mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-28 01:52:16 +00:00
Livio SpringandGitHub
5329d50509
# Which Problems Are Solved This PR fixes the self-management of users for metadata and own removal and improves the corresponding permission checks. While looking into the problems, I also noticed that there's a bug in the metadata mapping when using `api.metadata.push` in actions v1 and that re-adding a previously existing key after its removal was not possible. # How the Problems Are Solved - Added a parameter `allowSelfManagement` to checkPermissionOnUser to not require a permission if a user is changing its own data. - Updated use of `NewPermissionCheckUserWrite` including prevention of self-management for metadata. - Pass permission check to the command side (for metadata functions) to allow it implicitly for login v1 and actions v1. - Use of json.Marshal for the metadata mapping (as with `AppendMetadata`) - Check the metadata state when comparing the value. # Additional Changes - added a variadic `roles` parameter to the `CreateOrgMembership` integration test helper function to allow defining specific roles. # Additional Context - noted internally while testing v4.1.x - requires backport to v4.x - closes https://github.com/zitadel/zitadel/issues/10470 - relates to https://github.com/zitadel/zitadel/pull/10426
78 lines
3.4 KiB
Go
78 lines
3.4 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
type Permissions struct {
|
|
Permissions []string
|
|
}
|
|
|
|
func (p *Permissions) AppendPermissions(ctxID string, permissions ...string) {
|
|
for _, permission := range permissions {
|
|
p.appendPermission(ctxID, permission)
|
|
}
|
|
}
|
|
|
|
func (p *Permissions) appendPermission(ctxID, permission string) {
|
|
if ctxID != "" {
|
|
permission = permission + ":" + ctxID
|
|
}
|
|
for _, existingPermission := range p.Permissions {
|
|
if existingPermission == permission {
|
|
return
|
|
}
|
|
}
|
|
p.Permissions = append(p.Permissions, permission)
|
|
}
|
|
|
|
type PermissionCheck func(ctx context.Context, permission, resourceOwnerID, aggregateID string) (err error)
|
|
|
|
const (
|
|
PermissionUserWrite = "user.write"
|
|
PermissionUserRead = "user.read"
|
|
PermissionUserDelete = "user.delete"
|
|
PermissionUserDeleteSelf = "user.self.delete"
|
|
PermissionUserCredentialWrite = "user.credential.write"
|
|
PermissionSessionWrite = "session.write"
|
|
PermissionSessionRead = "session.read"
|
|
PermissionSessionLink = "session.link"
|
|
PermissionSessionDelete = "session.delete"
|
|
PermissionOrgRead = "org.read"
|
|
PermissionIDPRead = "iam.idp.read"
|
|
PermissionOrgIDPRead = "org.idp.read"
|
|
PermissionProjectCreate = "project.create"
|
|
PermissionProjectWrite = "project.write"
|
|
PermissionProjectRead = "project.read"
|
|
PermissionProjectDelete = "project.delete"
|
|
PermissionProjectGrantWrite = "project.grant.write"
|
|
PermissionProjectGrantRead = "project.grant.read"
|
|
PermissionProjectGrantDelete = "project.grant.delete"
|
|
PermissionProjectRoleWrite = "project.role.write"
|
|
PermissionProjectRoleRead = "project.role.read"
|
|
PermissionProjectRoleDelete = "project.role.delete"
|
|
PermissionProjectAppWrite = "project.app.write"
|
|
PermissionProjectAppDelete = "project.app.delete"
|
|
PermissionProjectAppRead = "project.app.read"
|
|
PermissionInstanceMemberWrite = "iam.member.write"
|
|
PermissionInstanceMemberDelete = "iam.member.delete"
|
|
PermissionInstanceMemberRead = "iam.member.read"
|
|
PermissionOrgMemberWrite = "org.member.write"
|
|
PermissionOrgMemberDelete = "org.member.delete"
|
|
PermissionOrgMemberRead = "org.member.read"
|
|
PermissionProjectMemberWrite = "project.member.write"
|
|
PermissionProjectMemberDelete = "project.member.delete"
|
|
PermissionProjectMemberRead = "project.member.read"
|
|
PermissionProjectGrantMemberWrite = "project.grant.member.write"
|
|
PermissionProjectGrantMemberDelete = "project.grant.member.delete"
|
|
PermissionProjectGrantMemberRead = "project.grant.member.read"
|
|
PermissionUserGrantWrite = "user.grant.write"
|
|
PermissionUserGrantRead = "user.grant.read"
|
|
PermissionUserGrantDelete = "user.grant.delete"
|
|
PermissionIAMPolicyWrite = "iam.policy.write"
|
|
PermissionIAMPolicyDelete = "iam.policy.delete"
|
|
PermissionPolicyRead = "policy.read"
|
|
)
|
|
|
|
// ProjectPermissionCheck is used as a check for preconditions dependent on application, project, user resourceowner and usergrants.
|
|
// Configurable on the project the application belongs to through the flags related to authentication.
|
|
type ProjectPermissionCheck func(ctx context.Context, clientID, userID string) (err error)
|