mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-25 16:52:17 +00:00
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved
Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.
A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.
Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.
Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).
# How the Problems Are Solved
Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).
- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.
Setup writes `finalized` on the 79 repeatable.done payload:
- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.
Member and grant owner bags now include every org that should delete the
row:
- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.
# Additional Changes
- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.
# Additional Context
A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.
<!-- CURSOR_AGENT_PR_BODY_END -->
<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>
---------
Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>
421 lines
12 KiB
Go
421 lines
12 KiB
Go
package project
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
const (
|
|
UniqueProjectnameType = "project_names"
|
|
projectEventTypePrefix = eventstore.EventType("project.")
|
|
ProjectAddedType = projectEventTypePrefix + "added"
|
|
ProjectChangedType = projectEventTypePrefix + "changed"
|
|
ProjectDeactivatedType = projectEventTypePrefix + "deactivated"
|
|
ProjectReactivatedType = projectEventTypePrefix + "reactivated"
|
|
ProjectRemovedType = projectEventTypePrefix + "removed"
|
|
ProjectOwnerCorrected = projectEventTypePrefix + "owner.corrected"
|
|
|
|
ProjectSearchType = "project"
|
|
ProjectObjectRevision = uint8(1)
|
|
ProjectNameSearchField = "name"
|
|
ProjectStateSearchField = "state"
|
|
)
|
|
|
|
func NewAddProjectNameUniqueConstraint(projectName, resourceOwner string) *eventstore.UniqueConstraint {
|
|
return eventstore.NewAddEventUniqueConstraint(
|
|
UniqueProjectnameType,
|
|
projectName+resourceOwner,
|
|
"Errors.Project.AlreadyExists")
|
|
}
|
|
|
|
func NewRemoveProjectNameUniqueConstraint(projectName, resourceOwner string) *eventstore.UniqueConstraint {
|
|
return eventstore.NewRemoveUniqueConstraint(
|
|
UniqueProjectnameType,
|
|
projectName+resourceOwner)
|
|
}
|
|
|
|
type ProjectAddedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name string `json:"name,omitempty"`
|
|
ProjectRoleAssertion bool `json:"projectRoleAssertion,omitempty"`
|
|
ProjectRoleCheck bool `json:"projectRoleCheck,omitempty"`
|
|
HasProjectCheck bool `json:"hasProjectCheck,omitempty"`
|
|
PrivateLabelingSetting domain.PrivateLabelingSetting `json:"privateLabelingSetting,omitempty"`
|
|
}
|
|
|
|
func (*ProjectAddedEvent) EnforceResourceOwner() {}
|
|
|
|
func (e *ProjectAddedEvent) Payload() interface{} {
|
|
return e
|
|
}
|
|
|
|
func projectOwnerTags(agg *eventstore.Aggregate) []string {
|
|
return []string{
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
|
}
|
|
}
|
|
|
|
func grantOwnerTags(agg *eventstore.Aggregate, grantID, grantedOrgID string) []string {
|
|
return []string{
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, agg.ResourceOwner),
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerOrg, grantedOrgID),
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerProject, agg.ID),
|
|
eventstore.OwnerTag(eventstore.UniqueConstraintOwnerGrant, grantID),
|
|
}
|
|
}
|
|
|
|
func (e *ProjectAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return []*eventstore.UniqueConstraint{NewAddProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner).WithOwners(projectOwnerTags(e.Aggregate())...)}
|
|
}
|
|
|
|
func (e *ProjectAddedEvent) Fields() []*eventstore.FieldOperation {
|
|
return []*eventstore.FieldOperation{
|
|
eventstore.SetField(
|
|
e.Aggregate(),
|
|
projectSearchObject(e.Aggregate().ID),
|
|
ProjectNameSearchField,
|
|
&eventstore.Value{
|
|
Value: e.Name,
|
|
ShouldIndex: true,
|
|
},
|
|
eventstore.FieldTypeInstanceID,
|
|
eventstore.FieldTypeResourceOwner,
|
|
eventstore.FieldTypeAggregateID,
|
|
eventstore.FieldTypeAggregateType,
|
|
eventstore.FieldTypeObjectType,
|
|
eventstore.FieldTypeObjectID,
|
|
eventstore.FieldTypeObjectRevision,
|
|
eventstore.FieldTypeFieldName,
|
|
),
|
|
eventstore.SetField(
|
|
e.Aggregate(),
|
|
projectSearchObject(e.Aggregate().ID),
|
|
ProjectStateSearchField,
|
|
&eventstore.Value{
|
|
Value: domain.ProjectStateActive,
|
|
ShouldIndex: true,
|
|
},
|
|
eventstore.FieldTypeInstanceID,
|
|
eventstore.FieldTypeResourceOwner,
|
|
eventstore.FieldTypeAggregateID,
|
|
eventstore.FieldTypeAggregateType,
|
|
eventstore.FieldTypeObjectType,
|
|
eventstore.FieldTypeObjectID,
|
|
eventstore.FieldTypeObjectRevision,
|
|
eventstore.FieldTypeFieldName,
|
|
),
|
|
}
|
|
}
|
|
|
|
func NewProjectAddedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
name string,
|
|
projectRoleAssertion,
|
|
projectRoleCheck,
|
|
hasProjectCheck bool,
|
|
privateLabelingSetting domain.PrivateLabelingSetting,
|
|
) *ProjectAddedEvent {
|
|
return &ProjectAddedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ProjectAddedType,
|
|
),
|
|
Name: name,
|
|
ProjectRoleAssertion: projectRoleAssertion,
|
|
ProjectRoleCheck: projectRoleCheck,
|
|
HasProjectCheck: hasProjectCheck,
|
|
PrivateLabelingSetting: privateLabelingSetting,
|
|
}
|
|
}
|
|
|
|
func ProjectAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
e := &ProjectAddedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}
|
|
|
|
err := event.Unmarshal(e)
|
|
if err != nil {
|
|
return nil, zerrors.ThrowInternal(err, "PROJECT-Bfg2f", "unable to unmarshal project")
|
|
}
|
|
|
|
return e, nil
|
|
}
|
|
|
|
type ProjectChangeEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name *string `json:"name,omitempty"`
|
|
ProjectRoleAssertion *bool `json:"projectRoleAssertion,omitempty"`
|
|
ProjectRoleCheck *bool `json:"projectRoleCheck,omitempty"`
|
|
HasProjectCheck *bool `json:"hasProjectCheck,omitempty"`
|
|
PrivateLabelingSetting *domain.PrivateLabelingSetting `json:"privateLabelingSetting,omitempty"`
|
|
oldName string
|
|
}
|
|
|
|
func (e *ProjectChangeEvent) Payload() interface{} {
|
|
return e
|
|
}
|
|
|
|
func (e *ProjectChangeEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
if e.Name != nil {
|
|
return []*eventstore.UniqueConstraint{
|
|
NewRemoveProjectNameUniqueConstraint(e.oldName, e.Aggregate().ResourceOwner),
|
|
NewAddProjectNameUniqueConstraint(*e.Name, e.Aggregate().ResourceOwner).WithOwners(projectOwnerTags(e.Aggregate())...),
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectChangeEvent) Fields() []*eventstore.FieldOperation {
|
|
if e.Name == nil {
|
|
return nil
|
|
}
|
|
return []*eventstore.FieldOperation{
|
|
eventstore.SetField(
|
|
e.Aggregate(),
|
|
projectSearchObject(e.Aggregate().ID),
|
|
ProjectNameSearchField,
|
|
&eventstore.Value{
|
|
Value: *e.Name,
|
|
ShouldIndex: true,
|
|
},
|
|
eventstore.FieldTypeInstanceID,
|
|
eventstore.FieldTypeResourceOwner,
|
|
eventstore.FieldTypeAggregateType,
|
|
eventstore.FieldTypeAggregateID,
|
|
eventstore.FieldTypeObjectType,
|
|
eventstore.FieldTypeObjectID,
|
|
eventstore.FieldTypeFieldName,
|
|
),
|
|
}
|
|
}
|
|
|
|
func NewProjectChangeEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
oldName string,
|
|
changes []ProjectChanges,
|
|
) *ProjectChangeEvent {
|
|
changeEvent := &ProjectChangeEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ProjectChangedType,
|
|
),
|
|
oldName: oldName,
|
|
}
|
|
for _, change := range changes {
|
|
change(changeEvent)
|
|
}
|
|
return changeEvent
|
|
}
|
|
|
|
type ProjectChanges func(event *ProjectChangeEvent)
|
|
|
|
func ChangeName(name string) func(event *ProjectChangeEvent) {
|
|
return func(e *ProjectChangeEvent) {
|
|
e.Name = &name
|
|
}
|
|
}
|
|
|
|
func ChangeProjectRoleAssertion(projectRoleAssertion bool) func(event *ProjectChangeEvent) {
|
|
return func(e *ProjectChangeEvent) {
|
|
e.ProjectRoleAssertion = &projectRoleAssertion
|
|
}
|
|
}
|
|
|
|
func ChangeProjectRoleCheck(projectRoleCheck bool) func(event *ProjectChangeEvent) {
|
|
return func(e *ProjectChangeEvent) {
|
|
e.ProjectRoleCheck = &projectRoleCheck
|
|
}
|
|
}
|
|
|
|
func ChangeHasProjectCheck(ChangeHasProjectCheck bool) func(event *ProjectChangeEvent) {
|
|
return func(e *ProjectChangeEvent) {
|
|
e.HasProjectCheck = &ChangeHasProjectCheck
|
|
}
|
|
}
|
|
|
|
func ChangePrivateLabelingSetting(ChangePrivateLabelingSetting domain.PrivateLabelingSetting) func(event *ProjectChangeEvent) {
|
|
return func(e *ProjectChangeEvent) {
|
|
e.PrivateLabelingSetting = &ChangePrivateLabelingSetting
|
|
}
|
|
}
|
|
|
|
func ProjectChangeEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
e := &ProjectChangeEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}
|
|
|
|
err := event.Unmarshal(e)
|
|
if err != nil {
|
|
return nil, zerrors.ThrowInternal(err, "PROJECT-M9osd", "unable to unmarshal project")
|
|
}
|
|
|
|
return e, nil
|
|
}
|
|
|
|
type ProjectDeactivatedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
}
|
|
|
|
func (e *ProjectDeactivatedEvent) Payload() interface{} {
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectDeactivatedEvent) Fields() []*eventstore.FieldOperation {
|
|
return []*eventstore.FieldOperation{
|
|
eventstore.SetField(
|
|
e.Aggregate(),
|
|
projectSearchObject(e.Aggregate().ID),
|
|
ProjectStateSearchField,
|
|
&eventstore.Value{
|
|
Value: domain.ProjectStateInactive,
|
|
ShouldIndex: true,
|
|
},
|
|
|
|
eventstore.FieldTypeInstanceID,
|
|
eventstore.FieldTypeResourceOwner,
|
|
eventstore.FieldTypeAggregateType,
|
|
eventstore.FieldTypeAggregateID,
|
|
eventstore.FieldTypeObjectType,
|
|
eventstore.FieldTypeObjectID,
|
|
eventstore.FieldTypeFieldName,
|
|
),
|
|
}
|
|
}
|
|
|
|
func NewProjectDeactivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate) *ProjectDeactivatedEvent {
|
|
return &ProjectDeactivatedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ProjectDeactivatedType,
|
|
),
|
|
}
|
|
}
|
|
|
|
func ProjectDeactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
return &ProjectDeactivatedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}, nil
|
|
}
|
|
|
|
type ProjectReactivatedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
}
|
|
|
|
func (e *ProjectReactivatedEvent) Payload() interface{} {
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectReactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectReactivatedEvent) Fields() []*eventstore.FieldOperation {
|
|
return []*eventstore.FieldOperation{
|
|
eventstore.SetField(
|
|
e.Aggregate(),
|
|
projectSearchObject(e.Aggregate().ID),
|
|
ProjectStateSearchField,
|
|
&eventstore.Value{
|
|
Value: domain.ProjectStateRemoved,
|
|
ShouldIndex: true,
|
|
},
|
|
|
|
eventstore.FieldTypeInstanceID,
|
|
eventstore.FieldTypeResourceOwner,
|
|
eventstore.FieldTypeAggregateType,
|
|
eventstore.FieldTypeAggregateID,
|
|
eventstore.FieldTypeObjectType,
|
|
eventstore.FieldTypeObjectID,
|
|
eventstore.FieldTypeFieldName,
|
|
),
|
|
}
|
|
}
|
|
|
|
func NewProjectReactivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate) *ProjectReactivatedEvent {
|
|
return &ProjectReactivatedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ProjectReactivatedType,
|
|
),
|
|
}
|
|
}
|
|
|
|
func ProjectReactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
return &ProjectReactivatedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}, nil
|
|
}
|
|
|
|
type ProjectRemovedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name string
|
|
entityIDUniqueContraints []*eventstore.UniqueConstraint
|
|
}
|
|
|
|
func (e *ProjectRemovedEvent) Payload() interface{} {
|
|
return nil
|
|
}
|
|
|
|
func (e *ProjectRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
constraints := []*eventstore.UniqueConstraint{
|
|
NewRemoveProjectNameUniqueConstraint(e.Name, e.Aggregate().ResourceOwner),
|
|
eventstore.NewRemoveUniqueConstraintsByOwner(eventstore.UniqueConstraintOwnerProject, e.Aggregate().ID),
|
|
}
|
|
constraints = append(constraints, e.entityIDUniqueContraints...)
|
|
return constraints
|
|
}
|
|
|
|
func (e *ProjectRemovedEvent) Fields() []*eventstore.FieldOperation {
|
|
return []*eventstore.FieldOperation{
|
|
eventstore.RemoveSearchFieldsByAggregate(e.Aggregate()),
|
|
}
|
|
}
|
|
|
|
func NewProjectRemovedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
name string,
|
|
entityIDUniqueContraints []*eventstore.UniqueConstraint,
|
|
) *ProjectRemovedEvent {
|
|
return &ProjectRemovedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ProjectRemovedType,
|
|
),
|
|
Name: name,
|
|
entityIDUniqueContraints: entityIDUniqueContraints,
|
|
}
|
|
}
|
|
|
|
func ProjectRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
return &ProjectRemovedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}, nil
|
|
}
|
|
|
|
func projectSearchObject(id string) eventstore.Object {
|
|
return eventstore.Object{
|
|
Type: ProjectSearchType,
|
|
Revision: ProjectObjectRevision,
|
|
ID: id,
|
|
}
|
|
}
|