From 8fcb03854bf554ab698ef4fb8316d8737ebe0ca6 Mon Sep 17 00:00:00 2001 From: Livio Amstutz Date: Thu, 10 Sep 2020 15:40:20 +0200 Subject: [PATCH] fix: iam permission (#720) * fix: get iam permissions * fix: iam permissions --- .../eventsourcing/eventstore/user_grant.go | 28 +++++++++++++++---- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/internal/auth/repository/eventsourcing/eventstore/user_grant.go b/internal/auth/repository/eventsourcing/eventstore/user_grant.go index 078321f60..24ca9874a 100644 --- a/internal/auth/repository/eventsourcing/eventstore/user_grant.go +++ b/internal/auth/repository/eventsourcing/eventstore/user_grant.go @@ -95,7 +95,7 @@ func membershipsToOrgResp(memberships []*user_view_model.UserMembershipView, cou func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]string, error) { ctxData := authz.GetCtxData(ctx) - memberships, count, err := repo.View.SearchUserMemberships(&user_model.UserMembershipSearchRequest{ + orgMemberships, orgCount, err := repo.View.SearchUserMemberships(&user_model.UserMembershipSearchRequest{ Queries: []*user_model.UserMembershipSearchQuery{ { Key: user_model.UserMembershipSearchKeyUserID, @@ -104,19 +104,37 @@ func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]st }, { Key: user_model.UserMembershipSearchKeyResourceOwner, - Method: global_model.SearchMethodIsOneOf, - Value: []string{repo.IamID, ctxData.OrgID}, + Method: global_model.SearchMethodEquals, + Value: ctxData.OrgID, }, }, }) if err != nil { return nil, err } - if count == 0 { + iamMemberships, iamCount, err := repo.View.SearchUserMemberships(&user_model.UserMembershipSearchRequest{ + Queries: []*user_model.UserMembershipSearchQuery{ + { + Key: user_model.UserMembershipSearchKeyUserID, + Method: global_model.SearchMethodEquals, + Value: ctxData.UserID, + }, + { + Key: user_model.UserMembershipSearchKeyAggregateID, + Method: global_model.SearchMethodEquals, + Value: repo.IamID, + }, + }, + }) + if err != nil { + return nil, err + } + if orgCount == 0 && iamCount == 0 { return []string{}, nil } + orgMemberships = append(orgMemberships, iamMemberships...) permissions := &grant_model.Permissions{Permissions: []string{}} - for _, membership := range memberships { + for _, membership := range orgMemberships { for _, role := range membership.Roles { permissions = repo.mapRoleToPermission(permissions, membership, role) }