feat(rt): authorizations (#11066)

# Which Problems Are Solved

This PR implements relational table and repository interface for the
authorizations feature as described in
https://github.com/zitadel/zitadel/issues/10767

# How the Problems Are Solved

By
* adding new `zitadel.authorizations` and `zitadel.authorization_roles`
tables
* implementing the `AuthorizationRepository` interface to create,
update, query, and delete user authorizations and roles
* implementing `authorization_relational.go` projection to update
`zitadel.authorizations` and `zitadel.authorization_roles` tables based
on events

# Additional Changes
N/A

# Additional Context
- Closes #10767

---------

Co-authored-by: Livio Spring <[email protected]>

backend/v3/storage/database/dialect/postgres/migration/010_authorizations_table.go

@@ -0,0 +1,16 @@
+package migration
+
+import (
+	_ "embed"
+)
+
+var (
+	//go:embed 010_authorizations_table/up.sql
+	up010AuthorizationsTable string
+	//go:embed 010_authorizations_table/down.sql
+	down010AuthorizationsTable string
+)
+
+func init() {
+	registerSQLMigration(10, up010AuthorizationsTable, down010AuthorizationsTable)
+}

backend/v3/storage/database/dialect/postgres/migration/010_authorizations_table/down.sql

@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS zitadel.authorization_roles;
+DROP TABLE IF EXISTS zitadel.authorizations;
+DROP TYPE IF EXISTS zitadel.authorization_state;

backend/v3/storage/database/dialect/postgres/migration/010_authorizations_table/up.sql

@@ -0,0 +1,40 @@
+CREATE TYPE zitadel.authorization_state AS ENUM (
+    'active',
+    'inactive'
+    );
+
+CREATE TABLE zitadel.authorizations
+(
+    instance_id TEXT                        NOT NULL,
+    id          TEXT                        NOT NULL CHECK ( id <> '' ),
+    state       zitadel.authorization_state NOT NULL DEFAULT 'active',
+    project_id  TEXT                        NOT NULL,
+    grant_id    TEXT,
+    user_id     TEXT                        NOT NULL,
+    created_at  TIMESTAMPTZ                 NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ                 NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (instance_id, id),
+--     FOREIGN KEY (instance_id, user_id) REFERENCES zitadel.users (instance_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (instance_id, project_id) REFERENCES zitadel.projects (instance_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (instance_id, grant_id) REFERENCES zitadel.project_grants (instance_id, id) ON DELETE CASCADE
+);
+
+CREATE TABLE zitadel.authorization_roles
+(
+    instance_id      TEXT NOT NULL,
+    authorization_id TEXT NOT NULL,
+    role_key         TEXT NOT NULL CHECK ( role_key <> '' ),
+    project_id       TEXT NOT NULL,
+    grant_id         TEXT,
+    PRIMARY KEY (instance_id, authorization_id, role_key),
+    FOREIGN KEY (instance_id, authorization_id) REFERENCES zitadel.authorizations (instance_id, id) ON DELETE CASCADE,
+    FOREIGN KEY (instance_id, project_id, role_key) REFERENCES zitadel.project_roles (instance_id, project_id, key) ON DELETE CASCADE,
+    FOREIGN KEY (instance_id, grant_id, role_key) REFERENCES zitadel.project_grant_roles (instance_id, grant_id, key) ON DELETE CASCADE
+);
+
+CREATE TRIGGER trigger_set_updated_at
+    BEFORE UPDATE
+    ON zitadel.authorizations
+    FOR EACH ROW
+    WHEN (NEW.updated_at IS NULL)
+EXECUTE FUNCTION zitadel.set_updated_at();