andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-09 07:35:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: check whether org exists before creating user (#11647)

Browse Source 
# Which Problems Are Solved

It was possible to create a user with an imaginary org.

# How the Problems Are Solved

Check whether org exists before creating the user.

# Additional Changes


# Additional Context

- Closes #11532
This commit is contained in:
Wim Van Laer
2026-03-16 13:12:21 +01:00
committed by GitHub
parent 9a4530bf77
commit 965e3fa621
5 changed files with 352 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/command/user_machine_test.go
+119 -33
View File
@@ -2,6 +2,7 @@ package command
import (
"context"
"errors"
"testing"
"github.com/stretchr/testify/assert"
@@ -18,7 +19,7 @@ import (
func TestCommandSide_AddMachine(t *testing.T) {
type fields struct {
eventstore *eventstore.Eventstore
eventstore func(t *testing.T) *eventstore.Eventstore
idGenerator id.Generator
}
type args struct {
@@ -32,6 +33,9 @@ func TestCommandSide_AddMachine(t *testing.T) {
want *domain.ObjectDetails
err func(error) bool
}
orgAgg := org.NewAggregate("org1")
tests := []struct {
name string
fields fields
@@ -41,8 +45,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "user invalid, invalid argument error name",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
},
@@ -62,8 +70,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "user invalid, invalid argument error username",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
},
@@ -83,8 +95,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "org policy not found, precondition error",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(),
expectFilter(),
@@ -108,8 +124,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine with invalid metadata key, error",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
},
@@ -137,8 +157,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine with invalid metadata value, error",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
},
@@ -166,8 +190,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -224,8 +252,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine, orgScopedUsername, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -271,8 +303,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine - custom id, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -319,8 +355,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
name: "with username fallback to given username",
fields: fields{
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "aggregateID"),
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -370,8 +410,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
name: "with username fallback to generated id",
fields: fields{
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "aggregateID"),
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -419,8 +463,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "with username fallback to given id",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -469,8 +517,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "with succeeding permission check, ok",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -519,9 +571,7 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "with failing permission check, error",
fields: fields{
eventstore: eventstoreExpect(
t,
),
eventstore: expectEventstore(),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
},
args: args{
@@ -545,8 +595,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine, ok + deactive state",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -599,8 +653,12 @@ func TestCommandSide_AddMachine(t *testing.T) {
{
name: "add machine, ok + locked state",
fields: fields{
eventstore: eventstoreExpect(
t,
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
org.NewOrgAddedEvent(context.Background(), &orgAgg.Aggregate, "org1"),
),
),
expectFilter(),
expectFilter(
eventFromEventPusher(
@@ -650,11 +708,39 @@ func TestCommandSide_AddMachine(t *testing.T) {
},
},
},
{
name: "org not found, precondition error",
fields: fields{
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "user1"),
eventstore: expectEventstore(
expectFilter(),
),
},
args: args{
ctx: context.Background(),
machine: &Machine{
ObjectRoot: models.ObjectRoot{
ResourceOwner: "non-existing-org",
},
Description: "description",
Name: "name",
Username: "username",
},
check: func(resourceOwner, aggregateID string) error {
return nil
},
},
res: res{
err: func(err error) bool {
return errors.Is(err, zerrors.ThrowPreconditionFailed(nil, "COMMAND-QXPGs", "Errors.Org.NotFound"))
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
r := &Commands{
eventstore: tt.fields.eventstore,
eventstore: tt.fields.eventstore(t),
idGenerator: tt.fields.idGenerator,
checkPermission: newMockPermissionCheckAllowed(),
}