mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
6082e59d47
# Which Problems Are Solved - The eventstore did not support intentionally overwriting the resource owner when creating events for aggregates that may be reused across owners. - Resource owner handling was implicit and could not be controlled per command/event type. - We needed a safe way to distinguish between: - keeping the existing aggregate owner, and - explicitly setting a new owner for specific create-like events. # How the Problems Are Solved - Introduced a new eventstore command type with an explicit enforce_owner flag. - Updated eventstore.commands_to_events and eventstore.push so owner assignment is now explicit: - if enforce_owner is true, the command owner is written - if enforce_owner is false, the existing aggregate owner is retained when present - Added EnforceResourceOwnerCommand and wiring so command types can opt in to enforced owner behavior. - Wired the new behavior through the v3 eventstore push path, including compatibility fallback for older command type mapping. - Added migration/setup changes to register and use the new command type and SQL functions. - Added and updated tests for owner overwrite and aggregate ID reuse scenarios. # Additional Changes - Added small migration/setup robustness improvements related to eventstore setup ordering and helper reuse. - Added focused test coverage for enforced owner behavior and sequencing. - Events that currently allow owner changes (implement EnforceResourceOwner) are: - AddedEvent (action) - GroupAddedEvent - StartedEvent (idp intent) - ProjectAddedEvent - HumanAddedEvent - HumanRegisteredEvent - MachineAddedEvent - CreatedEvent (schema user) # Additional Context - Follow-up for eventstore owner-handling correctness in create flows and aggregate ID reuse cases. - No additional issue link was attached for this change. --------- Co-authored-by: abhishek kumar gupta <[email protected]>
623 lines
18 KiB
Go
623 lines
18 KiB
Go
package command
|
|
|
|
import (
|
|
"time"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
"github.com/zitadel/zitadel/internal/repository/user"
|
|
)
|
|
|
|
type HumanWebAuthNWriteModel struct {
|
|
eventstore.WriteModel
|
|
|
|
WebauthNTokenID string
|
|
Challenge string
|
|
|
|
KeyID []byte
|
|
PublicKey []byte
|
|
AttestationType string
|
|
AAGUID []byte
|
|
SignCount uint32
|
|
WebAuthNTokenName string
|
|
RPID string
|
|
|
|
State domain.MFAState
|
|
}
|
|
|
|
func NewHumanWebAuthNWriteModel(userID, webAuthNTokenID, resourceOwner string) *HumanWebAuthNWriteModel {
|
|
return &HumanWebAuthNWriteModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
WebauthNTokenID: webAuthNTokenID,
|
|
}
|
|
}
|
|
|
|
func (wm *HumanWebAuthNWriteModel) AppendEvents(events ...eventstore.Event) {
|
|
for _, event := range events {
|
|
switch e := event.(type) {
|
|
case *user.HumanWebAuthNAddedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessAddedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNAddedEvent)
|
|
}
|
|
case *user.HumanU2FAddedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNAddedEvent)
|
|
}
|
|
case *user.HumanWebAuthNVerifiedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessVerifiedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNVerifiedEvent)
|
|
}
|
|
case *user.HumanU2FVerifiedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNVerifiedEvent)
|
|
}
|
|
case *user.HumanWebAuthNSignCountChangedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessSignCountChangedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNSignCountChangedEvent)
|
|
}
|
|
case *user.HumanU2FSignCountChangedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNSignCountChangedEvent)
|
|
}
|
|
case *user.HumanWebAuthNRemovedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessRemovedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNRemovedEvent)
|
|
}
|
|
case *user.HumanU2FRemovedEvent:
|
|
if wm.WebauthNTokenID == e.WebAuthNTokenID {
|
|
wm.WriteModel.AppendEvents(&e.HumanWebAuthNRemovedEvent)
|
|
}
|
|
default:
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (wm *HumanWebAuthNWriteModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanWebAuthNAddedEvent:
|
|
wm.appendAddedEvent(e)
|
|
case *user.HumanWebAuthNVerifiedEvent:
|
|
wm.appendVerifiedEvent(e)
|
|
case *user.HumanWebAuthNSignCountChangedEvent:
|
|
wm.SignCount = e.SignCount
|
|
case *user.HumanWebAuthNRemovedEvent:
|
|
wm.State = domain.MFAStateRemoved
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent, *user.UserRemovedEvent:
|
|
wm.Challenge = ""
|
|
wm.KeyID = nil
|
|
wm.PublicKey = nil
|
|
wm.AttestationType = ""
|
|
wm.AAGUID = nil
|
|
wm.SignCount = 0
|
|
wm.WebAuthNTokenName = ""
|
|
wm.RPID = ""
|
|
wm.State = domain.MFAStateRemoved
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (wm *HumanWebAuthNWriteModel) appendAddedEvent(e *user.HumanWebAuthNAddedEvent) {
|
|
wm.WebauthNTokenID = e.WebAuthNTokenID
|
|
wm.Challenge = e.Challenge
|
|
wm.RPID = e.RPID
|
|
wm.State = domain.MFAStateNotReady
|
|
}
|
|
|
|
func (wm *HumanWebAuthNWriteModel) appendVerifiedEvent(e *user.HumanWebAuthNVerifiedEvent) {
|
|
wm.KeyID = e.KeyID
|
|
wm.PublicKey = e.PublicKey
|
|
wm.AttestationType = e.AttestationType
|
|
wm.AAGUID = e.AAGUID
|
|
wm.SignCount = e.SignCount
|
|
wm.WebAuthNTokenName = e.WebAuthNTokenName
|
|
wm.State = domain.MFAStateReady
|
|
}
|
|
|
|
func (wm *HumanWebAuthNWriteModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(wm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(wm.AggregateID).
|
|
EventTypes(
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
user.HumanU2FTokenAddedType,
|
|
user.HumanPasswordlessTokenAddedType,
|
|
user.HumanU2FTokenAddedType,
|
|
user.HumanPasswordlessTokenAddedType,
|
|
user.HumanU2FTokenSignCountChangedType,
|
|
user.HumanPasswordlessTokenSignCountChangedType,
|
|
user.HumanU2FTokenRemovedType,
|
|
user.HumanPasswordlessTokenRemovedType,
|
|
user.UserRemovedType).
|
|
Builder()
|
|
}
|
|
|
|
type HumanWebAuthNTokensReadModel interface {
|
|
eventstore.QueryReducer
|
|
GetWebAuthNTokens() []*HumanWebAuthNWriteModel
|
|
WebAuthNTokenByID(id string) (int, *HumanWebAuthNWriteModel)
|
|
}
|
|
|
|
type HumanU2FTokensReadModel struct {
|
|
eventstore.WriteModel
|
|
|
|
WebAuthNTokens []*HumanWebAuthNWriteModel
|
|
UserState domain.UserState
|
|
}
|
|
|
|
func NewHumanU2FTokensReadModel(userID, resourceOwner string) *HumanU2FTokensReadModel {
|
|
return &HumanU2FTokensReadModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (wm *HumanU2FTokensReadModel) AppendEvents(events ...eventstore.Event) {
|
|
wm.WriteModel.AppendEvents(events...)
|
|
}
|
|
|
|
func (wm *HumanU2FTokensReadModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanU2FAddedEvent:
|
|
token := &HumanWebAuthNWriteModel{}
|
|
token.appendAddedEvent(&e.HumanWebAuthNAddedEvent)
|
|
token.WriteModel = eventstore.WriteModel{
|
|
AggregateID: e.Aggregate().ID,
|
|
}
|
|
replaced := false
|
|
for i, existingTokens := range wm.WebAuthNTokens {
|
|
if existingTokens.State == domain.MFAStateNotReady {
|
|
wm.WebAuthNTokens[i] = token
|
|
replaced = true
|
|
}
|
|
}
|
|
if !replaced {
|
|
wm.WebAuthNTokens = append(wm.WebAuthNTokens, token)
|
|
}
|
|
case *user.HumanU2FVerifiedEvent:
|
|
idx, token := wm.WebAuthNTokenByID(e.WebAuthNTokenID)
|
|
if idx < 0 {
|
|
continue
|
|
}
|
|
token.appendVerifiedEvent(&e.HumanWebAuthNVerifiedEvent)
|
|
case *user.HumanU2FRemovedEvent:
|
|
idx, _ := wm.WebAuthNTokenByID(e.WebAuthNTokenID)
|
|
if idx < 0 {
|
|
continue
|
|
}
|
|
copy(wm.WebAuthNTokens[idx:], wm.WebAuthNTokens[idx+1:])
|
|
wm.WebAuthNTokens[len(wm.WebAuthNTokens)-1] = nil
|
|
wm.WebAuthNTokens = wm.WebAuthNTokens[:len(wm.WebAuthNTokens)-1]
|
|
case *user.UserRemovedEvent:
|
|
wm.WebAuthNTokens = nil
|
|
wm.UserState = domain.UserStateDeleted
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent:
|
|
wm.WebAuthNTokens = nil
|
|
wm.UserState = domain.UserStateUnspecified
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (rm *HumanU2FTokensReadModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(rm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(rm.AggregateID).
|
|
EventTypes(
|
|
user.HumanU2FTokenAddedType,
|
|
user.HumanU2FTokenVerifiedType,
|
|
user.HumanU2FTokenRemovedType,
|
|
user.UserRemovedType,
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
).
|
|
Builder()
|
|
|
|
}
|
|
|
|
func (wm *HumanU2FTokensReadModel) GetWebAuthNTokens() []*HumanWebAuthNWriteModel {
|
|
return wm.WebAuthNTokens
|
|
}
|
|
|
|
func (wm *HumanU2FTokensReadModel) WebAuthNTokenByID(id string) (idx int, token *HumanWebAuthNWriteModel) {
|
|
for idx, token = range wm.WebAuthNTokens {
|
|
if token.WebauthNTokenID == id {
|
|
return idx, token
|
|
}
|
|
}
|
|
return -1, nil
|
|
}
|
|
|
|
type HumanPasswordlessTokensReadModel struct {
|
|
eventstore.WriteModel
|
|
|
|
WebAuthNTokens []*HumanWebAuthNWriteModel
|
|
UserState domain.UserState
|
|
}
|
|
|
|
func NewHumanPasswordlessTokensReadModel(userID, resourceOwner string) *HumanPasswordlessTokensReadModel {
|
|
return &HumanPasswordlessTokensReadModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessTokensReadModel) AppendEvents(events ...eventstore.Event) {
|
|
wm.WriteModel.AppendEvents(events...)
|
|
}
|
|
|
|
func (wm *HumanPasswordlessTokensReadModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanPasswordlessAddedEvent:
|
|
token := &HumanWebAuthNWriteModel{}
|
|
token.appendAddedEvent(&e.HumanWebAuthNAddedEvent)
|
|
token.WriteModel = eventstore.WriteModel{
|
|
AggregateID: e.Aggregate().ID,
|
|
}
|
|
replaced := false
|
|
for i, existingTokens := range wm.WebAuthNTokens {
|
|
if existingTokens.State == domain.MFAStateNotReady {
|
|
wm.WebAuthNTokens[i] = token
|
|
replaced = true
|
|
}
|
|
}
|
|
if !replaced {
|
|
wm.WebAuthNTokens = append(wm.WebAuthNTokens, token)
|
|
}
|
|
case *user.HumanPasswordlessVerifiedEvent:
|
|
idx, token := wm.WebAuthNTokenByID(e.WebAuthNTokenID)
|
|
if idx < 0 {
|
|
continue
|
|
}
|
|
token.appendVerifiedEvent(&e.HumanWebAuthNVerifiedEvent)
|
|
case *user.HumanPasswordlessRemovedEvent:
|
|
idx, _ := wm.WebAuthNTokenByID(e.WebAuthNTokenID)
|
|
if idx < 0 {
|
|
continue
|
|
}
|
|
copy(wm.WebAuthNTokens[idx:], wm.WebAuthNTokens[idx+1:])
|
|
wm.WebAuthNTokens[len(wm.WebAuthNTokens)-1] = nil
|
|
wm.WebAuthNTokens = wm.WebAuthNTokens[:len(wm.WebAuthNTokens)-1]
|
|
case *user.UserRemovedEvent:
|
|
wm.WebAuthNTokens = nil
|
|
wm.UserState = domain.UserStateDeleted
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent:
|
|
wm.WebAuthNTokens = nil
|
|
wm.UserState = domain.UserStateUnspecified
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (rm *HumanPasswordlessTokensReadModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(rm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(rm.AggregateID).
|
|
EventTypes(
|
|
user.HumanPasswordlessTokenAddedType,
|
|
user.HumanPasswordlessTokenVerifiedType,
|
|
user.HumanPasswordlessTokenRemovedType,
|
|
user.UserRemovedType,
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
).
|
|
Builder()
|
|
|
|
}
|
|
|
|
func (wm *HumanPasswordlessTokensReadModel) GetWebAuthNTokens() []*HumanWebAuthNWriteModel {
|
|
return wm.WebAuthNTokens
|
|
}
|
|
|
|
func (wm *HumanPasswordlessTokensReadModel) WebAuthNTokenByID(id string) (idx int, token *HumanWebAuthNWriteModel) {
|
|
for idx, token = range wm.WebAuthNTokens {
|
|
if token.WebauthNTokenID == id {
|
|
return idx, token
|
|
}
|
|
}
|
|
return -1, nil
|
|
}
|
|
|
|
type HumanU2FLoginReadModel struct {
|
|
eventstore.WriteModel
|
|
|
|
AuthReqID string
|
|
Challenge string
|
|
AllowedCredentialIDs [][]byte
|
|
UserVerification domain.UserVerificationRequirement
|
|
State domain.UserState
|
|
}
|
|
|
|
func NewHumanU2FLoginReadModel(userID, authReqID, resourceOwner string) *HumanU2FLoginReadModel {
|
|
return &HumanU2FLoginReadModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
AuthReqID: authReqID,
|
|
}
|
|
}
|
|
|
|
func (wm *HumanU2FLoginReadModel) AppendEvents(events ...eventstore.Event) {
|
|
for _, event := range events {
|
|
switch e := event.(type) {
|
|
case *user.HumanU2FBeginLoginEvent:
|
|
if e.AuthRequestInfo.ID != wm.AuthReqID {
|
|
continue
|
|
}
|
|
wm.WriteModel.AppendEvents(e)
|
|
default:
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (wm *HumanU2FLoginReadModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanU2FBeginLoginEvent:
|
|
wm.Challenge = e.Challenge
|
|
wm.AllowedCredentialIDs = e.AllowedCredentialIDs
|
|
wm.UserVerification = e.UserVerification
|
|
wm.State = domain.UserStateActive
|
|
case *user.UserRemovedEvent:
|
|
wm.Challenge = ""
|
|
wm.AllowedCredentialIDs = nil
|
|
wm.UserVerification = domain.UserVerificationRequirementUnspecified
|
|
wm.State = domain.UserStateDeleted
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent:
|
|
wm.Challenge = ""
|
|
wm.AllowedCredentialIDs = nil
|
|
wm.UserVerification = domain.UserVerificationRequirementUnspecified
|
|
wm.State = domain.UserStateUnspecified
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (rm *HumanU2FLoginReadModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(rm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(rm.AggregateID).
|
|
EventTypes(
|
|
user.HumanU2FTokenBeginLoginType,
|
|
user.UserRemovedType,
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
).
|
|
Builder()
|
|
}
|
|
|
|
type HumanPasswordlessLoginReadModel struct {
|
|
eventstore.WriteModel
|
|
|
|
AuthReqID string
|
|
Challenge string
|
|
AllowedCredentialIDs [][]byte
|
|
UserVerification domain.UserVerificationRequirement
|
|
State domain.UserState
|
|
}
|
|
|
|
func NewHumanPasswordlessLoginReadModel(userID, authReqID, resourceOwner string) *HumanPasswordlessLoginReadModel {
|
|
return &HumanPasswordlessLoginReadModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
AuthReqID: authReqID,
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessLoginReadModel) AppendEvents(events ...eventstore.Event) {
|
|
for _, event := range events {
|
|
switch e := event.(type) {
|
|
case *user.HumanPasswordlessBeginLoginEvent:
|
|
if e.AuthRequestInfo.ID != wm.AuthReqID {
|
|
continue
|
|
}
|
|
wm.WriteModel.AppendEvents(e)
|
|
default:
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessLoginReadModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanPasswordlessBeginLoginEvent:
|
|
wm.Challenge = e.Challenge
|
|
wm.AllowedCredentialIDs = e.AllowedCredentialIDs
|
|
wm.UserVerification = e.UserVerification
|
|
wm.State = domain.UserStateActive
|
|
case *user.UserRemovedEvent:
|
|
wm.Challenge = ""
|
|
wm.AllowedCredentialIDs = nil
|
|
wm.UserVerification = domain.UserVerificationRequirementUnspecified
|
|
wm.State = domain.UserStateDeleted
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent:
|
|
wm.Challenge = ""
|
|
wm.AllowedCredentialIDs = nil
|
|
wm.UserVerification = domain.UserVerificationRequirementUnspecified
|
|
wm.State = domain.UserStateUnspecified
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (rm *HumanPasswordlessLoginReadModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(rm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(rm.AggregateID).
|
|
EventTypes(
|
|
user.HumanPasswordlessTokenBeginLoginType,
|
|
user.UserRemovedType,
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
).
|
|
Builder()
|
|
|
|
}
|
|
|
|
type HumanPasswordlessInitCodeWriteModel struct {
|
|
eventstore.WriteModel
|
|
|
|
CodeID string
|
|
Attempts uint8
|
|
CryptoCode *crypto.CryptoValue
|
|
CodeCreationDate time.Time
|
|
CodeExpiration time.Duration
|
|
State domain.PasswordlessInitCodeState
|
|
}
|
|
|
|
func NewHumanPasswordlessInitCodeWriteModel(userID, codeID, resourceOwner string) *HumanPasswordlessInitCodeWriteModel {
|
|
return &HumanPasswordlessInitCodeWriteModel{
|
|
WriteModel: eventstore.WriteModel{
|
|
AggregateID: userID,
|
|
ResourceOwner: resourceOwner,
|
|
},
|
|
CodeID: codeID,
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) AppendEvents(events ...eventstore.Event) {
|
|
for _, event := range events {
|
|
switch e := event.(type) {
|
|
case *user.HumanPasswordlessInitCodeAddedEvent:
|
|
if wm.CodeID == e.ID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessInitCodeRequestedEvent:
|
|
if wm.CodeID == e.ID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessInitCodeSentEvent:
|
|
if wm.CodeID == e.ID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessInitCodeCheckFailedEvent:
|
|
if wm.CodeID == e.ID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
case *user.HumanPasswordlessInitCodeCheckSucceededEvent:
|
|
if wm.CodeID == e.ID {
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
default:
|
|
wm.WriteModel.AppendEvents(e)
|
|
}
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) Reduce() error {
|
|
for _, event := range wm.Events {
|
|
switch e := event.(type) {
|
|
case *user.HumanPasswordlessInitCodeAddedEvent:
|
|
wm.appendAddedEvent(e)
|
|
case *user.HumanPasswordlessInitCodeRequestedEvent:
|
|
wm.appendRequestedEvent(e)
|
|
case *user.HumanPasswordlessInitCodeSentEvent:
|
|
wm.State = domain.PasswordlessInitCodeStateActive
|
|
case *user.HumanPasswordlessInitCodeCheckFailedEvent:
|
|
wm.appendCheckFailedEvent(e)
|
|
case *user.HumanPasswordlessInitCodeCheckSucceededEvent:
|
|
wm.State = domain.PasswordlessInitCodeStateRemoved
|
|
case *user.HumanAddedEvent, *user.HumanRegisteredEvent, *user.MachineAddedEvent, *user.UserRemovedEvent:
|
|
wm.Attempts = 0
|
|
wm.CryptoCode = nil
|
|
wm.CodeCreationDate = time.Time{}
|
|
wm.CodeExpiration = 0
|
|
wm.State = domain.PasswordlessInitCodeStateUnspecified
|
|
wm.State = domain.PasswordlessInitCodeStateRemoved
|
|
}
|
|
}
|
|
return wm.WriteModel.Reduce()
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) appendAddedEvent(e *user.HumanPasswordlessInitCodeAddedEvent) {
|
|
wm.CryptoCode = e.Code
|
|
wm.CodeExpiration = e.Expiry
|
|
wm.CodeCreationDate = e.CreationDate()
|
|
wm.State = domain.PasswordlessInitCodeStateActive
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) appendRequestedEvent(e *user.HumanPasswordlessInitCodeRequestedEvent) {
|
|
wm.CryptoCode = e.Code
|
|
wm.CodeExpiration = e.Expiry
|
|
wm.CodeCreationDate = e.CreationDate()
|
|
wm.State = domain.PasswordlessInitCodeStateRequested
|
|
if e.CodeReturned {
|
|
wm.State = domain.PasswordlessInitCodeStateActive
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) appendCheckFailedEvent(e *user.HumanPasswordlessInitCodeCheckFailedEvent) {
|
|
wm.Attempts++
|
|
if wm.Attempts == 3 { //TODO: config?
|
|
wm.State = domain.PasswordlessInitCodeStateRemoved
|
|
}
|
|
}
|
|
|
|
func (wm *HumanPasswordlessInitCodeWriteModel) Query() *eventstore.SearchQueryBuilder {
|
|
return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
|
|
ResourceOwner(wm.ResourceOwner).
|
|
AddQuery().
|
|
AggregateTypes(user.AggregateType).
|
|
AggregateIDs(wm.AggregateID).
|
|
EventTypes(user.HumanPasswordlessInitCodeAddedType,
|
|
user.HumanPasswordlessInitCodeRequestedType,
|
|
user.HumanPasswordlessInitCodeSentType,
|
|
user.HumanPasswordlessInitCodeCheckFailedType,
|
|
user.HumanPasswordlessInitCodeCheckSucceededType,
|
|
user.UserRemovedType,
|
|
user.HumanAddedType,
|
|
user.HumanRegisteredType,
|
|
user.MachineAddedEventType,
|
|
).
|
|
Builder()
|
|
}
|