mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-29 10:32:15 +00:00
feat: user grants command side (#1191)
* fix: user grant command side * fix: user grant command side * fix: user grant command side check permissions * fix: unique constraint on user grants * fix: add usergrant * fix: add usergrant * fix: add usergrant * fix: user grant remove * Update internal/v2/command/auth_checks.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/auth_checks.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/project.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/user_grant.go Co-authored-by: Livio Amstutz <[email protected]> * fix: project events Co-authored-by: Livio Amstutz <[email protected]>
This commit is contained in:
Fabi
Livio Amstutz
@@ -0,0 +1,31 @@
|
||||
package command
|
||||
|
||||
import (
|
||||
"context"
|
||||
"github.com/caos/zitadel/internal/api/authz"
|
||||
caos_errors "github.com/caos/zitadel/internal/errors"
|
||||
)
|
||||
|
||||
func checkExplicitProjectPermission(ctx context.Context, grantID, projectID string) error {
|
||||
permissions := authz.GetRequestPermissionsFromCtx(ctx)
|
||||
if authz.HasGlobalPermission(permissions) {
|
||||
return nil
|
||||
}
|
||||
ids := authz.GetAllPermissionCtxIDs(permissions)
|
||||
if grantID != "" && listContainsID(ids, grantID) {
|
||||
return nil
|
||||
}
|
||||
if listContainsID(ids, projectID) {
|
||||
return nil
|
||||
}
|
||||
return caos_errors.ThrowPermissionDenied(nil, "EVENT-Shu7e", "Errors.UserGrant.NoPermissionForProject")
|
||||
}
|
||||
|
||||
func listContainsID(ids []string, id string) bool {
|
||||
for _, i := range ids {
|
||||
if i == id {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -12,7 +12,9 @@ import (
|
||||
"github.com/caos/zitadel/internal/telemetry/tracing"
|
||||
iam_repo "github.com/caos/zitadel/internal/v2/repository/iam"
|
||||
"github.com/caos/zitadel/internal/v2/repository/org"
|
||||
proj_repo "github.com/caos/zitadel/internal/v2/repository/project"
|
||||
usr_repo "github.com/caos/zitadel/internal/v2/repository/user"
|
||||
usr_grant_repo "github.com/caos/zitadel/internal/v2/repository/usergrant"
|
||||
webauthn_helper "github.com/caos/zitadel/internal/webauthn"
|
||||
)
|
||||
|
||||
@@ -53,6 +55,8 @@ func StartCommandSide(config *Config) (repo *CommandSide, err error) {
|
||||
iam_repo.RegisterEventMappers(repo.eventstore)
|
||||
org.RegisterEventMappers(repo.eventstore)
|
||||
usr_repo.RegisterEventMappers(repo.eventstore)
|
||||
usr_grant_repo.RegisterEventMappers(repo.eventstore)
|
||||
proj_repo.RegisterEventMappers(repo.eventstore)
|
||||
|
||||
//TODO: simplify!!!!
|
||||
repo.idpConfigSecretCrypto, err = crypto.NewAESCrypto(config.SystemDefaults.IDPConfigVerificationKey)
|
||||
|
||||
@@ -54,6 +54,17 @@ func (r *CommandSide) getProjectByID(ctx context.Context, projectID, resourceOwn
|
||||
return projectWriteModelToProject(projectWriteModel), nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) checkProjectExists(ctx context.Context, projectID, resourceOwner string) error {
|
||||
projectWriteModel, err := r.getProjectWriteModelByID(ctx, projectID, resourceOwner)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if projectWriteModel.State == domain.ProjectStateUnspecified || projectWriteModel.State == domain.ProjectStateRemoved {
|
||||
return caos_errs.ThrowPreconditionFailed(nil, "COMMAND-4M0fs", "Errors.Project.NotFound")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) getProjectWriteModelByID(ctx context.Context, projectID, resourceOwner string) (*ProjectWriteModel, error) {
|
||||
projectWriteModel := NewProjectWriteModel(projectID, resourceOwner)
|
||||
err := r.eventstore.FilterToQueryReducer(ctx, projectWriteModel)
|
||||
|
||||
@@ -26,12 +26,6 @@ func NewProjectWriteModel(projectID string, resourceOwner string) *ProjectWriteM
|
||||
|
||||
func (wm *ProjectWriteModel) AppendEvents(events ...eventstore.EventReader) {
|
||||
wm.WriteModel.AppendEvents(events...)
|
||||
for _, event := range events {
|
||||
switch e := event.(type) {
|
||||
case *project.ProjectAddedEvent:
|
||||
wm.WriteModel.AppendEvents(e)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (wm *ProjectWriteModel) Reduce() error {
|
||||
|
||||
@@ -0,0 +1,236 @@
|
||||
package command
|
||||
|
||||
import (
|
||||
"context"
|
||||
caos_errs "github.com/caos/zitadel/internal/errors"
|
||||
"github.com/caos/zitadel/internal/eventstore/v2"
|
||||
"github.com/caos/zitadel/internal/telemetry/tracing"
|
||||
"github.com/caos/zitadel/internal/v2/domain"
|
||||
"github.com/caos/zitadel/internal/v2/repository/usergrant"
|
||||
"reflect"
|
||||
)
|
||||
|
||||
func (r *CommandSide) AddUserGrant(ctx context.Context, usergrant *domain.UserGrant, resourceOwner string) (_ *domain.UserGrant, err error) {
|
||||
userGrantAgg, addedUserGrant, err := r.addUserGrant(ctx, usergrant, resourceOwner)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
err = r.eventstore.PushAggregate(ctx, addedUserGrant, userGrantAgg)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return userGrantWriteModelToUserGrant(addedUserGrant), nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) addUserGrant(ctx context.Context, userGrant *domain.UserGrant, resourceOwner string) (_ *usergrant.Aggregate, _ *UserGrantWriteModel, err error) {
|
||||
err = checkExplicitProjectPermission(ctx, userGrant.ProjectGrantID, userGrant.ProjectID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if !userGrant.IsValid() {
|
||||
return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-4M0fs", "Errors.UserGrant.Invalid")
|
||||
}
|
||||
exists, err := r.checkUserExists(ctx, userGrant.UserID, resourceOwner)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if !exists {
|
||||
return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-4M0fs", "Errors.User.NotFound")
|
||||
}
|
||||
err = r.checkProjectExists(ctx, userGrant.ProjectID, resourceOwner)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
userGrant.AggregateID, err = r.idGenerator.Next()
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
addedUserGrant := NewUserGrantWriteModel(userGrant.AggregateID, resourceOwner)
|
||||
userGrantAgg := UserGrantAggregateFromWriteModel(&addedUserGrant.WriteModel)
|
||||
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantAddedEvent(
|
||||
ctx,
|
||||
resourceOwner,
|
||||
userGrant.UserID,
|
||||
userGrant.ProjectID,
|
||||
userGrant.ProjectGrantID,
|
||||
userGrant.RoleKeys,
|
||||
),
|
||||
)
|
||||
return userGrantAgg, addedUserGrant, nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) ChangeUserGrant(ctx context.Context, userGrant *domain.UserGrant, resourceOwner string) (_ *domain.UserGrant, err error) {
|
||||
userGrantAgg, addedUserGrant, err := r.changeUserGrant(ctx, userGrant, resourceOwner, false)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
err = r.eventstore.PushAggregate(ctx, addedUserGrant, userGrantAgg)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return userGrantWriteModelToUserGrant(addedUserGrant), nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) changeUserGrant(ctx context.Context, userGrant *domain.UserGrant, resourceOwner string, cascade bool) (_ *usergrant.Aggregate, _ *UserGrantWriteModel, err error) {
|
||||
err = checkExplicitProjectPermission(ctx, userGrant.ProjectGrantID, userGrant.ProjectID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if userGrant.IsValid() {
|
||||
return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-3M0sd", "Errors.UserGrant.Invalid")
|
||||
}
|
||||
|
||||
existingUserGrant, err := r.userGrantWriteModelByID(ctx, userGrant.AggregateID, userGrant.ResourceOwner)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if existingUserGrant.State == domain.UserGrantStateUnspecified || existingUserGrant.State == domain.UserGrantStateRemoved {
|
||||
return nil, nil, caos_errs.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.UserGrant.NotFound")
|
||||
}
|
||||
if reflect.DeepEqual(existingUserGrant.RoleKeys, userGrant.RoleKeys) {
|
||||
return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-Rs8fy", "Errors.UserGrant.NotChanged")
|
||||
}
|
||||
|
||||
changedUserGrant := NewUserGrantWriteModel(userGrant.AggregateID, resourceOwner)
|
||||
userGrantAgg := UserGrantAggregateFromWriteModel(&changedUserGrant.WriteModel)
|
||||
|
||||
if !cascade {
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantChangedEvent(ctx, userGrant.RoleKeys),
|
||||
)
|
||||
} else {
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantCascadeChangedEvent(ctx, userGrant.RoleKeys),
|
||||
)
|
||||
}
|
||||
|
||||
return userGrantAgg, changedUserGrant, nil
|
||||
}
|
||||
|
||||
func (r *CommandSide) DeactivateUserGrant(ctx context.Context, grantID, resourceOwner string) (err error) {
|
||||
if grantID == "" || resourceOwner == "" {
|
||||
return caos_errs.ThrowPreconditionFailed(nil, "COMMAND-M0dsf", "Errors.UserGrant.IDMissing")
|
||||
}
|
||||
|
||||
existingUserGrant, err := r.userGrantWriteModelByID(ctx, grantID, resourceOwner)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
err = checkExplicitProjectPermission(ctx, existingUserGrant.ProjectGrantID, existingUserGrant.ProjectID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if existingUserGrant.State == domain.UserGrantStateUnspecified || existingUserGrant.State == domain.UserGrantStateRemoved {
|
||||
return caos_errs.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.UserGrant.NotFound")
|
||||
}
|
||||
if existingUserGrant.State != domain.UserGrantStateActive {
|
||||
return caos_errs.ThrowNotFound(nil, "COMMAND-1S9gx", "Errors.UserGrant.NotActive")
|
||||
}
|
||||
|
||||
deactivateUserGrant := NewUserGrantWriteModel(grantID, resourceOwner)
|
||||
userGrantAgg := UserGrantAggregateFromWriteModel(&deactivateUserGrant.WriteModel)
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantDeactivatedEvent(ctx),
|
||||
)
|
||||
|
||||
return r.eventstore.PushAggregate(ctx, deactivateUserGrant, userGrantAgg)
|
||||
}
|
||||
|
||||
func (r *CommandSide) ReactivateUserGrant(ctx context.Context, grantID, resourceOwner string) (err error) {
|
||||
if grantID == "" || resourceOwner == "" {
|
||||
return caos_errs.ThrowPreconditionFailed(nil, "COMMAND-Qxy8v", "Errors.UserGrant.IDMissing")
|
||||
}
|
||||
|
||||
existingUserGrant, err := r.userGrantWriteModelByID(ctx, grantID, resourceOwner)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
err = checkExplicitProjectPermission(ctx, existingUserGrant.ProjectGrantID, existingUserGrant.ProjectID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if existingUserGrant.State == domain.UserGrantStateUnspecified || existingUserGrant.State == domain.UserGrantStateRemoved {
|
||||
return caos_errs.ThrowNotFound(nil, "COMMAND-Lp0gs", "Errors.UserGrant.NotFound")
|
||||
}
|
||||
if existingUserGrant.State != domain.UserGrantStateInactive {
|
||||
return caos_errs.ThrowNotFound(nil, "COMMAND-1ML0v", "Errors.UserGrant.NotInactive")
|
||||
}
|
||||
|
||||
deactivateUserGrant := NewUserGrantWriteModel(grantID, resourceOwner)
|
||||
userGrantAgg := UserGrantAggregateFromWriteModel(&deactivateUserGrant.WriteModel)
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantReactivatedEvent(ctx),
|
||||
)
|
||||
|
||||
return r.eventstore.PushAggregate(ctx, deactivateUserGrant, userGrantAgg)
|
||||
}
|
||||
|
||||
func (r *CommandSide) RemoveUserGrant(ctx context.Context, grantID, resourceOwner string) (err error) {
|
||||
userGrantAgg, removeUserGrant, err := r.removeUserGrant(ctx, grantID, resourceOwner, false)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
return r.eventstore.PushAggregate(ctx, removeUserGrant, userGrantAgg)
|
||||
}
|
||||
|
||||
func (r *CommandSide) BulkRemoveUserGrant(ctx context.Context, grantIDs []string, resourceOwner string) (err error) {
|
||||
aggregates := make([]eventstore.Aggregater, len(grantIDs))
|
||||
for i, grantID := range grantIDs {
|
||||
userGrantAgg, _, err := r.removeUserGrant(ctx, grantID, resourceOwner, false)
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
aggregates[i] = userGrantAgg
|
||||
}
|
||||
_, err = r.eventstore.PushAggregates(ctx, aggregates...)
|
||||
return err
|
||||
}
|
||||
|
||||
func (r *CommandSide) removeUserGrant(ctx context.Context, grantID, resourceOwner string, cascade bool) (_ *usergrant.Aggregate, _ *UserGrantWriteModel, err error) {
|
||||
if grantID == "" || resourceOwner == "" {
|
||||
return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-J9sc5", "Errors.UserGrant.IDMissing")
|
||||
}
|
||||
|
||||
existingUserGrant, err := r.userGrantWriteModelByID(ctx, grantID, resourceOwner)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
err = checkExplicitProjectPermission(ctx, existingUserGrant.ProjectGrantID, existingUserGrant.ProjectID)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
if existingUserGrant.State == domain.UserGrantStateUnspecified || existingUserGrant.State == domain.UserGrantStateRemoved {
|
||||
return nil, nil, caos_errs.ThrowNotFound(nil, "COMMAND-1My0t", "Errors.UserGrant.NotFound")
|
||||
}
|
||||
|
||||
//TODO: Remove Uniqueness
|
||||
removeUserGrant := NewUserGrantWriteModel(grantID, resourceOwner)
|
||||
userGrantAgg := UserGrantAggregateFromWriteModel(&removeUserGrant.WriteModel)
|
||||
if !cascade {
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantRemovedEvent(ctx, existingUserGrant.ResourceOwner, existingUserGrant.UserID, existingUserGrant.ProjectID),
|
||||
)
|
||||
} else {
|
||||
userGrantAgg.PushEvents(
|
||||
usergrant.NewUserGrantCascadeRemovedEvent(ctx, existingUserGrant.ResourceOwner, existingUserGrant.UserID, existingUserGrant.ProjectID),
|
||||
)
|
||||
}
|
||||
|
||||
return userGrantAgg, removeUserGrant, nil
|
||||
}
|
||||
func (r *CommandSide) userGrantWriteModelByID(ctx context.Context, userGrantID, resourceOwner string) (writeModel *UserGrantWriteModel, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
writeModel = NewUserGrantWriteModel(userGrantID, resourceOwner)
|
||||
err = r.eventstore.FilterToQueryReducer(ctx, writeModel)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return writeModel, nil
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
package command
|
||||
|
||||
import "github.com/caos/zitadel/internal/v2/domain"
|
||||
|
||||
func userGrantWriteModelToUserGrant(writeModel *UserGrantWriteModel) *domain.UserGrant {
|
||||
return &domain.UserGrant{
|
||||
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
||||
UserID: writeModel.UserID,
|
||||
ProjectID: writeModel.ProjectID,
|
||||
ProjectGrantID: writeModel.ProjectGrantID,
|
||||
RoleKeys: writeModel.RoleKeys,
|
||||
State: writeModel.State,
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package command
|
||||
|
||||
import (
|
||||
"github.com/caos/zitadel/internal/eventstore/v2"
|
||||
"github.com/caos/zitadel/internal/v2/domain"
|
||||
"github.com/caos/zitadel/internal/v2/repository/usergrant"
|
||||
)
|
||||
|
||||
type UserGrantWriteModel struct {
|
||||
eventstore.WriteModel
|
||||
|
||||
UserID string
|
||||
ProjectID string
|
||||
ProjectGrantID string
|
||||
RoleKeys []string
|
||||
State domain.UserGrantState
|
||||
}
|
||||
|
||||
func NewUserGrantWriteModel(userGrantID string, resourceOwner string) *UserGrantWriteModel {
|
||||
return &UserGrantWriteModel{
|
||||
WriteModel: eventstore.WriteModel{
|
||||
AggregateID: userGrantID,
|
||||
ResourceOwner: resourceOwner,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func (wm *UserGrantWriteModel) AppendEvents(events ...eventstore.EventReader) {
|
||||
wm.WriteModel.AppendEvents(events...)
|
||||
}
|
||||
|
||||
func (wm *UserGrantWriteModel) Reduce() error {
|
||||
for _, event := range wm.Events {
|
||||
switch e := event.(type) {
|
||||
case *usergrant.UserGrantAddedEvent:
|
||||
wm.UserID = e.UserID
|
||||
wm.ProjectID = e.ProjectID
|
||||
wm.ProjectGrantID = e.ProjectGrantID
|
||||
wm.RoleKeys = e.RoleKeys
|
||||
wm.State = domain.UserGrantStateActive
|
||||
case *usergrant.UserGrantChangedEvent:
|
||||
wm.RoleKeys = e.RoleKeys
|
||||
case *usergrant.UserGrantCascadeChangedEvent:
|
||||
wm.RoleKeys = e.RoleKeys
|
||||
case *usergrant.UserGrantDeactivatedEvent:
|
||||
if wm.State == domain.UserGrantStateRemoved {
|
||||
continue
|
||||
}
|
||||
wm.State = domain.UserGrantStateInactive
|
||||
case *usergrant.UserGrantReactivatedEvent:
|
||||
if wm.State == domain.UserGrantStateRemoved {
|
||||
continue
|
||||
}
|
||||
wm.State = domain.UserGrantStateActive
|
||||
case *usergrant.UserGrantRemovedEvent:
|
||||
wm.State = domain.UserGrantStateRemoved
|
||||
case *usergrant.UserGrantCascadeRemovedEvent:
|
||||
wm.State = domain.UserGrantStateRemoved
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (wm *UserGrantWriteModel) Query() *eventstore.SearchQueryBuilder {
|
||||
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, usergrant.AggregateType).
|
||||
AggregateIDs(wm.AggregateID).
|
||||
ResourceOwner(wm.ResourceOwner)
|
||||
}
|
||||
|
||||
func UserGrantAggregateFromWriteModel(wm *eventstore.WriteModel) *usergrant.Aggregate {
|
||||
return &usergrant.Aggregate{
|
||||
Aggregate: *eventstore.AggregateFromWriteModel(wm, usergrant.AggregateType, usergrant.AggregateVersion),
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user