feat: port reduction (#323)

* move mgmt pkg

* begin package restructure

* rename auth package to authz

* begin start api

* move auth

* move admin

* fix merge

* configs and interceptors

* interceptor

* revert generate-grpc.sh

* some cleanups

* console

* move console

* fix tests and merging

* js linting

* merge

* merging and configs

* change k8s base to current ports

* fixes

* cleanup

* regenerate proto

* remove unnecessary whitespace

* missing param

* go mod tidy

* fix merging

* move login pkg

* cleanup

* move api pkgs again

* fix pkg naming

* fix generate-static.sh for login

* update workflow

* fixes

* logging

* remove duplicate

* comment for optional gateway interfaces

* regenerate protos

* fix proto imports for grpc web

* protos

* grpc web generate

* grpc web generate

* fix changes

* add translation interceptor

* fix merging

* regenerate mgmt proto

internal/auth/auth/token_verifier.go

@@ -1,36 +0,0 @@
-package auth
-
-import (
-	"context"
-	"github.com/caos/zitadel/internal/api/auth"
-	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
-)
-
-const (
-	authName = "Auth-API"
-)
-
-type TokenVerifier struct {
-	authID    string
-	authZRepo *authz_repo.EsRepository
-}
-
-func Start(authZRepo *authz_repo.EsRepository) (v *TokenVerifier) {
-	return &TokenVerifier{authZRepo: authZRepo}
-}
-
-func (v *TokenVerifier) VerifyAccessToken(ctx context.Context, token string) (string, string, string, error) {
-	userID, clientID, agentID, err := v.authZRepo.VerifyAccessToken(ctx, token, authName, v.authID)
-	if clientID != "" {
-		v.authID = clientID
-	}
-	return userID, clientID, agentID, err
-}
-
-func (v *TokenVerifier) ResolveGrant(ctx context.Context) (*auth.Grant, error) {
-	return v.authZRepo.ResolveGrants(ctx)
-}
-
-func (v *TokenVerifier) GetProjectIDByClientID(ctx context.Context, clientID string) (string, error) {
-	return v.authZRepo.ProjectIDByClientID(ctx, clientID)
-}

internal/auth/repository/eventsourcing/eventstore/key.go

@@ -6,7 +6,7 @@ import (
 
 	"gopkg.in/square/go-jose.v2"
 
-	"github.com/caos/zitadel/internal/api/auth"
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/key/model"
 	key_event "github.com/caos/zitadel/internal/key/repository/eventsourcing"
@@ -71,5 +71,5 @@ func (k *KeyRepository) refreshSigningKey(keyCh chan<- jose.SigningKey, errCh ch
 }
 
 func setOIDCCtx(ctx context.Context) context.Context {
-	return auth.SetCtxData(ctx, auth.CtxData{UserID: oidcUser, OrgID: iamOrg})
+	return authz.SetCtxData(ctx, authz.CtxData{UserID: oidcUser, OrgID: iamOrg})
 }

internal/auth/repository/eventsourcing/eventstore/policy.go

@@ -3,7 +3,7 @@ package eventstore
 import (
 	"context"
 
-	"github.com/caos/zitadel/internal/api/auth"
+	"github.com/caos/zitadel/internal/api/authz"
 	pol_model "github.com/caos/zitadel/internal/policy/model"
 	pol_event "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 )
@@ -13,6 +13,6 @@ type PolicyRepo struct {
 }
 
 func (repo *PolicyRepo) GetMyPasswordComplexityPolicy(ctx context.Context) (*pol_model.PasswordComplexityPolicy, error) {
-	ctxData := auth.GetCtxData(ctx)
+	ctxData := authz.GetCtxData(ctx)
 	return repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, ctxData.OrgID)
 }

internal/auth/repository/eventsourcing/eventstore/user.go

@@ -4,20 +4,20 @@ import (
 	"context"
 
 	"github.com/caos/logging"
+
+	"github.com/caos/zitadel/internal/api/authz"
+	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
+	"github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
 	"github.com/caos/zitadel/internal/eventstore/sdk"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	org_event "github.com/caos/zitadel/internal/org/repository/eventsourcing"
-	usr_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
-	usr_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
-
-	"github.com/caos/zitadel/internal/api/auth"
-	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
-	"github.com/caos/zitadel/internal/errors"
-	es_models "github.com/caos/zitadel/internal/eventstore/models"
 	policy_event "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 	"github.com/caos/zitadel/internal/user/model"
 	user_event "github.com/caos/zitadel/internal/user/repository/eventsourcing"
+	usr_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	usr_view_model "github.com/caos/zitadel/internal/user/repository/view/model"
 )
 
 type UserRepo struct {
@@ -33,7 +33,7 @@ func (repo *UserRepo) Health(ctx context.Context) error {
 }
 
 func (repo *UserRepo) Register(ctx context.Context, registerUser *model.User, orgMember *org_model.OrgMember, resourceOwner string) (*model.User, error) {
-	policyResourceOwner := auth.GetCtxData(ctx).OrgID
+	policyResourceOwner := authz.GetCtxData(ctx).OrgID
 	if resourceOwner != "" {
 		policyResourceOwner = resourceOwner
 	}
@@ -66,11 +66,11 @@ func (repo *UserRepo) Register(ctx context.Context, registerUser *model.User, or
 }
 
 func (repo *UserRepo) MyUser(ctx context.Context) (*model.UserView, error) {
-	return repo.UserByID(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserByID(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) MyProfile(ctx context.Context) (*model.Profile, error) {
-	user, err := repo.UserByID(ctx, auth.GetCtxData(ctx).UserID)
+	user, err := repo.UserByID(ctx, authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err
 	}
@@ -85,7 +85,7 @@ func (repo *UserRepo) ChangeMyProfile(ctx context.Context, profile *model.Profil
 }
 
 func (repo *UserRepo) MyEmail(ctx context.Context) (*model.Email, error) {
-	user, err := repo.UserByID(ctx, auth.GetCtxData(ctx).UserID)
+	user, err := repo.UserByID(ctx, authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +104,7 @@ func (repo *UserRepo) VerifyEmail(ctx context.Context, userID, code string) erro
 }
 
 func (repo *UserRepo) VerifyMyEmail(ctx context.Context, code string) error {
-	return repo.UserEvents.VerifyEmail(ctx, auth.GetCtxData(ctx).UserID, code)
+	return repo.UserEvents.VerifyEmail(ctx, authz.GetCtxData(ctx).UserID, code)
 }
 
 func (repo *UserRepo) ResendEmailVerificationMail(ctx context.Context, userID string) error {
@@ -112,11 +112,11 @@ func (repo *UserRepo) ResendEmailVerificationMail(ctx context.Context, userID st
 }
 
 func (repo *UserRepo) ResendMyEmailVerificationMail(ctx context.Context) error {
-	return repo.UserEvents.CreateEmailVerificationCode(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserEvents.CreateEmailVerificationCode(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) MyPhone(ctx context.Context) (*model.Phone, error) {
-	user, err := repo.UserByID(ctx, auth.GetCtxData(ctx).UserID)
+	user, err := repo.UserByID(ctx, authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err
 	}
@@ -131,19 +131,19 @@ func (repo *UserRepo) ChangeMyPhone(ctx context.Context, phone *model.Phone) (*m
 }
 
 func (repo *UserRepo) RemoveMyPhone(ctx context.Context) error {
-	return repo.UserEvents.RemovePhone(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserEvents.RemovePhone(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) VerifyMyPhone(ctx context.Context, code string) error {
-	return repo.UserEvents.VerifyPhone(ctx, auth.GetCtxData(ctx).UserID, code)
+	return repo.UserEvents.VerifyPhone(ctx, authz.GetCtxData(ctx).UserID, code)
 }
 
 func (repo *UserRepo) ResendMyPhoneVerificationCode(ctx context.Context) error {
-	return repo.UserEvents.CreatePhoneVerificationCode(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserEvents.CreatePhoneVerificationCode(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) MyAddress(ctx context.Context) (*model.Address, error) {
-	user, err := repo.UserByID(ctx, auth.GetCtxData(ctx).UserID)
+	user, err := repo.UserByID(ctx, authz.GetCtxData(ctx).UserID)
 	if err != nil {
 		return nil, err
 	}
@@ -158,16 +158,16 @@ func (repo *UserRepo) ChangeMyAddress(ctx context.Context, address *model.Addres
 }
 
 func (repo *UserRepo) ChangeMyPassword(ctx context.Context, old, new string) error {
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return err
 	}
-	_, err = repo.UserEvents.ChangePassword(ctx, policy, auth.GetCtxData(ctx).UserID, old, new)
+	_, err = repo.UserEvents.ChangePassword(ctx, policy, authz.GetCtxData(ctx).UserID, old, new)
 	return err
 }
 
 func (repo *UserRepo) ChangePassword(ctx context.Context, userID, old, new string) error {
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return err
 	}
@@ -176,7 +176,7 @@ func (repo *UserRepo) ChangePassword(ctx context.Context, userID, old, new strin
 }
 
 func (repo *UserRepo) MyUserMfas(ctx context.Context) ([]*model.MultiFactor, error) {
-	return repo.View.UserMfas(auth.GetCtxData(ctx).UserID)
+	return repo.View.UserMfas(authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) AddMfaOTP(ctx context.Context, userID string) (*model.OTP, error) {
@@ -184,7 +184,7 @@ func (repo *UserRepo) AddMfaOTP(ctx context.Context, userID string) (*model.OTP,
 }
 
 func (repo *UserRepo) AddMyMfaOTP(ctx context.Context) (*model.OTP, error) {
-	return repo.UserEvents.AddOTP(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserEvents.AddOTP(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) VerifyMfaOTPSetup(ctx context.Context, userID, code string) error {
@@ -192,11 +192,11 @@ func (repo *UserRepo) VerifyMfaOTPSetup(ctx context.Context, userID, code string
 }
 
 func (repo *UserRepo) VerifyMyMfaOTPSetup(ctx context.Context, code string) error {
-	return repo.UserEvents.CheckMfaOTPSetup(ctx, auth.GetCtxData(ctx).UserID, code)
+	return repo.UserEvents.CheckMfaOTPSetup(ctx, authz.GetCtxData(ctx).UserID, code)
 }
 
 func (repo *UserRepo) RemoveMyMfaOTP(ctx context.Context) error {
-	return repo.UserEvents.RemoveOTP(ctx, auth.GetCtxData(ctx).UserID)
+	return repo.UserEvents.RemoveOTP(ctx, authz.GetCtxData(ctx).UserID)
 }
 
 func (repo *UserRepo) ResendInitVerificationMail(ctx context.Context, userID string) error {
@@ -205,7 +205,7 @@ func (repo *UserRepo) ResendInitVerificationMail(ctx context.Context, userID str
 }
 
 func (repo *UserRepo) VerifyInitCode(ctx context.Context, userID, code, password string) error {
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return err
 	}
@@ -225,7 +225,7 @@ func (repo *UserRepo) RequestPasswordReset(ctx context.Context, loginname string
 }
 
 func (repo *UserRepo) SetPassword(ctx context.Context, userID, code, password string) error {
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, authz.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return err
 	}
@@ -264,7 +264,7 @@ func (repo *UserRepo) UserByID(ctx context.Context, id string) (*model.UserView,
 }
 
 func (repo *UserRepo) MyUserChanges(ctx context.Context, lastSequence uint64, limit uint64, sortAscending bool) (*model.UserChanges, error) {
-	changes, err := repo.UserEvents.UserChanges(ctx, auth.GetCtxData(ctx).UserID, lastSequence, limit, sortAscending)
+	changes, err := repo.UserEvents.UserChanges(ctx, authz.GetCtxData(ctx).UserID, lastSequence, limit, sortAscending)
 	if err != nil {
 		return nil, err
 	}
@@ -279,7 +279,7 @@ func (repo *UserRepo) MyUserChanges(ctx context.Context, lastSequence uint64, li
 }
 
 func checkIDs(ctx context.Context, obj es_models.ObjectRoot) error {
-	if obj.AggregateID != auth.GetCtxData(ctx).UserID {
+	if obj.AggregateID != authz.GetCtxData(ctx).UserID {
 		return errors.ThrowPermissionDenied(nil, "EVENT-kFi9w", "object does not belong to user")
 	}
 	return nil

internal/auth/repository/eventsourcing/eventstore/user_grant.go

@@ -2,7 +2,8 @@ package eventstore
 
 import (
 	"context"
-	"github.com/caos/zitadel/internal/api/auth"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
 	caos_errs "github.com/caos/zitadel/internal/errors"
@@ -17,13 +18,13 @@ type UserGrantRepo struct {
 	SearchLimit uint64
 	View        *view.View
 	IamID       string
-	Auth        auth.Config
+	Auth        authz.Config
 	AuthZRepo   *authz_repo.EsRepository
 }
 
 func (repo *UserGrantRepo) SearchMyUserGrants(ctx context.Context, request *grant_model.UserGrantSearchRequest) (*grant_model.UserGrantSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyUserID, Method: global_model.SearchMethodEquals, Value: auth.GetCtxData(ctx).UserID})
+	request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyUserID, Method: global_model.SearchMethodEquals, Value: authz.GetCtxData(ctx).UserID})
 	grants, count, err := repo.View.SearchUserGrants(request)
 	if err != nil {
 		return nil, err
@@ -38,7 +39,7 @@ func (repo *UserGrantRepo) SearchMyUserGrants(ctx context.Context, request *gran
 
 func (repo *UserGrantRepo) SearchMyProjectOrgs(ctx context.Context, request *grant_model.UserGrantSearchRequest) (*grant_model.ProjectOrgSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	ctxData := auth.GetCtxData(ctx)
+	ctxData := authz.GetCtxData(ctx)
 	if ctxData.ProjectID == "" {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "APP-7lqva", "Could not get ProjectID")
 	}
@@ -74,7 +75,7 @@ func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]st
 	}
 	permissions := &grant_model.Permissions{Permissions: []string{}}
 	for _, role := range grant.Roles {
-		roleName, ctxID := auth.SplitPermission(role)
+		roleName, ctxID := authz.SplitPermission(role)
 		for _, mapping := range repo.Auth.RolePermissionMappings {
 			if mapping.Role == roleName {
 				permissions.AppendPermissions(ctxID, mapping.Permissions...)
@@ -85,7 +86,7 @@ func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]st
 }
 
 func (repo *UserGrantRepo) SearchMyProjectPermissions(ctx context.Context) ([]string, error) {
-	ctxData := auth.GetCtxData(ctx)
+	ctxData := authz.GetCtxData(ctx)
 	usergrant, err := repo.View.UserGrantByIDs(ctxData.OrgID, ctxData.ProjectID, ctxData.UserID)
 	if err != nil {
 		return nil, err
@@ -116,7 +117,7 @@ func (repo *UserGrantRepo) SearchAdminOrgs(request *grant_model.UserGrantSearchR
 func (repo *UserGrantRepo) IsIamAdmin(ctx context.Context) (bool, error) {
 	grantSearch := &grant_model.UserGrantSearchRequest{
 		Queries: []*grant_model.UserGrantSearchQuery{
-			&grant_model.UserGrantSearchQuery{Key: grant_model.UserGrantSearchKeyResourceOwner, Method: global_model.SearchMethodEquals, Value: repo.IamID},
+			{Key: grant_model.UserGrantSearchKeyResourceOwner, Method: global_model.SearchMethodEquals, Value: repo.IamID},
 		}}
 	result, err := repo.SearchMyUserGrants(ctx, grantSearch)
 	if err != nil {
@@ -150,15 +151,15 @@ func orgRespToOrgResp(orgs []*org_view_model.OrgView, count int) *grant_model.Pr
 	return resp
 }
 
-func mergeOrgAndAdminGrant(ctxData auth.CtxData, orgGrant, iamAdminGrant *model.UserGrantView) (grant *auth.Grant) {
+func mergeOrgAndAdminGrant(ctxData authz.CtxData, orgGrant, iamAdminGrant *model.UserGrantView) (grant *authz.Grant) {
 	if orgGrant != nil {
 		roles := orgGrant.RoleKeys
 		if iamAdminGrant != nil {
 			roles = addIamAdminRoles(roles, iamAdminGrant.RoleKeys)
 		}
-		grant = &auth.Grant{OrgID: orgGrant.ResourceOwner, Roles: roles}
+		grant = &authz.Grant{OrgID: orgGrant.ResourceOwner, Roles: roles}
 	} else if iamAdminGrant != nil {
-		grant = &auth.Grant{
+		grant = &authz.Grant{
 			OrgID: ctxData.OrgID,
 			Roles: iamAdminGrant.RoleKeys,
 		}
@@ -170,7 +171,7 @@ func addIamAdminRoles(orgRoles, iamAdminRoles []string) []string {
 	result := make([]string, 0)
 	result = append(result, iamAdminRoles...)
 	for _, role := range orgRoles {
-		if !auth.ExistsPerm(result, role) {
+		if !authz.ExistsPerm(result, role) {
 			result = append(result, role)
 		}
 	}

internal/auth/repository/eventsourcing/eventstore/user_session.go

@@ -2,7 +2,8 @@ package eventstore
 
 import (
 	"context"
-	"github.com/caos/zitadel/internal/api/auth"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	"github.com/caos/zitadel/internal/user/repository/view/model"
@@ -13,7 +14,7 @@ type UserSessionRepo struct {
 }
 
 func (repo *UserSessionRepo) GetMyUserSessions(ctx context.Context) ([]*usr_model.UserSessionView, error) {
-	userSessions, err := repo.View.UserSessionsByAgentID(auth.GetCtxData(ctx).AgentID)
+	userSessions, err := repo.View.UserSessionsByAgentID(authz.GetCtxData(ctx).AgentID)
 	if err != nil {
 		return nil, err
 	}

internal/auth/repository/eventsourcing/repository.go

@@ -2,23 +2,23 @@ package eventsourcing
 
 import (
 	"context"
-	"github.com/caos/zitadel/internal/api/auth"
-	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
-	es_iam "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
-	es_org "github.com/caos/zitadel/internal/org/repository/eventsourcing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/eventstore"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/handler"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing/spooler"
 	auth_view "github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
 	"github.com/caos/zitadel/internal/auth_request/repository/cache"
+	authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
 	sd "github.com/caos/zitadel/internal/config/systemdefaults"
 	"github.com/caos/zitadel/internal/config/types"
 	"github.com/caos/zitadel/internal/crypto"
 	es_int "github.com/caos/zitadel/internal/eventstore"
 	es_spol "github.com/caos/zitadel/internal/eventstore/spooler"
+	es_iam "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
 	"github.com/caos/zitadel/internal/id"
 	es_key "github.com/caos/zitadel/internal/key/repository/eventsourcing"
+	es_org "github.com/caos/zitadel/internal/org/repository/eventsourcing"
 	es_policy "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 	es_proj "github.com/caos/zitadel/internal/project/repository/eventsourcing"
 	es_user "github.com/caos/zitadel/internal/user/repository/eventsourcing"
@@ -47,7 +47,7 @@ type EsRepository struct {
 	eventstore.PolicyRepo
 }
 
-func Start(conf Config, authZ auth.Config, systemDefaults sd.SystemDefaults, authZRepo *authz_repo.EsRepository) (*EsRepository, error) {
+func Start(conf Config, authZ authz.Config, systemDefaults sd.SystemDefaults, authZRepo *authz_repo.EsRepository) (*EsRepository, error) {
 	es, err := es_int.Start(conf.Eventstore)
 	if err != nil {
 		return nil, err