Commit Graph
2 Commits
Author SHA1 Message Date
Livio SpringandGitHub 5329d50509 fix: correct user self management on metadata and delete (#10666)
# Which Problems Are Solved

This PR fixes the self-management of users for metadata and own removal
and improves the corresponding permission checks.
While looking into the problems, I also noticed that there's a bug in
the metadata mapping when using `api.metadata.push` in actions v1 and
that re-adding a previously existing key after its removal was not
possible.

# How the Problems Are Solved

- Added a parameter `allowSelfManagement` to checkPermissionOnUser to
not require a permission if a user is changing its own data.
- Updated use of `NewPermissionCheckUserWrite` including prevention of
self-management for metadata.
- Pass permission check to the command side (for metadata functions) to
allow it implicitly for login v1 and actions v1.
- Use of json.Marshal for the metadata mapping (as with
`AppendMetadata`)
- Check the metadata state when comparing the value.

# Additional Changes

- added a variadic `roles` parameter to the `CreateOrgMembership`
integration test helper function to allow defining specific roles.

# Additional Context

- noted internally while testing v4.1.x
- requires backport to v4.x
- closes https://github.com/zitadel/zitadel/issues/10470
- relates to https://github.com/zitadel/zitadel/pull/10426
2025-09-16 12:26:21 +00:00
1579bbc8db fix: add user info to context for set metadata in actions (#10426)
# Which Problems Are Solved

User information in the context is necessary through the addition of the
resource based API endpoints for user metadata, for the permission
check.

# How the Problems Are Solved

Add user information to the action execution to add metadata to users.

# Additional Changes

None

# Additional Context

Needs to be added to v4 releases, to provide the functionality to add
metadata through actions v1 and actions v2 functions.

Co-authored-by: Marco A. <[email protected]>
2025-08-11 16:43:52 +02:00