mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved
Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.
A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.
Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.
Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).
# How the Problems Are Solved
Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).
- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.
Setup writes `finalized` on the 79 repeatable.done payload:
- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.
Member and grant owner bags now include every org that should delete the
row:
- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.
# Additional Changes
- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.
# Additional Context
A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.
<!-- CURSOR_AGENT_PR_BODY_END -->
<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>
304 lines
8.5 KiB
Go
304 lines
8.5 KiB
Go
package eventstore_test
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
pgxdecimal "github.com/jackc/pgx-shopspring-decimal"
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
"github.com/jackc/pgx/v5/stdlib"
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/cmd/initialise"
|
|
"github.com/zitadel/zitadel/internal/database"
|
|
"github.com/zitadel/zitadel/internal/database/dialect"
|
|
"github.com/zitadel/zitadel/internal/database/postgres"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
es_sql "github.com/zitadel/zitadel/internal/eventstore/repository/sql"
|
|
new_es "github.com/zitadel/zitadel/internal/eventstore/v3"
|
|
)
|
|
|
|
var (
|
|
testClient *database.DB
|
|
queriers map[string]eventstore.Querier = make(map[string]eventstore.Querier)
|
|
pushers map[string]eventstore.Pusher = make(map[string]eventstore.Pusher)
|
|
clients map[string]*database.DB = make(map[string]*database.DB)
|
|
)
|
|
|
|
func TestMain(m *testing.M) {
|
|
os.Exit(func() int {
|
|
config, cleanup := postgres.StartEmbedded()
|
|
defer cleanup()
|
|
|
|
testClient = &database.DB{
|
|
Database: new(testDB),
|
|
}
|
|
|
|
connConfig, err := pgxpool.ParseConfig(config.GetConnectionURL())
|
|
logging.OnError(err).Fatal("unable to parse db url")
|
|
|
|
connConfig.AfterConnect = func(ctx context.Context, conn *pgx.Conn) error {
|
|
pgxdecimal.Register(conn.TypeMap())
|
|
return new_es.RegisterEventstoreTypes(ctx, conn)
|
|
}
|
|
pool, err := pgxpool.NewWithConfig(context.Background(), connConfig)
|
|
logging.OnError(err).Fatal("unable to create db pool")
|
|
|
|
testClient.DB = stdlib.OpenDBFromPool(pool)
|
|
err = testClient.Ping()
|
|
logging.OnError(err).Fatal("unable to ping db")
|
|
|
|
v2 := &es_sql.Postgres{DB: testClient}
|
|
queriers["v2(inmemory)"] = v2
|
|
clients["v2(inmemory)"] = testClient
|
|
|
|
pushers["v3(inmemory)"] = new_es.NewEventstore(testClient)
|
|
clients["v3(inmemory)"] = testClient
|
|
|
|
if localDB, err := connectLocalhost(); err == nil {
|
|
err = initDB(context.Background(), localDB)
|
|
logging.OnError(err).Fatal("migrations failed")
|
|
|
|
pushers["v3(singlenode)"] = new_es.NewEventstore(localDB)
|
|
clients["v3(singlenode)"] = localDB
|
|
}
|
|
|
|
defer func() {
|
|
logging.OnError(testClient.Close()).Error("unable to close db")
|
|
}()
|
|
|
|
err = initDB(context.Background(), &database.DB{DB: testClient.DB, Database: &postgres.Config{Database: "zitadel"}})
|
|
logging.OnError(err).Fatal("migrations failed")
|
|
|
|
return m.Run()
|
|
}())
|
|
}
|
|
|
|
func initDB(ctx context.Context, db *database.DB) error {
|
|
config := new(database.Config)
|
|
config.SetConnector(&postgres.Config{User: postgres.User{Username: "zitadel"}, Database: "zitadel"})
|
|
|
|
if err := initialise.ReadStmts(); err != nil {
|
|
return err
|
|
}
|
|
|
|
err := initialise.Init(ctx, db,
|
|
initialise.VerifyUser(config.Username(), ""),
|
|
initialise.VerifyDatabase(config.DatabaseName()),
|
|
initialise.VerifyGrant(config.DatabaseName(), config.Username()))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
err = initialise.VerifyZitadel(ctx, db, *config)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// create old events
|
|
_, err = db.Exec(oldEventsTable)
|
|
return err
|
|
}
|
|
|
|
func connectLocalhost() (*database.DB, error) {
|
|
config, err := pgxpool.ParseConfig("postgresql://postgres@localhost:5432/postgres?sslmode=disable")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
config.AfterConnect = func(ctx context.Context, conn *pgx.Conn) error {
|
|
pgxdecimal.Register(conn.TypeMap())
|
|
return new_es.RegisterEventstoreTypes(ctx, conn)
|
|
}
|
|
pool, err := pgxpool.NewWithConfig(context.Background(), config)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
client := stdlib.OpenDBFromPool(pool)
|
|
if err = client.Ping(); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &database.DB{
|
|
DB: client,
|
|
Database: new(testDB),
|
|
}, nil
|
|
}
|
|
|
|
type testDB struct{}
|
|
|
|
func (_ *testDB) Timetravel(time.Duration) string { return " AS OF SYSTEM TIME '-1 ms' " }
|
|
|
|
func (*testDB) DatabaseName() string { return "db" }
|
|
|
|
func (*testDB) Username() string { return "user" }
|
|
|
|
func (*testDB) Type() dialect.DatabaseType { return dialect.DatabaseTypePostgres }
|
|
|
|
func generateCommand(aggregateType eventstore.AggregateType, aggregateID string, opts ...func(*testEvent)) eventstore.Command {
|
|
e := &testEvent{
|
|
BaseEvent: eventstore.BaseEvent{
|
|
Agg: &eventstore.Aggregate{
|
|
ID: aggregateID,
|
|
Type: aggregateType,
|
|
ResourceOwner: "ro",
|
|
Version: "v1",
|
|
},
|
|
Service: "svc",
|
|
EventType: "test.created",
|
|
},
|
|
}
|
|
|
|
for _, opt := range opts {
|
|
opt(e)
|
|
}
|
|
|
|
return e
|
|
}
|
|
|
|
func generateEnforcedCommand(aggregateType eventstore.AggregateType, aggregateID string, opts ...func(*testEvent)) eventstore.Command {
|
|
e := &enforcedTestEvent{
|
|
testEvent: testEvent{
|
|
BaseEvent: eventstore.BaseEvent{
|
|
Agg: &eventstore.Aggregate{
|
|
ID: aggregateID,
|
|
Type: aggregateType,
|
|
ResourceOwner: "ro",
|
|
Version: "v1",
|
|
},
|
|
Service: "svc",
|
|
EventType: "test.created",
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, opt := range opts {
|
|
opt(&e.testEvent)
|
|
}
|
|
|
|
return e
|
|
}
|
|
|
|
type testEvent struct {
|
|
eventstore.BaseEvent
|
|
uniqueConstraints []*eventstore.UniqueConstraint
|
|
}
|
|
|
|
type enforcedTestEvent struct {
|
|
testEvent
|
|
}
|
|
|
|
func (*enforcedTestEvent) EnforceResourceOwner() {}
|
|
|
|
func (e *testEvent) Payload() any {
|
|
return e.BaseEvent.Data
|
|
}
|
|
|
|
func (e *testEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return e.uniqueConstraints
|
|
}
|
|
|
|
func canceledCtx() context.Context {
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
cancel()
|
|
return ctx
|
|
}
|
|
|
|
func fillUniqueData(unique_type, field, instanceID string, owners ...string) error {
|
|
return insertUniqueConstraint(testClient, instanceID, unique_type, field, owners...)
|
|
}
|
|
|
|
func insertUniqueConstraint(db *database.DB, instanceID, uniqueType, uniqueField string, owners ...string) error {
|
|
if len(owners) == 0 {
|
|
_, err := db.Exec("INSERT INTO eventstore.unique_constraints (instance_id, unique_type, unique_field) VALUES ($1, $2, $3)", instanceID, uniqueType, uniqueField)
|
|
return err
|
|
}
|
|
_, err := db.Exec("INSERT INTO eventstore.unique_constraints (instance_id, unique_type, unique_field, owners) VALUES ($1, $2, $3, $4)", instanceID, uniqueType, uniqueField, database.TextArray[string](owners))
|
|
return err
|
|
}
|
|
|
|
func generateAddUniqueConstraint(table, uniqueField string, owners ...string) func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.uniqueConstraints = append(e.uniqueConstraints,
|
|
eventstore.NewAddEventUniqueConstraint(table, uniqueField, "").WithOwners(owners...),
|
|
)
|
|
}
|
|
}
|
|
|
|
func generateRemoveUniqueConstraint(table, uniqueField string) func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.uniqueConstraints = append(e.uniqueConstraints,
|
|
&eventstore.UniqueConstraint{
|
|
UniqueType: table,
|
|
UniqueField: uniqueField,
|
|
Action: eventstore.UniqueConstraintRemove,
|
|
},
|
|
)
|
|
}
|
|
}
|
|
|
|
func generateRemoveInstanceUniqueConstraints() func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.uniqueConstraints = append(e.uniqueConstraints, eventstore.NewRemoveInstanceUniqueConstraints())
|
|
}
|
|
}
|
|
|
|
func generateRemoveUniqueConstraintsByOwner(kind, id string) func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.uniqueConstraints = append(e.uniqueConstraints, eventstore.NewRemoveUniqueConstraintsByOwner(kind, id))
|
|
}
|
|
}
|
|
|
|
func withInstanceID(instanceID string) func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.Agg.InstanceID = instanceID
|
|
}
|
|
}
|
|
|
|
func withEventType(eventType eventstore.EventType) func(e *testEvent) {
|
|
return func(e *testEvent) {
|
|
e.EventType = eventType
|
|
}
|
|
}
|
|
|
|
func cleanupEventstore(client *database.DB) func() {
|
|
return func() {
|
|
_, err := client.Exec("TRUNCATE eventstore.events")
|
|
if err != nil {
|
|
logging.Warnf("unable to truncate events: %v", err)
|
|
}
|
|
_, err = client.Exec("TRUNCATE eventstore.events2")
|
|
if err != nil {
|
|
logging.Warnf("unable to truncate events: %v", err)
|
|
}
|
|
_, err = client.Exec("TRUNCATE eventstore.unique_constraints")
|
|
if err != nil {
|
|
logging.Warnf("unable to truncate unique constraints: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
const oldEventsTable = `CREATE TABLE IF NOT EXISTS eventstore.events (
|
|
id UUID DEFAULT gen_random_uuid()
|
|
, event_type TEXT NOT NULL
|
|
, aggregate_type TEXT NOT NULL
|
|
, aggregate_id TEXT NOT NULL
|
|
, aggregate_version TEXT NOT NULL
|
|
, event_sequence BIGINT NOT NULL
|
|
, previous_aggregate_sequence BIGINT
|
|
, previous_aggregate_type_sequence INT8
|
|
, creation_date TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
, created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
|
|
, event_data JSONB
|
|
, editor_user TEXT NOT NULL
|
|
, editor_service TEXT
|
|
, resource_owner TEXT NOT NULL
|
|
, instance_id TEXT NOT NULL
|
|
, "position" DECIMAL NOT NULL
|
|
, in_tx_order INTEGER NOT NULL
|
|
|
|
, PRIMARY KEY (instance_id, aggregate_type, aggregate_id, event_sequence)
|
|
);`
|