mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-21 23:14:26 +00:00
5f34d1af8f
# Which Problems Are Solved Recent changes to the v2beta and v2 API of the organization service were directly merged to the `next` branch and release on v4.x, since the ongoing move to the relation table, blocked it from being merged into main. # How the Problems Are Solved This PR ports the following changes into main: - fix(api): correct permission check in organization v2beta service: https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed - fix(actions v1): return org metadata again (https://github.com/zitadel/zitadel/pull/11040) - feat(api): move organization api (https://github.com/zitadel/zitadel/pull/11045) # Additional Changes None # Additional Context relates to #10772 --------- Co-authored-by: Gayathri Vijayan <[email protected]>
91 lines
4.0 KiB
Go
91 lines
4.0 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
type Permissions struct {
|
|
Permissions []string
|
|
}
|
|
|
|
func (p *Permissions) AppendPermissions(ctxID string, permissions ...string) {
|
|
for _, permission := range permissions {
|
|
p.appendPermission(ctxID, permission)
|
|
}
|
|
}
|
|
|
|
func (p *Permissions) appendPermission(ctxID, permission string) {
|
|
if ctxID != "" {
|
|
permission = permission + ":" + ctxID
|
|
}
|
|
for _, existingPermission := range p.Permissions {
|
|
if existingPermission == permission {
|
|
return
|
|
}
|
|
}
|
|
p.Permissions = append(p.Permissions, permission)
|
|
}
|
|
|
|
type PermissionCheck func(ctx context.Context, permission, resourceOwnerID, aggregateID string) (err error)
|
|
|
|
const (
|
|
PermissionUserWrite = "user.write"
|
|
PermissionUserRead = "user.read"
|
|
PermissionUserDelete = "user.delete"
|
|
PermissionUserDeleteSelf = "user.self.delete"
|
|
PermissionUserCredentialWrite = "user.credential.write"
|
|
PermissionSessionWrite = "session.write"
|
|
PermissionSessionRead = "session.read"
|
|
PermissionSessionLink = "session.link"
|
|
PermissionSessionDelete = "session.delete"
|
|
PermissionOrgRead = "org.read"
|
|
PermissionOrganizationWrite = "org.write"
|
|
PermissionOrganizationDelete = "org.delete"
|
|
PermissionIDPRead = "iam.idp.read"
|
|
PermissionOrgIDPRead = "org.idp.read"
|
|
PermissionProjectCreate = "project.create"
|
|
PermissionProjectWrite = "project.write"
|
|
PermissionProjectRead = "project.read"
|
|
PermissionProjectDelete = "project.delete"
|
|
PermissionProjectGrantWrite = "project.grant.write"
|
|
PermissionProjectGrantRead = "project.grant.read"
|
|
PermissionProjectGrantDelete = "project.grant.delete"
|
|
PermissionProjectRoleWrite = "project.role.write"
|
|
PermissionProjectRoleRead = "project.role.read"
|
|
PermissionProjectRoleDelete = "project.role.delete"
|
|
PermissionProjectAppWrite = "project.app.write"
|
|
PermissionProjectAppDelete = "project.app.delete"
|
|
PermissionProjectAppRead = "project.app.read"
|
|
PermissionInstanceMemberWrite = "iam.member.write"
|
|
PermissionInstanceMemberDelete = "iam.member.delete"
|
|
PermissionInstanceMemberRead = "iam.member.read"
|
|
PermissionOrgMemberWrite = "org.member.write"
|
|
PermissionOrgMemberDelete = "org.member.delete"
|
|
PermissionOrgMemberRead = "org.member.read"
|
|
PermissionProjectMemberWrite = "project.member.write"
|
|
PermissionProjectMemberDelete = "project.member.delete"
|
|
PermissionProjectMemberRead = "project.member.read"
|
|
PermissionProjectGrantMemberWrite = "project.grant.member.write"
|
|
PermissionProjectGrantMemberDelete = "project.grant.member.delete"
|
|
PermissionProjectGrantMemberRead = "project.grant.member.read"
|
|
PermissionUserGrantWrite = "user.grant.write"
|
|
PermissionUserGrantRead = "user.grant.read"
|
|
PermissionUserGrantDelete = "user.grant.delete"
|
|
PermissionIAMPolicyWrite = "iam.policy.write"
|
|
PermissionIAMPolicyDelete = "iam.policy.delete"
|
|
PermissionPolicyRead = "policy.read"
|
|
PermissionInstanceRead = "iam.read"
|
|
PermissionInstanceWrite = "iam.write"
|
|
PermissionSystemInstanceRead = "system.instance.read"
|
|
PermissionSystemInstanceWrite = "system.instance.write"
|
|
PermissionGroupCreate = "group.create"
|
|
PermissionGroupWrite = "group.write"
|
|
PermissionGroupRead = "group.read"
|
|
PermissionGroupDelete = "group.delete"
|
|
PermissionGroupUserWrite = "group.user.write"
|
|
PermissionGroupUserRead = "group.user.read"
|
|
PermissionGroupUserDelete = "group.user.delete"
|
|
)
|
|
|
|
// ProjectPermissionCheck is used as a check for preconditions dependent on application, project, user resourceowner and usergrants.
|
|
// Configurable on the project the application belongs to through the flags related to authentication.
|
|
type ProjectPermissionCheck func(ctx context.Context, clientID, userID string) (err error)
|