andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: naming consistency - Organization ID (#11733)

Browse Source 
# Which Problems Are Solved

Renaming of:

  - Resource Owner
  - OrgID
  - OrganizationID
  - Organization Id

# How the Problems Are Solved

Find & Replace, evalue entries, is resource owner referring to an
organization ? If so, do change

# Additional Context

- Closes #11305
This commit is contained in:
Marco A.
2026-03-03 10:24:44 +00:00
committed by GitHub
parent 41b8aa3f18
commit bebee4c795
12 changed files with 35 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/docs/content/concepts/eventstore/implementation.mdx
+1 -1
View File
@@ -27,7 +27,7 @@ An event has the following data:
| creation_date | timestamp when the event was created | 2022-07-05 13:57:56.358774+00 |
| editor_user | The editor user contains mostly an unique identifier of a user. And tells who did the request that led to this event. Sometimes this can also be a name of a system within ZITADEL. | 165460784409638965, NOTIFICATION, LOGIN |
| editor_service | The service defines which API was called when the event got created. If the event was created from the system itself this is empty. | Admin-API |
| resource_owner | The resource owner defines to which organization/resource_owner the event belongs. This is an id generated by ZITADEL as sonyflake id | 168051083313153168 |
| resource_owner | The resource owner is either the organization or instance ID the event belongs to. This is an id generated by ZITADEL as sonyflake id | 168051083313153168 |
| instance_id | ZITADEL is capable of containing multiple ZITADEL instances withing the system. This id is the unique identifier of the Instance and is generated by ZITADEL as sonyflake id. | 165460784409737865 |
## Schemas
backend/v3/domain/id_provider.go
+1 -1
View File
@@ -271,7 +271,7 @@ type IDPSAML struct {
// IDPIdentifierCondition is used to help specify a single identity_provider,
// it will either be used as the identity_provider ID or identity_provider name,
// as identity_provider can be identified either using (instanceID + OrgID + ID) OR (instanceID + OrgID + name)
// as identity_provider can be identified either using (instanceID + OrganizationID + ID) OR (instanceID + OrganizationID + name)
type IDPIdentifierCondition interface {
database.Condition
}
internal/api/grpc/system/instance.go
+1 -2
View File
@@ -103,8 +103,7 @@ func (s *Server) ListIAMMembers(ctx context.Context, req *system_pb.ListIAMMembe
}
return &system_pb.ListIAMMembersResponse{
Details: object.ToListDetails(res.Count, res.Sequence, res.LastRun),
//TODO: resource owner of user of the member instead of the membership resource owner
Result: member.MembersToPb("", res.Members),
Result: member.MembersToPb("", res.Members),
}, nil
}
internal/api/ui/login/custom_action.go
+1 -1
View File
@@ -40,7 +40,7 @@ func (l *Login) runPostExternalAuthenticationActions(
// so let's do a workaround and resourceOwnerOfUserIDPLink if there would be a IDP link
resourceOwner, err = l.resourceOwnerOfUserIDPLink(ctx, authRequest.SelectedIDPConfigID, user.ExternalUserID)
logging.WithFields("authReq", authRequest.ID, "idpID", authRequest.SelectedIDPConfigID).OnError(err).
Warn("could not determine resource owner for runPostExternalAuthenticationActions, fall back to default org id")
Warn("could not determine Organization ID for runPostExternalAuthenticationActions, fall back to default org id")
}
// fallback to default org id
if resourceOwner == "" {
internal/command/org_custom_message_text_test.go
+2 -2
View File
@@ -33,7 +33,7 @@ func TestCommandSide_SetCustomMessageText(t *testing.T) {
res res
}{
{
name: "no resource owner, error",
name: "no Organization ID, error",
fields: fields{
eventstore: eventstoreExpect(t),
},
@@ -383,7 +383,7 @@ func TestCommandSide_RemoveCustomMessageText(t *testing.T) {
res res
}{
{
name: "no resource owner, error",
name: "no Organization ID, error",
fields: fields{
eventstore: eventstoreExpect(
t,
internal/command/project_grant_member.go
+2 -2
View File
@@ -57,8 +57,8 @@ func (c *Commands) AddProjectGrantMember(ctx context.Context, member *AddProject
if err != nil {
return nil, err
}
// TODO: change e2e tests to use correct resourceowner, wrong resource owner is corrected through aggregate
// error if provided resourceowner is not equal to the resourceowner of the project grant
// TODO: change e2e tests to use correct organization ID, wrong organization ID is corrected through aggregate
// error if provided organization ID is not equal to the organization ID of the project grant
//if projectGrantResourceOwner != addedMember.ResourceOwner {
// return nil, zerrors.ThrowPreconditionFailed(nil, "PROJECT-0l10S9OmZV", "Errors.Project.Grant.Invalid")
//}
internal/command/session.go
+3 -3
View File
@@ -408,14 +408,14 @@ func (c *Commands) updateSession(ctx context.Context, checks *SessionCommands, m
}
// checkSessionWritePermission will check that the caller is granted the "session.write" permission on the resource owner of the authenticated user.
// In case the user is not set, and the userResourceOwner is not set (also the case for the session creation),
// In case the user is not set, and the userOrganizationID is not set (also the case for the session creation),
// it will check permission on the instance.
func (c *Commands) checkSessionWritePermission(ctx context.Context, model *SessionWriteModel) error {
userResourceOwner, err := c.sessionUserResourceOwner(ctx, model)
userOrganizationID, err := c.sessionUserResourceOwner(ctx, model)
if err != nil {
return err
}
return c.checkPermission(ctx, domain.PermissionSessionWrite, userResourceOwner, model.UserID)
return c.checkPermission(ctx, domain.PermissionSessionWrite, userOrganizationID, model.UserID)
}
// checkSessionTerminationPermission will check that the provided sessionToken is correct or
internal/command/user_grant_test.go
+4 -4
View File
@@ -663,7 +663,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
},
},
{
name: "usergrant without resource owner on project, ok",
name: "usergrant without Organization ID on project, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
@@ -816,7 +816,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
},
},
{
name: "usergrant for granted resource owner, ok",
name: "usergrant for granted Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
@@ -1717,7 +1717,7 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
},
},
{
name: "usergrant for projectgrant same resource owner, ok",
name: "usergrant for projectgrant same Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
@@ -1813,7 +1813,7 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
},
},
{
name: "usergrant for project without resource owner, ok",
name: "usergrant for project without Organization ID, ok",
fields: fields{
eventstore: expectEventstore(
expectFilter(
internal/query/permission_example_test.go
+4 -4
View File
@@ -11,7 +11,7 @@ import (
)
// ExamplePermissionClause_org shows how to use the PermissionClause function to filter
// permitted records based on the resource owner and the user's instance or organization membership.
// permitted records based on the Organization ID and the user's instance or organization membership.
func ExamplePermissionClause_org() {
// These variables are typically set in the middleware of Zitadel.
// They do not influence the generation of the clause, just what
@@ -23,7 +23,7 @@ func ExamplePermissionClause_org() {
join, args := PermissionClause(
ctx,
UserResourceOwnerCol, // match the resource owner column
UserResourceOwnerCol, // match the Organization ID column
domain.PermissionUserRead,
SingleOrgPermissionOption([]SearchQuery{
mustSearchQuery(NewUserDisplayNameSearchQuery("zitadel", TextContains)),
@@ -44,7 +44,7 @@ func ExamplePermissionClause_org() {
}
// ExamplePermissionClause_project shows how to use the PermissionClause function to filter
// permitted records based on the resource owner and the user's instance or organization membership.
// permitted records based on the Organization ID and the user's instance or organization membership.
// Additionally, it allows returning records based on the project ID and project membership.
func ExamplePermissionClause_project() {
// These variables are typically set in the middleware of Zitadel.
@@ -57,7 +57,7 @@ func ExamplePermissionClause_project() {
join, args := PermissionClause(
ctx,
ProjectColumnResourceOwner, // match the resource owner column
ProjectColumnResourceOwner, // match the Organization ID column
"project.read",
WithProjectsPermissionOption(ProjectColumnID),
SingleOrgPermissionOption([]SearchQuery{
internal/query/project_grant_test.go
+2 -2
View File
@@ -243,7 +243,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
},
},
{
name: "prepareProjectGrantsQuery no resource owner",
name: "prepareProjectGrantsQuery no Organization ID",
prepare: prepareProjectGrantsQuery,
want: want{
sqlExpectations: mockQueries(
@@ -476,7 +476,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
},
},
{
name: "prepareProjectGrantQuery no resource owner",
name: "prepareProjectGrantQuery no Organization ID",
prepare: prepareProjectGrantQuery,
want: want{
sqlExpectations: mockQuery(
internal/query/user_grant_test.go
+4 -4
View File
@@ -67,7 +67,7 @@ var (
"user_id",
"username",
"type",
"resource_owner", //user resource owner
"resource_owner", // user Organization ID
"name",
"primary_domain",
"first_name",
@@ -76,12 +76,12 @@ var (
"display_name",
"avatar_key",
"login_name",
"resource_owner", //user_grant resource owner
"name", //org name
"resource_owner", // user_grant Organization ID
"name", // org name
"primary_domain",
"project_id",
"name", // project name
"resource_owner", // project_grant resource owner
"resource_owner", // project_grant Organization ID
"id", // granted org id
"name", // granted org name
"primary_domain", // granted org domain
proto/zitadel/org/v2beta/org_service.proto
+10 -11
View File
@@ -629,7 +629,7 @@ message CreateOrganizationResponse{
}
message UpdateOrganizationRequest {
// Organization Id for the Organization to be updated
// Organization ID for the Organization to be updated
string id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -680,7 +680,7 @@ message ListOrganizationsResponse {
message DeleteOrganizationRequest {
// Organization Id for the Organization to be deleted
// Organization ID for the Organization to be deleted
string id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -702,7 +702,7 @@ message DeleteOrganizationResponse {
}
message DeactivateOrganizationRequest {
// Organization Id for the Organization to be deactivated
// Organization ID for the Organization to be deactivated
string id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -723,7 +723,7 @@ message DeactivateOrganizationResponse {
}
message ActivateOrganizationRequest {
// Organization Id for the Organization to be activated
// Organization ID for the Organization to be activated
string id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -744,7 +744,7 @@ message ActivateOrganizationResponse {
}
message AddOrganizationDomainRequest {
// Organization Id for the Organization for which the domain is to be added to.
// Organization ID for the Organization for which the domain is to be added to.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -776,7 +776,7 @@ message AddOrganizationDomainResponse {
}
message ListOrganizationDomainsRequest {
// Organization Id for the Organization which domains are to be listed.
// Organization ID for the Organization which domains are to be listed.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -801,7 +801,7 @@ message ListOrganizationDomainsResponse {
}
message DeleteOrganizationDomainRequest {
// Organization Id for the Organization which domain is to be deleted.
// Organization ID for the Organization which domain is to be deleted.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -832,7 +832,7 @@ message DeleteOrganizationDomainResponse {
}
message GenerateOrganizationDomainValidationRequest {
// Organization Id for the Organization which doman to be validated.
// Organization ID for the Organization which domain to be validated.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
@@ -872,7 +872,7 @@ message GenerateOrganizationDomainValidationResponse {
}
message VerifyOrganizationDomainRequest {
// Organization Id for the Organization doman to be verified.
// Organization ID for the Organization domain to be verified.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,
@@ -882,7 +882,7 @@ message VerifyOrganizationDomainRequest {
example: "\"69629012906488334\"";
}
];
// Organization Id for the Organization doman to be verified.
// The domain to be verified.
string domain = 2 [
(validate.rules).string = {min_len: 1, max_len: 200},
(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -909,7 +909,6 @@ message Metadata {
bytes value = 2 [(validate.rules).bytes = {min_len: 1, max_len: 500000}];
}
message SetOrganizationMetadataRequest{
// Organization Id for the Organization doman to be verified.
string organization_id = 1 [
(validate.rules).string = {min_len: 1, max_len: 200},
(google.api.field_behavior) = REQUIRED,