andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-03 12:52:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: correctly handle user grants on project grant to same organization (#10568)

Browse Source 
# Which Problems Are Solved

Authorizations (aka user grants) could not be managed correctly if they
were created on a project grant, which itself was based on a project
granted to the own organization. The error persisted if the
corresponding (potentially unintended) project grant was removed again.

# How the Problems Are Solved

Fixed checks for managing user grants: Roles from projects and project
grants get handled individually to ensure cases like project grants on
the own organization.

# Additional Changes

Additional tests for the 3 failing scenarios.

# Additional Context

Closes #10556

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Stefan Benz
2025-08-28 12:09:52 +00:00
committed by GitHub
co-authored by Livio Spring
parent f963ea9f86
commit 8e60cce20d
3 changed files with 359 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/user_grant.go
+4 -3
View File
@@ -469,7 +469,7 @@ func (c *Commands) checkUserGrantPreConditionOld(ctx context.Context, usergrant
usergrant.ResourceOwner = preConditions.ProjectResourceOwner
}
if usergrant.ProjectGrantID == "" {
usergrant.ProjectGrantID = preConditions.ProjectGrantID
usergrant.ProjectGrantID = preConditions.FoundGrantID
}
if !preConditions.UserExists {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-4f8sg", "Errors.User.NotFound")
@@ -478,10 +478,11 @@ func (c *Commands) checkUserGrantPreConditionOld(ctx context.Context, usergrant
if projectIsOwned && !preConditions.ProjectExists {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-3n77S", "Errors.Project.NotFound")
}
if !projectIsOwned && !preConditions.ProjectGrantExists {
if !projectIsOwned && preConditions.FoundGrantID == "" {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-4m9ff", "Errors.Project.Grant.NotFound")
}
if usergrant.HasInvalidRoles(preConditions.ExistingRoleKeys) {
// Either check roles from project or project grant
if usergrant.HasInvalidRoles(preConditions.existingRoles()) {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-mm9F4", "Errors.Project.Role.NotFound")
}
if check != nil {