feat: Policy (#79)

* policy added * Make it executable * Make it executable, corrections * password age policy added * password lockout policy added * corrections * policy added * Make it executable * Make it executable, corrections * password age policy added * password lockout policy added * corrections * fix(repository): remove second policy * complaints corrected * Init tests * add some tests * more tests added * systemfefaults added * default values load added * check for default value added * fixes * fixed * create policy if not exists * eventstore tests added Co-authored-by: adlerhurst <[email protected]>
2026-11-08 23:25:12 +00:00 · 2020-05-14 11:48:57 +02:00
parent 767bc5ce6c
commit b9c938594c
46 changed files with 3529 additions and 851 deletions
@@ -1,4 +1,4 @@
 package grpc

 //go:generate protoc -I$GOPATH/src -I../proto -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway -I$GOPATH/src/github.com/grpc-ecosystem/grpc-gateway/third_party/googleapis -I${GOPATH}/src/github.com/envoyproxy/protoc-gen-validate -I${GOPATH}/src/github.com/caos/zitadel/internal/protoc/protoc-gen-authoption --go_out=plugins=grpc:$GOPATH/src --grpc-gateway_out=logtostderr=true:$GOPATH/src --swagger_out=logtostderr=true:. --authoption_out=. ../proto/management.proto
-//go:generate mockgen -package api -destination ./mock/management.proto.mock.go github.com/caos/zitadel/pkg/management/api/grpc ManagementServiceClient
+//go:generate mockgen -package api -destination ./mock/management.proto.mock.go github.com/caos/zitadel/pkg/management/api/grpc ManagementServiceClient
@@ -1799,24 +1799,6 @@ func request_ManagementService_UpdatePasswordComplexityPolicy_0(ctx context.Cont
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := client.UpdatePasswordComplexityPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err

@@ -1834,49 +1816,24 @@ func local_request_ManagementService_UpdatePasswordComplexityPolicy_0(ctx contex
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := server.UpdatePasswordComplexityPolicy(ctx, &protoReq)
 	return msg, metadata, err

 }

+var (
+	filter_ManagementService_DeletePasswordComplexityPolicy_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+)
+
 func request_ManagementService_DeletePasswordComplexityPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq PasswordComplexityPolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ManagementService_DeletePasswordComplexityPolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := client.DeletePasswordComplexityPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -1888,22 +1845,8 @@ func local_request_ManagementService_DeletePasswordComplexityPolicy_0(ctx contex
 	var protoReq PasswordComplexityPolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.URL.Query(), filter_ManagementService_DeletePasswordComplexityPolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := server.DeletePasswordComplexityPolicy(ctx, &protoReq)
@@ -1975,24 +1918,6 @@ func request_ManagementService_UpdatePasswordAgePolicy_0(ctx context.Context, ma
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := client.UpdatePasswordAgePolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err

@@ -2010,49 +1935,24 @@ func local_request_ManagementService_UpdatePasswordAgePolicy_0(ctx context.Conte
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := server.UpdatePasswordAgePolicy(ctx, &protoReq)
 	return msg, metadata, err

 }

+var (
+	filter_ManagementService_DeletePasswordAgePolicy_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+)
+
 func request_ManagementService_DeletePasswordAgePolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq PasswordAgePolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ManagementService_DeletePasswordAgePolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := client.DeletePasswordAgePolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -2064,22 +1964,8 @@ func local_request_ManagementService_DeletePasswordAgePolicy_0(ctx context.Conte
 	var protoReq PasswordAgePolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.URL.Query(), filter_ManagementService_DeletePasswordAgePolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := server.DeletePasswordAgePolicy(ctx, &protoReq)
@@ -2151,24 +2037,6 @@ func request_ManagementService_UpdatePasswordLockoutPolicy_0(ctx context.Context
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := client.UpdatePasswordLockoutPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
 	return msg, metadata, err

@@ -2186,49 +2054,24 @@ func local_request_ManagementService_UpdatePasswordLockoutPolicy_0(ctx context.C
 		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
-	}
-
 	msg, err := server.UpdatePasswordLockoutPolicy(ctx, &protoReq)
 	return msg, metadata, err

 }

+var (
+	filter_ManagementService_DeletePasswordLockoutPolicy_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)}
+)
+
 func request_ManagementService_DeletePasswordLockoutPolicy_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var protoReq PasswordLockoutPolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
+	if err := req.ParseForm(); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_ManagementService_DeletePasswordLockoutPolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := client.DeletePasswordLockoutPolicy(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
@@ -2240,22 +2083,8 @@ func local_request_ManagementService_DeletePasswordLockoutPolicy_0(ctx context.C
 	var protoReq PasswordLockoutPolicyID
 	var metadata runtime.ServerMetadata

-	var (
-		val string
-		ok  bool
-		err error
-		_   = err
-	)
-
-	val, ok = pathParams["id"]
-	if !ok {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "missing parameter %s", "id")
-	}
-
-	protoReq.Id, err = runtime.String(val)
-
-	if err != nil {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "type mismatch, parameter: %s, error: %v", "id", err)
+	if err := runtime.PopulateQueryParameters(&protoReq, req.URL.Query(), filter_ManagementService_DeletePasswordLockoutPolicy_0); err != nil {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
 	}

 	msg, err := server.DeletePasswordLockoutPolicy(ctx, &protoReq)
@@ -11817,25 +11646,25 @@ var (

 	pattern_ManagementService_CreatePasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "complexity"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_UpdatePasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "complexity", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_UpdatePasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "complexity"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_DeletePasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "complexity", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_DeletePasswordComplexityPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "complexity"}, "", runtime.AssumeColonVerbOpt(true)))

 	pattern_ManagementService_GetPasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "age"}, "", runtime.AssumeColonVerbOpt(true)))

 	pattern_ManagementService_CreatePasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "age"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_UpdatePasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "age", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_UpdatePasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "age"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_DeletePasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "age", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_DeletePasswordAgePolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "age"}, "", runtime.AssumeColonVerbOpt(true)))

 	pattern_ManagementService_GetPasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "lockout"}, "", runtime.AssumeColonVerbOpt(true)))

 	pattern_ManagementService_CreatePasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "lockout"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_UpdatePasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "lockout", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_UpdatePasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "lockout"}, "", runtime.AssumeColonVerbOpt(true)))

-	pattern_ManagementService_DeletePasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"policies", "passwords", "lockout", "id"}, "", runtime.AssumeColonVerbOpt(true)))
+	pattern_ManagementService_DeletePasswordLockoutPolicy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"policies", "passwords", "lockout"}, "", runtime.AssumeColonVerbOpt(true)))

 	pattern_ManagementService_GetOrgByID_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 1, 0, 4, 1, 5, 1}, []string{"orgs", "id"}, "", runtime.AssumeColonVerbOpt(true)))

@@ -497,6 +497,28 @@
          "ManagementService"
        ]
      },
+      "delete": {
+        "operationId": "DeletePasswordAgePolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      },
      "post": {
        "operationId": "CreatePasswordAgePolicy",
        "responses": {
@@ -520,30 +542,6 @@
        "tags": [
          "ManagementService"
        ]
-      }
-    },
-    "/policies/passwords/age/{id}": {
-      "delete": {
-        "operationId": "DeletePasswordAgePolicy",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "properties": {}
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          }
-        ],
-        "tags": [
-          "ManagementService"
-        ]
      },
      "put": {
        "operationId": "UpdatePasswordAgePolicy",
@@ -556,12 +554,6 @@
          }
        },
        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
          {
            "name": "body",
            "in": "body",
@@ -592,6 +584,28 @@
          "ManagementService"
        ]
      },
+      "delete": {
+        "operationId": "DeletePasswordComplexityPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      },
      "post": {
        "operationId": "CreatePasswordComplexityPolicy",
        "responses": {
@@ -615,30 +629,6 @@
        "tags": [
          "ManagementService"
        ]
-      }
-    },
-    "/policies/passwords/complexity/{id}": {
-      "delete": {
-        "operationId": "DeletePasswordComplexityPolicy",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "properties": {}
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          }
-        ],
-        "tags": [
-          "ManagementService"
-        ]
      },
      "put": {
        "operationId": "UpdatePasswordComplexityPolicy",
@@ -651,12 +641,6 @@
          }
        },
        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
          {
            "name": "body",
            "in": "body",
@@ -687,6 +671,28 @@
          "ManagementService"
        ]
      },
+      "delete": {
+        "operationId": "DeletePasswordLockoutPolicy",
+        "responses": {
+          "200": {
+            "description": "A successful response.",
+            "schema": {
+              "properties": {}
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "id",
+            "in": "query",
+            "required": false,
+            "type": "string"
+          }
+        ],
+        "tags": [
+          "ManagementService"
+        ]
+      },
      "post": {
        "operationId": "CreatePasswordLockoutPolicy",
        "responses": {
@@ -710,30 +716,6 @@
        "tags": [
          "ManagementService"
        ]
-      }
-    },
-    "/policies/passwords/lockout/{id}": {
-      "delete": {
-        "operationId": "DeletePasswordLockoutPolicy",
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "properties": {}
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          }
-        ],
-        "tags": [
-          "ManagementService"
-        ]
      },
      "put": {
        "operationId": "UpdatePasswordLockoutPolicy",
@@ -746,12 +728,6 @@
          }
        },
        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "type": "string"
-          },
          {
            "name": "body",
            "in": "body",
@@ -4261,6 +4237,10 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "is_default": {
+          "type": "boolean",
+          "format": "boolean"
        }
      }
    },
@@ -4342,6 +4322,10 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "is_default": {
+          "type": "boolean",
+          "format": "boolean"
        }
      }
    },
@@ -4435,6 +4419,10 @@
        "sequence": {
          "type": "string",
          "format": "uint64"
+        },
+        "is_default": {
+          "type": "boolean",
+          "format": "boolean"
        }
      }
    },
@@ -2,54 +2,100 @@ package grpc

 import (
 	"context"
+
 	"github.com/caos/zitadel/internal/errors"
 	"github.com/golang/protobuf/ptypes/empty"
 )

-func (s *Server) GetPasswordComplexityPolicy(ctx context.Context, _ *empty.Empty) (*PasswordComplexityPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-swe5v", "Not implemented")
+func (s *Server) CreatePasswordComplexityPolicy(ctx context.Context, policy *PasswordComplexityPolicyCreate) (*PasswordComplexityPolicy, error) {
+	policyresp, err := s.policy.CreatePasswordComplexityPolicy(ctx, passwordComplexityPolicyCreateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordComplexityPolicyFromModel(policyresp), nil
 }

-func (s *Server) CreatePasswordComplexityPolicy(ctx context.Context, policy *PasswordComplexityPolicyCreate) (*PasswordComplexityPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-lo34s", "Not implemented")
+func (s *Server) GetPasswordComplexityPolicy(ctx context.Context, _ *empty.Empty) (*PasswordComplexityPolicy, error) {
+	policy, err := s.policy.GetPasswordComplexityPolicy(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordComplexityPolicyFromModel(policy), nil
 }

 func (s *Server) UpdatePasswordComplexityPolicy(ctx context.Context, policy *PasswordComplexityPolicyUpdate) (*PasswordComplexityPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-pl8fs", "Not implemented")
+	policyresp, err := s.policy.UpdatePasswordComplexityPolicy(ctx, passwordComplexityPolicyUpdateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordComplexityPolicyFromModel(policyresp), nil
 }

 func (s *Server) DeletePasswordComplexityPolicy(ctx context.Context, ID *PasswordComplexityPolicyID) (*empty.Empty, error) {
 	return nil, errors.ThrowUnimplemented(nil, "GRPC-skw3f", "Not implemented")
 }

-func (s *Server) GetPasswordAgePolicy(ctx context.Context, _ *empty.Empty) (*PasswordAgePolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-po9vb", "Not implemented")
+func (s *Server) CreatePasswordAgePolicy(ctx context.Context, policy *PasswordAgePolicyCreate) (*PasswordAgePolicy, error) {
+	policyresp, err := s.policy.CreatePasswordAgePolicy(ctx, passwordAgePolicyCreateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordAgePolicyFromModel(policyresp), nil
 }

-func (s *Server) CreatePasswordAgePolicy(ctx context.Context, policy *PasswordAgePolicyCreate) (*PasswordAgePolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-ldp3v", "Not implemented")
+func (s *Server) GetPasswordAgePolicy(ctx context.Context, _ *empty.Empty) (*PasswordAgePolicy, error) {
+	policy, err := s.policy.GetPasswordAgePolicy(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordAgePolicyFromModel(policy), nil
 }

 func (s *Server) UpdatePasswordAgePolicy(ctx context.Context, policy *PasswordAgePolicyUpdate) (*PasswordAgePolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-ckep3", "Not implemented")
+	policyresp, err := s.policy.UpdatePasswordAgePolicy(ctx, passwordAgePolicyUpdateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordAgePolicyFromModel(policyresp), nil
 }

 func (s *Server) DeletePasswordAgePolicy(ctx context.Context, ID *PasswordAgePolicyID) (*empty.Empty, error) {
 	return nil, errors.ThrowUnimplemented(nil, "GRPC-plo67", "Not implemented")
 }

-func (s *Server) GetPasswordLockoutPolicy(ctx context.Context, _ *empty.Empty) (*PasswordLockoutPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-GHkd9", "Not implemented")
+func (s *Server) CreatePasswordLockoutPolicy(ctx context.Context, policy *PasswordLockoutPolicyCreate) (*PasswordLockoutPolicy, error) {
+	policyresp, err := s.policy.CreatePasswordLockoutPolicy(ctx, passwordLockoutPolicyCreateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordLockoutPolicyFromModel(policyresp), nil
 }

-func (s *Server) CreatePasswordLockoutPolicy(ctx context.Context, policy *PasswordLockoutPolicyCreate) (*PasswordLockoutPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-mdk3c", "Not implemented")
+func (s *Server) GetPasswordLockoutPolicy(ctx context.Context, _ *empty.Empty) (*PasswordLockoutPolicy, error) {
+	policy, err := s.policy.GetPasswordLockoutPolicy(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordLockoutPolicyFromModel(policy), nil
 }

 func (s *Server) UpdatePasswordLockoutPolicy(ctx context.Context, policy *PasswordLockoutPolicyUpdate) (*PasswordLockoutPolicy, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-8dbN4", "Not implemented")
+	policyresp, err := s.policy.UpdatePasswordLockoutPolicy(ctx, passwordLockoutPolicyUpdateToModel(policy))
+	if err != nil {
+		return nil, err
+	}
+
+	return passwordLockoutPolicyFromModel(policyresp), nil
 }

 func (s *Server) DeletePasswordLockoutPolicy(ctx context.Context, ID *PasswordLockoutPolicyID) (*empty.Empty, error) {
-	return nil, errors.ThrowUnimplemented(nil, "GRPC-plV53", "Not implemented")
+	return nil, errors.ThrowUnimplemented(nil, "GRPC-GHkd9", "Not implemented")
 }
@@ -0,0 +1,66 @@
+package grpc
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/policy/model"
+	"github.com/golang/protobuf/ptypes"
+)
+
+func passwordAgePolicyFromModel(policy *model.PasswordAgePolicy) *PasswordAgePolicy {
+	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
+	logging.Log("GRPC-6ILdB").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(policy.ChangeDate)
+	logging.Log("GRPC-ngUzJ").OnError(err).Debug("unable to parse timestamp")
+
+	return &PasswordAgePolicy{
+		Id:             policy.AggregateID,
+		CreationDate:   creationDate,
+		ChangeDate:     changeDate,
+		Sequence:       policy.Sequence,
+		Description:    policy.Description,
+		ExpireWarnDays: policy.ExpireWarnDays,
+		MaxAgeDays:     policy.MaxAgeDays,
+		IsDefault:      policy.AggregateID == "",
+	}
+}
+
+func passwordAgePolicyToModel(policy *PasswordAgePolicy) *model.PasswordAgePolicy {
+	creationDate, err := ptypes.Timestamp(policy.CreationDate)
+	logging.Log("GRPC-2QSfU").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.Timestamp(policy.ChangeDate)
+	logging.Log("GRPC-LdU91").OnError(err).Debug("unable to parse timestamp")
+
+	return &model.PasswordAgePolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID:  policy.Id,
+			CreationDate: creationDate,
+			ChangeDate:   changeDate,
+			Sequence:     policy.Sequence,
+		},
+		Description:    policy.Description,
+		ExpireWarnDays: policy.ExpireWarnDays,
+		MaxAgeDays:     policy.MaxAgeDays,
+	}
+}
+
+func passwordAgePolicyCreateToModel(policy *PasswordAgePolicyCreate) *model.PasswordAgePolicy {
+	return &model.PasswordAgePolicy{
+		Description:    policy.Description,
+		ExpireWarnDays: policy.ExpireWarnDays,
+		MaxAgeDays:     policy.MaxAgeDays,
+	}
+}
+
+func passwordAgePolicyUpdateToModel(policy *PasswordAgePolicyUpdate) *model.PasswordAgePolicy {
+	return &model.PasswordAgePolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID: policy.Id,
+		},
+		Description:    policy.Description,
+		ExpireWarnDays: policy.ExpireWarnDays,
+		MaxAgeDays:     policy.MaxAgeDays,
+	}
+}
@@ -0,0 +1,78 @@
+package grpc
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/policy/model"
+	"github.com/golang/protobuf/ptypes"
+)
+
+func passwordComplexityPolicyFromModel(policy *model.PasswordComplexityPolicy) *PasswordComplexityPolicy {
+	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
+	logging.Log("GRPC-cQRHE").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(policy.ChangeDate)
+	logging.Log("GRPC-PVA1c").OnError(err).Debug("unable to parse timestamp")
+
+	return &PasswordComplexityPolicy{
+		Id:           policy.AggregateID,
+		CreationDate: creationDate,
+		ChangeDate:   changeDate,
+		Description:  policy.Description,
+		Sequence:     policy.Sequence,
+		MinLength:    policy.MinLength,
+		HasLowercase: policy.HasLowercase,
+		HasUppercase: policy.HasUppercase,
+		HasNumber:    policy.HasNumber,
+		HasSymbol:    policy.HasSymbol,
+		IsDefault:    policy.AggregateID == "",
+	}
+}
+
+func passwordComplexityPolicyToModel(policy *PasswordComplexityPolicy) *model.PasswordComplexityPolicy {
+	creationDate, err := ptypes.Timestamp(policy.CreationDate)
+	logging.Log("GRPC-asmEZ").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.Timestamp(policy.ChangeDate)
+	logging.Log("GRPC-MCE4o").OnError(err).Debug("unable to parse timestamp")
+
+	return &model.PasswordComplexityPolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID:  policy.Id,
+			CreationDate: creationDate,
+			ChangeDate:   changeDate,
+			Sequence:     policy.Sequence,
+		},
+		Description:  policy.Description,
+		MinLength:    policy.MinLength,
+		HasLowercase: policy.HasLowercase,
+		HasUppercase: policy.HasUppercase,
+		HasNumber:    policy.HasNumber,
+		HasSymbol:    policy.HasSymbol,
+	}
+}
+
+func passwordComplexityPolicyCreateToModel(policy *PasswordComplexityPolicyCreate) *model.PasswordComplexityPolicy {
+	return &model.PasswordComplexityPolicy{
+		Description:  policy.Description,
+		MinLength:    policy.MinLength,
+		HasLowercase: policy.HasLowercase,
+		HasUppercase: policy.HasUppercase,
+		HasNumber:    policy.HasNumber,
+		HasSymbol:    policy.HasSymbol,
+	}
+}
+
+func passwordComplexityPolicyUpdateToModel(policy *PasswordComplexityPolicyUpdate) *model.PasswordComplexityPolicy {
+	return &model.PasswordComplexityPolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID: policy.Id,
+		},
+		Description:  policy.Description,
+		MinLength:    policy.MinLength,
+		HasLowercase: policy.HasLowercase,
+		HasUppercase: policy.HasUppercase,
+		HasNumber:    policy.HasNumber,
+		HasSymbol:    policy.HasSymbol,
+	}
+}
@@ -0,0 +1,67 @@
+package grpc
+
+import (
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/policy/model"
+	"github.com/golang/protobuf/ptypes"
+)
+
+func passwordLockoutPolicyFromModel(policy *model.PasswordLockoutPolicy) *PasswordLockoutPolicy {
+	creationDate, err := ptypes.TimestampProto(policy.CreationDate)
+	logging.Log("GRPC-JRSbT").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.TimestampProto(policy.ChangeDate)
+	logging.Log("GRPC-1sizr").OnError(err).Debug("unable to parse timestamp")
+
+	return &PasswordLockoutPolicy{
+		Id:                  policy.AggregateID,
+		CreationDate:        creationDate,
+		ChangeDate:          changeDate,
+		Sequence:            policy.Sequence,
+		Description:         policy.Description,
+		MaxAttempts:         policy.MaxAttempts,
+		ShowLockOutFailures: policy.ShowLockOutFailures,
+		IsDefault:           policy.AggregateID == "",
+	}
+}
+
+func passwordLockoutPolicyToModel(policy *PasswordLockoutPolicy) *model.PasswordLockoutPolicy {
+	creationDate, err := ptypes.Timestamp(policy.CreationDate)
+	logging.Log("GRPC-8a511").OnError(err).Debug("unable to parse timestamp")
+
+	changeDate, err := ptypes.Timestamp(policy.ChangeDate)
+	logging.Log("GRPC-2rdGv").OnError(err).Debug("unable to parse timestamp")
+
+	return &model.PasswordLockoutPolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID:  policy.Id,
+			CreationDate: creationDate,
+			ChangeDate:   changeDate,
+			Sequence:     policy.Sequence,
+		},
+		Description: policy.Description,
+
+		MaxAttempts:         policy.MaxAttempts,
+		ShowLockOutFailures: policy.ShowLockOutFailures,
+	}
+}
+
+func passwordLockoutPolicyCreateToModel(policy *PasswordLockoutPolicyCreate) *model.PasswordLockoutPolicy {
+	return &model.PasswordLockoutPolicy{
+		Description:         policy.Description,
+		MaxAttempts:         policy.MaxAttempts,
+		ShowLockOutFailures: policy.ShowLockOutFailures,
+	}
+}
+
+func passwordLockoutPolicyUpdateToModel(policy *PasswordLockoutPolicyUpdate) *model.PasswordLockoutPolicy {
+	return &model.PasswordLockoutPolicy{
+		ObjectRoot: models.ObjectRoot{
+			AggregateID: policy.Id,
+		},
+		Description:         policy.Description,
+		MaxAttempts:         policy.MaxAttempts,
+		ShowLockOutFailures: policy.ShowLockOutFailures,
+	}
+}
@@ -15,6 +15,7 @@ var _ ManagementServiceServer = (*Server)(nil)
 type Server struct {
 	port      string
 	project   repository.ProjectRepository
+	policy    repository.PolicyRepository
 	org       repository.OrgRepository
 	orgMember repository.OrgMemberRepository
 	user      repository.UserRepository
@@ -27,6 +28,7 @@ func StartServer(conf grpc_util.ServerConfig, authZ auth.Config, repo repository
 	return &Server{
 		port:      conf.Port,
 		project:   repo,
+		policy:    repo,
 		org:       repo,
 		orgMember: repo,
 		user:      repo,
@@ -368,7 +368,7 @@ service ManagementService {

    rpc UpdatePasswordComplexityPolicy(PasswordComplexityPolicyUpdate) returns (PasswordComplexityPolicy) {
        option (google.api.http) = {
-            put: "/policies/passwords/complexity/{id}"
+            put: "/policies/passwords/complexity"
            body: "*"
        };

@@ -379,7 +379,7 @@ service ManagementService {

    rpc DeletePasswordComplexityPolicy(PasswordComplexityPolicyID) returns (google.protobuf.Empty) {
        option (google.api.http) = {
-            delete: "/policies/passwords/complexity/{id}"
+            delete: "/policies/passwords/complexity"
        };

        option (caos.zitadel.utils.v1.auth_option) = {
@@ -411,7 +411,7 @@ service ManagementService {

    rpc UpdatePasswordAgePolicy(PasswordAgePolicyUpdate) returns (PasswordAgePolicy) {
        option (google.api.http) = {
-            put: "/policies/passwords/age/{id}"
+            put: "/policies/passwords/age"
            body: "*"
        };

@@ -422,7 +422,7 @@ service ManagementService {

    rpc DeletePasswordAgePolicy(PasswordAgePolicyID) returns (google.protobuf.Empty) {
        option (google.api.http) = {
-            delete: "/policies/passwords/age/{id}"
+            delete: "/policies/passwords/age"
        };

        option (caos.zitadel.utils.v1.auth_option) = {
@@ -454,7 +454,7 @@ service ManagementService {

    rpc UpdatePasswordLockoutPolicy(PasswordLockoutPolicyUpdate) returns (PasswordLockoutPolicy) {
        option (google.api.http) = {
-            put: "/policies/passwords/lockout/{id}"
+            put: "/policies/passwords/lockout"
            body: "*"
        };

@@ -465,7 +465,7 @@ service ManagementService {

    rpc DeletePasswordLockoutPolicy(PasswordLockoutPolicyID) returns (google.protobuf.Empty) {
        option (google.api.http) = {
-            delete: "/policies/passwords/lockout/{id}"
+            delete: "/policies/passwords/lockout"
        };

        option (caos.zitadel.utils.v1.auth_option) = {
@@ -1532,6 +1532,7 @@ message PasswordComplexityPolicy {
    bool has_number = 9;
    bool has_symbol = 10;
    uint64 sequence = 11;
+    bool is_default = 12;
 }

 message PasswordComplexityPolicyCreate {
@@ -1566,6 +1567,7 @@ message PasswordAgePolicy {
    uint64 max_age_days = 6;
    uint64 expire_warn_days = 7;
    uint64 sequence = 8;
+    bool is_default = 9;
 }

 message PasswordAgePolicyCreate {
@@ -1594,6 +1596,8 @@ message PasswordLockoutPolicy {
    uint64 max_attempts = 6;
    bool show_lock_out_failures = 7;
    uint64 sequence = 8;
+    bool is_default = 9
+    ;
 }

 message PasswordLockoutPolicyCreate {