From 31b542015eee7bad845cdfb9f2a7cc93b8451d5f Mon Sep 17 00:00:00 2001
From: Fabi <38692350+fgerschwiler@users.noreply.github.com>
Date: Thu, 25 Mar 2021 18:12:24 +0100
Subject: [PATCH] fix: new es bug fixes (#1477)

* fix: displayname on members

* fix: user grant update

* fix: user grant id

* console grantid

Co-authored-by: Max Peintner <max@caos.ch>
---
 .../user-grants/user-grants.component.html    |  16 +-
 .../user-grants/user-grants.component.ts      |  18 +-
 internal/api/grpc/user/user_grant.go          |   2 +-
 internal/command/user_grant.go                |  11 +-
 internal/command/user_grant_model.go          |   3 +
 internal/command/user_grant_test.go           | 317 ++++++++----------
 .../eventsourcing/handler/org_member.go       |   2 +-
 .../handler/project_grant_member.go           |   2 +-
 .../eventsourcing/handler/project_member.go   |   2 +-
 .../org/repository/view/org_member_view.go    |   4 +-
 internal/user/repository/view/model/user.go   |   8 +
 internal/user/repository/view/user_view.go    |   5 +
 proto/zitadel/user.proto                      |   2 +-
 13 files changed, 181 insertions(+), 211 deletions(-)

diff --git a/console/src/app/modules/user-grants/user-grants.component.html b/console/src/app/modules/user-grants/user-grants.component.html
index e79b3ded3b..0492f4502e 100644
--- a/console/src/app/modules/user-grants/user-grants.component.html
+++ b/console/src/app/modules/user-grants/user-grants.component.html
@@ -26,7 +26,7 @@
                 </th>
                 <td class="selection" mat-cell *matCellDef="let row">
                     <mat-checkbox
-                        [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + row?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + row?.grantId] : []) | hasRole | async))"
+                        [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + row?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + row?.id] : []) | hasRole | async))"
                         color="primary" (click)="$event.stopPropagation()"
                         (change)="$event ? selection.toggle(row) : null" [checked]="selection.isSelected(row)">
                         <app-avatar
@@ -86,15 +86,15 @@
                 </th>
                 <td mat-cell *matCellDef="let grant; let i = index" class="role-data">
                     <ng-container
-                        *ngIf="(context === UserGrantContext.USER || context === UserGrantContext.NONE) && (grant.grantId && grantToEdit !== grant.grantId) || (grantToEdit !== grant.grantId)">
+                        *ngIf="(context === UserGrantContext.USER || context === UserGrantContext.NONE) && (grant.id && grantToEdit !== grant.id) || (grantToEdit !== grant.id)">
                         <div class="flex-row">
                             <div class="role">
                                 <span *ngFor="let role of grant.roleKeysList">{{ role }}</span>
                             </div>
                             <span class="fill-space"></span>
                             <button mat-stroked-button
-                                *ngIf="grant.grantId ? grantToEdit !== grant.grantId : grantToEdit !== grant.grantId"
-                                [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.grantId] : []) | hasRole | async))"
+                                *ngIf="grant.id ? grantToEdit !== grant.id : grantToEdit !== grant.id"
+                                [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.id] : []) | hasRole | async))"
                                 (click)="loadGrantOptions(grant)" matTooltip="{{'ACTIONS.CHANGE' | translate}}">
                                 <i class="las la-edit"></i>
                                 {{'ACTIONS.EDIT' | translate}}
@@ -104,11 +104,11 @@
 
                     <div class="row-form">
                         <ng-container
-                            *ngIf="(context === UserGrantContext.OWNED_PROJECT || context === UserGrantContext.USER || context === UserGrantContext.NONE) && grantToEdit == grant.grantId && loadedProjectId && loadedProjectId === grant.projectId">
+                            *ngIf="(context === UserGrantContext.OWNED_PROJECT || context === UserGrantContext.USER || context === UserGrantContext.NONE) && grantToEdit == grant.id && loadedProjectId && loadedProjectId === grant.projectId">
                             <cnsl-form-field class="form-field" appearance="outline">
                                 <!-- <cnsl-label>{{ 'PROJECT.GRANT.ROLENAMESLIST' | translate }}</cnsl-label> -->
                                 <mat-select [(ngModel)]="grant.roleKeysList" multiple
-                                    [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.grantId] : []) | hasRole | async))"
+                                    [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.id] : []) | hasRole | async))"
                                     (selectionChange)="updateRoles(grant, $event)">
                                     <mat-option *ngFor="let role of projectRoleOptions" [value]="role.key">
                                         {{role.key}}
@@ -123,11 +123,11 @@
                         </ng-container>
 
                         <ng-container
-                            *ngIf="(context === UserGrantContext.GRANTED_PROJECT || context === UserGrantContext.USER || context === UserGrantContext.NONE) && loadedGrantId && loadedGrantId === grant.grantId && grantToEdit == grant.grantId">
+                            *ngIf="(context === UserGrantContext.GRANTED_PROJECT || context === UserGrantContext.USER || context === UserGrantContext.NONE) && loadedId && loadedId === grant.id && grantToEdit == grant.id">
                             <cnsl-form-field class="form-field" appearance="outline">
                                 <!-- <cnsl-label>{{ 'PROJECT.GRANT.ROLENAMESLIST' | translate }}</cnsl-label> -->
                                 <mat-select [(ngModel)]="grant.roleKeysList" multiple
-                                    [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.grantId] : []) | hasRole | async))"
+                                    [disabled]="disableWrite || !((['user.grant.write$'] | hasRole | async) || ((context === UserGrantContext.OWNED_PROJECT ? ['user.grant.write:' + grant?.projectId] : context === UserGrantContext.GRANTED_PROJECT ? ['user.grant.write:' + grant?.id] : []) | hasRole | async))"
                                     (selectionChange)="updateRoles(grant, $event)">
                                     <mat-option *ngFor="let role of grantRoleOptions" [value]="role">
                                         {{role}}
diff --git a/console/src/app/modules/user-grants/user-grants.component.ts b/console/src/app/modules/user-grants/user-grants.component.ts
index cec488b398..da29197cbe 100644
--- a/console/src/app/modules/user-grants/user-grants.component.ts
+++ b/console/src/app/modules/user-grants/user-grants.component.ts
@@ -60,7 +60,7 @@ export class UserGrantsComponent implements OnInit, AfterViewInit {
     public projectRoleOptions: Role.AsObject[] = [];
     public routerLink: any = [''];
 
-    public loadedGrantId: string = '';
+    public loadedId: string = '';
     public loadedProjectId: string = '';
     public grantToEdit: string = '';
 
@@ -173,7 +173,7 @@ export class UserGrantsComponent implements OnInit, AfterViewInit {
     }
 
     public loadGrantOptions(grant: UserGrant.AsObject): void {
-        this.grantToEdit = grant.grantId;
+        this.grantToEdit = grant.id;
         if (grant.projectGrantId && grant.projectId) {
             this.getGrantRoleOptions(grant.projectGrantId, grant.projectId);
         } else if (grant.projectId) {
@@ -181,11 +181,11 @@ export class UserGrantsComponent implements OnInit, AfterViewInit {
         }
     }
 
-    private getGrantRoleOptions(grantId: string, projectId: string): void {
-        console.log(projectId, grantId);
-        this.mgmtService.getGrantedProjectByID(projectId, grantId).then(resp => {
+    private getGrantRoleOptions(id: string, projectId: string): void {
+        console.log(projectId, id);
+        this.mgmtService.getGrantedProjectByID(projectId, id).then(resp => {
             if (resp.grantedProject) {
-                this.loadedGrantId = grantId;
+                this.loadedId = id;
                 this.grantRoleOptions = resp.grantedProject?.grantedRoleKeysList;
             }
         }).catch(error => {
@@ -202,7 +202,7 @@ export class UserGrantsComponent implements OnInit, AfterViewInit {
     }
 
     updateRoles(grant: UserGrant.AsObject, selectionChange: MatSelectChange): void {
-        this.userService.updateUserGrant(grant.grantId, grant.userId, selectionChange.value)
+        this.userService.updateUserGrant(grant.id, grant.userId, selectionChange.value)
             .then(() => {
                 this.toast.showInfo('GRANTS.TOAST.UPDATED', true);
             }).catch(error => {
@@ -211,11 +211,11 @@ export class UserGrantsComponent implements OnInit, AfterViewInit {
     }
 
     deleteGrantSelection(): void {
-        this.userService.bulkRemoveUserGrant(this.selection.selected.map(grant => grant.grantId)).then(() => {
+        this.userService.bulkRemoveUserGrant(this.selection.selected.map(grant => grant.id)).then(() => {
             this.toast.showInfo('GRANTS.TOAST.BULKREMOVED', true);
             const data = this.dataSource.grantsSubject.getValue();
             this.selection.selected.forEach((item) => {
-                const index = data.findIndex(i => i.grantId === item.grantId);
+                const index = data.findIndex(i => i.id === item.id);
                 if (index > -1) {
                     data.splice(index, 1);
                     this.dataSource.grantsSubject.next(data);
diff --git a/internal/api/grpc/user/user_grant.go b/internal/api/grpc/user/user_grant.go
index 51495d2db1..a06ceb73d5 100644
--- a/internal/api/grpc/user/user_grant.go
+++ b/internal/api/grpc/user/user_grant.go
@@ -17,7 +17,7 @@ func UserGrantsToPb(grants []*usr_grant_model.UserGrantView) []*user_pb.UserGran
 
 func UserGrantToPb(grant *usr_grant_model.UserGrantView) *user_pb.UserGrant {
 	return &user_pb.UserGrant{
-		GrantId:        grant.ID,
+		Id:             grant.ID,
 		UserId:         grant.UserID,
 		State:          ModelUserGrantStateToPb(grant.State),
 		RoleKeys:       grant.RoleKeys,
diff --git a/internal/command/user_grant.go b/internal/command/user_grant.go
index fe70d0b9bb..4ecdd4940b 100644
--- a/internal/command/user_grant.go
+++ b/internal/command/user_grant.go
@@ -79,14 +79,9 @@ func (c *Commands) changeUserGrant(ctx context.Context, userGrant *domain.UserGr
 	if err != nil {
 		return nil, nil, err
 	}
-	if !userGrant.IsValid() || userGrant.AggregateID == "" {
+	if userGrant.AggregateID == "" {
 		return nil, nil, caos_errs.ThrowInvalidArgument(nil, "COMMAND-3M0sd", "Errors.UserGrant.Invalid")
 	}
-
-	err = c.checkUserGrantPreCondition(ctx, userGrant)
-	if err != nil {
-		return nil, nil, err
-	}
 	existingUserGrant, err := c.userGrantWriteModelByID(ctx, userGrant.AggregateID, userGrant.ResourceOwner)
 	if err != nil {
 		return nil, nil, err
@@ -97,6 +92,10 @@ func (c *Commands) changeUserGrant(ctx context.Context, userGrant *domain.UserGr
 	if reflect.DeepEqual(existingUserGrant.RoleKeys, userGrant.RoleKeys) {
 		return nil, nil, caos_errs.ThrowPreconditionFailed(nil, "COMMAND-Rs8fy", "Errors.UserGrant.NotChanged")
 	}
+	err = c.checkUserGrantPreCondition(ctx, userGrantWriteModelToUserGrant(existingUserGrant))
+	if err != nil {
+		return nil, nil, err
+	}
 
 	changedUserGrant := NewUserGrantWriteModel(userGrant.AggregateID, resourceOwner)
 	userGrantAgg := UserGrantAggregateFromWriteModel(&changedUserGrant.WriteModel)
diff --git a/internal/command/user_grant_model.go b/internal/command/user_grant_model.go
index c4e6378df7..0e9e0d2c0d 100644
--- a/internal/command/user_grant_model.go
+++ b/internal/command/user_grant_model.go
@@ -104,6 +104,8 @@ func (wm *UserGrantPreConditionReadModel) Reduce() error {
 		switch e := event.(type) {
 		case *user.HumanAddedEvent:
 			wm.UserExists = true
+		case *user.HumanRegisteredEvent:
+			wm.UserExists = true
 		case *user.MachineAddedEvent:
 			wm.UserExists = true
 		case *user.UserRemovedEvent:
@@ -150,6 +152,7 @@ func (wm *UserGrantPreConditionReadModel) Query() *eventstore.SearchQueryBuilder
 	query := eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent, user.AggregateType, project.AggregateType).
 		AggregateIDs(wm.UserID, wm.ProjectID).
 		EventTypes(user.HumanAddedType,
+			user.HumanRegisteredType,
 			user.MachineAddedEventType,
 			user.UserRemovedType,
 			project.ProjectAddedType,
diff --git a/internal/command/user_grant_test.go b/internal/command/user_grant_test.go
index 30b6159d3d..0ca74a2ca3 100644
--- a/internal/command/user_grant_test.go
+++ b/internal/command/user_grant_test.go
@@ -538,11 +538,100 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 				err: caos_errs.IsErrorInvalidArgument,
 			},
 		},
+		{
+			name: "usergrant not existing, not found error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
+				userGrant: &domain.UserGrant{
+					ObjectRoot: models.ObjectRoot{
+						AggregateID: "usergrant1",
+					},
+					UserID:    "user1",
+					ProjectID: "project1",
+					RoleKeys:  []string{"rolekey1"},
+				},
+				resourceOwner: "org1",
+			},
+			res: res{
+				err: caos_errs.IsNotFound,
+			},
+		},
+		{
+			name: "usergrant not existing, not found error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
+				userGrant: &domain.UserGrant{
+					ObjectRoot: models.ObjectRoot{
+						AggregateID: "usergrant1",
+					},
+					UserID:    "user1",
+					ProjectID: "project1",
+					RoleKeys:  []string{"rolekey1"},
+				},
+				resourceOwner: "org1",
+			},
+			res: res{
+				err: caos_errs.IsNotFound,
+			},
+		},
+		{
+			name: "usergrant roles not changed, precondition error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
+				userGrant: &domain.UserGrant{
+					ObjectRoot: models.ObjectRoot{
+						AggregateID: "usergrant1",
+					},
+					UserID:    "user1",
+					ProjectID: "project1",
+					RoleKeys:  []string{"rolekey1"},
+				},
+				resourceOwner: "org1",
+			},
+			res: res{
+				err: caos_errs.IsPreconditionFailed,
+			},
+		},
 		{
 			name: "user removed, precondition error",
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -589,6 +678,15 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -639,6 +737,15 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -684,6 +791,15 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -730,6 +846,15 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -788,180 +913,19 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			},
 		},
 		{
-			name: "usergrant not existing, not found error",
+			name: "usergrant for project, ok",
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
-					expectFilter(
-						eventFromEventPusher(
-							user.NewHumanAddedEvent(context.Background(),
-								&user.NewAggregate("user1", "org1").Aggregate,
-								"username1",
-								"firstname1",
-								"lastname1",
-								"nickname1",
-								"displayname1",
-								language.German,
-								domain.GenderMale,
-								"email1",
-								true,
-							),
-						),
-						eventFromEventPusher(
-							project.NewProjectAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"projectname1",
-							),
-						),
-						eventFromEventPusher(
-							project.NewRoleAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"rolekey1",
-								"rolekey",
-								"",
-							),
-						),
-					),
-					expectFilter(),
-				),
-			},
-			args: args{
-				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
-				userGrant: &domain.UserGrant{
-					ObjectRoot: models.ObjectRoot{
-						AggregateID: "usergrant1",
-					},
-					UserID:    "user1",
-					ProjectID: "project1",
-					RoleKeys:  []string{"rolekey1"},
-				},
-				resourceOwner: "org1",
-			},
-			res: res{
-				err: caos_errs.IsNotFound,
-			},
-		},
-		{
-			name: "usergrant not existing, not found error",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-					expectFilter(
-						eventFromEventPusher(
-							user.NewHumanAddedEvent(context.Background(),
-								&user.NewAggregate("user1", "org1").Aggregate,
-								"username1",
-								"firstname1",
-								"lastname1",
-								"nickname1",
-								"displayname1",
-								language.German,
-								domain.GenderMale,
-								"email1",
-								true,
-							),
-						),
-						eventFromEventPusher(
-							project.NewProjectAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"projectname1",
-							),
-						),
-						eventFromEventPusher(
-							project.NewRoleAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"rolekey1",
-								"rolekey",
-								"",
-							),
-						),
-					),
-					expectFilter(),
-				),
-			},
-			args: args{
-				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
-				userGrant: &domain.UserGrant{
-					ObjectRoot: models.ObjectRoot{
-						AggregateID: "usergrant1",
-					},
-					UserID:    "user1",
-					ProjectID: "project1",
-					RoleKeys:  []string{"rolekey1"},
-				},
-				resourceOwner: "org1",
-			},
-			res: res{
-				err: caos_errs.IsNotFound,
-			},
-		},
-		{
-			name: "usergrant roles not changed, precondition error",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-					expectFilter(
-						eventFromEventPusher(
-							user.NewHumanAddedEvent(context.Background(),
-								&user.NewAggregate("user1", "org1").Aggregate,
-								"username1",
-								"firstname1",
-								"lastname1",
-								"nickname1",
-								"displayname1",
-								language.German,
-								domain.GenderMale,
-								"email1",
-								true,
-							),
-						),
-						eventFromEventPusher(
-							project.NewProjectAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"projectname1",
-							),
-						),
-						eventFromEventPusher(
-							project.NewRoleAddedEvent(context.Background(),
-								&project.NewAggregate("project1", "org1").Aggregate,
-								"rolekey1",
-								"rolekey",
-								"",
-							),
-						),
-					),
 					expectFilter(
 						eventFromEventPusher(
 							usergrant.NewUserGrantAddedEvent(context.Background(),
-								&usergrant.NewAggregate("usergrant1", "org").Aggregate,
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
 								"user1",
 								"project1",
 								"", []string{"rolekey1"}),
 						),
 					),
-				),
-			},
-			args: args{
-				ctx: authz.NewMockContextWithPermissions("", "", []string{domain.RoleProjectOwner}),
-				userGrant: &domain.UserGrant{
-					ObjectRoot: models.ObjectRoot{
-						AggregateID: "usergrant1",
-					},
-					UserID:    "user1",
-					ProjectID: "project1",
-					RoleKeys:  []string{"rolekey1"},
-				},
-				resourceOwner: "org1",
-			},
-			res: res{
-				err: caos_errs.IsPreconditionFailed,
-			},
-		},
-		{
-			name: "usergrant for project, ok",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1000,15 +964,6 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 							),
 						),
 					),
-					expectFilter(
-						eventFromEventPusher(
-							usergrant.NewUserGrantAddedEvent(context.Background(),
-								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
-								"user1",
-								"project1",
-								"", []string{"rolekey1"}),
-						),
-					),
 					expectPush(
 						[]*repository.Event{
 							eventFromEventPusher(usergrant.NewUserGrantChangedEvent(context.Background(),
@@ -1049,6 +1004,15 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
+					expectFilter(
+						eventFromEventPusher(
+							usergrant.NewUserGrantAddedEvent(context.Background(),
+								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
+								"user1",
+								"project1",
+								"projectgrant1", []string{"rolekey1"}),
+						),
+					),
 					expectFilter(
 						eventFromEventPusher(
 							user.NewHumanAddedEvent(context.Background(),
@@ -1095,15 +1059,6 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 							),
 						),
 					),
-					expectFilter(
-						eventFromEventPusher(
-							usergrant.NewUserGrantAddedEvent(context.Background(),
-								&usergrant.NewAggregate("usergrant1", "org1").Aggregate,
-								"user1",
-								"project1",
-								"projectgrant1", []string{"rolekey1"}),
-						),
-					),
 					expectPush(
 						[]*repository.Event{
 							eventFromEventPusher(usergrant.NewUserGrantChangedEvent(context.Background(),
diff --git a/internal/management/repository/eventsourcing/handler/org_member.go b/internal/management/repository/eventsourcing/handler/org_member.go
index be9a4c1e20..3ae0b73287 100644
--- a/internal/management/repository/eventsourcing/handler/org_member.go
+++ b/internal/management/repository/eventsourcing/handler/org_member.go
@@ -175,7 +175,7 @@ func (m *OrgMember) fillUserData(member *org_view_model.OrgMemberView, user *usr
 	if user.HumanView != nil {
 		member.FirstName = user.FirstName
 		member.LastName = user.LastName
-		member.DisplayName = user.FirstName + " " + user.LastName
+		member.DisplayName = user.DisplayName
 		member.Email = user.Email
 	}
 	if user.MachineView != nil {
diff --git a/internal/management/repository/eventsourcing/handler/project_grant_member.go b/internal/management/repository/eventsourcing/handler/project_grant_member.go
index 31fa74f8e2..b9af309f6b 100644
--- a/internal/management/repository/eventsourcing/handler/project_grant_member.go
+++ b/internal/management/repository/eventsourcing/handler/project_grant_member.go
@@ -182,7 +182,7 @@ func (p *ProjectGrantMember) fillUserData(member *view_model.ProjectGrantMemberV
 	if user.HumanView != nil {
 		member.FirstName = user.FirstName
 		member.LastName = user.LastName
-		member.DisplayName = user.FirstName + " " + user.LastName
+		member.DisplayName = user.DisplayName
 		member.Email = user.Email
 	}
 	if user.MachineView != nil {
diff --git a/internal/management/repository/eventsourcing/handler/project_member.go b/internal/management/repository/eventsourcing/handler/project_member.go
index 42025bd0b0..9b7e6b8f15 100644
--- a/internal/management/repository/eventsourcing/handler/project_member.go
+++ b/internal/management/repository/eventsourcing/handler/project_member.go
@@ -179,7 +179,7 @@ func (p *ProjectMember) fillUserData(member *view_model.ProjectMemberView, user
 		member.FirstName = user.FirstName
 		member.LastName = user.LastName
 		member.Email = user.Email
-		member.DisplayName = user.FirstName + " " + user.LastName
+		member.DisplayName = user.DisplayName
 	}
 	if user.MachineView != nil {
 		member.DisplayName = user.MachineView.Name
diff --git a/internal/org/repository/view/org_member_view.go b/internal/org/repository/view/org_member_view.go
index 5d8bf657e5..9723817d78 100644
--- a/internal/org/repository/view/org_member_view.go
+++ b/internal/org/repository/view/org_member_view.go
@@ -48,9 +48,9 @@ func OrgMembersByUserID(db *gorm.DB, table string, userID string) ([]*model.OrgM
 	return members, nil
 }
 
-func PutOrgMember(db *gorm.DB, table string, role *model.OrgMemberView) error {
+func PutOrgMember(db *gorm.DB, table string, member *model.OrgMemberView) error {
 	save := repository.PrepareSave(table)
-	return save(db, role)
+	return save(db, member)
 }
 
 func PutOrgMembers(db *gorm.DB, table string, members ...*model.OrgMemberView) error {
diff --git a/internal/user/repository/view/model/user.go b/internal/user/repository/view/model/user.go
index 8648c8d85b..b64df66ce1 100644
--- a/internal/user/repository/view/model/user.go
+++ b/internal/user/repository/view/model/user.go
@@ -500,3 +500,11 @@ func (u *UserView) ComputeMFAMaxSetUp() {
 	}
 	u.MFAMaxSetUp = int32(req_model.MFALevelNotSetUp)
 }
+
+func (u *UserView) SetEmptyUserType() {
+	if u.MachineView != nil && u.MachineView.Name == "" {
+		u.MachineView = nil
+	} else {
+		u.HumanView = nil
+	}
+}
diff --git a/internal/user/repository/view/user_view.go b/internal/user/repository/view/user_view.go
index c00b9a5941..0542ec69f5 100644
--- a/internal/user/repository/view/user_view.go
+++ b/internal/user/repository/view/user_view.go
@@ -18,6 +18,7 @@ func UserByID(db *gorm.DB, table, userID string) (*model.UserView, error) {
 	if caos_errs.IsNotFound(err) {
 		return nil, caos_errs.ThrowNotFound(nil, "VIEW-sj8Sw", "Errors.User.NotFound")
 	}
+	user.SetEmptyUserType()
 	return user, err
 }
 
@@ -28,6 +29,7 @@ func UserByUserName(db *gorm.DB, table, userName string) (*model.UserView, error
 	if caos_errs.IsNotFound(err) {
 		return nil, caos_errs.ThrowNotFound(nil, "VIEW-Lso9s", "Errors.User.NotFound")
 	}
+	user.SetEmptyUserType()
 	return user, err
 }
 
@@ -43,6 +45,7 @@ func UserByLoginName(db *gorm.DB, table, loginName string) (*model.UserView, err
 	if caos_errs.IsNotFound(err) {
 		return nil, caos_errs.ThrowNotFound(nil, "VIEW-AD4qs", "Errors.User.NotFound")
 	}
+	user.SetEmptyUserType()
 	return user, err
 }
 
@@ -63,6 +66,7 @@ func UserByLoginNameAndResourceOwner(db *gorm.DB, table, loginName, resourceOwne
 	if caos_errs.IsNotFound(err) {
 		return nil, caos_errs.ThrowNotFound(nil, "VIEW-AD4qs", "Errors.User.NotFoundOnOrg")
 	}
+	user.SetEmptyUserType()
 	return user, err
 }
 
@@ -121,6 +125,7 @@ func GetGlobalUserByLoginName(db *gorm.DB, table, loginName string) (*model.User
 	if caos_errs.IsNotFound(err) {
 		return nil, caos_errs.ThrowNotFound(nil, "VIEW-8uWer", "Errors.User.NotFound")
 	}
+	user.SetEmptyUserType()
 	return user, err
 }
 
diff --git a/proto/zitadel/user.proto b/proto/zitadel/user.proto
index 94c9a00dcc..29dfb223f9 100644
--- a/proto/zitadel/user.proto
+++ b/proto/zitadel/user.proto
@@ -244,7 +244,7 @@ enum SessionState {
 }
 
 message UserGrant {
-    string grant_id = 1;
+    string id = 1;
     zitadel.v1.ObjectDetails details = 2;
     repeated string role_keys = 3;
     UserGrantState state = 4;