fix: usermemberships in authz (#1288)

* fix: usermemberships in authz

* fix: tests

* fix: migration

* fix: handler

internal/authz/repository/eventsourcing/eventstore/user_grant.go

@@ -2,6 +2,9 @@ package eventstore
 
 import (
 	"context"
+	global_model "github.com/caos/zitadel/internal/model"
+	user_model "github.com/caos/zitadel/internal/user/model"
+	user_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
 
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/authz/repository/eventsourcing/view"
@@ -9,7 +12,6 @@ import (
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	iam_event "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
 	grant_model "github.com/caos/zitadel/internal/usergrant/model"
-	"github.com/caos/zitadel/internal/usergrant/repository/view/model"
 )
 
 type UserGrantRepo struct {
@@ -24,46 +26,70 @@ func (repo *UserGrantRepo) Health() error {
 	return repo.View.Health()
 }
 
-func (repo *UserGrantRepo) ResolveGrants(ctx context.Context) (*authz.Grant, error) {
-	err := repo.FillIamProjectID(ctx)
+func (repo *UserGrantRepo) SearchMyMemberships(ctx context.Context) ([]*authz.Membership, error) {
+	memberships, err := repo.searchUserMemberships(ctx)
 	if err != nil {
 		return nil, err
 	}
-	ctxData := authz.GetCtxData(ctx)
-
-	orgGrant, err := repo.View.UserGrantByIDs(ctxData.OrgID, repo.IamProjectID, ctxData.UserID)
-	if err != nil && !caos_errs.IsNotFound(err) {
-		return nil, err
-	}
-	iamAdminGrant, err := repo.View.UserGrantByIDs(repo.IamID, repo.IamProjectID, ctxData.UserID)
-	if err != nil && !caos_errs.IsNotFound(err) {
-		return nil, err
-	}
-
-	return mergeOrgAndAdminGrant(ctxData, orgGrant, iamAdminGrant), nil
+	return userMembershipsToMemberships(memberships), nil
 }
 
 func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]string, error) {
-	grant, err := repo.ResolveGrants(ctx)
+	memberships, err := repo.searchUserMemberships(ctx)
 	if err != nil {
 		return nil, err
 	}
-
-	if grant == nil {
-		return []string{}, nil
-	}
 	permissions := &grant_model.Permissions{Permissions: []string{}}
-	for _, role := range grant.Roles {
-		roleName, ctxID := authz.SplitPermission(role)
-		for _, mapping := range repo.Auth.RolePermissionMappings {
-			if mapping.Role == roleName {
-				permissions.AppendPermissions(ctxID, mapping.Permissions...)
-			}
+	for _, membership := range memberships {
+		for _, role := range membership.Roles {
+			permissions = repo.mapRoleToPermission(permissions, membership, role)
 		}
 	}
 	return permissions.Permissions, nil
 }
 
+func (repo *UserGrantRepo) searchUserMemberships(ctx context.Context) ([]*user_view_model.UserMembershipView, error) {
+	ctxData := authz.GetCtxData(ctx)
+	orgMemberships, orgCount, err := repo.View.SearchUserMemberships(&user_model.UserMembershipSearchRequest{
+		Queries: []*user_model.UserMembershipSearchQuery{
+			{
+				Key:    user_model.UserMembershipSearchKeyUserID,
+				Method: global_model.SearchMethodEquals,
+				Value:  ctxData.UserID,
+			},
+			{
+				Key:    user_model.UserMembershipSearchKeyResourceOwner,
+				Method: global_model.SearchMethodEquals,
+				Value:  ctxData.OrgID,
+			},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	iamMemberships, iamCount, err := repo.View.SearchUserMemberships(&user_model.UserMembershipSearchRequest{
+		Queries: []*user_model.UserMembershipSearchQuery{
+			{
+				Key:    user_model.UserMembershipSearchKeyUserID,
+				Method: global_model.SearchMethodEquals,
+				Value:  ctxData.UserID,
+			},
+			{
+				Key:    user_model.UserMembershipSearchKeyAggregateID,
+				Method: global_model.SearchMethodEquals,
+				Value:  repo.IamID,
+			},
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	if orgCount == 0 && iamCount == 0 {
+		return []*user_view_model.UserMembershipView{}, nil
+	}
+	return append(orgMemberships, iamMemberships...), nil
+}
+
 func (repo *UserGrantRepo) FillIamProjectID(ctx context.Context) error {
 	if repo.IamProjectID != "" {
 		return nil
@@ -79,29 +105,32 @@ func (repo *UserGrantRepo) FillIamProjectID(ctx context.Context) error {
 	return nil
 }
 
-func mergeOrgAndAdminGrant(ctxData authz.CtxData, orgGrant, iamAdminGrant *model.UserGrantView) (grant *authz.Grant) {
-	if orgGrant != nil {
-		roles := orgGrant.RoleKeys
-		if iamAdminGrant != nil {
-			roles = addIamAdminRoles(roles, iamAdminGrant.RoleKeys)
-		}
-		grant = &authz.Grant{OrgID: orgGrant.ResourceOwner, Roles: roles}
-	} else if iamAdminGrant != nil {
-		grant = &authz.Grant{
-			OrgID: ctxData.OrgID,
-			Roles: iamAdminGrant.RoleKeys,
+func (repo *UserGrantRepo) mapRoleToPermission(permissions *grant_model.Permissions, membership *user_view_model.UserMembershipView, role string) *grant_model.Permissions {
+	for _, mapping := range repo.Auth.RolePermissionMappings {
+		if mapping.Role == role {
+			ctxID := ""
+			if membership.MemberType == int32(user_model.MemberTypeProject) || membership.MemberType == int32(user_model.MemberTypeProjectGrant) {
+				ctxID = membership.ObjectID
+			}
+			permissions.AppendPermissions(ctxID, mapping.Permissions...)
 		}
 	}
-	return grant
+	return permissions
 }
 
-func addIamAdminRoles(orgRoles, iamAdminRoles []string) []string {
-	result := make([]string, 0)
-	result = append(result, iamAdminRoles...)
-	for _, role := range orgRoles {
-		if !authz.ExistsPerm(result, role) {
-			result = append(result, role)
-		}
+func userMembershipToMembership(membership *user_view_model.UserMembershipView) *authz.Membership {
+	return &authz.Membership{
+		MemberType:  authz.MemberType(membership.MemberType),
+		AggregateID: membership.AggregateID,
+		ObjectID:    membership.ObjectID,
+		Roles:       membership.Roles,
+	}
+}
+
+func userMembershipsToMemberships(memberships []*user_view_model.UserMembershipView) []*authz.Membership {
+	result := make([]*authz.Membership, len(memberships))
+	for i, m := range memberships {
+		result[i] = userMembershipToMembership(m)
 	}
 	return result
 }

internal/authz/repository/eventsourcing/handler/handler.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"github.com/caos/zitadel/internal/iam/repository/eventsourcing"
 	"time"
 
 	"github.com/caos/zitadel/internal/authz/repository/eventsourcing/view"
@@ -8,7 +9,8 @@ import (
 	"github.com/caos/zitadel/internal/config/types"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/eventstore/query"
-	iam_events "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
+	org_events "github.com/caos/zitadel/internal/org/repository/eventsourcing"
+	project_events "github.com/caos/zitadel/internal/project/repository/eventsourcing"
 )
 
 type Configs map[string]*Config
@@ -31,15 +33,21 @@ func (h *handler) Eventstore() eventstore.Eventstore {
 }
 
 type EventstoreRepos struct {
-	IAMEvents *iam_events.IAMEventstore
+	IAMEvents     *eventsourcing.IAMEventstore
+	OrgEvents     *org_events.OrgEventstore
+	ProjectEvents *project_events.ProjectEventstore
 }
 
 func Register(configs Configs, bulkLimit, errorCount uint64, view *view.View, es eventstore.Eventstore, repos EventstoreRepos, systemDefaults sd.SystemDefaults) []query.Handler {
 	return []query.Handler{
 		newUserGrant(
-			handler{view, bulkLimit, configs.cycleDuration("UserGrant"), errorCount, es},
+			handler{view, bulkLimit, configs.cycleDuration("UserGrants"), errorCount, es},
 			repos.IAMEvents,
 			systemDefaults.IamID),
+		newUserMembership(
+			handler{view, bulkLimit, configs.cycleDuration("UserMemberships"), errorCount, es},
+			repos.OrgEvents,
+			repos.ProjectEvents),
 		newApplication(
 			handler{view, bulkLimit, configs.cycleDuration("Application"), errorCount, es}),
 		newOrg(

internal/authz/repository/eventsourcing/handler/user_membership.go

@@ -0,0 +1,274 @@
+package handler
+
+import (
+	"context"
+
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/query"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	iam_es_model "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model"
+	org_model "github.com/caos/zitadel/internal/org/model"
+	org_event "github.com/caos/zitadel/internal/org/repository/eventsourcing"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	proj_event "github.com/caos/zitadel/internal/project/repository/eventsourcing"
+	proj_es_model "github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	usr_es_model "github.com/caos/zitadel/internal/user/repository/view/model"
+)
+
+const (
+	userMembershipTable = "authz.user_memberships"
+)
+
+type UserMembership struct {
+	handler
+	orgEvents     *org_event.OrgEventstore
+	projectEvents *proj_event.ProjectEventstore
+	subscription  *eventstore.Subscription
+}
+
+func newUserMembership(
+	handler handler,
+	orgEvents *org_event.OrgEventstore,
+	projectEvents *proj_event.ProjectEventstore,
+) *UserMembership {
+	h := &UserMembership{
+		handler:       handler,
+		orgEvents:     orgEvents,
+		projectEvents: projectEvents,
+	}
+
+	h.subscribe()
+
+	return h
+}
+
+func (m *UserMembership) subscribe() {
+	m.subscription = m.es.Subscribe(m.AggregateTypes()...)
+	go func() {
+		for event := range m.subscription.Events {
+			query.ReduceEvent(m, event)
+		}
+	}()
+}
+
+func (m *UserMembership) ViewModel() string {
+	return userMembershipTable
+}
+
+func (_ *UserMembership) AggregateTypes() []es_models.AggregateType {
+	return []es_models.AggregateType{iam_es_model.IAMAggregate, org_es_model.OrgAggregate, proj_es_model.ProjectAggregate, model.UserAggregate}
+}
+
+func (m *UserMembership) CurrentSequence() (uint64, error) {
+	sequence, err := m.view.GetLatestUserMembershipSequence()
+	if err != nil {
+		return 0, err
+	}
+	return sequence.CurrentSequence, nil
+}
+
+func (m *UserMembership) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := m.view.GetLatestUserMembershipSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(m.AggregateTypes()...).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (m *UserMembership) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case iam_es_model.IAMAggregate:
+		err = m.processIAM(event)
+	case org_es_model.OrgAggregate:
+		err = m.processOrg(event)
+	case proj_es_model.ProjectAggregate:
+		err = m.processProject(event)
+	case model.UserAggregate:
+		err = m.processUser(event)
+	}
+	return err
+}
+
+func (m *UserMembership) processIAM(event *models.Event) (err error) {
+	member := new(usr_es_model.UserMembershipView)
+	err = member.AppendEvent(event)
+	if err != nil {
+		return err
+	}
+	switch event.Type {
+	case iam_es_model.IAMMemberAdded:
+		m.fillIamDisplayName(member)
+	case iam_es_model.IAMMemberChanged:
+		member, err = m.view.UserMembershipByIDs(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeIam)
+		if err != nil {
+			return err
+		}
+		err = member.AppendEvent(event)
+	case iam_es_model.IAMMemberRemoved:
+		return m.view.DeleteUserMembership(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeIam, event)
+	default:
+		return m.view.ProcessedUserMembershipSequence(event)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutUserMembership(member, event)
+}
+
+func (m *UserMembership) fillIamDisplayName(member *usr_es_model.UserMembershipView) {
+	member.DisplayName = member.AggregateID
+	member.ResourceOwnerName = member.ResourceOwner
+}
+
+func (m *UserMembership) processOrg(event *models.Event) (err error) {
+	member := new(usr_es_model.UserMembershipView)
+	err = member.AppendEvent(event)
+	if err != nil {
+		return err
+	}
+	switch event.Type {
+	case org_es_model.OrgMemberAdded:
+		err = m.fillOrgName(member)
+	case org_es_model.OrgMemberChanged:
+		member, err = m.view.UserMembershipByIDs(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeOrganisation)
+		if err != nil {
+			return err
+		}
+		err = member.AppendEvent(event)
+	case org_es_model.OrgMemberRemoved:
+		return m.view.DeleteUserMembership(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeOrganisation, event)
+	case org_es_model.OrgChanged:
+		return m.updateOrgName(event)
+	default:
+		return m.view.ProcessedUserMembershipSequence(event)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutUserMembership(member, event)
+}
+
+func (m *UserMembership) fillOrgName(member *usr_es_model.UserMembershipView) (err error) {
+	org, err := m.orgEvents.OrgByID(context.Background(), org_model.NewOrg(member.ResourceOwner))
+	if err != nil {
+		return err
+	}
+	member.ResourceOwnerName = org.Name
+	if member.AggregateID == org.AggregateID {
+		member.DisplayName = org.Name
+	}
+	return nil
+}
+
+func (m *UserMembership) updateOrgName(event *models.Event) error {
+	org, err := m.orgEvents.OrgByID(context.Background(), org_model.NewOrg(event.AggregateID))
+	if err != nil {
+		return err
+	}
+
+	memberships, err := m.view.UserMembershipsByResourceOwner(event.ResourceOwner)
+	if err != nil {
+		return err
+	}
+	for _, membership := range memberships {
+		membership.ResourceOwnerName = org.Name
+		if membership.AggregateID == event.AggregateID {
+			membership.DisplayName = org.Name
+		}
+	}
+	return m.view.BulkPutUserMemberships(memberships, event)
+}
+
+func (m *UserMembership) processProject(event *models.Event) (err error) {
+	member := new(usr_es_model.UserMembershipView)
+	err = member.AppendEvent(event)
+	if err != nil {
+		return err
+	}
+	switch event.Type {
+	case proj_es_model.ProjectMemberAdded, proj_es_model.ProjectGrantMemberAdded:
+		err = m.fillProjectDisplayName(member)
+		if err != nil {
+			return err
+		}
+		err = m.fillOrgName(member)
+	case proj_es_model.ProjectMemberChanged:
+		member, err = m.view.UserMembershipByIDs(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeProject)
+		if err != nil {
+			return err
+		}
+		err = member.AppendEvent(event)
+	case proj_es_model.ProjectMemberRemoved:
+		return m.view.DeleteUserMembership(member.UserID, event.AggregateID, event.AggregateID, usr_model.MemberTypeProject, event)
+	case proj_es_model.ProjectGrantMemberChanged:
+		member, err = m.view.UserMembershipByIDs(member.UserID, event.AggregateID, member.ObjectID, usr_model.MemberTypeProjectGrant)
+		if err != nil {
+			return err
+		}
+		err = member.AppendEvent(event)
+	case proj_es_model.ProjectGrantMemberRemoved:
+		return m.view.DeleteUserMembership(member.UserID, event.AggregateID, member.ObjectID, usr_model.MemberTypeProjectGrant, event)
+	case proj_es_model.ProjectChanged:
+		return m.updateProjectDisplayName(event)
+	case proj_es_model.ProjectRemoved:
+		return m.view.DeleteUserMembershipsByAggregateID(event.AggregateID, event)
+	case proj_es_model.ProjectGrantRemoved:
+		return m.view.DeleteUserMembershipsByAggregateIDAndObjectID(event.AggregateID, member.ObjectID, event)
+	default:
+		return m.view.ProcessedUserMembershipSequence(event)
+	}
+	if err != nil {
+		return err
+	}
+	return m.view.PutUserMembership(member, event)
+}
+
+func (m *UserMembership) fillProjectDisplayName(member *usr_es_model.UserMembershipView) (err error) {
+	project, err := m.projectEvents.ProjectByID(context.Background(), member.AggregateID)
+	if err != nil {
+		return err
+	}
+	member.DisplayName = project.Name
+	return nil
+}
+
+func (m *UserMembership) updateProjectDisplayName(event *models.Event) error {
+	project, err := m.projectEvents.ProjectByID(context.Background(), event.AggregateID)
+	if err != nil {
+		return err
+	}
+
+	memberships, err := m.view.UserMembershipsByAggregateID(event.AggregateID)
+	if err != nil {
+		return err
+	}
+	for _, membership := range memberships {
+		membership.DisplayName = project.Name
+	}
+	return m.view.BulkPutUserMemberships(memberships, event)
+}
+
+func (m *UserMembership) processUser(event *models.Event) (err error) {
+	switch event.Type {
+	case model.UserRemoved:
+		return m.view.DeleteUserMembershipsByUserID(event.AggregateID, event)
+	default:
+		return m.view.ProcessedUserMembershipSequence(event)
+	}
+}
+
+func (m *UserMembership) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-Ms3fj", "id", event.AggregateID).WithError(err).Warn("something went wrong in user membership handler")
+	return spooler.HandleError(event, err, m.view.GetLatestUserMembershipFailedEvent, m.view.ProcessedUserMembershipFailedEvent, m.view.ProcessedUserMembershipSequence, m.errorCountUntilSkip)
+}
+
+func (m *UserMembership) OnSuccess() error {
+	return spooler.HandleSuccess(m.view.UpdateUserMembershipSpoolerRunTimestamp)
+}

internal/authz/repository/eventsourcing/repository.go

@@ -2,6 +2,7 @@ package eventsourcing
 
 import (
 	"context"
+	es_org "github.com/caos/zitadel/internal/org/repository/eventsourcing"
 
 	es_user "github.com/caos/zitadel/internal/user/repository/eventsourcing"
 
@@ -22,6 +23,7 @@ import (
 )
 
 type Config struct {
+	Domain      string
 	Eventstore  es_int.Config
 	AuthRequest cache.Config
 	View        types.SQL
@@ -60,6 +62,8 @@ func Start(conf Config, authZ authz.Config, systemDefaults sd.SystemDefaults) (*
 	if err != nil {
 		return nil, err
 	}
+	org := es_org.StartOrg(es_org.OrgConfig{Eventstore: es, IAMDomain: conf.Domain}, systemDefaults)
+
 	project, err := es_proj.StartProject(es_proj.ProjectConfig{
 		Eventstore: es,
 		Cache:      conf.Eventstore.Cache,
@@ -77,7 +81,7 @@ func Start(conf Config, authZ authz.Config, systemDefaults sd.SystemDefaults) (*
 	if err != nil {
 		return nil, err
 	}
-	repos := handler.EventstoreRepos{IAMEvents: iam}
+	repos := handler.EventstoreRepos{IAMEvents: iam, OrgEvents: org, ProjectEvents: project}
 	spool := spooler.StartSpooler(conf.Spooler, es, view, sqlClient, repos, systemDefaults)
 
 	return &EsRepository{

internal/authz/repository/eventsourcing/view/user_membership.go

@@ -0,0 +1,98 @@
+package view
+
+import (
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	userMembershipTable = "authz.user_memberships"
+)
+
+func (v *View) UserMembershipByIDs(userID, aggregateID, objectID string, memberType usr_model.MemberType) (*model.UserMembershipView, error) {
+	return view.UserMembershipByIDs(v.Db, userMembershipTable, userID, aggregateID, objectID, memberType)
+}
+
+func (v *View) UserMembershipsByAggregateID(aggregateID string) ([]*model.UserMembershipView, error) {
+	return view.UserMembershipsByAggregateID(v.Db, userMembershipTable, aggregateID)
+}
+
+func (v *View) UserMembershipsByResourceOwner(resourceOwner string) ([]*model.UserMembershipView, error) {
+	return view.UserMembershipsByResourceOwner(v.Db, userMembershipTable, resourceOwner)
+}
+
+func (v *View) SearchUserMemberships(request *usr_model.UserMembershipSearchRequest) ([]*model.UserMembershipView, uint64, error) {
+	return view.SearchUserMemberships(v.Db, userMembershipTable, request)
+}
+
+func (v *View) PutUserMembership(membership *model.UserMembershipView, event *models.Event) error {
+	err := view.PutUserMembership(v.Db, userMembershipTable, membership)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) BulkPutUserMemberships(memberships []*model.UserMembershipView, event *models.Event) error {
+	err := view.PutUserMemberships(v.Db, userMembershipTable, memberships...)
+	if err != nil {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) DeleteUserMembership(userID, aggregateID, objectID string, memberType usr_model.MemberType, event *models.Event) error {
+	err := view.DeleteUserMembership(v.Db, userMembershipTable, userID, aggregateID, objectID, memberType)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) DeleteUserMembershipsByUserID(userID string, event *models.Event) error {
+	err := view.DeleteUserMembershipsByUserID(v.Db, userMembershipTable, userID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) DeleteUserMembershipsByAggregateID(aggregateID string, event *models.Event) error {
+	err := view.DeleteUserMembershipsByAggregateID(v.Db, userMembershipTable, aggregateID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) DeleteUserMembershipsByAggregateIDAndObjectID(aggregateID, objectID string, event *models.Event) error {
+	err := view.DeleteUserMembershipsByAggregateIDAndObjectID(v.Db, userMembershipTable, aggregateID, objectID)
+	if err != nil && !errors.IsNotFound(err) {
+		return err
+	}
+	return v.ProcessedUserMembershipSequence(event)
+}
+
+func (v *View) GetLatestUserMembershipSequence() (*repository.CurrentSequence, error) {
+	return v.latestSequence(userMembershipTable)
+}
+
+func (v *View) ProcessedUserMembershipSequence(event *models.Event) error {
+	return v.saveCurrentSequence(userMembershipTable, event)
+}
+
+func (v *View) UpdateUserMembershipSpoolerRunTimestamp() error {
+	return v.updateSpoolerRunSequence(userMembershipTable)
+}
+
+func (v *View) GetLatestUserMembershipFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(userMembershipTable, sequence)
+}
+
+func (v *View) ProcessedUserMembershipFailedEvent(failedEvent *repository.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}