mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-07 14:52:15 +00:00
8b90ddb0b5
# Which Problems Are Solved As part of #11035 , this PR implements the user check logic for session validation # How the Problems Are Solved - Add user and session repositories as invoke options, as well as their mocks to prepare the ground for testing - Implement the logic for the UserCheck command, following what has been done on eventstore side - Add a session permission chek interface to be used during the `Validate()` part of the Commander # Additional Context This is a cherry-picked PR + minor changes, coming from https://github.com/zitadel/zitadel/pull/11164 - Relates to #11035 --------- Co-authored-by: Silvan <[email protected]>
71 lines
2.7 KiB
Go
71 lines
2.7 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
const (
|
|
InstanceReadPermission = "instance.read"
|
|
InstanceWritePermission = "instance.write"
|
|
DomainReadPermission = "domain.read"
|
|
DomainWritePermission = "domain.write"
|
|
OrganizationReadPermission = "organization.read"
|
|
OrganizationWritePermission = "organization.write"
|
|
SessionReadPermission = "session.read"
|
|
SessionWritePermission = "session.write"
|
|
)
|
|
|
|
// PermissionRepository is the interface that manages and checks Zitadel permissions.
|
|
//
|
|
// TODO(muhlemmer): This just defines the checker methods, rest to be done later.
|
|
type PermissionRepository interface {
|
|
PermissionChecker
|
|
}
|
|
|
|
// PermissionChecker defines the methods needed to check permissions.
|
|
//
|
|
//go:generate mockgen -typed -package domainmock -destination ./mock/permission.mock.go . PermissionChecker
|
|
type PermissionChecker interface {
|
|
// Check if the authenticated user has the given permission on instance level.
|
|
CheckInstancePermission(ctx context.Context, permission string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given organization.
|
|
// A permission may be inherited from the instance level.
|
|
CheckOrganizationPermission(ctx context.Context, permission, orgID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project.
|
|
// A permission may be inherited from the instance or organization level.
|
|
CheckProjectPermission(ctx context.Context, permission, projectID string) error
|
|
|
|
// Check if the authenticated user has the given permission on the given project grant.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckProjectGrantPermission(ctx context.Context, permission, projectGrantID string) error
|
|
|
|
// Check if the user in context has the given permission on the given session.
|
|
// A permission may be inherited from the instance or granted organization level.
|
|
CheckSessionPermission(ctx context.Context, permission, sessionID string) error
|
|
}
|
|
|
|
type noopPermissionChecker struct{}
|
|
|
|
// CheckSessionPermission implements [PermissionChecker].
|
|
func (n *noopPermissionChecker) CheckSessionPermission(ctx context.Context, permission string, sessionID string) error {
|
|
return nil
|
|
}
|
|
|
|
var _ PermissionChecker = (*noopPermissionChecker)(nil)
|
|
|
|
func (*noopPermissionChecker) CheckInstancePermission(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckOrganizationPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (*noopPermissionChecker) CheckProjectGrantPermission(context.Context, string, string) error {
|
|
return nil
|
|
}
|