fix: cascading changes for usergrants when managing projects / projectgrants (#3035)

internal/query/projection/user_grant.go

@@ -87,6 +87,18 @@ func (p *UserGrantProjection) reducers() []handler.AggregateReducer {
 					Event:  project.GrantRemovedType,
 					Reduce: p.reduceProjectGrantRemoved,
 				},
+				{
+					Event:  project.RoleRemovedType,
+					Reduce: p.reduceRoleRemoved,
+				},
+				{
+					Event:  project.GrantChangedType,
+					Reduce: p.reduceProjectGrantChanged,
+				},
+				{
+					Event:  project.GrantCascadeChangedType,
+					Reduce: p.reduceProjectGrantChanged,
+				},
 			},
 		},
 	}
@@ -253,3 +265,47 @@ func (p *UserGrantProjection) reduceProjectGrantRemoved(event eventstore.Event)
 		},
 	), nil
 }
+
+func (p *UserGrantProjection) reduceRoleRemoved(event eventstore.Event) (*handler.Statement, error) {
+	e, ok := event.(*project.RoleRemovedEvent)
+	if !ok {
+		logging.LogWithFields("PROJE-Edg22", "seq", event.Sequence(), "expectedType", project.RoleRemovedType).Error("wrong event type")
+		return nil, errors.ThrowInvalidArgument(nil, "PROJE-dswg2", "reduce.wrong.event.type")
+	}
+
+	return crdb.NewUpdateStatement(
+		event,
+		[]handler.Column{
+			crdb.NewArrayRemoveCol(UserGrantRoles, e.Key),
+		},
+		[]handler.Condition{
+			handler.NewCond(UserGrantProjectID, e.Aggregate().ID),
+		},
+	), nil
+}
+
+func (p *UserGrantProjection) reduceProjectGrantChanged(event eventstore.Event) (*handler.Statement, error) {
+	var grantID string
+	var keys []string
+	switch e := event.(type) {
+	case *project.GrantChangedEvent:
+		grantID = e.GrantID
+		keys = e.RoleKeys
+	case *project.GrantCascadeChangedEvent:
+		grantID = e.GrantID
+		keys = e.RoleKeys
+	default:
+		logging.LogWithFields("PROJE-FGgw2", "seq", event.Sequence(), "expectedTypes", []eventstore.EventType{project.GrantChangedType, project.GrantCascadeChangedType}).Error("wrong event type")
+		return nil, errors.ThrowInvalidArgument(nil, "PROJE-Fh3gw", "reduce.wrong.event.type")
+	}
+
+	return crdb.NewUpdateStatement(
+		event,
+		[]handler.Column{
+			crdb.NewArrayIntersectCol(UserGrantRoles, pq.StringArray(keys)),
+		},
+		[]handler.Condition{
+			handler.NewCond(UserGrantGrantID, grantID),
+		},
+	), nil
+}

internal/query/projection/user_grant_test.go

@@ -324,6 +324,62 @@ func TestUserGrantProjection_reduces(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "reduceRoleRemoved",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(project.RoleRemovedType),
+					project.AggregateType,
+					[]byte(`{"key": "key"}`),
+				), project.RoleRemovedEventMapper),
+			},
+			reduce: (&UserGrantProjection{}).reduceRoleRemoved,
+			want: wantReduce{
+				aggregateType:    project.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				projection:       UserGrantProjectionTable,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE zitadel.projections.user_grants SET (roles) = (array_remove(roles, $1)) WHERE (project_id = $2)",
+							expectedArgs: []interface{}{
+								"key",
+								"agg-id",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "reduceProjectGrantChanged",
+			args: args{
+				event: getEvent(testEvent(
+					repository.EventType(project.GrantChangedType),
+					project.AggregateType,
+					[]byte(`{"grantId": "grantID", "roleKeys": ["key"]}`),
+				), project.GrantChangedEventMapper),
+			},
+			reduce: (&UserGrantProjection{}).reduceProjectGrantChanged,
+			want: wantReduce{
+				aggregateType:    project.AggregateType,
+				sequence:         15,
+				previousSequence: 10,
+				projection:       UserGrantProjectionTable,
+				executer: &testExecuter{
+					executions: []execution{
+						{
+							expectedStmt: "UPDATE zitadel.projections.user_grants SET (roles) = (SELECT ARRAY( SELECT UNNEST(roles) INTERSECT SELECT UNNEST ($1::STRING[]))) WHERE (grant_id = $2)",
+							expectedArgs: []interface{}{
+								pq.StringArray{"key"},
+								"grantID",
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {