mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-04 21:32:15 +00:00
fix: generated project grant id (#10747)
# Which Problems Are Solved Project Grant ID would have needed to be unique to be handled properly on the projections, but was defined as the organization ID the project was granted to, so could be non-unique. # How the Problems Are Solved Generate the Project Grant ID even in the v2 APIs, which also includes fixes in the integration tests. Additionally to that, the logic for some functionality had to be extended as the Project Grant ID is not provided anymore in the API, so had to be queried before creating events for Project Grants. # Additional Changes Included fix for authorizations, when an authorization was intended to be created for a project, without providing any organization information, which also showed some faulty integration tests. # Additional Context Partially closes #10745 --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Stefan Benz
co-authored by
Livio Spring
Silvan
Livio Spring
Silvan
parent
adc8fb2013
commit
b6ff4ff16c
@@ -263,9 +263,9 @@ func TestServer_ListAuthorizations(t *testing.T) {
|
||||
userResp := Instance.CreateUserTypeHuman(iamOwnerCtx, integration.Email())
|
||||
|
||||
resp := createAuthorization(iamOwnerCtx, Instance, t, Instance.DefaultOrg.GetId(), userResp.GetId(), true)
|
||||
request.Filters[0].Filter = &authorization.AuthorizationsSearchFilter_ProjectGrantId{
|
||||
ProjectGrantId: &filter.IDFilter{
|
||||
Id: resp.GetProjectGrantId(),
|
||||
request.Filters[0].Filter = &authorization.AuthorizationsSearchFilter_OrganizationId{
|
||||
OrganizationId: &filter.IDFilter{
|
||||
Id: resp.GetGrantedOrganizationId(),
|
||||
},
|
||||
}
|
||||
response.Authorizations[0] = resp
|
||||
@@ -330,8 +330,8 @@ func TestServer_ListAuthorizations(t *testing.T) {
|
||||
},
|
||||
}
|
||||
|
||||
response.Authorizations[1] = createAuthorizationForProject(iamOwnerCtx, Instance, t, Instance.DefaultOrg.GetId(), userResp.GetId(), projectResp.GetName(), projectResp.GetId())
|
||||
response.Authorizations[0] = createAuthorizationWithProjectGrant(iamOwnerCtx, Instance, t, Instance.DefaultOrg.GetId(), userResp.GetId(), grantedProjectResp.GetName(), grantedProjectResp.GetId())
|
||||
response.Authorizations[0] = createAuthorizationForProject(iamOwnerCtx, Instance, t, Instance.DefaultOrg.GetId(), userResp.GetId(), projectResp.GetName(), projectResp.GetId())
|
||||
createAuthorizationWithProjectGrant(iamOwnerCtx, Instance, t, Instance.DefaultOrg.GetId(), userResp.GetId(), grantedProjectResp.GetName(), grantedProjectResp.GetId())
|
||||
},
|
||||
req: &authorization.ListAuthorizationsRequest{
|
||||
Filters: []*authorization.AuthorizationsSearchFilter{{}},
|
||||
@@ -343,7 +343,7 @@ func TestServer_ListAuthorizations(t *testing.T) {
|
||||
AppliedLimit: 100,
|
||||
},
|
||||
Authorizations: []*authorization.Authorization{
|
||||
{}, {},
|
||||
{},
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -426,6 +426,10 @@ func TestServer_ListAuthorizations(t *testing.T) {
|
||||
// always first check length, otherwise its failed anyway
|
||||
if assert.Len(ttt, got.Authorizations, len(tt.want.Authorizations)) {
|
||||
for i := range tt.want.Authorizations {
|
||||
// set as project grant id is generated
|
||||
if grant := got.Authorizations[i].ProjectGrantId; grant != nil {
|
||||
tt.want.Authorizations[i].ProjectGrantId = grant
|
||||
}
|
||||
assert.EqualExportedValues(ttt, tt.want.Authorizations[i], got.Authorizations[i])
|
||||
}
|
||||
}
|
||||
@@ -454,15 +458,15 @@ func createAuthorizationForProject(ctx context.Context, instance *integration.In
|
||||
userResp, err := instance.Client.UserV2.GetUserByID(ctx, &user.GetUserByIDRequest{UserId: userID})
|
||||
require.NoError(t, err)
|
||||
|
||||
userGrantResp := instance.CreateProjectUserGrant(t, ctx, orgID, projectID, userID)
|
||||
authResp := instance.CreateAuthorizationProject(t, ctx, projectID, userID)
|
||||
return &authorization.Authorization{
|
||||
Id: userGrantResp.GetUserGrantId(),
|
||||
Id: authResp.GetId(),
|
||||
ProjectId: projectID,
|
||||
ProjectName: projectName,
|
||||
ProjectOrganizationId: orgID,
|
||||
OrganizationId: orgID,
|
||||
CreationDate: userGrantResp.Details.GetCreationDate(),
|
||||
ChangeDate: userGrantResp.Details.GetCreationDate(),
|
||||
CreationDate: authResp.GetCreationDate(),
|
||||
ChangeDate: authResp.GetCreationDate(),
|
||||
State: 1,
|
||||
User: &authorization.User{
|
||||
Id: userID,
|
||||
@@ -486,17 +490,18 @@ func createAuthorizationForProjectGrant(ctx context.Context, instance *integrati
|
||||
userResp, err := instance.Client.UserV2.GetUserByID(ctx, &user.GetUserByIDRequest{UserId: userID})
|
||||
require.NoError(t, err)
|
||||
|
||||
userGrantResp := instance.CreateProjectGrantUserGrant(ctx, orgID, projectID, grantedOrgID, userID)
|
||||
authResp := instance.CreateAuthorizationProjectGrant(t, ctx, projectID, grantedOrgID, userID)
|
||||
return &authorization.Authorization{
|
||||
Id: userGrantResp.GetUserGrantId(),
|
||||
Id: authResp.GetId(),
|
||||
ProjectId: projectID,
|
||||
ProjectName: projectName,
|
||||
ProjectOrganizationId: orgID,
|
||||
ProjectGrantId: gu.Ptr(grantedOrgID),
|
||||
// empty as generated
|
||||
ProjectGrantId: nil,
|
||||
GrantedOrganizationId: gu.Ptr(grantedOrgID),
|
||||
OrganizationId: orgID,
|
||||
CreationDate: userGrantResp.Details.GetCreationDate(),
|
||||
ChangeDate: userGrantResp.Details.GetCreationDate(),
|
||||
OrganizationId: grantedOrgID,
|
||||
CreationDate: authResp.GetCreationDate(),
|
||||
ChangeDate: authResp.GetCreationDate(),
|
||||
State: 1,
|
||||
User: &authorization.User{
|
||||
Id: userID,
|
||||
@@ -795,9 +800,9 @@ func TestServer_ListAuthorizations_PermissionsV2(t *testing.T) {
|
||||
userResp := InstancePermissionV2.CreateUserTypeHuman(iamOwnerCtx, integration.Email())
|
||||
|
||||
resp := createAuthorization(iamOwnerCtx, InstancePermissionV2, t, InstancePermissionV2.DefaultOrg.GetId(), userResp.GetId(), true)
|
||||
request.Filters[0].Filter = &authorization.AuthorizationsSearchFilter_ProjectGrantId{
|
||||
ProjectGrantId: &filter.IDFilter{
|
||||
Id: resp.GetProjectGrantId(),
|
||||
request.Filters[0].Filter = &authorization.AuthorizationsSearchFilter_OrganizationId{
|
||||
OrganizationId: &filter.IDFilter{
|
||||
Id: resp.GetGrantedOrganizationId(),
|
||||
},
|
||||
}
|
||||
response.Authorizations[0] = resp
|
||||
@@ -862,8 +867,8 @@ func TestServer_ListAuthorizations_PermissionsV2(t *testing.T) {
|
||||
},
|
||||
}
|
||||
|
||||
response.Authorizations[1] = createAuthorizationForProject(iamOwnerCtx, InstancePermissionV2, t, InstancePermissionV2.DefaultOrg.GetId(), userResp.GetId(), projectResp.GetName(), projectResp.GetId())
|
||||
response.Authorizations[0] = createAuthorizationWithProjectGrant(iamOwnerCtx, InstancePermissionV2, t, InstancePermissionV2.DefaultOrg.GetId(), userResp.GetId(), grantedProjectResp.GetName(), grantedProjectResp.GetId())
|
||||
response.Authorizations[0] = createAuthorizationForProject(iamOwnerCtx, InstancePermissionV2, t, InstancePermissionV2.DefaultOrg.GetId(), userResp.GetId(), projectResp.GetName(), projectResp.GetId())
|
||||
createAuthorizationWithProjectGrant(iamOwnerCtx, InstancePermissionV2, t, InstancePermissionV2.DefaultOrg.GetId(), userResp.GetId(), grantedProjectResp.GetName(), grantedProjectResp.GetId())
|
||||
},
|
||||
req: &authorization.ListAuthorizationsRequest{
|
||||
Filters: []*authorization.AuthorizationsSearchFilter{{}},
|
||||
@@ -875,7 +880,7 @@ func TestServer_ListAuthorizations_PermissionsV2(t *testing.T) {
|
||||
AppliedLimit: 100,
|
||||
},
|
||||
Authorizations: []*authorization.Authorization{
|
||||
{}, {},
|
||||
{},
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -958,6 +963,10 @@ func TestServer_ListAuthorizations_PermissionsV2(t *testing.T) {
|
||||
// always first check length, otherwise its failed anyway
|
||||
if assert.Len(ttt, got.Authorizations, len(tt.want.Authorizations)) {
|
||||
for i := range tt.want.Authorizations {
|
||||
// set as project grant id is generated
|
||||
if grant := got.Authorizations[i].ProjectGrantId; grant != nil {
|
||||
tt.want.Authorizations[i].ProjectGrantId = grant
|
||||
}
|
||||
assert.EqualExportedValues(ttt, tt.want.Authorizations[i], got.Authorizations[i])
|
||||
}
|
||||
}
|
||||
|
||||
@@ -85,10 +85,10 @@ func createAdministratorProjectToCommand(req *internal_permission.ResourceType_P
|
||||
|
||||
func createAdministratorProjectGrantToCommand(req *internal_permission.ResourceType_ProjectGrant_, userID string, roles []string) *command.AddProjectGrantMember {
|
||||
return &command.AddProjectGrantMember{
|
||||
GrantID: req.ProjectGrant.ProjectGrantId,
|
||||
ProjectID: req.ProjectGrant.ProjectId,
|
||||
UserID: userID,
|
||||
Roles: roles,
|
||||
OrganizationID: req.ProjectGrant.OrganizationId,
|
||||
ProjectID: req.ProjectGrant.ProjectId,
|
||||
UserID: userID,
|
||||
Roles: roles,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -165,10 +165,10 @@ func updateAdministratorProjectToCommand(req *internal_permission.ResourceType_P
|
||||
|
||||
func updateAdministratorProjectGrantToCommand(req *internal_permission.ResourceType_ProjectGrant_, userID string, roles []string) *command.ChangeProjectGrantMember {
|
||||
return &command.ChangeProjectGrantMember{
|
||||
GrantID: req.ProjectGrant.ProjectGrantId,
|
||||
ProjectID: req.ProjectGrant.ProjectId,
|
||||
UserID: userID,
|
||||
Roles: roles,
|
||||
OrganizationID: req.ProjectGrant.OrganizationId,
|
||||
ProjectID: req.ProjectGrant.ProjectId,
|
||||
UserID: userID,
|
||||
Roles: roles,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -203,7 +203,7 @@ func (s *Server) DeleteAdministrator(ctx context.Context, req *connect.Request[i
|
||||
deletionDate = timestamppb.New(member.EventDate)
|
||||
}
|
||||
case *internal_permission.ResourceType_ProjectGrant_:
|
||||
member, err := s.command.RemoveProjectGrantMember(ctx, resource.ProjectGrant.ProjectId, req.Msg.UserId, resource.ProjectGrant.ProjectGrantId)
|
||||
member, err := s.command.RemoveProjectGrantMember(ctx, resource.ProjectGrant.ProjectId, req.Msg.UserId, "", resource.ProjectGrant.OrganizationId)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
+69
-18
@@ -239,7 +239,7 @@ func TestServer_CreateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: "notexisting",
|
||||
OrganizationId: "notexisting",
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -263,7 +263,7 @@ func TestServer_CreateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -289,7 +289,7 @@ func TestServer_CreateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -334,6 +334,13 @@ func TestServer_CreateAdministrator_Permission(t *testing.T) {
|
||||
patProjectGrantResp := instance.CreatePersonalAccessToken(iamOwnerCtx, userProjectGrantResp.GetUserId())
|
||||
projectGrantOwnerCtx := integration.WithAuthorizationToken(CTX, patProjectGrantResp.Token)
|
||||
|
||||
grantedProjectResp := instance.CreateProject(iamOwnerCtx, t, orgResp.GetOrganizationId(), integration.ProjectName(), false, false)
|
||||
userGrantedProjectResp := instance.CreateMachineUser(iamOwnerCtx)
|
||||
instance.CreateProjectMembership(t, iamOwnerCtx, grantedProjectResp.GetId(), userGrantedProjectResp.GetUserId())
|
||||
patGrantedProjectResp := instance.CreatePersonalAccessToken(iamOwnerCtx, userGrantedProjectResp.GetUserId())
|
||||
grantedProjectOwnerCtx := integration.WithAuthorizationToken(CTX, patGrantedProjectResp.Token)
|
||||
instance.CreateProjectGrant(iamOwnerCtx, t, grantedProjectResp.GetId(), instance.DefaultOrg.GetId())
|
||||
|
||||
type want struct {
|
||||
creationDate bool
|
||||
}
|
||||
@@ -508,6 +515,50 @@ func TestServer_CreateAdministrator_Permission(t *testing.T) {
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "project grant, org owner, ok",
|
||||
ctx: instance.WithAuthorizationToken(CTX, integration.UserTypeOrgOwner),
|
||||
prepare: func(request *internal_permission.CreateAdministratorRequest) {
|
||||
userResp := instance.CreateUserTypeHuman(iamOwnerCtx, integration.Email())
|
||||
|
||||
request.UserId = userResp.GetId()
|
||||
},
|
||||
req: &internal_permission.CreateAdministratorRequest{
|
||||
Resource: &internal_permission.ResourceType{
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: grantedProjectResp.GetId(),
|
||||
OrganizationId: instance.DefaultOrg.GetId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
Roles: []string{"PROJECT_GRANT_OWNER"},
|
||||
},
|
||||
want: want{
|
||||
creationDate: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "project grant, project owner, error",
|
||||
ctx: grantedProjectOwnerCtx,
|
||||
prepare: func(request *internal_permission.CreateAdministratorRequest) {
|
||||
userResp := instance.CreateUserTypeHuman(iamOwnerCtx, integration.Email())
|
||||
|
||||
request.UserId = userResp.GetId()
|
||||
},
|
||||
req: &internal_permission.CreateAdministratorRequest{
|
||||
Resource: &internal_permission.ResourceType{
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: grantedProjectResp.GetId(),
|
||||
OrganizationId: instance.DefaultOrg.GetId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
Roles: []string{"PROJECT_GRANT_OWNER"},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "project grant, project grant owner, ok",
|
||||
ctx: projectGrantOwnerCtx,
|
||||
@@ -521,7 +572,7 @@ func TestServer_CreateAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -544,7 +595,7 @@ func TestServer_CreateAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -869,7 +920,7 @@ func TestServer_UpdateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: "notexisting",
|
||||
OrganizationId: "notexisting",
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -894,7 +945,7 @@ func TestServer_UpdateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -922,7 +973,7 @@ func TestServer_UpdateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -949,7 +1000,7 @@ func TestServer_UpdateAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -1192,7 +1243,7 @@ func TestServer_UpdateAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -1215,7 +1266,7 @@ func TestServer_UpdateAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -1236,7 +1287,7 @@ func TestServer_UpdateAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -1487,7 +1538,7 @@ func TestServer_DeleteAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: "notexisting",
|
||||
OrganizationId: "notexisting",
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -1512,7 +1563,7 @@ func TestServer_DeleteAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -1538,7 +1589,7 @@ func TestServer_DeleteAdministrator(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
}
|
||||
@@ -1766,7 +1817,7 @@ func TestServer_DeleteAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -1788,7 +1839,7 @@ func TestServer_DeleteAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -1808,7 +1859,7 @@ func TestServer_DeleteAdministrator_Permission(t *testing.T) {
|
||||
Resource: &internal_permission.ResourceType_ProjectGrant_{
|
||||
ProjectGrant: &internal_permission.ResourceType_ProjectGrant{
|
||||
ProjectId: projectResp.GetId(),
|
||||
ProjectGrantId: orgResp.GetOrganizationId(),
|
||||
OrganizationId: orgResp.GetOrganizationId(),
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
@@ -535,6 +535,10 @@ func TestServer_ListAdministrators(t *testing.T) {
|
||||
// always first check length, otherwise its failed anyway
|
||||
if assert.Len(ttt, got.Administrators, len(tt.want.Administrators)) {
|
||||
for i := range tt.want.Administrators {
|
||||
// need to set the project grant ID as it is generated
|
||||
if grant := got.Administrators[i].GetProjectGrant(); grant != nil {
|
||||
tt.want.Administrators[i].GetProjectGrant().Id = grant.Id
|
||||
}
|
||||
assert.EqualExportedValues(ttt, tt.want.Administrators[i], got.Administrators[i])
|
||||
}
|
||||
}
|
||||
@@ -631,7 +635,8 @@ func createProjectGrantAdministrator(ctx context.Context, instance *integration.
|
||||
},
|
||||
Resource: &internal_permission.Administrator_ProjectGrant{
|
||||
ProjectGrant: &internal_permission.ProjectGrant{
|
||||
Id: grantedOrgID,
|
||||
// left empty as generated
|
||||
Id: "",
|
||||
ProjectId: projectID,
|
||||
ProjectName: projectName,
|
||||
OrganizationId: orgID,
|
||||
@@ -1162,6 +1167,10 @@ func TestServer_ListAdministrators_PermissionV2(t *testing.T) {
|
||||
// always first check length, otherwise its failed anyway
|
||||
if assert.Len(ttt, got.Administrators, len(tt.want.Administrators)) {
|
||||
for i := range tt.want.Administrators {
|
||||
// set as project grant id is generated
|
||||
if grant := got.Administrators[i].GetProjectGrant(); grant != nil {
|
||||
tt.want.Administrators[i].GetProjectGrant().Id = grant.Id
|
||||
}
|
||||
assert.EqualExportedValues(ttt, tt.want.Administrators[i], got.Administrators[i])
|
||||
}
|
||||
}
|
||||
|
||||
@@ -204,7 +204,7 @@ func (s *Server) UpdateProjectGrantMember(ctx context.Context, req *mgmt_pb.Upda
|
||||
}
|
||||
|
||||
func (s *Server) RemoveProjectGrantMember(ctx context.Context, req *mgmt_pb.RemoveProjectGrantMemberRequest) (*mgmt_pb.RemoveProjectGrantMemberResponse, error) {
|
||||
details, err := s.command.RemoveProjectGrantMember(ctx, req.ProjectId, req.UserId, req.GrantId)
|
||||
details, err := s.command.RemoveProjectGrantMember(ctx, req.ProjectId, req.UserId, req.GrantId, "")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -147,19 +147,19 @@ func ListProjectGrantMembersRequestToModel(ctx context.Context, req *mgmt_pb.Lis
|
||||
|
||||
func AddProjectGrantMemberRequestToCommand(req *mgmt_pb.AddProjectGrantMemberRequest, orgID string) *command.AddProjectGrantMember {
|
||||
return &command.AddProjectGrantMember{
|
||||
ResourceOwner: orgID,
|
||||
ProjectID: req.ProjectId,
|
||||
GrantID: req.GrantId,
|
||||
UserID: req.UserId,
|
||||
Roles: req.Roles,
|
||||
ResourceOwner: orgID,
|
||||
ProjectID: req.ProjectId,
|
||||
ProjectGrantID: req.GrantId,
|
||||
UserID: req.UserId,
|
||||
Roles: req.Roles,
|
||||
}
|
||||
}
|
||||
|
||||
func UpdateProjectGrantMemberRequestToCommand(req *mgmt_pb.UpdateProjectGrantMemberRequest) *command.ChangeProjectGrantMember {
|
||||
return &command.ChangeProjectGrantMember{
|
||||
ProjectID: req.ProjectId,
|
||||
GrantID: req.GrantId,
|
||||
UserID: req.UserId,
|
||||
Roles: req.Roles,
|
||||
ProjectID: req.ProjectId,
|
||||
ProjectGrantID: req.GrantId,
|
||||
UserID: req.UserId,
|
||||
Roles: req.Roles,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -426,7 +426,7 @@ func TestServer_CreateCallback_Permission(t *testing.T) {
|
||||
orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email())
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
createProjectGrantUserGrant(ctx, t, Instance.DefaultOrg.GetId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
|
||||
return createSessionAndAuthRequestForCallback(ctx, t, clientID, Instance.Users.Get(integration.UserTypeLogin).ID, user.GetUserId())
|
||||
},
|
||||
@@ -564,7 +564,7 @@ func TestServer_CreateCallback_Permission(t *testing.T) {
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
|
||||
createProjectGrantUserGrant(ctx, t, orgResp.GetOrganizationId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
return createSessionAndAuthRequestForCallback(ctx, t, clientID, Instance.Users.Get(integration.UserTypeLogin).ID, user.GetUserId())
|
||||
},
|
||||
want: &oidc_pb.CreateCallbackResponse{
|
||||
@@ -940,26 +940,26 @@ func createOIDCApplication(ctx context.Context, t *testing.T, projectRoleCheck,
|
||||
}
|
||||
|
||||
func createProjectUserGrant(ctx context.Context, t *testing.T, orgID, projectID, userID string) {
|
||||
resp := Instance.CreateProjectUserGrant(t, ctx, orgID, projectID, userID)
|
||||
resp := Instance.CreateAuthorizationProject(t, ctx, projectID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
}
|
||||
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, orgID, projectID, projectGrantID, userID string) {
|
||||
resp := Instance.CreateProjectGrantUserGrant(ctx, orgID, projectID, projectGrantID, userID)
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, projectID, grantedOrgID, userID string) {
|
||||
resp := Instance.CreateAuthorizationProjectGrant(t, ctx, projectID, grantedOrgID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, grantedOrgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
|
||||
@@ -427,7 +427,7 @@ func TestServer_CreateCallback_Permission(t *testing.T) {
|
||||
orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email())
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
createProjectGrantUserGrant(ctx, t, orgResp.GetOrganizationId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
|
||||
return createSessionAndAuthRequestForCallback(ctx, t, clientID, Instance.Users.Get(integration.UserTypeLogin).ID, user.GetUserId())
|
||||
},
|
||||
@@ -564,7 +564,7 @@ func TestServer_CreateCallback_Permission(t *testing.T) {
|
||||
orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email())
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
createProjectGrantUserGrant(ctx, t, orgResp.GetOrganizationId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
return createSessionAndAuthRequestForCallback(ctx, t, clientID, Instance.Users.Get(integration.UserTypeLogin).ID, user.GetUserId())
|
||||
},
|
||||
want: &oidc_pb.CreateCallbackResponse{
|
||||
@@ -693,26 +693,26 @@ func createOIDCApplication(ctx context.Context, t *testing.T, projectRoleCheck,
|
||||
}
|
||||
|
||||
func createProjectUserGrant(ctx context.Context, t *testing.T, orgID, projectID, userID string) {
|
||||
resp := Instance.CreateProjectUserGrant(t, ctx, orgID, projectID, userID)
|
||||
resp := Instance.CreateAuthorizationProject(t, ctx, projectID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
}
|
||||
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, orgID, projectID, projectGrantID, userID string) {
|
||||
resp := Instance.CreateProjectGrantUserGrant(ctx, orgID, projectID, projectGrantID, userID)
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, projectID, grantedOrgID, userID string) {
|
||||
resp := Instance.CreateAuthorizationProjectGrant(t, ctx, projectID, grantedOrgID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, grantedOrgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
|
||||
@@ -32,7 +32,6 @@ func projectGrantCreateToCommand(req *project_pb.CreateProjectGrantRequest) *com
|
||||
ObjectRoot: models.ObjectRoot{
|
||||
AggregateID: req.ProjectId,
|
||||
},
|
||||
GrantID: req.GrantedOrganizationId,
|
||||
GrantedOrgID: req.GrantedOrganizationId,
|
||||
RoleKeys: req.RoleKeys,
|
||||
}
|
||||
@@ -113,7 +112,7 @@ func (s *Server) userGrantsFromProjectGrant(ctx context.Context, projectID, gran
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
grantQuery, err := query.NewUserGrantGrantIDSearchQuery(grantedOrganizationID)
|
||||
grantQuery, err := query.NewUserGrantWithGrantedQuery(grantedOrganizationID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -416,7 +416,7 @@ func TestServer_CreateResponse_Permission(t *testing.T) {
|
||||
orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email())
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
createProjectGrantUserGrant(ctx, t, orgResp.GetOrganizationId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
|
||||
return createSessionAndSmlRequestForCallback(ctx, t, sp, Instance.Users[integration.UserTypeLogin].ID, acsRedirect, user.GetUserId(), saml.HTTPRedirectBinding)
|
||||
},
|
||||
@@ -550,7 +550,7 @@ func TestServer_CreateResponse_Permission(t *testing.T) {
|
||||
orgResp := Instance.CreateOrganization(ctx, integration.OrganizationName(), integration.Email())
|
||||
Instance.CreateProjectGrant(ctx, t, projectID, orgResp.GetOrganizationId())
|
||||
user := Instance.CreateHumanUserVerified(ctx, orgResp.GetOrganizationId(), integration.Email(), integration.Phone())
|
||||
createProjectGrantUserGrant(ctx, t, orgResp.GetOrganizationId(), projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
createProjectGrantUserGrant(ctx, t, projectID, orgResp.GetOrganizationId(), user.GetUserId())
|
||||
|
||||
return createSessionAndSmlRequestForCallback(ctx, t, sp, Instance.Users[integration.UserTypeLogin].ID, acsRedirect, user.GetUserId(), saml.HTTPRedirectBinding)
|
||||
},
|
||||
@@ -694,26 +694,26 @@ func createSAMLApplication(ctx context.Context, t *testing.T, idpMetadata *saml.
|
||||
}
|
||||
|
||||
func createProjectUserGrant(ctx context.Context, t *testing.T, orgID, projectID, userID string) {
|
||||
resp := Instance.CreateProjectUserGrant(t, ctx, orgID, projectID, userID)
|
||||
resp := Instance.CreateAuthorizationProject(t, ctx, projectID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
}
|
||||
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, orgID, projectID, projectGrantID, userID string) {
|
||||
resp := Instance.CreateProjectGrantUserGrant(ctx, orgID, projectID, projectGrantID, userID)
|
||||
func createProjectGrantUserGrant(ctx context.Context, t *testing.T, projectID, grantedOrgID, userID string) {
|
||||
resp := Instance.CreateAuthorizationProjectGrant(t, ctx, projectID, grantedOrgID, userID)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(collect *assert.CollectT) {
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, orgID), &mgmt.GetUserGrantByIDRequest{
|
||||
_, err := Instance.Client.Mgmt.GetUserGrantByID(integration.SetOrgID(ctx, grantedOrgID), &mgmt.GetUserGrantByIDRequest{
|
||||
UserId: userID,
|
||||
GrantId: resp.GetUserGrantId(),
|
||||
GrantId: resp.GetId(),
|
||||
})
|
||||
assert.NoError(collect, err)
|
||||
}, retryDuration, tick)
|
||||
|
||||
Reference in New Issue
Block a user