fix: multiple setup steps (#773)

* fix: multiple setup steps

* fix: test set up started

* fix: possible nil pointers in setup

* fix: validate executed step

internal/setup/setup.go

@@ -7,22 +7,20 @@ import (
 
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/config/systemdefaults"
+	"github.com/caos/zitadel/internal/errors"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	es_int "github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/eventstore/models"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 	es_iam "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
 	iam_event "github.com/caos/zitadel/internal/iam/repository/eventsourcing"
-	org_model "github.com/caos/zitadel/internal/org/model"
 	es_org "github.com/caos/zitadel/internal/org/repository/eventsourcing"
 	org_event "github.com/caos/zitadel/internal/org/repository/eventsourcing"
-	policy_model "github.com/caos/zitadel/internal/policy/model"
 	es_policy "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 	policy_event "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	es_proj "github.com/caos/zitadel/internal/project/repository/eventsourcing"
 	proj_event "github.com/caos/zitadel/internal/project/repository/eventsourcing"
-	usr_model "github.com/caos/zitadel/internal/user/model"
 	es_usr "github.com/caos/zitadel/internal/user/repository/eventsourcing"
 	usr_event "github.com/caos/zitadel/internal/user/repository/eventsourcing"
 )
@@ -36,14 +34,6 @@ type Setup struct {
 	PolicyEvents  *policy_event.PolicyEventstore
 }
 
-type initializer struct {
-	*Setup
-	createdUsers       map[string]*usr_model.User
-	createdOrgs        map[string]*org_model.Org
-	createdProjects    map[string]*proj_model.Project
-	pwComplexityPolicy *policy_model.PasswordComplexityPolicy
-}
-
 const (
 	OrgOwnerRole                   = "ORG_OWNER"
 	SetupUser                      = "SETUP"
@@ -107,309 +97,65 @@ func StartSetup(esConfig es_int.Config, sd systemdefaults.SystemDefaults) (*Setu
 }
 
 func (s *Setup) Execute(ctx context.Context, setUpConfig IAMSetUp) error {
+	logging.Log("SETUP-hwG32").Info("starting setup")
+
 	iam, err := s.IamEvents.IAMByID(ctx, s.iamID)
 	if err != nil && !caos_errs.IsNotFound(err) {
 		return err
 	}
-	if iam != nil && (iam.SetUpStarted || iam.SetUpDone) {
+	if iam != nil && (iam.SetUpDone == iam_model.StepCount-1 || iam.SetUpStarted != iam.SetUpDone) {
+		logging.Log("SETUP-cWEsn").Info("all steps done")
 		return nil
 	}
 
-	logging.Log("SETUP-hwG32").Info("starting setup")
-	ctx = setSetUpContextData(ctx, s.iamID)
-	iam, err = s.IamEvents.StartSetup(ctx, s.iamID)
-	if err != nil {
-		return err
+	if iam == nil {
+		iam = &iam_model.IAM{ObjectRoot: models.ObjectRoot{AggregateID: s.iamID}}
 	}
 
-	setUp := &initializer{
-		Setup:           s,
-		createdUsers:    make(map[string]*usr_model.User),
-		createdOrgs:     make(map[string]*org_model.Org),
-		createdProjects: make(map[string]*proj_model.Project),
-	}
-
-	err = setUp.loginPolicy(ctx, setUpConfig.DefaultLoginPolicy)
-	if err != nil {
-		logging.Log("SETUP-Hdu8S").WithError(err).Error("unable to create login policy")
-		return err
-	}
-
-	pwComplexityPolicy, err := s.PolicyEvents.GetPasswordComplexityPolicy(ctx, policy_model.DefaultPolicy)
-	if err != nil {
-		logging.Log("SETUP-9osWF").WithError(err).Error("unable to read complexity policy")
-		return err
-	}
-	setUp.pwComplexityPolicy = pwComplexityPolicy
-
-	err = setUp.orgs(ctx, setUpConfig.Orgs)
-	if err != nil {
-		logging.Log("SETUP-p4oWq").WithError(err).Error("unable to set up orgs")
+	steps, err := setUpConfig.steps(iam.SetUpDone)
+	if err != nil || len(steps) == 0 {
 		return err
 	}
 
 	ctx = setSetUpContextData(ctx, s.iamID)
-	err = setUp.iamOwners(ctx, setUpConfig.Owners)
-	if err != nil {
-		logging.Log("SETUP-WHr01").WithError(err).Error("unable to set up iam owners")
-		return err
+
+	for _, step := range steps {
+		step.init(s)
+		if step.step() != iam.SetUpDone+1 {
+			logging.LogWithFields("SETUP-rxRM1", "step", step.step(), "previous", iam.SetUpDone).Warn("wrong step order")
+			return errors.ThrowPreconditionFailed(nil, "SETUP-wwAqO", "too few steps for this zitadel verison")
+		}
+		iam, err = s.IamEvents.StartSetup(ctx, s.iamID, step.step())
+		if err != nil {
+			return err
+		}
+
+		err = step.execute(ctx)
+		if err != nil {
+			return err
+		}
+
+		err = s.validateExecutedStep(ctx)
+		if err != nil {
+			return err
+		}
 	}
 
-	err = setUp.setGlobalOrg(ctx, setUpConfig.GlobalOrg)
-	if err != nil {
-		logging.Log("SETUP-0874m").WithError(err).Error("unable to set global org")
-		return err
-	}
-
-	err = setUp.setIamProject(ctx, setUpConfig.IAMProject)
-	if err != nil {
-		logging.Log("SETUP-kaWjq").WithError(err).Error("unable to set zitadel project")
-		return err
-	}
-
-	iam, err = s.IamEvents.SetupDone(ctx, s.iamID)
-	if err != nil {
-		logging.Log("SETUP-de342").WithError(err).Error("unable to finish setup")
-		return err
-	}
 	logging.Log("SETUP-ds31h").Info("setup done")
 	return nil
 }
 
-func (setUp *initializer) loginPolicy(ctx context.Context, policy LoginPolicy) error {
-	logging.Log("SETUP-4djul").Info("setting up login policy")
-	loginPolicy := &iam_model.LoginPolicy{
-		ObjectRoot: models.ObjectRoot{
-			AggregateID: setUp.iamID,
-		},
-		AllowRegister:         policy.AllowRegister,
-		AllowUsernamePassword: policy.AllowUsernamePassword,
-		AllowExternalIdp:      policy.AllowExternalIdp,
-	}
-	_, err := setUp.IamEvents.AddLoginPolicy(ctx, loginPolicy)
-	return err
-}
-
-func (setUp *initializer) orgs(ctx context.Context, orgs []Org) error {
-	logging.Log("SETUP-dsTh3").Info("setting up orgs")
-	for _, iamOrg := range orgs {
-		org, err := setUp.org(ctx, iamOrg)
-		if err != nil {
-			logging.LogWithFields("SETUP-IlLif", "Org", iamOrg.Name).WithError(err).Error("unable to create org")
-			return err
-		}
-		setUp.createdOrgs[iamOrg.Name] = org
-
-		var policy *org_model.OrgIAMPolicy
-		if iamOrg.OrgIamPolicy {
-			policy, err = setUp.iamorgpolicy(ctx, org)
-			if err != nil {
-				logging.LogWithFields("SETUP-IlLif", "Org IAM Policy", iamOrg.Name).WithError(err).Error("unable to create iam org policy")
-				return err
-			}
-		} else {
-			policy, err = setUp.OrgEvents.GetOrgIAMPolicy(ctx, policy_model.DefaultPolicy)
-			if err != nil {
-				logging.LogWithFields("SETUP-IS8wS", "Org IAM Policy", iamOrg.Name).WithError(err).Error("unable to get default iam org policy")
-				return err
-			}
-		}
-
-		ctx = setSetUpContextData(ctx, org.AggregateID)
-		err = setUp.users(ctx, iamOrg.Users, policy)
-		if err != nil {
-			logging.LogWithFields("SETUP-8zfwz", "Org", iamOrg.Name).WithError(err).Error("unable to set up org users")
-			return err
-		}
-
-		err = setUp.orgOwners(ctx, org, iamOrg.Owners)
-		if err != nil {
-			logging.LogWithFields("SETUP-0874m", "Org", iamOrg.Name).WithError(err).Error("unable to set up org owners")
-			return err
-		}
-
-		err = setUp.projects(ctx, iamOrg.Projects, setUp.createdUsers[iamOrg.Owners[0]].AggregateID)
-		if err != nil {
-			logging.LogWithFields("SETUP-wUzqY", "Org", iamOrg.Name).WithError(err).Error("unable to set up org projects")
-			return err
-		}
-	}
-	logging.Log("SETUP-dgjT4").Info("orgs set up")
-	return nil
-}
-
-func (setUp *initializer) org(ctx context.Context, org Org) (*org_model.Org, error) {
-	ctx = setSetUpContextData(ctx, "")
-	createOrg := &org_model.Org{
-		Name:    org.Name,
-		Domains: []*org_model.OrgDomain{{Domain: org.Domain}},
-	}
-	return setUp.OrgEvents.CreateOrg(ctx, createOrg, nil)
-}
-
-func (setUp *initializer) iamorgpolicy(ctx context.Context, org *org_model.Org) (*org_model.OrgIAMPolicy, error) {
-	ctx = setSetUpContextData(ctx, org.AggregateID)
-	policy := &org_model.OrgIAMPolicy{
-		ObjectRoot:            models.ObjectRoot{AggregateID: org.AggregateID},
-		UserLoginMustBeDomain: false,
-	}
-	return setUp.OrgEvents.AddOrgIAMPolicy(ctx, policy)
-}
-
-func (setUp *initializer) iamOwners(ctx context.Context, owners []string) error {
-	logging.Log("SETUP-dtxfj").Info("setting iam owners")
-	for _, iamOwner := range owners {
-		user, ok := setUp.createdUsers[iamOwner]
-		if !ok {
-			logging.LogWithFields("SETUP-8siew", "Owner", iamOwner).Error("unable to add user to iam members")
-			return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-su6L3", "unable to add user to iam members")
-		}
-		_, err := setUp.IamEvents.AddIAMMember(ctx, &iam_model.IAMMember{ObjectRoot: models.ObjectRoot{AggregateID: setUp.iamID}, UserID: user.AggregateID, Roles: []string{"IAM_OWNER"}})
-		if err != nil {
-			logging.Log("SETUP-LM7rI").WithError(err).Error("unable to add iam administrator to iam members as owner")
-			return err
-		}
-	}
-	logging.Log("SETUP-fg5aq").Info("iam owners set")
-	return nil
-}
-
-func (setUp *initializer) setGlobalOrg(ctx context.Context, globalOrgName string) error {
-	logging.Log("SETUP-dsj75").Info("setting global org")
-	globalOrg, ok := setUp.createdOrgs[globalOrgName]
-	if !ok {
-		logging.LogWithFields("SETUP-FBhs9", "GlobalOrg", globalOrgName).Error("global org not created")
-		return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-4GwU7", "global org not created: %v", globalOrgName)
-	}
-
-	if _, err := setUp.IamEvents.SetGlobalOrg(ctx, setUp.iamID, globalOrg.AggregateID); err != nil {
-		logging.Log("SETUP-uGMA3").WithError(err).Error("unable to set global org on iam")
+func (s *Setup) validateExecutedStep(ctx context.Context) error {
+	iam, err := s.IamEvents.IAMByID(ctx, s.iamID)
+	if err != nil {
 		return err
 	}
-	logging.Log("SETUP-d32h1").Info("global org set")
-	return nil
-}
-
-func (setUp *initializer) setIamProject(ctx context.Context, iamProjectName string) error {
-	logging.Log("SETUP-HE3qa").Info("setting iam project")
-	iamProject, ok := setUp.createdProjects[iamProjectName]
-	if !ok {
-		logging.LogWithFields("SETUP-SJFWP", "IAM Project", iamProjectName).Error("iam project created")
-		return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-sGmQt", "iam project not created: %v", iamProjectName)
-	}
-
-	if _, err := setUp.IamEvents.SetIAMProject(ctx, setUp.iamID, iamProject.AggregateID); err != nil {
-		logging.Log("SETUP-i1pNh").WithError(err).Error("unable to set iam project on iam")
-		return err
-	}
-	logging.Log("SETUP-d7WEU").Info("iam project set")
-	return nil
-}
-
-func (setUp *initializer) users(ctx context.Context, users []User, orgPolicy *org_model.OrgIAMPolicy) error {
-	for _, user := range users {
-		created, err := setUp.user(ctx, user, orgPolicy)
-		if err != nil {
-			logging.LogWithFields("SETUP-9soer", "Email", user.Email).WithError(err).Error("unable to create iam user")
-			return err
-		}
-		setUp.createdUsers[user.Email] = created
+	if iam.SetUpStarted != iam.SetUpDone {
+		return errors.ThrowInternal(nil, "SETUP-QeukK", "started step is not equal to done")
 	}
 	return nil
 }
 
-func (setUp *initializer) user(ctx context.Context, user User, orgPolicy *org_model.OrgIAMPolicy) (*usr_model.User, error) {
-	createUser := &usr_model.User{
-		UserName: user.UserName,
-		Human: &usr_model.Human{
-			Profile: &usr_model.Profile{
-				FirstName: user.FirstName,
-				LastName:  user.LastName,
-			},
-			Email: &usr_model.Email{
-				EmailAddress:    user.Email,
-				IsEmailVerified: true,
-			},
-			Password: &usr_model.Password{
-				SecretString: user.Password,
-			},
-		},
-	}
-	return setUp.UserEvents.CreateUser(ctx, createUser, setUp.pwComplexityPolicy, orgPolicy)
-}
-
-func (setUp *initializer) orgOwners(ctx context.Context, org *org_model.Org, owners []string) error {
-	for _, orgOwner := range owners {
-		user, ok := setUp.createdUsers[orgOwner]
-		if !ok {
-			logging.LogWithFields("SETUP-s9ilr", "Owner", orgOwner).Error("unable to add user to org members")
-			return caos_errs.ThrowPreconditionFailedf(nil, "SETUP-s0prs", "unable to add user to org members: %v", orgOwner)
-		}
-		err := setUp.orgOwner(ctx, org, user)
-		if err != nil {
-			logging.Log("SETUP-s90oe").WithError(err).Error("unable to add global org admin to members of global org")
-			return err
-		}
-	}
-	return nil
-}
-
-func (setUp *initializer) orgOwner(ctx context.Context, org *org_model.Org, user *usr_model.User) error {
-	addMember := &org_model.OrgMember{
-		ObjectRoot: models.ObjectRoot{AggregateID: org.AggregateID},
-		UserID:     user.AggregateID,
-		Roles:      []string{OrgOwnerRole},
-	}
-	_, err := setUp.OrgEvents.AddOrgMember(ctx, addMember)
-	return err
-}
-
-func (setUp *initializer) projects(ctx context.Context, projects []Project, ownerID string) error {
-	ctxData := authz.GetCtxData(ctx)
-	ctxData.UserID = ownerID
-	projectCtx := authz.SetCtxData(ctx, ctxData)
-
-	for _, project := range projects {
-		createdProject, err := setUp.project(projectCtx, project)
-		if err != nil {
-			return err
-		}
-		setUp.createdProjects[createdProject.Name] = createdProject
-		for _, oidc := range project.OIDCApps {
-			app, err := setUp.oidcApp(ctx, createdProject, oidc)
-			if err != nil {
-				return err
-			}
-			logging.LogWithFields("SETUP-asd32f", "name", app.Name, "clientID", app.OIDCConfig.ClientID).Info("created OIDC application")
-		}
-	}
-	return nil
-}
-
-func (setUp *initializer) project(ctx context.Context, project Project) (*proj_model.Project, error) {
-	addProject := &proj_model.Project{
-		Name: project.Name,
-	}
-	return setUp.ProjectEvents.CreateProject(ctx, addProject, false)
-}
-
-func (setUp *initializer) oidcApp(ctx context.Context, project *proj_model.Project, oidc OIDCApp) (*proj_model.Application, error) {
-	addOIDCApp := &proj_model.Application{
-		ObjectRoot: models.ObjectRoot{AggregateID: project.AggregateID},
-		Name:       oidc.Name,
-		OIDCConfig: &proj_model.OIDCConfig{
-			RedirectUris:           oidc.RedirectUris,
-			ResponseTypes:          getOIDCResponseTypes(oidc.ResponseTypes),
-			GrantTypes:             getOIDCGrantTypes(oidc.GrantTypes),
-			ApplicationType:        getOIDCApplicationType(oidc.ApplicationType),
-			AuthMethodType:         getOIDCAuthMethod(oidc.AuthMethodType),
-			PostLogoutRedirectUris: oidc.PostLogoutRedirectUris,
-			DevMode:                oidc.DevMode,
-		},
-	}
-	return setUp.ProjectEvents.AddApplication(ctx, addOIDCApp)
-}
-
 func getOIDCResponseTypes(responseTypes []string) []proj_model.OIDCResponseType {
 	types := make([]proj_model.OIDCResponseType, len(responseTypes))
 	for i, t := range responseTypes {