkUpdateUserGrant(arg0 context.Context, arg1 *grpc.UserGrantUpdateBulk, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0, arg1}
+	for _, a := range arg2 {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "BulkUpdateUserGrant", varargs...)
+	ret0, _ := ret[0].(*emptypb.Empty)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// BulkUpdateUserGrant indicates an expected call of BulkUpdateUserGrant
+func (mr *MockManagementServiceClientMockRecorder) BulkUpdateUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0, arg1}, arg2...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BulkUpdateUserGrant", reflect.TypeOf((*MockManagementServiceClient)(nil).BulkUpdateUserGrant), varargs...)
+}
+
 // ChangeMyOrgMember mocks base method
 func (m *MockManagementServiceClient) ChangeMyOrgMember(arg0 context.Context, arg1 *grpc.ChangeOrgMemberRequest, arg2 ...grpc0.CallOption) (*grpc.OrgMember, error) {
 	m.ctrl.T.Helper()

pkg/management/api/grpc/project.go

@@ -81,6 +81,12 @@ func (s *Server) AddProjectRole(ctx context.Context, in *ProjectRoleAdd) (*Proje
 	}
 	return projectRoleFromModel(role), nil
 }
+
+func (s *Server) BulkAddProjectRole(ctx context.Context, in *ProjectRoleAddBulk) (*empty.Empty, error) {
+	err := s.project.BulkAddProjectRole(ctx, projectRoleAddBulkToModel(in))
+	return &empty.Empty{}, err
+}
+
 func (s *Server) ChangeProjectRole(ctx context.Context, in *ProjectRoleChange) (*ProjectRole, error) {
 	role, err := s.project.ChangeProjectRole(ctx, projectRoleChangeToModel(in))
 	if err != nil {

pkg/management/api/grpc/project_converter.go

@@ -131,6 +131,21 @@ func projectRoleFromModel(role *proj_model.ProjectRole) *ProjectRole {
 	}
 }
 
+func projectRoleAddBulkToModel(bulk *ProjectRoleAddBulk) []*proj_model.ProjectRole {
+	roles := make([]*proj_model.ProjectRole, len(bulk.ProjectRoles))
+	for i, role := range bulk.ProjectRoles {
+		roles[i] = &proj_model.ProjectRole{
+			ObjectRoot: models.ObjectRoot{
+				AggregateID: bulk.Id,
+			},
+			Key:         role.Key,
+			DisplayName: role.DisplayName,
+			Group:       role.Group,
+		}
+	}
+	return roles
+}
+
 func projectRoleAddToModel(role *ProjectRoleAdd) *proj_model.ProjectRole {
 	return &proj_model.ProjectRole{
 		ObjectRoot: models.ObjectRoot{

pkg/management/api/grpc/project_grant_converter.go

@@ -51,17 +51,40 @@ func projectGrantSearchRequestsToModel(request *ProjectGrantSearchRequest) *proj
 	return &proj_model.ProjectGrantViewSearchRequest{
 		Offset:  request.Offset,
 		Limit:   request.Limit,
-		Queries: projectGrantSearchQueriesToModel(request.ProjectId),
+		Queries: projectGrantSearchQueriesToModel(request.ProjectId, request.Queries),
 	}
 }
 
-func projectGrantSearchQueriesToModel(projectId string) []*proj_model.ProjectGrantViewSearchQuery {
+func projectGrantSearchQueriesToModel(projectId string, queries []*ProjectGrantSearchQuery) []*proj_model.ProjectGrantViewSearchQuery {
 	converted := make([]*proj_model.ProjectGrantViewSearchQuery, 0)
-	return append(converted, &proj_model.ProjectGrantViewSearchQuery{
+	converted = append(converted, &proj_model.ProjectGrantViewSearchQuery{
 		Key:    proj_model.GRANTEDPROJECTSEARCHKEY_PROJECTID,
 		Method: model.SEARCHMETHOD_EQUALS,
 		Value:  projectId,
 	})
+	for i, query := range queries {
+		converted[i] = projectGrantSearchQueryToModel(query)
+	}
+	return converted
+}
+
+func projectGrantSearchQueryToModel(query *ProjectGrantSearchQuery) *proj_model.ProjectGrantViewSearchQuery {
+	return &proj_model.ProjectGrantViewSearchQuery{
+		Key:    projectGrantViewSearchKeyToModel(query.Key),
+		Method: searchMethodToModel(query.Method),
+		Value:  query.Value,
+	}
+}
+
+func projectGrantViewSearchKeyToModel(key ProjectGrantSearchKey) proj_model.ProjectGrantViewSearchKey {
+	switch key {
+	case ProjectGrantSearchKey_PROJECTGRANTSEARCHKEY_PROJECT_NAME:
+		return proj_model.GRANTEDPROJECTSEARCHKEY_PROJECTID
+	case ProjectGrantSearchKey_PROJECTGRANTSEARCHKEY_ROLE_KEY:
+		return proj_model.GRANTEDPROJECTSEARCHKEY_ROLE_KEYS
+	default:
+		return proj_model.GRANTEDPROJECTSEARCHKEY_UNSPECIFIED
+	}
 }
 
 func projectGrantSearchResponseFromModel(response *proj_model.ProjectGrantViewSearchResponse) *ProjectGrantSearchResponse {
@@ -89,16 +112,18 @@ func projectGrantFromGrantedProjectModel(project *proj_model.ProjectGrantView) *
 	logging.Log("GRPC-sope3").OnError(err).Debug("unable to parse timestamp")
 
 	return &ProjectGrantView{
-		ProjectId:        project.ProjectID,
-		State:            projectGrantStateFromProjectStateModel(project.State),
-		CreationDate:     creationDate,
-		ChangeDate:       changeDate,
-		ProjectName:      project.Name,
-		Sequence:         project.Sequence,
-		GrantedOrgId:     project.OrgID,
-		GrantedOrgName:   project.OrgName,
-		GrantedOrgDomain: project.OrgDomain,
-		Id:               project.GrantID,
+		ProjectId:         project.ProjectID,
+		State:             projectGrantStateFromProjectStateModel(project.State),
+		CreationDate:      creationDate,
+		ChangeDate:        changeDate,
+		ProjectName:       project.Name,
+		Sequence:          project.Sequence,
+		GrantedOrgId:      project.OrgID,
+		GrantedOrgName:    project.OrgName,
+		Id:                project.GrantID,
+		RoleKeys:          project.GrantedRoleKeys,
+		ResourceOwner:     project.ResourceOwner,
+		ResourceOwnerName: project.ResourceOwnerName,
 	}
 }
 

pkg/management/api/grpc/search_converter.go

@@ -16,6 +16,12 @@ func searchMethodToModel(method SearchMethod) model.SearchMethod {
 		return model.SEARCHMETHOD_CONTAINS_IGNORE_CASE
 	case SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
 		return model.SEARCHMETHOD_STARTS_WITH_IGNORE_CASE
+	case SearchMethod_SEARCHMETHOD_NOT_EQUALS:
+		return model.SEARCHMETHOD_NOT_EQUALS
+	case SearchMethod_SEARCHMETHOD_IS_ONE_OF:
+		return model.SEARCHMETHOD_IS_ONE_OF
+	case SearchMethod_SEARCHMETHOD_LIST_CONTAINS:
+		return model.SEARCHMETHOD_LIST_CONTAINS
 	default:
 		return model.SEARCHMETHOD_EQUALS
 	}

pkg/management/api/grpc/user_grant.go

@@ -2,12 +2,14 @@ package grpc
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/auth"
 	"github.com/caos/zitadel/internal/errors"
 	"github.com/golang/protobuf/ptypes/empty"
 )
 
 func (s *Server) SearchUserGrants(ctx context.Context, in *UserGrantSearchRequest) (*UserGrantSearchResponse, error) {
 	request := userGrantSearchRequestsToModel(in)
+	request.AppendMyOrgQuery(auth.GetCtxData(ctx).OrgID)
 	response, err := s.usergrant.SearchUserGrants(ctx, request)
 	if err != nil {
 		return nil, err
@@ -30,6 +32,7 @@ func (s *Server) CreateUserGrant(ctx context.Context, in *UserGrantCreate) (*Use
 	}
 	return usergrantFromModel(user), nil
 }
+
 func (s *Server) UpdateUserGrant(ctx context.Context, in *UserGrantUpdate) (*UserGrant, error) {
 	user, err := s.usergrant.ChangeUserGrant(ctx, userGrantUpdateToModel(in))
 	if err != nil {
@@ -57,6 +60,21 @@ func (s *Server) RemoveUserGrant(ctx context.Context, in *UserGrantID) (*empty.E
 	return &empty.Empty{}, err
 }
 
+func (s *Server) BulkCreateUserGrant(ctx context.Context, in *UserGrantCreateBulk) (*empty.Empty, error) {
+	err := s.usergrant.BulkAddUserGrant(ctx, userGrantCreateBulkToModel(in)...)
+	return &empty.Empty{}, err
+}
+
+func (s *Server) BulkUpdateUserGrant(ctx context.Context, in *UserGrantUpdateBulk) (*empty.Empty, error) {
+	err := s.usergrant.BulkChangeUserGrant(ctx, userGrantUpdateBulkToModel(in)...)
+	return &empty.Empty{}, err
+}
+
+func (s *Server) BulkRemoveUserGrant(ctx context.Context, in *UserGrantRemoveBulk) (*empty.Empty, error) {
+	err := s.usergrant.BulkRemoveUserGrant(ctx, userGrantRemoveBulkToModel(in)...)
+	return &empty.Empty{}, err
+}
+
 func (s *Server) SearchProjectUserGrants(ctx context.Context, request *ProjectUserGrantSearchRequest) (*UserGrantSearchResponse, error) {
 	return nil, errors.ThrowUnimplemented(nil, "GRPC-8jdSw", "Not implemented")
 }

pkg/management/api/grpc/user_grant_converter.go

@@ -26,6 +26,14 @@ func usergrantFromModel(grant *grant_model.UserGrant) *UserGrant {
 	}
 }
 
+func userGrantCreateBulkToModel(u *UserGrantCreateBulk) []*grant_model.UserGrant {
+	grants := make([]*grant_model.UserGrant, len(u.UserGrants))
+	for i, grant := range u.UserGrants {
+		grants[i] = userGrantCreateToModel(grant)
+	}
+	return grants
+}
+
 func userGrantCreateToModel(u *UserGrantCreate) *grant_model.UserGrant {
 	return &grant_model.UserGrant{
 		ObjectRoot: models.ObjectRoot{AggregateID: u.UserId},
@@ -35,6 +43,14 @@ func userGrantCreateToModel(u *UserGrantCreate) *grant_model.UserGrant {
 	}
 }
 
+func userGrantUpdateBulkToModel(u *UserGrantUpdateBulk) []*grant_model.UserGrant {
+	grants := make([]*grant_model.UserGrant, len(u.UserGrants))
+	for i, grant := range u.UserGrants {
+		grants[i] = userGrantUpdateToModel(grant)
+	}
+	return grants
+}
+
 func userGrantUpdateToModel(u *UserGrantUpdate) *grant_model.UserGrant {
 	return &grant_model.UserGrant{
 		ObjectRoot: models.ObjectRoot{AggregateID: u.Id},
@@ -42,6 +58,14 @@ func userGrantUpdateToModel(u *UserGrantUpdate) *grant_model.UserGrant {
 	}
 }
 
+func userGrantRemoveBulkToModel(u *UserGrantRemoveBulk) []string {
+	ids := make([]string, len(u.Ids))
+	for i, id := range u.Ids {
+		ids[i] = id
+	}
+	return ids
+}
+
 func projectUserGrantUpdateToModel(u *ProjectUserGrantUpdate) *grant_model.UserGrant {
 	return &grant_model.UserGrant{
 		ObjectRoot: models.ObjectRoot{AggregateID: u.Id},
@@ -96,6 +120,8 @@ func userGrantSearchKeyToModel(key UserGrantSearchKey) grant_model.UserGrantSear
 		return grant_model.USERGRANTSEARCHKEY_PROJECT_ID
 	case UserGrantSearchKey_USERGRANTSEARCHKEY_USER_ID:
 		return grant_model.USERGRANTSEARCHKEY_USER_ID
+	case UserGrantSearchKey_USERGRANTSEARCHKEY_ROLE_KEY:
+		return grant_model.USERGRANTSEARCHKEY_ROLE_KEY
 	default:
 		return grant_model.USERGRANTSEARCHKEY_UNSPECIFIED
 	}

pkg/management/api/proto/management.proto

@@ -801,6 +801,18 @@ service ManagementService {
         };
     }
 
+    rpc BulkAddProjectRole(ProjectRoleAddBulk) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            post: "/projects/{id}/roles/_bulk"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "project.role.write"
+            check_field_name: "Id"
+        };
+    }
+
     rpc ChangeProjectRole(ProjectRoleChange) returns (ProjectRole) {
         option (google.api.http) = {
             put: "/projects/{id}/roles/{key}"
@@ -813,6 +825,7 @@ service ManagementService {
         };
     }
 
+    /* RemoveProjectRole removes role from UserGrants, ProjectGrants and from Project */
     rpc RemoveProjectRole(ProjectRoleRemove) returns (google.protobuf.Empty) {
         option (google.api.http) = {
             delete: "/projects/{id}/roles/{key}"
@@ -1137,6 +1150,39 @@ service ManagementService {
         };
     }
 
+    rpc BulkCreateUserGrant(UserGrantCreateBulk) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            post: "/usergrants/_bulk"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.write"
+        };
+    }
+
+    rpc BulkUpdateUserGrant(UserGrantUpdateBulk) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            put: "/usergrants/_bulk"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.write"
+        };
+    }
+
+    rpc BulkRemoveUserGrant(UserGrantRemoveBulk) returns (google.protobuf.Empty) {
+        option (google.api.http) = {
+            delete: "/usersgrants/_bulk"
+            body: "*"
+        };
+
+        option (caos.zitadel.utils.v1.auth_option) = {
+            permission: "user.grant.delete"
+        };
+    }
+
     //PROJECT_USER_GRANT
     rpc SearchProjectUserGrants(ProjectUserGrantSearchRequest) returns (UserGrantSearchResponse) {
         option (google.api.http) = {
@@ -1470,6 +1516,11 @@ enum SearchMethod {
     SEARCHMETHOD_EQUALS_IGNORE_CASE = 3;
     SEARCHMETHOD_STARTS_WITH_IGNORE_CASE = 4;
     SEARCHMETHOD_CONTAINS_IGNORE_CASE = 5;
+    SEARCHMETHOD_NOT_EQUALS = 6;
+    SEARCHMETHOD_GREATER_THAN = 7;
+    SEARCHMETHOD_LESS_THAN = 8;
+    SEARCHMETHOD_IS_ONE_OF = 9;
+    SEARCHMETHOD_LIST_CONTAINS = 10;
 }
 
 message UserProfile {
@@ -1993,6 +2044,11 @@ message ProjectRoleAdd {
      string group = 4;
 }
 
+message ProjectRoleAddBulk {
+    string id = 1;
+    repeated ProjectRoleAdd project_roles = 2;
+}
+
 message ProjectRoleChange {
     string id = 1;
     string key = 2;
@@ -2252,13 +2308,14 @@ message ProjectGrantView {
     string project_id = 2;
     string granted_org_id = 3;
     string granted_org_name = 4;
-    string granted_org_domain = 5;
-    repeated string role_keys = 6;
-    ProjectGrantState state = 7;
-    google.protobuf.Timestamp creation_date = 8;
-    google.protobuf.Timestamp change_date = 9;
-    string project_name = 10;
-    uint64 sequence = 11;
+    repeated string role_keys = 5;
+    ProjectGrantState state = 6;
+    google.protobuf.Timestamp creation_date = 7;
+    google.protobuf.Timestamp change_date = 8;
+    string project_name = 9;
+    uint64 sequence = 10;
+    string resource_owner = 11;
+    string resource_owner_name = 12;
 }
 
 message ProjectGrantSearchResponse {
@@ -2268,18 +2325,32 @@ message ProjectGrantSearchResponse {
     repeated ProjectGrantView result = 4;
 }
 
-message ProjectGrantSearchRequest {
-    string project_id = 1;
-    uint64 offset = 2;
-    uint64 limit = 3;
-}
-
 message GrantedProjectSearchRequest {
     uint64 offset = 1;
     uint64 limit = 2;
     repeated ProjectSearchQuery queries = 3;
 }
 
+message ProjectGrantSearchRequest {
+    string project_id = 1;
+    uint64 offset = 2;
+    uint64 limit = 3;
+    repeated ProjectGrantSearchQuery queries = 4;
+}
+
+message ProjectGrantSearchQuery {
+    ProjectGrantSearchKey key = 1 [(validate.rules).enum = {not_in: [0]}];
+    SearchMethod method = 2;
+    string value = 3;
+}
+
+enum ProjectGrantSearchKey {
+    PROJECTGRANTSEARCHKEY_UNSPECIFIED = 0;
+    PROJECTGRANTSEARCHKEY_PROJECT_NAME = 1;
+    PROJECTGRANTSEARCHKEY_ROLE_KEY = 2;
+}
+
+
 message ProjectGrantMemberRoles {
     repeated string roles = 1;
 }
@@ -2366,18 +2437,30 @@ message UserGrant {
     uint64 sequence = 9;
 }
 
+message UserGrantCreateBulk {
+    repeated UserGrantCreate user_grants = 1;
+}
+
 message UserGrantCreate {
     string user_id = 1;
     string project_id = 2;
     repeated string role_keys = 3;
 }
 
+message UserGrantUpdateBulk {
+    repeated UserGrantUpdate user_grants = 1;
+}
+
 message UserGrantUpdate {
     string user_id = 1;
     string id = 2;
     repeated string role_keys = 3;
 }
 
+message UserGrantRemoveBulk {
+    repeated string ids = 1;
+}
+
 message UserGrantID {
     string user_id = 1;
     string id = 2;
@@ -2467,6 +2550,7 @@ enum UserGrantSearchKey {
     USERGRANTSEARCHKEY_PROJECT_ID = 1;
     USERGRANTSEARCHKEY_USER_ID = 2;
     USERGRANTSEARCHKEY_ORG_ID = 3;
+    USERGRANTSEARCHKEY_ROLE_KEY = 4;
 }
 
 message ProjectUserGrantSearchRequest {