Files
zitadel/internal/repository/group/group.go
T
6082e59d47 fix(eventstore): allow overwriting resource owner of events (#12261)
# Which Problems Are Solved

- The eventstore did not support intentionally overwriting the resource
owner when creating events for aggregates that may be reused across
owners.
- Resource owner handling was implicit and could not be controlled per
command/event type.
- We needed a safe way to distinguish between:
  - keeping the existing aggregate owner, and
  - explicitly setting a new owner for specific create-like events.

# How the Problems Are Solved

- Introduced a new eventstore command type with an explicit
enforce_owner flag.
- Updated eventstore.commands_to_events and eventstore.push so owner
assignment is now explicit:
  - if enforce_owner is true, the command owner is written
- if enforce_owner is false, the existing aggregate owner is retained
when present
- Added EnforceResourceOwnerCommand and wiring so command types can opt
in to enforced owner behavior.
- Wired the new behavior through the v3 eventstore push path, including
compatibility fallback for older command type mapping.
- Added migration/setup changes to register and use the new command type
and SQL functions.
- Added and updated tests for owner overwrite and aggregate ID reuse
scenarios.

# Additional Changes

- Added small migration/setup robustness improvements related to
eventstore setup ordering and helper reuse.
- Added focused test coverage for enforced owner behavior and
sequencing.
- Events that currently allow owner changes (implement
EnforceResourceOwner) are:
  - AddedEvent (action)
  - GroupAddedEvent
  - StartedEvent (idp intent)
  - ProjectAddedEvent
  - HumanAddedEvent
  - HumanRegisteredEvent
  - MachineAddedEvent
  - CreatedEvent (schema user)

# Additional Context

- Follow-up for eventstore owner-handling correctness in create flows
and aggregate ID reuse cases.
- No additional issue link was attached for this change.

---------

Co-authored-by: abhishek kumar gupta <[email protected]>
2026-06-15 11:24:37 +02:00

158 lines
3.6 KiB
Go

package group
import (
"context"
"github.com/zitadel/zitadel/internal/eventstore"
)
const (
uniqueGroupname = "group_name"
GroupAddedEventType = groupEventTypePrefix + "added"
GroupChangedEventType = groupEventTypePrefix + "changed"
GroupRemovedEventType = groupEventTypePrefix + "removed"
)
type GroupAddedEvent struct {
eventstore.BaseEvent `json:"-"`
Name string `json:"name,omitempty"`
Description string `json:"description,omitempty"`
}
func (*GroupAddedEvent) EnforceResourceOwner() {}
func NewGroupAddedEvent(
ctx context.Context,
aggregate *eventstore.Aggregate,
name,
description string,
) *GroupAddedEvent {
return &GroupAddedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(
ctx,
aggregate,
GroupAddedEventType),
Name: name,
Description: description,
}
}
func (g *GroupAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
g.BaseEvent = *event
}
func (g *GroupAddedEvent) Payload() any {
return g
}
func (g *GroupAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
return []*eventstore.UniqueConstraint{NewAddGroupNameUniqueConstraint(g.Name, g.Aggregate().ResourceOwner)}
}
func NewAddGroupNameUniqueConstraint(groupName, organizationID string) *eventstore.UniqueConstraint {
return eventstore.NewAddEventUniqueConstraint(
uniqueGroupname,
groupName+":"+organizationID,
"Errors.Group.AlreadyExists")
}
func NewRemoveGroupNameUniqueConstraint(groupName, organizationID string) *eventstore.UniqueConstraint {
return eventstore.NewRemoveUniqueConstraint(
uniqueGroupname,
groupName+":"+organizationID,
)
}
type GroupChangedEvent struct {
eventstore.BaseEvent `json:"-"`
Name *string `json:"name,omitempty"`
Description *string `json:"description,omitempty"`
oldName string
}
func NewGroupChangedEvent(
ctx context.Context,
aggregate *eventstore.Aggregate,
oldName string,
changes []GroupChanges,
) *GroupChangedEvent {
changeEvent := &GroupChangedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(
ctx,
aggregate,
GroupChangedEventType,
),
oldName: oldName,
}
for _, change := range changes {
change(changeEvent)
}
return changeEvent
}
type GroupChanges func(event *GroupChangedEvent)
func ChangeName(name *string) func(event *GroupChangedEvent) {
return func(event *GroupChangedEvent) {
event.Name = name
}
}
func ChangeDescription(description *string) func(event *GroupChangedEvent) {
return func(event *GroupChangedEvent) {
event.Description = description
}
}
func (g *GroupChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
g.BaseEvent = *event
}
func (g *GroupChangedEvent) Payload() any {
return g
}
func (g *GroupChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
if g.Name == nil {
return nil
}
return []*eventstore.UniqueConstraint{
NewRemoveGroupNameUniqueConstraint(g.oldName, g.Aggregate().ResourceOwner),
NewAddGroupNameUniqueConstraint(*g.Name, g.Aggregate().ResourceOwner)}
}
type GroupRemovedEvent struct {
eventstore.BaseEvent `json:"-"`
ID string `json:"id,omitempty"`
name string
}
func NewGroupRemovedEvent(
ctx context.Context,
aggregate *eventstore.Aggregate,
name string,
) *GroupRemovedEvent {
return &GroupRemovedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(ctx, aggregate, GroupRemovedEventType),
ID: aggregate.ID,
name: name,
}
}
func (g *GroupRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
g.BaseEvent = *event
}
func (g *GroupRemovedEvent) Payload() any {
return g
}
func (g *GroupRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
return []*eventstore.UniqueConstraint{NewRemoveGroupNameUniqueConstraint(g.name, g.Aggregate().ResourceOwner)}
}