fix: set correct owner on project grants (#9089)

# Which Problems Are Solved

In versions previous to v2.66 it was possible to set a different
resource owner on project grants. This was introduced with the new
resource based API. The resource owner was possible to overwrite using
the x-zitadel-org header.

Because of this issue project grants got the wrong resource owner,
instead of the owner of the project it got the granted org which is
wrong because a resource owner of an aggregate is not allowed to change.

# How the Problems Are Solved

- The wrong owners of the events are set to the original owner of the
project.
- A new event is pushed to these aggregates `project.owner.corrected` 
- The projection updates the owners of the user grants if that event was
written

# Additional Changes

The eventstore push function (replaced in version 2.66) writes the
correct resource owner.

# Additional Context

closes https://github.com/zitadel/zitadel/issues/9072
This commit is contained in:
Silvan
2025-01-15 11:22:16 +01:00
committed by GitHub
parent b664ffe993
commit 1949d1546a
11 changed files with 308 additions and 1 deletions

View File

@@ -0,0 +1,40 @@
package owner
import (
"context"
"github.com/zitadel/zitadel/internal/eventstore"
)
const OwnerCorrectedType = ".owner.corrected"
type Corrected struct {
eventstore.BaseEvent `json:"-"`
PreviousOwners map[uint32]string `json:"previousOwners,omitempty"`
}
var _ eventstore.Command = (*Corrected)(nil)
func (e *Corrected) Payload() interface{} {
return e
}
func (e *Corrected) UniqueConstraints() []*eventstore.UniqueConstraint {
return nil
}
func NewCorrected(
ctx context.Context,
aggregate *eventstore.Aggregate,
previousOwners map[uint32]string,
) *Corrected {
return &Corrected{
BaseEvent: *eventstore.NewBaseEventForPush(
ctx,
aggregate,
eventstore.EventType(aggregate.Type+OwnerCorrectedType),
),
PreviousOwners: previousOwners,
}
}

View File

@@ -16,6 +16,7 @@ const (
ProjectDeactivatedType = projectEventTypePrefix + "deactivated"
ProjectReactivatedType = projectEventTypePrefix + "reactivated"
ProjectRemovedType = projectEventTypePrefix + "removed"
ProjectOwnerCorrected = projectEventTypePrefix + "owner.corrected"
ProjectSearchType = "project"
ProjectObjectRevision = uint8(1)