feat: user grants command side (#1191)

* fix: user grant command side * fix: user grant command side * fix: user grant command side check permissions * fix: unique constraint on user grants * fix: add usergrant * fix: add usergrant * fix: add usergrant * fix: user grant remove * Update internal/v2/command/auth_checks.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/auth_checks.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/project.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/v2/command/user_grant.go Co-authored-by: Livio Amstutz <[email protected]> * fix: project events Co-authored-by: Livio Amstutz <[email protected]>
2026-11-09 07:35:13 +00:00 · 2021-01-22 13:31:52 +01:00
parent 28bfe72930
commit dfcb96d6a3
30 changed files with 890 additions and 277 deletions
@@ -0,0 +1,31 @@
+package command
+
+import (
+	"context"
+	"github.com/caos/zitadel/internal/api/authz"
+	caos_errors "github.com/caos/zitadel/internal/errors"
+)
+
+func checkExplicitProjectPermission(ctx context.Context, grantID, projectID string) error {
+	permissions := authz.GetRequestPermissionsFromCtx(ctx)
+	if authz.HasGlobalPermission(permissions) {
+		return nil
+	}
+	ids := authz.GetAllPermissionCtxIDs(permissions)
+	if grantID != "" && listContainsID(ids, grantID) {
+		return nil
+	}
+	if listContainsID(ids, projectID) {
+		return nil
+	}
+	return caos_errors.ThrowPermissionDenied(nil, "EVENT-Shu7e", "Errors.UserGrant.NoPermissionForProject")
+}
+
+func listContainsID(ids []string, id string) bool {
+	for _, i := range ids {
+		if i == id {
+			return true
+		}
+	}
+	return false
+}