mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
Livio SpringandGitHub
5329d50509
# Which Problems Are Solved This PR fixes the self-management of users for metadata and own removal and improves the corresponding permission checks. While looking into the problems, I also noticed that there's a bug in the metadata mapping when using `api.metadata.push` in actions v1 and that re-adding a previously existing key after its removal was not possible. # How the Problems Are Solved - Added a parameter `allowSelfManagement` to checkPermissionOnUser to not require a permission if a user is changing its own data. - Updated use of `NewPermissionCheckUserWrite` including prevention of self-management for metadata. - Pass permission check to the command side (for metadata functions) to allow it implicitly for login v1 and actions v1. - Use of json.Marshal for the metadata mapping (as with `AppendMetadata`) - Check the metadata state when comparing the value. # Additional Changes - added a variadic `roles` parameter to the `CreateOrgMembership` integration test helper function to allow defining specific roles. # Additional Context - noted internally while testing v4.1.x - requires backport to v4.x - closes https://github.com/zitadel/zitadel/issues/10470 - relates to https://github.com/zitadel/zitadel/pull/10426
58 lines
1.9 KiB
Go
58 lines
1.9 KiB
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
|
|
"connectrpc.com/connect"
|
|
"github.com/zitadel/oidc/v3/pkg/oidc"
|
|
"google.golang.org/protobuf/types/known/timestamppb"
|
|
|
|
z_oidc "github.com/zitadel/zitadel/internal/api/oidc"
|
|
"github.com/zitadel/zitadel/internal/command"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/eventstore/v1/models"
|
|
"github.com/zitadel/zitadel/pkg/grpc/user/v2"
|
|
)
|
|
|
|
func (s *Server) AddPersonalAccessToken(ctx context.Context, req *connect.Request[user.AddPersonalAccessTokenRequest]) (*connect.Response[user.AddPersonalAccessTokenResponse], error) {
|
|
newPat := &command.PersonalAccessToken{
|
|
ObjectRoot: models.ObjectRoot{
|
|
AggregateID: req.Msg.GetUserId(),
|
|
},
|
|
PermissionCheck: s.command.NewPermissionCheckUserWrite(ctx, true),
|
|
ExpirationDate: req.Msg.GetExpirationDate().AsTime(),
|
|
Scopes: []string{
|
|
oidc.ScopeOpenID,
|
|
oidc.ScopeProfile,
|
|
z_oidc.ScopeUserMetaData,
|
|
z_oidc.ScopeResourceOwner,
|
|
},
|
|
AllowedUserType: domain.UserTypeMachine,
|
|
}
|
|
details, err := s.command.AddPersonalAccessToken(ctx, newPat)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return connect.NewResponse(&user.AddPersonalAccessTokenResponse{
|
|
CreationDate: timestamppb.New(details.EventDate),
|
|
TokenId: newPat.TokenID,
|
|
Token: newPat.Token,
|
|
}), nil
|
|
}
|
|
|
|
func (s *Server) RemovePersonalAccessToken(ctx context.Context, req *connect.Request[user.RemovePersonalAccessTokenRequest]) (*connect.Response[user.RemovePersonalAccessTokenResponse], error) {
|
|
objectDetails, err := s.command.RemovePersonalAccessToken(ctx, &command.PersonalAccessToken{
|
|
TokenID: req.Msg.GetTokenId(),
|
|
ObjectRoot: models.ObjectRoot{
|
|
AggregateID: req.Msg.GetUserId(),
|
|
},
|
|
PermissionCheck: s.command.NewPermissionCheckUserWrite(ctx, true),
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return connect.NewResponse(&user.RemovePersonalAccessTokenResponse{
|
|
DeletionDate: timestamppb.New(objectDetails.EventDate),
|
|
}), nil
|
|
}
|