fix: user grant query with user organization instead of organization … (#10732)

…of project grant # Which Problems Are Solved On Management API the fields for `GrantedOrgId`, `GrantedOrgName` and `GrantedOrgDomain` were only filled if it was a usergrant for a granted project. # How the Problems Are Solved Correctly query the Organization of the User again to the Organization the Project is granted to. Then fill in the information about the Organization of the User in the fields `GrantedOrgId`, `GrantedOrgName` and `GrantedOrgDomain`. # Additional Changes Additionally query the information about the Organization the Project is granted to, to have it available for the Authorization v2beta API. # Additional Context Closes #10723 --------- Co-authored-by: Tim Möhlmann <tim+github@zitadel.com> (cherry picked from commit edb227f066)
2025-11-03 06:31:58 +00:00 · 2025-09-16 12:04:53 +02:00
parent a3c0d53c79
commit 389f908041
3 changed files with 436 additions and 341 deletions
--- a/internal/api/grpc/user/user_grant.go
+++ b/internal/api/grpc/user/user_grant.go
@@ -39,9 +39,9 @@ func UserGrantToPb(assetPrefix string, grant *query.UserGrant) *user_pb.UserGran
 		AvatarUrl:          domain.AvatarURL(assetPrefix, grant.UserResourceOwner, grant.AvatarURL),
 		PreferredLoginName: grant.PreferredLoginName,
 		UserType:           TypeToPb(grant.UserType),
-		GrantedOrgId:       grant.GrantedOrgID,
-		GrantedOrgName:     grant.GrantedOrgName,
-		GrantedOrgDomain:   grant.GrantedOrgDomain,
+		GrantedOrgId:       grant.UserResourceOwner,
+		GrantedOrgName:     grant.UserResourceOwnerName,
+		GrantedOrgDomain:   grant.UserResourceOwnerDomain,
 		Details: object.ToViewDetailsPb(
 			grant.Sequence,
 			grant.CreationDate,
--- a/internal/query/user_grant.go
+++ b/internal/query/user_grant.go
@@ -34,6 +34,8 @@ type UserGrant struct {
 	Username                string          `json:"username,omitempty"`
 	UserType                domain.UserType `json:"user_type,omitempty"`
 	UserResourceOwner       string          `json:"user_resource_owner,omitempty"`
+	UserResourceOwnerName   string          `json:"user_resource_owner_name,omitempty"`
+	UserResourceOwnerDomain string          `json:"user_resource_owner_domain,omitempty"`
 	FirstName               string          `json:"first_name,omitempty"`
 	LastName                string          `json:"last_name,omitempty"`
 	Email                   string          `json:"email,omitempty"`
@@ -257,6 +259,25 @@ var (
 		name:  projection.UserGrantState,
 		table: userGrantTable,
 	}
+
+	UserOrgsTable = table{
+		name:          projection.OrgProjectionTable,
+		alias:         "user_orgs",
+		instanceIDCol: projection.OrgColumnInstanceID,
+	}
+	UserOrgColumnId = Column{
+		name:  projection.OrgColumnID,
+		table: UserOrgsTable,
+	}
+	UserOrgColumnName = Column{
+		name:  projection.OrgColumnName,
+		table: UserOrgsTable,
+	}
+	UserOrgColumnDomain = Column{
+		name:  projection.OrgColumnDomain,
+		table: UserOrgsTable,
+	}
+
 	GrantedOrgsTable = table{
 		name:          projection.OrgProjectionTable,
 		alias:         "granted_orgs",
@@ -366,7 +387,9 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
 			UserGrantUserID.identifier(),
 			UserUsernameCol.identifier(),
 			UserTypeCol.identifier(),
-			UserResourceOwnerCol.identifier(),
+			UserOrgColumnId.identifier(),
+			UserOrgColumnName.identifier(),
+			UserOrgColumnDomain.identifier(),
 			HumanFirstNameCol.identifier(),
 			HumanLastNameCol.identifier(),
 			HumanEmailCol.identifier(),
@@ -391,6 +414,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
 			LeftJoin(join(HumanUserIDCol, UserGrantUserID)).
 			LeftJoin(join(OrgColumnID, UserGrantResourceOwner)).
 			LeftJoin(join(ProjectColumnID, UserGrantProjectID)).
+			LeftJoin(join(UserOrgColumnId, UserResourceOwnerCol)).
 			LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
 			LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
 			LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
@@ -405,6 +429,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
 				firstName          sql.NullString
 				userType           sql.NullInt32
 				userOwner          sql.NullString
+				userOwnerName      sql.NullString
+				userOwnerDomain    sql.NullString
 				lastName           sql.NullString
 				email              sql.NullString
 				displayName        sql.NullString
@@ -435,6 +461,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
 				&username,
 				&userType,
 				&userOwner,
+				&userOwnerName,
+				&userOwnerDomain,
 				&firstName,
 				&lastName,
 				&email,
@@ -464,6 +492,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
 			g.Username = username.String
 			g.UserType = domain.UserType(userType.Int32)
 			g.UserResourceOwner = userOwner.String
+			g.UserResourceOwnerName = userOwnerName.String
+			g.UserResourceOwnerDomain = userOwnerDomain.String
 			g.FirstName = firstName.String
 			g.LastName = lastName.String
 			g.Email = email.String
@@ -494,7 +524,9 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
 			UserGrantUserID.identifier(),
 			UserUsernameCol.identifier(),
 			UserTypeCol.identifier(),
-			UserResourceOwnerCol.identifier(),
+			UserOrgColumnId.identifier(),
+			UserOrgColumnName.identifier(),
+			UserOrgColumnDomain.identifier(),
 			HumanFirstNameCol.identifier(),
 			HumanLastNameCol.identifier(),
 			HumanEmailCol.identifier(),
@@ -521,6 +553,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
 			LeftJoin(join(HumanUserIDCol, UserGrantUserID)).
 			LeftJoin(join(OrgColumnID, UserGrantResourceOwner)).
 			LeftJoin(join(ProjectColumnID, UserGrantProjectID)).
+			LeftJoin(join(UserOrgColumnId, UserResourceOwnerCol)).
 			LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
 			LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
 			LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
@@ -537,6 +570,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
 					username           sql.NullString
 					userType           sql.NullInt32
 					userOwner          sql.NullString
+					userOwnerName      sql.NullString
+					userOwnerDomain    sql.NullString
 					firstName          sql.NullString
 					lastName           sql.NullString
 					email              sql.NullString
@@ -568,6 +603,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
 					&username,
 					&userType,
 					&userOwner,
+					&userOwnerName,
+					&userOwnerDomain,
 					&firstName,
 					&lastName,
 					&email,
@@ -596,6 +633,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
 				g.Username = username.String
 				g.UserType = domain.UserType(userType.Int32)
 				g.UserResourceOwner = userOwner.String
+				g.UserResourceOwnerName = userOwnerName.String
+				g.UserResourceOwnerDomain = userOwnerDomain.String
 				g.FirstName = firstName.String
 				g.LastName = lastName.String
 				g.Email = email.String
--- a/internal/query/user_grant_test.go
+++ b/internal/query/user_grant_test.go
@@ -25,7 +25,9 @@ var (
 			", projections.user_grants5.user_id" +
 			", projections.users14.username" +
 			", projections.users14.type" +
-			", projections.users14.resource_owner" +
+			", user_orgs.id" +
+			", user_orgs.name" +
+			", user_orgs.primary_domain" +
 			", projections.users14_humans.first_name" +
 			", projections.users14_humans.last_name" +
 			", projections.users14_humans.email" +
@@ -46,6 +48,7 @@ var (
 			" LEFT JOIN projections.users14_humans ON projections.user_grants5.user_id = projections.users14_humans.user_id AND projections.user_grants5.instance_id = projections.users14_humans.instance_id" +
 			" LEFT JOIN projections.orgs1 ON projections.user_grants5.resource_owner = projections.orgs1.id AND projections.user_grants5.instance_id = projections.orgs1.instance_id" +
 			" LEFT JOIN projections.projects4 ON projections.user_grants5.project_id = projections.projects4.id AND projections.user_grants5.instance_id = projections.projects4.instance_id" +
+			" LEFT JOIN projections.orgs1 AS user_orgs ON projections.users14.resource_owner = user_orgs.id AND projections.users14.instance_id = user_orgs.instance_id" +
 			" LEFT JOIN projections.project_grants4 ON projections.user_grants5.grant_id = projections.project_grants4.grant_id AND projections.user_grants5.instance_id = projections.project_grants4.instance_id AND projections.project_grants4.project_id = projections.user_grants5.project_id" +
 			" LEFT JOIN projections.orgs1 AS granted_orgs ON projections.project_grants4.granted_org_id = granted_orgs.id AND projections.project_grants4.instance_id = granted_orgs.instance_id" +
 			" LEFT JOIN projections.login_names3 ON projections.user_grants5.user_id = projections.login_names3.user_id AND projections.user_grants5.instance_id = projections.login_names3.instance_id" +
@@ -62,6 +65,8 @@ var (
 		"username",
 		"type",
 		"resource_owner", //user resource owner
+		"name",
+		"primary_domain",
 		"first_name",
 		"last_name",
 		"email",
@@ -89,7 +94,9 @@ var (
 			", projections.user_grants5.user_id" +
 			", projections.users14.username" +
 			", projections.users14.type" +
-			", projections.users14.resource_owner" +
+			", user_orgs.id" +
+			", user_orgs.name" +
+			", user_orgs.primary_domain" +
 			", projections.users14_humans.first_name" +
 			", projections.users14_humans.last_name" +
 			", projections.users14_humans.email" +
@@ -111,6 +118,7 @@ var (
 			" LEFT JOIN projections.users14_humans ON projections.user_grants5.user_id = projections.users14_humans.user_id AND projections.user_grants5.instance_id = projections.users14_humans.instance_id" +
 			" LEFT JOIN projections.orgs1 ON projections.user_grants5.resource_owner = projections.orgs1.id AND projections.user_grants5.instance_id = projections.orgs1.instance_id" +
 			" LEFT JOIN projections.projects4 ON projections.user_grants5.project_id = projections.projects4.id AND projections.user_grants5.instance_id = projections.projects4.instance_id" +
+			" LEFT JOIN projections.orgs1 AS user_orgs ON projections.users14.resource_owner = user_orgs.id AND projections.users14.instance_id = user_orgs.instance_id" +
 			" LEFT JOIN projections.project_grants4 ON projections.user_grants5.grant_id = projections.project_grants4.grant_id AND projections.user_grants5.instance_id = projections.project_grants4.instance_id AND projections.project_grants4.project_id = projections.user_grants5.project_id" +
 			" LEFT JOIN projections.orgs1 AS granted_orgs ON projections.project_grants4.granted_org_id = granted_orgs.id AND projections.project_grants4.instance_id = granted_orgs.instance_id" +
 			" LEFT JOIN projections.login_names3 ON projections.user_grants5.user_id = projections.login_names3.user_id AND projections.user_grants5.instance_id = projections.login_names3.instance_id" +
@@ -168,7 +176,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						"user-id",
 						"username",
 						domain.UserTypeHuman,
-						"resource-owner",
+						"user-resource-owner",
+						"user-resource-owner-name",
+						"user-resource-owner-domain",
 						"first-name",
 						"last-name",
 						"email",
@@ -198,7 +208,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 				UserID:                  "user-id",
 				Username:                "username",
 				UserType:                domain.UserTypeHuman,
-				UserResourceOwner:    "resource-owner",
+				UserResourceOwner:       "user-resource-owner",
+				UserResourceOwnerName:   "user-resource-owner-name",
+				UserResourceOwnerDomain: "user-resource-owner-domain",
 				FirstName:               "first-name",
 				LastName:                "last-name",
 				Email:                   "email",
@@ -234,7 +246,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						"user-id",
 						"username",
 						domain.UserTypeMachine,
-						"resource-owner",
+						"user-resource-owner",
+						"user-resource-owner-name",
+						"user-resource-owner-domain",
 						nil,
 						nil,
 						nil,
@@ -264,7 +278,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 				UserID:                  "user-id",
 				Username:                "username",
 				UserType:                domain.UserTypeMachine,
-				UserResourceOwner:    "resource-owner",
+				UserResourceOwner:       "user-resource-owner",
+				UserResourceOwnerName:   "user-resource-owner-name",
+				UserResourceOwnerDomain: "user-resource-owner-domain",
 				FirstName:               "",
 				LastName:                "",
 				Email:                   "",
@@ -300,7 +316,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						"user-id",
 						"username",
 						domain.UserTypeHuman,
-						"resource-owner",
+						"user-resource-owner",
+						"user-resource-owner-name",
+						"user-resource-owner-domain",
 						"first-name",
 						"last-name",
 						"email",
@@ -330,7 +348,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 				UserID:                  "user-id",
 				Username:                "username",
 				UserType:                domain.UserTypeHuman,
-				UserResourceOwner:    "resource-owner",
+				UserResourceOwner:       "user-resource-owner",
+				UserResourceOwnerName:   "user-resource-owner-name",
+				UserResourceOwnerDomain: "user-resource-owner-domain",
 				FirstName:               "first-name",
 				LastName:                "last-name",
 				Email:                   "email",
@@ -366,7 +386,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						"user-id",
 						"username",
 						domain.UserTypeHuman,
-						"resource-owner",
+						"user-resource-owner",
+						"user-resource-owner-name",
+						"user-resource-owner-domain",
 						"first-name",
 						"last-name",
 						"email",
@@ -396,7 +418,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 				UserID:                  "user-id",
 				Username:                "username",
 				UserType:                domain.UserTypeHuman,
-				UserResourceOwner:    "resource-owner",
+				UserResourceOwner:       "user-resource-owner",
+				UserResourceOwnerName:   "user-resource-owner-name",
+				UserResourceOwnerDomain: "user-resource-owner-domain",
 				FirstName:               "first-name",
 				LastName:                "last-name",
 				Email:                   "email",
@@ -432,7 +456,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						"user-id",
 						"username",
 						domain.UserTypeHuman,
-						"resource-owner",
+						"user-resource-owner",
+						"user-resource-owner-name",
+						"user-resource-owner-domain",
 						"first-name",
 						"last-name",
 						"email",
@@ -462,7 +488,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 				UserID:                  "user-id",
 				Username:                "username",
 				UserType:                domain.UserTypeHuman,
-				UserResourceOwner:    "resource-owner",
+				UserResourceOwner:       "user-resource-owner",
+				UserResourceOwnerName:   "user-resource-owner-name",
+				UserResourceOwnerDomain: "user-resource-owner-domain",
 				FirstName:               "first-name",
 				LastName:                "last-name",
 				Email:                   "email",
@@ -528,7 +556,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeHuman,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -564,7 +594,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeHuman,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",
@@ -603,7 +635,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeMachine,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							nil,
 							nil,
 							nil,
@@ -639,7 +673,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeMachine,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "",
 						LastName:                "",
 						Email:                   "",
@@ -678,7 +714,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeMachine,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -714,7 +752,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeMachine,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",
@@ -753,7 +793,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeHuman,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -789,7 +831,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeHuman,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",
@@ -828,7 +872,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeHuman,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -864,7 +910,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeHuman,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",
@@ -903,7 +951,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeHuman,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -931,7 +981,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 							"user-id",
 							"username",
 							domain.UserTypeHuman,
-							"resource-owner",
+							"user-resource-owner",
+							"user-resource-owner-name",
+							"user-resource-owner-domain",
 							"first-name",
 							"last-name",
 							"email",
@@ -967,7 +1019,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeHuman,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",
@@ -995,7 +1049,9 @@ func Test_UserGrantPrepares(t *testing.T) {
 						UserID:                  "user-id",
 						Username:                "username",
 						UserType:                domain.UserTypeHuman,
-						UserResourceOwner:    "resource-owner",
+						UserResourceOwner:       "user-resource-owner",
+						UserResourceOwnerName:   "user-resource-owner-name",
+						UserResourceOwnerDomain: "user-resource-owner-domain",
 						FirstName:               "first-name",
 						LastName:                "last-name",
 						Email:                   "email",