feat: Login, OP Support and Auth Queries (#177)

* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <[email protected]> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <[email protected]> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <[email protected]> * fix test * fix ports and enable console Co-authored-by: Fabiennne <[email protected]> Co-authored-by: Fabi <[email protected]> Co-authored-by: Silvan <[email protected]>
2026-10-30 11:02:16 +00:00 · 2020-06-05 07:50:04 +02:00
parent 46b60a6968
commit 8a5badddf6
293 changed files with 14189 additions and 3176 deletions
@@ -105,12 +105,12 @@ var AuthService_AuthMethods = utils_auth.MethodMapping{
 		CheckParam: "",
 	},

-	"/zitadel.auth.api.v1.AuthService/SearchMyProjectOrgs": utils_auth.Option{
+	"/zitadel.auth.api.v1.AuthService/SearchMyUserGrant": utils_auth.Option{
 		Permission: "authenticated",
 		CheckParam: "",
 	},

-	"/zitadel.auth.api.v1.AuthService/IsIamAdmin": utils_auth.Option{
+	"/zitadel.auth.api.v1.AuthService/SearchMyProjectOrgs": utils_auth.Option{
 		Permission: "authenticated",
 		CheckParam: "",
 	},
@@ -19,22 +19,6 @@
    "application/grpc"
  ],
  "paths": {
-    "/global/_isiamadmin": {
-      "get": {
-        "operationId": "IsIamAdmin",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/v1IsAdminResponse"
-            }
-          }
-        },
-        "tags": [
-          "AuthService"
-        ]
-      }
-    },
    "/global/projectorgs/_search": {
      "post": {
        "operationId": "SearchMyProjectOrgs",
@@ -128,6 +112,32 @@
        ]
      }
    },
+    "/usergrants/me/_search": {
+      "post": {
+        "operationId": "SearchMyUserGrant",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "$ref": "#/definitions/v1UserGrantSearchResponse"
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "body",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/v1UserGrantSearchRequest"
+            }
+          }
+        ],
+        "tags": [
+          "AuthService"
+        ]
+      }
+    },
    "/users/me/address": {
      "get": {
        "operationId": "GetMyUserAddress",
@@ -510,7 +520,7 @@
          "200": {
            "description": "A successful response.",
            "schema": {
-              "type": "object"
+              "$ref": "#/definitions/protobufStruct"
            }
          }
        },
@@ -521,6 +531,19 @@
    }
  },
  "definitions": {
+    "protobufListValue": {
+      "type": "object",
+      "properties": {
+        "values": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/protobufValue"
+          },
+          "description": "Repeated field of dynamically typed values."
+        }
+      },
+      "description": "`ListValue` is a wrapper around a repeated field of values.\n\nThe JSON representation for `ListValue` is JSON array."
+    },
    "protobufNullValue": {
      "type": "string",
      "enum": [
@@ -529,6 +552,51 @@
      "default": "NULL_VALUE",
      "description": "`NullValue` is a singleton enumeration to represent the null value for the\n`Value` type union.\n\n The JSON representation for `NullValue` is JSON `null`.\n\n - NULL_VALUE: Null value."
    },
+    "protobufStruct": {
+      "type": "object",
+      "properties": {
+        "fields": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/protobufValue"
+          },
+          "description": "Unordered map of dynamically typed values."
+        }
+      },
+      "description": "`Struct` represents a structured data value, consisting of fields\nwhich map to dynamically typed values. In some languages, `Struct`\nmight be supported by a native representation. For example, in\nscripting languages like JS a struct is represented as an\nobject. The details of that representation are described together\nwith the proto support for the language.\n\nThe JSON representation for `Struct` is JSON object."
+    },
+    "protobufValue": {
+      "type": "object",
+      "properties": {
+        "null_value": {
+          "$ref": "#/definitions/protobufNullValue",
+          "description": "Represents a null value."
+        },
+        "number_value": {
+          "type": "number",
+          "format": "double",
+          "description": "Represents a double value."
+        },
+        "string_value": {
+          "type": "string",
+          "description": "Represents a string value."
+        },
+        "bool_value": {
+          "type": "boolean",
+          "format": "boolean",
+          "description": "Represents a boolean value."
+        },
+        "struct_value": {
+          "$ref": "#/definitions/protobufStruct",
+          "description": "Represents a structured value."
+        },
+        "list_value": {
+          "$ref": "#/definitions/protobufListValue",
+          "description": "Represents a repeated `Value`."
+        }
+      },
+      "description": "`Value` represents a dynamically typed value which can be either\nnull, a number, a string, a boolean, a recursive struct value, or a\nlist of values. A producer of value is expected to set one of that\nvariants, absence of any variant indicates an error.\n\nThe JSON representation for `Value` is JSON value."
+    },
    "v1Gender": {
      "type": "string",
      "enum": [
@@ -539,15 +607,6 @@
      ],
      "default": "GENDER_UNSPECIFIED"
    },
-    "v1IsAdminResponse": {
-      "type": "object",
-      "properties": {
-        "is_admin": {
-          "type": "boolean",
-          "format": "boolean"
-        }
-      }
-    },
    "v1MFAState": {
      "type": "string",
      "enum": [
@@ -712,7 +771,10 @@
      "enum": [
        "SEARCHMETHOD_EQUALS",
        "SEARCHMETHOD_STARTS_WITH",
-        "SEARCHMETHOD_CONTAINS"
+        "SEARCHMETHOD_CONTAINS",
+        "SEARCHMETHOD_EQUALS_IGNORE_CASE",
+        "SEARCHMETHOD_STARTS_WITH_IGNORE_CASE",
+        "SEARCHMETHOD_CONTAINS_IGNORE_CASE"
      ],
      "default": "SEARCHMETHOD_EQUALS"
    },
@@ -837,6 +899,101 @@
        }
      }
    },
+    "v1UserGrantSearchKey": {
+      "type": "string",
+      "enum": [
+        "UserGrantSearchKey_UNKNOWN",
+        "UserGrantSearchKey_ORG_ID",
+        "UserGrantSearchKey_PROJECT_ID"
+      ],
+      "default": "UserGrantSearchKey_UNKNOWN"
+    },
+    "v1UserGrantSearchQuery": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "$ref": "#/definitions/v1UserGrantSearchKey"
+        },
+        "method": {
+          "$ref": "#/definitions/v1SearchMethod"
+        },
+        "value": {
+          "type": "string"
+        }
+      }
+    },
+    "v1UserGrantSearchRequest": {
+      "type": "object",
+      "properties": {
+        "offset": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "limit": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "sorting_column": {
+          "$ref": "#/definitions/v1UserGrantSearchKey"
+        },
+        "asc": {
+          "type": "boolean",
+          "format": "boolean"
+        },
+        "queries": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1UserGrantSearchQuery"
+          }
+        }
+      }
+    },
+    "v1UserGrantSearchResponse": {
+      "type": "object",
+      "properties": {
+        "offset": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "limit": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "total_result": {
+          "type": "string",
+          "format": "uint64"
+        },
+        "result": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/v1UserGrantView"
+          }
+        }
+      }
+    },
+    "v1UserGrantView": {
+      "type": "object",
+      "properties": {
+        "OrgId": {
+          "type": "string"
+        },
+        "ProjectId": {
+          "type": "string"
+        },
+        "UserId": {
+          "type": "string"
+        },
+        "Roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "OrgName": {
+          "type": "string"
+        }
+      }
+    },
    "v1UserPhone": {
      "type": "object",
      "properties": {
@@ -1,15 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/golang/protobuf/ptypes/empty"
-)
-
-func (s *Server) SearchMyProjectOrgs(ctx context.Context, request *MyProjectOrgSearchRequest) (*MyProjectOrgSearchResponse, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-8kdRf", "Not implemented")
-}
-
-func (s *Server) IsIamAdmin(ctx context.Context, _ *empty.Empty) (*IsAdminResponse, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-9odFv", "Not implemented")
-}
@@ -277,26 +277,6 @@ func (mr *MockAuthServiceClientMockRecorder) Healthz(arg0, arg1 interface{}, arg
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Healthz", reflect.TypeOf((*MockAuthServiceClient)(nil).Healthz), varargs...)
 }

-// IsIamAdmin mocks base method
-func (m *MockAuthServiceClient) IsIamAdmin(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc0.CallOption) (*grpc.IsAdminResponse, error) {
-	m.ctrl.T.Helper()
-	varargs := []interface{}{arg0, arg1}
-	for _, a := range arg2 {
-		varargs = append(varargs, a)
-	}
-	ret := m.ctrl.Call(m, "IsIamAdmin", varargs...)
-	ret0, _ := ret[0].(*grpc.IsAdminResponse)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// IsIamAdmin indicates an expected call of IsIamAdmin
-func (mr *MockAuthServiceClientMockRecorder) IsIamAdmin(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]interface{}{arg0, arg1}, arg2...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsIamAdmin", reflect.TypeOf((*MockAuthServiceClient)(nil).IsIamAdmin), varargs...)
-}
-
 // Ready mocks base method
 func (m *MockAuthServiceClient) Ready(arg0 context.Context, arg1 *emptypb.Empty, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
@@ -397,24 +377,24 @@ func (mr *MockAuthServiceClientMockRecorder) SearchMyProjectOrgs(arg0, arg1 inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SearchMyProjectOrgs", reflect.TypeOf((*MockAuthServiceClient)(nil).SearchMyProjectOrgs), varargs...)
 }

-// SetMyPassword mocks base method
-func (m *MockAuthServiceClient) SetMyPassword(arg0 context.Context, arg1 *grpc.PasswordRequest, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
+// SearchUserGrant mocks base method
+func (m *MockAuthServiceClient) SearchUserGrant(arg0 context.Context, arg1 *grpc.UserGrantSearchRequest, arg2 ...grpc0.CallOption) (*grpc.UserGrantSearchResponse, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{arg0, arg1}
 	for _, a := range arg2 {
 		varargs = append(varargs, a)
 	}
-	ret := m.ctrl.Call(m, "SetMyPassword", varargs...)
-	ret0, _ := ret[0].(*emptypb.Empty)
+	ret := m.ctrl.Call(m, "SearchUserGrant", varargs...)
+	ret0, _ := ret[0].(*grpc.UserGrantSearchResponse)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }

-// SetMyPassword indicates an expected call of SetMyPassword
-func (mr *MockAuthServiceClientMockRecorder) SetMyPassword(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+// SearchUserGrant indicates an expected call of SearchUserGrant
+func (mr *MockAuthServiceClientMockRecorder) SearchUserGrant(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	varargs := append([]interface{}{arg0, arg1}, arg2...)
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetMyPassword", reflect.TypeOf((*MockAuthServiceClient)(nil).SetMyPassword), varargs...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SearchUserGrant", reflect.TypeOf((*MockAuthServiceClient)(nil).SearchUserGrant), varargs...)
 }

 // UpdateMyUserAddress mocks base method
@@ -478,14 +458,14 @@ func (mr *MockAuthServiceClientMockRecorder) Validate(arg0, arg1 interface{}, ar
 }

 // VerifyMfaOTP mocks base method
-func (m *MockAuthServiceClient) VerifyMfaOTP(arg0 context.Context, arg1 *grpc.VerifyMfaOtp, arg2 ...grpc0.CallOption) (*grpc.MfaOtpResponse, error) {
+func (m *MockAuthServiceClient) VerifyMfaOTP(arg0 context.Context, arg1 *grpc.VerifyMfaOtp, arg2 ...grpc0.CallOption) (*emptypb.Empty, error) {
 	m.ctrl.T.Helper()
 	varargs := []interface{}{arg0, arg1}
 	for _, a := range arg2 {
 		varargs = append(varargs, a)
 	}
 	ret := m.ctrl.Call(m, "VerifyMfaOTP", varargs...)
-	ret0, _ := ret[0].(*grpc.MfaOtpResponse)
+	ret0, _ := ret[0].(*emptypb.Empty)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -1,50 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"github.com/caos/zitadel/internal/errors"
-	"github.com/golang/protobuf/ptypes/empty"
-)
-
-func (s *Server) GetMyZitadelPermissions(ctx context.Context, _ *empty.Empty) (*MyPermissions, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-or67G", "Not implemented")
-	//ctxData := auth.GetCtxData(ctx)
-	//
-	//grants, err := s.processor.ResolveGrants(ctx, ctxData.UserID, ctxData.OrgID)
-	//if err != nil {
-	//	return nil, err
-	//}
-	//
-	//permissions := &MyPermissions{Permissions: []string{}}
-	//
-	//for _, grant := range grants {
-	//	for _, role := range grant.Roles {
-	//		roleName, ctxID := auth.SplitPermission(role)
-	//		for _, mapping := range s.authConf.RolePermissionMappings {
-	//			if mapping.Role == roleName {
-	//				permissions.appendPermissions(ctxID, mapping.Permissions...)
-	//			}
-	//		}
-	//	}
-	//}
-	//
-	//return permissions, nil
-}
-
-func (p *MyPermissions) appendPermissions(ctxID string, permissions ...string) {
-	for _, permission := range permissions {
-		p.appendPermission(ctxID, permission)
-	}
-}
-
-func (p *MyPermissions) appendPermission(ctxID, permission string) {
-	if ctxID != "" {
-		permission = permission + ":" + ctxID
-	}
-	for _, existingPermission := range p.Permissions {
-		if existingPermission == permission {
-			return
-		}
-	}
-	p.Permissions = append(p.Permissions, permission)
-}
@@ -0,0 +1,22 @@
+package grpc
+
+import "github.com/caos/zitadel/internal/model"
+
+func searchMethodToModel(method SearchMethod) model.SearchMethod {
+	switch method {
+	case SearchMethod_SEARCHMETHOD_EQUALS:
+		return model.SEARCHMETHOD_EQUALS
+	case SearchMethod_SEARCHMETHOD_CONTAINS:
+		return model.SEARCHMETHOD_CONTAINS
+	case SearchMethod_SEARCHMETHOD_STARTS_WITH:
+		return model.SEARCHMETHOD_STARTS_WITH
+	case SearchMethod_SEARCHMETHOD_EQUALS_IGNORE_CASE:
+		return model.SEARCHMETHOD_EQUALS_IGNORE_CASE
+	case SearchMethod_SEARCHMETHOD_CONTAINS_IGNORE_CASE:
+		return model.SEARCHMETHOD_CONTAINS_IGNORE_CASE
+	case SearchMethod_SEARCHMETHOD_STARTS_WITH_IGNORE_CASE:
+		return model.SEARCHMETHOD_STARTS_WITH_IGNORE_CASE
+	default:
+		return model.SEARCHMETHOD_EQUALS
+	}
+}
@@ -1,6 +1,7 @@
 package grpc

 import (
+	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"google.golang.org/grpc"

@@ -20,12 +21,12 @@ type Server struct {
 	authZ    auth_util.Config
 }

-func StartServer(conf grpc_util.ServerConfig, authZ auth_util.Config, repo repository.Repository) *Server {
+func StartServer(conf grpc_util.ServerConfig, authZRepo *authz_repo.EsRepository, authZ auth_util.Config, authRepo repository.Repository) *Server {
 	return &Server{
 		port:     conf.Port,
-		repo:     repo,
+		repo:     authRepo,
 		authZ:    authZ,
-		verifier: auth.Start(),
+		verifier: auth.Start(authZRepo),
 	}
 }

@@ -110,7 +110,7 @@ func (s *Server) AddMfaOTP(ctx context.Context, _ *empty.Empty) (_ *MfaOtpRespon
 }

 func (s *Server) VerifyMfaOTP(ctx context.Context, request *VerifyMfaOtp) (*empty.Empty, error) {
-	err := s.repo.VerifyMyMfaOTP(ctx, request.Code)
+	err := s.repo.VerifyMyMfaOTPSetup(ctx, request.Code)
 	return &empty.Empty{}, err
 }

@@ -0,0 +1,30 @@
+package grpc
+
+import (
+	"context"
+	"github.com/golang/protobuf/ptypes/empty"
+)
+
+func (s *Server) SearchMyUserGrant(ctx context.Context, in *UserGrantSearchRequest) (*UserGrantSearchResponse, error) {
+	response, err := s.repo.SearchMyUserGrants(ctx, userGrantSearchRequestsToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return userGrantSearchResponseFromModel(response), nil
+}
+
+func (s *Server) SearchMyProjectOrgs(ctx context.Context, in *MyProjectOrgSearchRequest) (*MyProjectOrgSearchResponse, error) {
+	response, err := s.repo.SearchMyProjectOrgs(ctx, myProjectOrgSearchRequestRequestsToModel(in))
+	if err != nil {
+		return nil, err
+	}
+	return projectOrgSearchResponseFromModel(response), nil
+}
+
+func (s *Server) GetMyZitadelPermissions(ctx context.Context, _ *empty.Empty) (*MyPermissions, error) {
+	perms, err := s.repo.SearchMyZitadelPermissions(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &MyPermissions{Permissions: perms}, nil
+}
@@ -0,0 +1,126 @@
+package grpc
+
+import (
+	grant_model "github.com/caos/zitadel/internal/usergrant/model"
+)
+
+func userGrantSearchRequestsToModel(request *UserGrantSearchRequest) *grant_model.UserGrantSearchRequest {
+	return &grant_model.UserGrantSearchRequest{
+		Offset:  request.Offset,
+		Limit:   request.Limit,
+		Queries: userGrantSearchQueriesToModel(request.Queries),
+	}
+}
+
+func userGrantSearchQueriesToModel(queries []*UserGrantSearchQuery) []*grant_model.UserGrantSearchQuery {
+	converted := make([]*grant_model.UserGrantSearchQuery, len(queries))
+	for i, q := range queries {
+		converted[i] = userGrantSearchQueryToModel(q)
+	}
+	return converted
+}
+
+func userGrantSearchQueryToModel(query *UserGrantSearchQuery) *grant_model.UserGrantSearchQuery {
+	return &grant_model.UserGrantSearchQuery{
+		Key:    userGrantSearchKeyToModel(query.Key),
+		Method: searchMethodToModel(query.Method),
+		Value:  query.Value,
+	}
+}
+
+func userGrantSearchKeyToModel(key UserGrantSearchKey) grant_model.UserGrantSearchKey {
+	switch key {
+	case UserGrantSearchKey_UserGrantSearchKey_ORG_ID:
+		return grant_model.USERGRANTSEARCHKEY_RESOURCEOWNER
+	case UserGrantSearchKey_UserGrantSearchKey_PROJECT_ID:
+		return grant_model.USERGRANTSEARCHKEY_PROJECT_ID
+	default:
+		return grant_model.USERGRANTSEARCHKEY_UNSPECIFIED
+	}
+}
+
+func myProjectOrgSearchRequestRequestsToModel(request *MyProjectOrgSearchRequest) *grant_model.UserGrantSearchRequest {
+	return &grant_model.UserGrantSearchRequest{
+		Offset:        request.Offset,
+		Limit:         request.Limit,
+		Asc:           request.Asc,
+		SortingColumn: grant_model.USERGRANTSEARCHKEY_RESOURCEOWNER,
+		Queries:       myProjectOrgSearchQueriesToModel(request.Queries),
+	}
+}
+
+func myProjectOrgSearchQueriesToModel(queries []*MyProjectOrgSearchQuery) []*grant_model.UserGrantSearchQuery {
+	converted := make([]*grant_model.UserGrantSearchQuery, len(queries))
+	for i, q := range queries {
+		converted[i] = myProjectOrgSearchQueryToModel(q)
+	}
+	return converted
+}
+
+func myProjectOrgSearchQueryToModel(query *MyProjectOrgSearchQuery) *grant_model.UserGrantSearchQuery {
+	return &grant_model.UserGrantSearchQuery{
+		Key:    myProjectOrgSearchKeyToModel(query.Key),
+		Method: searchMethodToModel(query.Method),
+		Value:  query.Value,
+	}
+}
+
+func myProjectOrgSearchKeyToModel(key MyProjectOrgSearchKey) grant_model.UserGrantSearchKey {
+	switch key {
+	case MyProjectOrgSearchKey_MYPROJECTORGSEARCHKEY_ORG_NAME:
+		return grant_model.USERGRANTSEARCHKEY_ORG_NAME
+	default:
+		return grant_model.USERGRANTSEARCHKEY_UNSPECIFIED
+	}
+}
+
+func userGrantSearchResponseFromModel(response *grant_model.UserGrantSearchResponse) *UserGrantSearchResponse {
+	return &UserGrantSearchResponse{
+		Offset:      response.Offset,
+		Limit:       response.Limit,
+		TotalResult: response.TotalResult,
+		Result:      userGrantViewsFromModel(response.Result),
+	}
+}
+
+func userGrantViewsFromModel(users []*grant_model.UserGrantView) []*UserGrantView {
+	converted := make([]*UserGrantView, len(users))
+	for i, user := range users {
+		converted[i] = userGrantViewFromModel(user)
+	}
+	return converted
+}
+
+func userGrantViewFromModel(grant *grant_model.UserGrantView) *UserGrantView {
+	return &UserGrantView{
+		UserId:    grant.UserID,
+		OrgId:     grant.ResourceOwner,
+		OrgName:   grant.OrgName,
+		ProjectId: grant.ProjectID,
+		Roles:     grant.RoleKeys,
+	}
+}
+
+func projectOrgSearchResponseFromModel(response *grant_model.ProjectOrgSearchResponse) *MyProjectOrgSearchResponse {
+	return &MyProjectOrgSearchResponse{
+		Offset:      response.Offset,
+		Limit:       response.Limit,
+		TotalResult: response.TotalResult,
+		Result:      projectOrgsFromModel(response.Result),
+	}
+}
+
+func projectOrgsFromModel(projectOrgs []*grant_model.Org) []*Org {
+	converted := make([]*Org, len(projectOrgs))
+	for i, org := range projectOrgs {
+		converted[i] = projectOrgFromModel(org)
+	}
+	return converted
+}
+
+func projectOrgFromModel(org *grant_model.Org) *Org {
+	return &Org{
+		Id:   org.OrgID,
+		Name: org.OrgName,
+	}
+}
@@ -2,10 +2,13 @@ package grpc

 import (
 	"context"
-	"github.com/caos/zitadel/internal/errors"
 	"github.com/golang/protobuf/ptypes/empty"
 )

 func (s *Server) GetMyUserSessions(ctx context.Context, _ *empty.Empty) (_ *UserSessionViews, err error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-nc52s", "Not implemented")
+	userSessions, err := s.repo.GetMyUserSessions(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &UserSessionViews{UserSessions: userSessionViewsFromModel(userSessions)}, nil
 }
@@ -0,0 +1,35 @@
+package grpc
+
+import (
+	auth_req_model "github.com/caos/zitadel/internal/auth_request/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+)
+
+func userSessionViewsFromModel(userSessions []*usr_model.UserSessionView) []*UserSessionView {
+	converted := make([]*UserSessionView, len(userSessions))
+	for i, s := range userSessions {
+		converted[i] = userSessionViewFromModel(s)
+	}
+	return converted
+}
+
+func userSessionViewFromModel(userSession *usr_model.UserSessionView) *UserSessionView {
+	return &UserSessionView{
+		Sequence:  userSession.Sequence,
+		AgentId:   userSession.UserAgentID,
+		UserId:    userSession.UserID,
+		UserName:  userSession.UserName,
+		AuthState: userSessionStateFromModel(userSession.State),
+	}
+}
+
+func userSessionStateFromModel(state auth_req_model.UserSessionState) UserSessionState {
+	switch state {
+	case auth_req_model.UserSessionStateActive:
+		return UserSessionState_USERSESSIONSTATE_ACTIVE
+	case auth_req_model.UserSessionStateTerminated:
+		return UserSessionState_USERSESSIONSTATE_TERMINATED
+	default:
+		return UserSessionState_USERSESSIONSTATE_UNSPECIFIED
+	}
+}