mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-19 22:14:25 +00:00
# Which Problems Are Solved - The eventstore did not support intentionally overwriting the resource owner when creating events for aggregates that may be reused across owners. - Resource owner handling was implicit and could not be controlled per command/event type. - We needed a safe way to distinguish between: - keeping the existing aggregate owner, and - explicitly setting a new owner for specific create-like events. # How the Problems Are Solved - Introduced a new eventstore command type with an explicit enforce_owner flag. - Updated eventstore.commands_to_events and eventstore.push so owner assignment is now explicit: - if enforce_owner is true, the command owner is written - if enforce_owner is false, the existing aggregate owner is retained when present - Added EnforceResourceOwnerCommand and wiring so command types can opt in to enforced owner behavior. - Wired the new behavior through the v3 eventstore push path, including compatibility fallback for older command type mapping. - Added migration/setup changes to register and use the new command type and SQL functions. - Added and updated tests for owner overwrite and aggregate ID reuse scenarios. # Additional Changes - Added small migration/setup robustness improvements related to eventstore setup ordering and helper reuse. - Added focused test coverage for enforced owner behavior and sequencing. - Events that currently allow owner changes (implement EnforceResourceOwner) are: - AddedEvent (action) - GroupAddedEvent - StartedEvent (idp intent) - ProjectAddedEvent - HumanAddedEvent - HumanRegisteredEvent - MachineAddedEvent - CreatedEvent (schema user) # Additional Context - Follow-up for eventstore owner-handling correctness in create flows and aggregate ID reuse cases. - No additional issue link was attached for this change. --------- Co-authored-by: abhishek kumar gupta <[email protected]>
138 lines
3.5 KiB
Go
138 lines
3.5 KiB
Go
package user
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
const (
|
|
machineEventPrefix = userEventTypePrefix + "machine."
|
|
MachineAddedEventType = machineEventPrefix + "added"
|
|
MachineChangedEventType = machineEventPrefix + "changed"
|
|
)
|
|
|
|
type MachineAddedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
UserName string `json:"userName"`
|
|
orgScopedUsername bool
|
|
|
|
Name string `json:"name,omitempty"`
|
|
Description string `json:"description,omitempty"`
|
|
AccessTokenType domain.OIDCTokenType `json:"accessTokenType,omitempty"`
|
|
}
|
|
|
|
func (*MachineAddedEvent) EnforceResourceOwner() {}
|
|
|
|
func (e *MachineAddedEvent) Payload() interface{} {
|
|
return e
|
|
}
|
|
|
|
func (e *MachineAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return []*eventstore.UniqueConstraint{NewAddUsernameUniqueConstraint(e.UserName, e.Aggregate().ResourceOwner, e.orgScopedUsername)}
|
|
}
|
|
|
|
func NewMachineAddedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
userName,
|
|
name,
|
|
description string,
|
|
orgScopedUsername bool,
|
|
accessTokenType domain.OIDCTokenType,
|
|
) *MachineAddedEvent {
|
|
return &MachineAddedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
MachineAddedEventType,
|
|
),
|
|
UserName: userName,
|
|
Name: name,
|
|
Description: description,
|
|
orgScopedUsername: orgScopedUsername,
|
|
AccessTokenType: accessTokenType,
|
|
}
|
|
}
|
|
|
|
func MachineAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
machineAdded := &MachineAddedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}
|
|
err := event.Unmarshal(machineAdded)
|
|
if err != nil {
|
|
return nil, zerrors.ThrowInternal(err, "USER-tMv9s", "unable to unmarshal machine added")
|
|
}
|
|
|
|
return machineAdded, nil
|
|
}
|
|
|
|
type MachineChangedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name *string `json:"name,omitempty"`
|
|
Description *string `json:"description,omitempty"`
|
|
AccessTokenType *domain.OIDCTokenType `json:"accessTokenType,omitempty"`
|
|
}
|
|
|
|
func (e *MachineChangedEvent) Payload() interface{} {
|
|
return e
|
|
}
|
|
|
|
func (e *MachineChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return nil
|
|
}
|
|
|
|
func NewMachineChangedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
changes []MachineChanges,
|
|
) *MachineChangedEvent {
|
|
changeEvent := &MachineChangedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
MachineChangedEventType,
|
|
),
|
|
}
|
|
for _, change := range changes {
|
|
change(changeEvent)
|
|
}
|
|
return changeEvent
|
|
}
|
|
|
|
type MachineChanges func(event *MachineChangedEvent)
|
|
|
|
func ChangeName(name string) func(event *MachineChangedEvent) {
|
|
return func(e *MachineChangedEvent) {
|
|
e.Name = &name
|
|
}
|
|
}
|
|
|
|
func ChangeDescription(description string) func(event *MachineChangedEvent) {
|
|
return func(e *MachineChangedEvent) {
|
|
e.Description = &description
|
|
}
|
|
}
|
|
|
|
func ChangeAccessTokenType(accessTokenType domain.OIDCTokenType) func(event *MachineChangedEvent) {
|
|
return func(e *MachineChangedEvent) {
|
|
e.AccessTokenType = &accessTokenType
|
|
}
|
|
}
|
|
|
|
func MachineChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
|
|
machineChanged := &MachineChangedEvent{
|
|
BaseEvent: *eventstore.BaseEventFromRepo(event),
|
|
}
|
|
err := event.Unmarshal(machineChanged)
|
|
if err != nil {
|
|
return nil, zerrors.ThrowInternal(err, "USER-4M9ds", "unable to unmarshal machine changed")
|
|
}
|
|
|
|
return machineChanged, nil
|
|
}
|