andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 21:52:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): move authorization service to v2 (#10914)

Browse Source 
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves the authorization v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- The `organization_id` to create an authorization is now required to be
always passed. There's no implicit fallback to the project's
organization anymore.
- The `user_id` filter has been removed in favor of the recently added
`in_user_ids` filter.
- The returned `Authorization` object has been reworked to return
`project`, `organization` and `roles` as objects like the granted `user`
already was.
- Additionally the `roles` now not only contain the granted `role_keys`,
but also the `display_name` and `group`. To implement this the query has
been updated internally. Existing APIs are unchanged and still return
just the keys.

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- closes #10746 
- requires backport to v4.x
This commit is contained in:
Livio Spring
2025-10-28 12:11:12 +00:00
committed by GitHub
parent 196eaa84d2
commit c9ac1ce344
21 changed files with 3249 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/query/user_grant.go
+54 -5
View File
@@ -3,7 +3,9 @@ package query
import (
"context"
"database/sql"
"encoding/json"
"errors"
"fmt"
"slices"
"time"
@@ -21,11 +23,12 @@ import (
type UserGrant struct {
// ID represents the aggregate id (id of the user grant)
ID string `json:"id,omitempty"`
CreationDate time.Time `json:"creation_date,omitempty"`
ChangeDate time.Time `json:"change_date,omitempty"`
Sequence uint64 `json:"sequence,omitempty"`
Roles database.TextArray[string] `json:"roles,omitempty"`
ID string `json:"id,omitempty"`
CreationDate time.Time `json:"creation_date,omitempty"`
ChangeDate time.Time `json:"change_date,omitempty"`
Sequence uint64 `json:"sequence,omitempty"`
Roles database.TextArray[string] `json:"roles,omitempty"`
RoleInformation []Role `json:"-"`
// GrantID represents the project grant id
GrantID string `json:"grant_id,omitempty"`
State domain.UserGrantState `json:"state,omitempty"`
@@ -56,6 +59,12 @@ type UserGrant struct {
GrantedOrgDomain string `json:"granted_org_domain,omitempty"`
}
type Role struct {
Key string `json:"role_key,omitempty"`
DisplayName string `json:"display_name,omitempty"`
GroupName string `json:"group_name,omitempty"`
}
type UserGrants struct {
SearchResponse
UserGrants []*UserGrant
@@ -390,6 +399,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
UserGrantSequence.identifier(),
UserGrantGrantID.identifier(),
UserGrantRoles.identifier(),
"roles.role_information",
UserGrantState.identifier(),
UserGrantUserID.identifier(),
@@ -426,6 +436,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
LeftJoin("LATERAL (" + rolesInfoQuery + ") as roles ON true").
Where(
sq.Eq{LoginNameIsPrimaryCol.identifier(): true},
).PlaceholderFormat(sq.Dollar),
@@ -433,6 +444,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
g := new(UserGrant)
var (
roles []byte
username sql.NullString
firstName sql.NullString
userType sql.NullInt32
@@ -463,6 +476,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
&g.Sequence,
&g.GrantID,
&g.Roles,
&roles,
&g.State,
&g.UserID,
@@ -496,6 +510,12 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
}
return nil, zerrors.ThrowInternal(err, "QUERY-oQPcP", "Errors.Internal")
}
if len(roles) > 0 {
err = json.Unmarshal(roles, &g.RoleInformation)
if err != nil {
return nil, err
}
}
g.Username = username.String
g.UserType = domain.UserType(userType.Int32)
@@ -527,6 +547,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
UserGrantSequence.identifier(),
UserGrantGrantID.identifier(),
UserGrantRoles.identifier(),
"roles.role_information",
UserGrantState.identifier(),
UserGrantUserID.identifier(),
@@ -565,6 +586,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
LeftJoin("LATERAL (" + rolesInfoQuery + ") as roles ON true").
Where(
sq.Eq{LoginNameIsPrimaryCol.identifier(): true},
).PlaceholderFormat(sq.Dollar),
@@ -575,6 +597,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
g := new(UserGrant)
var (
roles []byte
username sql.NullString
userType sql.NullInt32
userOwner sql.NullString
@@ -605,6 +629,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
&g.Sequence,
&g.GrantID,
&g.Roles,
&roles,
&g.State,
&g.UserID,
@@ -637,6 +662,12 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
if err != nil {
return nil, err
}
if len(roles) > 0 {
err = json.Unmarshal(roles, &g.RoleInformation)
if err != nil {
return nil, err
}
}
g.Username = username.String
g.UserType = domain.UserType(userType.Int32)
@@ -672,3 +703,21 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
}, nil
}
}
var rolesInfoQuery = fmt.Sprintf(
`SELECT JSON_AGG(
JSON_BUILD_OBJECT(
'role_key', pr.role_key,
'display_name', pr.display_name,
'group_name', pr.group_name
)
) as role_information
FROM %[1]s pr
WHERE pr.instance_id = %[2]s
AND pr.project_id = %[3]s
AND pr.role_key = ANY(%[4]s)`,
projectRolesTable.identifier(),
UserGrantInstanceID.identifier(),
UserGrantProjectID.identifier(),
UserGrantRoles.identifier(),
)
internal/query/user_grant_test.go
+29
View File
@@ -21,6 +21,7 @@ var (
", projections.user_grants5.sequence" +
", projections.user_grants5.grant_id" +
", projections.user_grants5.roles" +
", roles.role_information" +
", projections.user_grants5.state" +
", projections.user_grants5.user_id" +
", projections.users14.username" +
@@ -52,6 +53,7 @@ var (
" LEFT JOIN projections.project_grants4 ON projections.user_grants5.grant_id = projections.project_grants4.grant_id AND projections.user_grants5.instance_id = projections.project_grants4.instance_id AND projections.project_grants4.project_id = projections.user_grants5.project_id" +
" LEFT JOIN projections.orgs1 AS granted_orgs ON projections.project_grants4.granted_org_id = granted_orgs.id AND projections.project_grants4.instance_id = granted_orgs.instance_id" +
" LEFT JOIN projections.login_names3 ON projections.user_grants5.user_id = projections.login_names3.user_id AND projections.user_grants5.instance_id = projections.login_names3.instance_id" +
" LEFT JOIN LATERAL (SELECT JSON_AGG( JSON_BUILD_OBJECT( 'role_key', pr.role_key, 'display_name', pr.display_name, 'group_name', pr.group_name ) ) as role_information FROM projections.project_roles4 pr WHERE pr.instance_id = projections.user_grants5.instance_id AND pr.project_id = projections.user_grants5.project_id AND pr.role_key = ANY(projections.user_grants5.roles)) as roles ON true " +
" WHERE projections.login_names3.is_primary = $1")
userGrantCols = []string{
"id",
@@ -60,6 +62,7 @@ var (
"sequence",
"grant_id",
"roles",
"role_information",
"state",
"user_id",
"username",
@@ -90,6 +93,7 @@ var (
", projections.user_grants5.sequence" +
", projections.user_grants5.grant_id" +
", projections.user_grants5.roles" +
", roles.role_information" +
", projections.user_grants5.state" +
", projections.user_grants5.user_id" +
", projections.users14.username" +
@@ -122,6 +126,7 @@ var (
" LEFT JOIN projections.project_grants4 ON projections.user_grants5.grant_id = projections.project_grants4.grant_id AND projections.user_grants5.instance_id = projections.project_grants4.instance_id AND projections.project_grants4.project_id = projections.user_grants5.project_id" +
" LEFT JOIN projections.orgs1 AS granted_orgs ON projections.project_grants4.granted_org_id = granted_orgs.id AND projections.project_grants4.instance_id = granted_orgs.instance_id" +
" LEFT JOIN projections.login_names3 ON projections.user_grants5.user_id = projections.login_names3.user_id AND projections.user_grants5.instance_id = projections.login_names3.instance_id" +
" LEFT JOIN LATERAL (SELECT JSON_AGG( JSON_BUILD_OBJECT( 'role_key', pr.role_key, 'display_name', pr.display_name, 'group_name', pr.group_name ) ) as role_information FROM projections.project_roles4 pr WHERE pr.instance_id = projections.user_grants5.instance_id AND pr.project_id = projections.user_grants5.project_id AND pr.role_key = ANY(projections.user_grants5.roles)) as roles ON true " +
" WHERE projections.login_names3.is_primary = $1")
userGrantsCols = append(
userGrantCols,
@@ -172,6 +177,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -203,6 +209,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -242,6 +249,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -273,6 +281,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -312,6 +321,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -343,6 +353,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -382,6 +393,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -413,6 +425,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -452,6 +465,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -483,6 +497,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -552,6 +567,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -589,6 +605,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -631,6 +648,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -668,6 +686,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -710,6 +729,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -747,6 +767,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -789,6 +810,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -826,6 +848,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -868,6 +891,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -905,6 +929,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -947,6 +972,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -977,6 +1003,7 @@ func Test_UserGrantPrepares(t *testing.T) {
20211111,
"grant-id",
database.TextArray[string]{"role-key"},
`[{"display_name":"displayName","group_name":"groupName","role_key":"role-key"}]`,
domain.UserGrantStateActive,
"user-id",
"username",
@@ -1014,6 +1041,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",
@@ -1044,6 +1072,7 @@ func Test_UserGrantPrepares(t *testing.T) {
ChangeDate: testNow,
Sequence: 20211111,
Roles: database.TextArray[string]{"role-key"},
RoleInformation: []Role{{Key: "role-key", DisplayName: "displayName", GroupName: "groupName"}},
GrantID: "grant-id",
State: domain.UserGrantStateActive,
UserID: "user-id",