feat: user profile requests in resource APIs (#10151)

# Which Problems Are Solved

The commands for the resource based v2beta AuthorizationService API are
added.
Authorizations, previously knows as user grants, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The given roles can be used to restrict access within the projects
applications.

The commands for the resource based v2beta InteralPermissionService API
are added.
Administrators, previously knows as memberships, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The give roles give the user permissions to manage different resources
in Zitadel.

API definitions from https://github.com/zitadel/zitadel/issues/9165 are
implemented.

Contains endpoints for user metadata.

# How the Problems Are Solved

### New Methods

- CreateAuthorization
- UpdateAuthorization
- DeleteAuthorization
- ActivateAuthorization
- DeactivateAuthorization
- ListAuthorizations
- CreateAdministrator
- UpdateAdministrator
- DeleteAdministrator
- ListAdministrators
- SetUserMetadata to set metadata on a user
- DeleteUserMetadata to delete metadata on a user
- ListUserMetadata to query for metadata of a user

## Deprecated Methods

### v1.ManagementService
- GetUserGrantByID
- ListUserGrants
- AddUserGrant
- UpdateUserGrant
- DeactivateUserGrant
- ReactivateUserGrant
- RemoveUserGrant
- BulkRemoveUserGrant

### v1.AuthService
- ListMyUserGrants
- ListMyProjectPermissions

# Additional Changes

- Permission checks for metadata functionality on query and command side
- correct existence checks for resources, for example you can only be an
administrator on an existing project
- combined all member tables to singular query for the administrators
- add permission checks for command an query side functionality
- combined functions on command side where necessary for easier
maintainability

# Additional Context

Closes #9165

---------

Co-authored-by: Elio Bischof <elio@zitadel.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Livio Spring <livio.a@gmail.com>

internal/api/grpc/internal_permission/v2beta/administrator.go

@@ -0,0 +1,220 @@
+package internal_permission
+
+import (
+	"context"
+
+	"connectrpc.com/connect"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/zerrors"
+	internal_permission "github.com/zitadel/zitadel/pkg/grpc/internal_permission/v2beta"
+)
+
+func (s *Server) CreateAdministrator(ctx context.Context, req *connect.Request[internal_permission.CreateAdministratorRequest]) (*connect.Response[internal_permission.CreateAdministratorResponse], error) {
+	var creationDate *timestamppb.Timestamp
+
+	switch resource := req.Msg.GetResource().GetResource().(type) {
+	case *internal_permission.ResourceType_Instance:
+		if resource.Instance {
+			member, err := s.command.AddInstanceMember(ctx, createAdministratorInstanceToCommand(authz.GetInstance(ctx).InstanceID(), req.Msg.UserId, req.Msg.Roles))
+			if err != nil {
+				return nil, err
+			}
+			if !member.EventDate.IsZero() {
+				creationDate = timestamppb.New(member.EventDate)
+			}
+		}
+	case *internal_permission.ResourceType_OrganizationId:
+		member, err := s.command.AddOrgMember(ctx, createAdministratorOrganizationToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			creationDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectId:
+		member, err := s.command.AddProjectMember(ctx, createAdministratorProjectToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			creationDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectGrant_:
+		member, err := s.command.AddProjectGrantMember(ctx, createAdministratorProjectGrantToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			creationDate = timestamppb.New(member.EventDate)
+		}
+	default:
+		return nil, zerrors.ThrowInvalidArgument(nil, "ADMIN-IbPp47HDP5", "Errors.Invalid.Argument")
+	}
+
+	return connect.NewResponse(&internal_permission.CreateAdministratorResponse{
+		CreationDate: creationDate,
+	}), nil
+}
+
+func createAdministratorInstanceToCommand(instanceID, userID string, roles []string) *command.AddInstanceMember {
+	return &command.AddInstanceMember{
+		InstanceID: instanceID,
+		UserID:     userID,
+		Roles:      roles,
+	}
+}
+
+func createAdministratorOrganizationToCommand(req *internal_permission.ResourceType_OrganizationId, userID string, roles []string) *command.AddOrgMember {
+	return &command.AddOrgMember{
+		OrgID:  req.OrganizationId,
+		UserID: userID,
+		Roles:  roles,
+	}
+}
+
+func createAdministratorProjectToCommand(req *internal_permission.ResourceType_ProjectId, userID string, roles []string) *command.AddProjectMember {
+	return &command.AddProjectMember{
+		ProjectID: req.ProjectId,
+		UserID:    userID,
+		Roles:     roles,
+	}
+}
+
+func createAdministratorProjectGrantToCommand(req *internal_permission.ResourceType_ProjectGrant_, userID string, roles []string) *command.AddProjectGrantMember {
+	return &command.AddProjectGrantMember{
+		GrantID:   req.ProjectGrant.ProjectGrantId,
+		ProjectID: req.ProjectGrant.ProjectId,
+		UserID:    userID,
+		Roles:     roles,
+	}
+}
+
+func (s *Server) UpdateAdministrator(ctx context.Context, req *connect.Request[internal_permission.UpdateAdministratorRequest]) (*connect.Response[internal_permission.UpdateAdministratorResponse], error) {
+	var changeDate *timestamppb.Timestamp
+
+	switch resource := req.Msg.GetResource().GetResource().(type) {
+	case *internal_permission.ResourceType_Instance:
+		if resource.Instance {
+			member, err := s.command.ChangeInstanceMember(ctx, updateAdministratorInstanceToCommand(authz.GetInstance(ctx).InstanceID(), req.Msg.UserId, req.Msg.Roles))
+			if err != nil {
+				return nil, err
+			}
+			if !member.EventDate.IsZero() {
+				changeDate = timestamppb.New(member.EventDate)
+			}
+		}
+	case *internal_permission.ResourceType_OrganizationId:
+		member, err := s.command.ChangeOrgMember(ctx, updateAdministratorOrganizationToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			changeDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectId:
+		member, err := s.command.ChangeProjectMember(ctx, updateAdministratorProjectToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			changeDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectGrant_:
+		member, err := s.command.ChangeProjectGrantMember(ctx, updateAdministratorProjectGrantToCommand(resource, req.Msg.UserId, req.Msg.Roles))
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			changeDate = timestamppb.New(member.EventDate)
+		}
+	default:
+		return nil, zerrors.ThrowInvalidArgument(nil, "ADMIN-i0V2IbdloZ", "Errors.Invalid.Argument")
+	}
+
+	return connect.NewResponse(&internal_permission.UpdateAdministratorResponse{
+		ChangeDate: changeDate,
+	}), nil
+}
+
+func updateAdministratorInstanceToCommand(instanceID, userID string, roles []string) *command.ChangeInstanceMember {
+	return &command.ChangeInstanceMember{
+		InstanceID: instanceID,
+		UserID:     userID,
+		Roles:      roles,
+	}
+}
+
+func updateAdministratorOrganizationToCommand(req *internal_permission.ResourceType_OrganizationId, userID string, roles []string) *command.ChangeOrgMember {
+	return &command.ChangeOrgMember{
+		OrgID:  req.OrganizationId,
+		UserID: userID,
+		Roles:  roles,
+	}
+}
+
+func updateAdministratorProjectToCommand(req *internal_permission.ResourceType_ProjectId, userID string, roles []string) *command.ChangeProjectMember {
+	return &command.ChangeProjectMember{
+		ProjectID: req.ProjectId,
+		UserID:    userID,
+		Roles:     roles,
+	}
+}
+
+func updateAdministratorProjectGrantToCommand(req *internal_permission.ResourceType_ProjectGrant_, userID string, roles []string) *command.ChangeProjectGrantMember {
+	return &command.ChangeProjectGrantMember{
+		GrantID:   req.ProjectGrant.ProjectGrantId,
+		ProjectID: req.ProjectGrant.ProjectId,
+		UserID:    userID,
+		Roles:     roles,
+	}
+}
+
+func (s *Server) DeleteAdministrator(ctx context.Context, req *connect.Request[internal_permission.DeleteAdministratorRequest]) (*connect.Response[internal_permission.DeleteAdministratorResponse], error) {
+	var deletionDate *timestamppb.Timestamp
+
+	switch resource := req.Msg.GetResource().GetResource().(type) {
+	case *internal_permission.ResourceType_Instance:
+		if resource.Instance {
+			member, err := s.command.RemoveInstanceMember(ctx, authz.GetInstance(ctx).InstanceID(), req.Msg.UserId)
+			if err != nil {
+				return nil, err
+			}
+			if !member.EventDate.IsZero() {
+				deletionDate = timestamppb.New(member.EventDate)
+			}
+		}
+	case *internal_permission.ResourceType_OrganizationId:
+		member, err := s.command.RemoveOrgMember(ctx, resource.OrganizationId, req.Msg.UserId)
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			deletionDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectId:
+		member, err := s.command.RemoveProjectMember(ctx, resource.ProjectId, req.Msg.UserId, "")
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			deletionDate = timestamppb.New(member.EventDate)
+		}
+	case *internal_permission.ResourceType_ProjectGrant_:
+		member, err := s.command.RemoveProjectGrantMember(ctx, resource.ProjectGrant.ProjectId, req.Msg.UserId, resource.ProjectGrant.ProjectGrantId)
+		if err != nil {
+			return nil, err
+		}
+		if !member.EventDate.IsZero() {
+			deletionDate = timestamppb.New(member.EventDate)
+		}
+	default:
+		return nil, zerrors.ThrowInvalidArgument(nil, "ADMIN-3UOjLtuohh", "Errors.Invalid.Argument")
+	}
+
+	return connect.NewResponse(&internal_permission.DeleteAdministratorResponse{
+		DeletionDate: deletionDate,
+	}), nil
+}

internal/api/grpc/internal_permission/v2beta/integration/server_test.go

@@ -0,0 +1,63 @@
+//go:build integration
+
+package project_test
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/muhlemmer/gu"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/integration"
+	"github.com/zitadel/zitadel/pkg/grpc/feature/v2"
+)
+
+var (
+	CTX                  context.Context
+	instance             *integration.Instance
+	instancePermissionV2 *integration.Instance
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(func() int {
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+		defer cancel()
+		CTX = ctx
+		instance = integration.NewInstance(ctx)
+		instancePermissionV2 = integration.NewInstance(CTX)
+		return m.Run()
+	}())
+}
+
+func ensureFeaturePermissionV2Enabled(t *testing.T, instance *integration.Instance) {
+	ctx := instance.WithAuthorization(CTX, integration.UserTypeIAMOwner)
+	f, err := instance.Client.FeatureV2.GetInstanceFeatures(ctx, &feature.GetInstanceFeaturesRequest{
+		Inheritance: true,
+	})
+	require.NoError(t, err)
+	if f.PermissionCheckV2.GetEnabled() {
+		return
+	}
+	_, err = instance.Client.FeatureV2.SetInstanceFeatures(ctx, &feature.SetInstanceFeaturesRequest{
+		PermissionCheckV2: gu.Ptr(true),
+	})
+	require.NoError(t, err)
+	retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, 5*time.Minute)
+	require.EventuallyWithT(t,
+		func(ttt *assert.CollectT) {
+			f, err := instance.Client.FeatureV2.GetInstanceFeatures(ctx, &feature.GetInstanceFeaturesRequest{
+				Inheritance: true,
+			})
+			assert.NoError(ttt, err)
+			if f.PermissionCheckV2.GetEnabled() {
+				return
+			}
+		},
+		retryDuration,
+		tick,
+		"timed out waiting for ensuring instance feature")
+}

internal/api/grpc/internal_permission/v2beta/query.go

@@ -0,0 +1,192 @@
+package internal_permission
+
+import (
+	"context"
+
+	"connectrpc.com/connect"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	filter "github.com/zitadel/zitadel/internal/api/grpc/filter/v2beta"
+	"github.com/zitadel/zitadel/internal/query"
+	"github.com/zitadel/zitadel/internal/zerrors"
+	filter_pb "github.com/zitadel/zitadel/pkg/grpc/filter/v2beta"
+	internal_permission "github.com/zitadel/zitadel/pkg/grpc/internal_permission/v2beta"
+)
+
+func (s *Server) ListAdministrators(ctx context.Context, req *connect.Request[internal_permission.ListAdministratorsRequest]) (*connect.Response[internal_permission.ListAdministratorsResponse], error) {
+	queries, err := s.listAdministratorsRequestToModel(req.Msg)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := s.query.SearchAdministrators(ctx, queries, s.checkPermission)
+	if err != nil {
+		return nil, err
+	}
+	return connect.NewResponse(&internal_permission.ListAdministratorsResponse{
+		Administrators: administratorsToPb(resp.Administrators),
+		Pagination:     filter.QueryToPaginationPb(queries.SearchRequest, resp.SearchResponse),
+	}), nil
+}
+
+func (s *Server) listAdministratorsRequestToModel(req *internal_permission.ListAdministratorsRequest) (*query.MembershipSearchQuery, error) {
+	offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
+	if err != nil {
+		return nil, err
+	}
+	queries, err := administratorSearchFiltersToQuery(req.Filters)
+	if err != nil {
+		return nil, err
+	}
+	return &query.MembershipSearchQuery{
+		SearchRequest: query.SearchRequest{
+			Offset:        offset,
+			Limit:         limit,
+			Asc:           asc,
+			SortingColumn: administratorFieldNameToSortingColumn(req.GetSortingColumn()),
+		},
+		Queries: queries,
+	}, nil
+}
+
+func administratorFieldNameToSortingColumn(field internal_permission.AdministratorFieldName) query.Column {
+	switch field {
+	case internal_permission.AdministratorFieldName_ADMINISTRATOR_FIELD_NAME_CREATION_DATE:
+		return query.MembershipCreationDate
+	case internal_permission.AdministratorFieldName_ADMINISTRATOR_FIELD_NAME_USER_ID:
+		return query.MembershipUserID
+	case internal_permission.AdministratorFieldName_ADMINISTRATOR_FIELD_NAME_CHANGE_DATE:
+		return query.MembershipChangeDate
+	case internal_permission.AdministratorFieldName_ADMINISTRATOR_FIELD_NAME_UNSPECIFIED:
+		return query.MembershipCreationDate
+	default:
+		return query.MembershipCreationDate
+	}
+}
+
+func administratorSearchFiltersToQuery(queries []*internal_permission.AdministratorSearchFilter) (_ []query.SearchQuery, err error) {
+	q := make([]query.SearchQuery, len(queries))
+	for i, qry := range queries {
+		q[i], err = administratorFilterToModel(qry)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return q, nil
+}
+
+func administratorFilterToModel(filter *internal_permission.AdministratorSearchFilter) (query.SearchQuery, error) {
+	switch q := filter.Filter.(type) {
+	case *internal_permission.AdministratorSearchFilter_InUserIdsFilter:
+		return inUserIDsFilterToQuery(q.InUserIdsFilter)
+	case *internal_permission.AdministratorSearchFilter_CreationDate:
+		return creationDateFilterToQuery(q.CreationDate)
+	case *internal_permission.AdministratorSearchFilter_ChangeDate:
+		return changeDateFilterToQuery(q.ChangeDate)
+	case *internal_permission.AdministratorSearchFilter_UserOrganizationId:
+		return userResourceOwnerFilterToQuery(q.UserOrganizationId)
+	case *internal_permission.AdministratorSearchFilter_UserPreferredLoginName:
+		return userLoginNameFilterToQuery(q.UserPreferredLoginName)
+	case *internal_permission.AdministratorSearchFilter_UserDisplayName:
+		return userDisplayNameFilterToQuery(q.UserDisplayName)
+	case *internal_permission.AdministratorSearchFilter_Resource:
+		return resourceFilterToQuery(q.Resource)
+	default:
+		return nil, zerrors.ThrowInvalidArgument(nil, "ORG-vR9nC", "List.Query.Invalid")
+	}
+}
+
+func inUserIDsFilterToQuery(q *filter_pb.InIDsFilter) (query.SearchQuery, error) {
+	return query.NewMemberInUserIDsSearchQuery(q.GetIds())
+}
+
+func userResourceOwnerFilterToQuery(q *filter_pb.IDFilter) (query.SearchQuery, error) {
+	return query.NewAdministratorUserResourceOwnerSearchQuery(q.GetId())
+}
+
+func userLoginNameFilterToQuery(q *internal_permission.UserPreferredLoginNameFilter) (query.SearchQuery, error) {
+	return query.NewAdministratorUserLoginNameSearchQuery(q.GetPreferredLoginName())
+}
+
+func userDisplayNameFilterToQuery(q *internal_permission.UserDisplayNameFilter) (query.SearchQuery, error) {
+	return query.NewAdministratorUserDisplayNameSearchQuery(q.GetDisplayName())
+}
+
+func creationDateFilterToQuery(q *filter_pb.TimestampFilter) (query.SearchQuery, error) {
+	return query.NewMembershipCreationDateQuery(q.GetTimestamp().AsTime(), filter.TimestampMethodPbToQuery(q.Method))
+}
+
+func changeDateFilterToQuery(q *filter_pb.TimestampFilter) (query.SearchQuery, error) {
+	return query.NewMembershipChangeDateQuery(q.GetTimestamp().AsTime(), filter.TimestampMethodPbToQuery(q.Method))
+}
+
+func resourceFilterToQuery(q *internal_permission.ResourceFilter) (query.SearchQuery, error) {
+	switch q.GetResource().(type) {
+	case *internal_permission.ResourceFilter_Instance:
+		if q.GetInstance() {
+			return query.NewMembershipIsIAMQuery()
+		}
+	case *internal_permission.ResourceFilter_OrganizationId:
+		return query.NewMembershipOrgIDQuery(q.GetOrganizationId())
+	case *internal_permission.ResourceFilter_ProjectId:
+		return query.NewMembershipProjectIDQuery(q.GetProjectId())
+	case *internal_permission.ResourceFilter_ProjectGrantId:
+		return query.NewMembershipProjectGrantIDQuery(q.GetProjectGrantId())
+	}
+	return nil, nil
+}
+
+func administratorsToPb(administrators []*query.Administrator) []*internal_permission.Administrator {
+	a := make([]*internal_permission.Administrator, len(administrators))
+	for i, admin := range administrators {
+		a[i] = administratorToPb(admin)
+	}
+	return a
+}
+
+func administratorToPb(admin *query.Administrator) *internal_permission.Administrator {
+	var resource internal_permission.Resource
+	if admin.Instance != nil {
+		resource = &internal_permission.Administrator_Instance{Instance: true}
+	}
+	if admin.Org != nil {
+		resource = &internal_permission.Administrator_Organization{
+			Organization: &internal_permission.Organization{
+				Id:   admin.Org.OrgID,
+				Name: admin.Org.Name,
+			},
+		}
+	}
+	if admin.Project != nil {
+		resource = &internal_permission.Administrator_Project{
+			Project: &internal_permission.Project{
+				Id:             admin.Project.ProjectID,
+				Name:           admin.Project.Name,
+				OrganizationId: admin.Project.ResourceOwner,
+			},
+		}
+	}
+	if admin.ProjectGrant != nil {
+		resource = &internal_permission.Administrator_ProjectGrant{
+			ProjectGrant: &internal_permission.ProjectGrant{
+				Id:                    admin.ProjectGrant.GrantID,
+				ProjectId:             admin.ProjectGrant.ProjectID,
+				ProjectName:           admin.ProjectGrant.ProjectName,
+				OrganizationId:        admin.ProjectGrant.ResourceOwner,
+				GrantedOrganizationId: admin.ProjectGrant.GrantedOrgID,
+			},
+		}
+	}
+
+	return &internal_permission.Administrator{
+		CreationDate: timestamppb.New(admin.CreationDate),
+		ChangeDate:   timestamppb.New(admin.ChangeDate),
+		User: &internal_permission.User{
+			Id:                 admin.User.UserID,
+			PreferredLoginName: admin.User.LoginName,
+			DisplayName:        admin.User.DisplayName,
+			OrganizationId:     admin.User.ResourceOwner,
+		},
+		Resource: resource,
+		Roles:    admin.Roles,
+	}
+}

internal/api/grpc/internal_permission/v2beta/server.go

@@ -0,0 +1,66 @@
+package internal_permission
+
+import (
+	"net/http"
+
+	"connectrpc.com/connect"
+	"google.golang.org/protobuf/reflect/protoreflect"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/api/grpc/server"
+	"github.com/zitadel/zitadel/internal/command"
+	"github.com/zitadel/zitadel/internal/config/systemdefaults"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/query"
+	internal_permission "github.com/zitadel/zitadel/pkg/grpc/internal_permission/v2beta"
+	"github.com/zitadel/zitadel/pkg/grpc/internal_permission/v2beta/internal_permissionconnect"
+)
+
+var _ internal_permissionconnect.InternalPermissionServiceHandler = (*Server)(nil)
+
+type Server struct {
+	systemDefaults  systemdefaults.SystemDefaults
+	command         *command.Commands
+	query           *query.Queries
+	checkPermission domain.PermissionCheck
+}
+
+type Config struct{}
+
+func CreateServer(
+	systemDefaults systemdefaults.SystemDefaults,
+	command *command.Commands,
+	query *query.Queries,
+	checkPermission domain.PermissionCheck,
+) *Server {
+	return &Server{
+		systemDefaults:  systemDefaults,
+		command:         command,
+		query:           query,
+		checkPermission: checkPermission,
+	}
+}
+
+func (s *Server) RegisterConnectServer(interceptors ...connect.Interceptor) (string, http.Handler) {
+	return internal_permissionconnect.NewInternalPermissionServiceHandler(s, connect.WithInterceptors(interceptors...))
+}
+
+func (s *Server) FileDescriptor() protoreflect.FileDescriptor {
+	return internal_permission.File_zitadel_internal_permission_v2beta_internal_permission_service_proto
+}
+
+func (s *Server) AppName() string {
+	return internal_permission.InternalPermissionService_ServiceDesc.ServiceName
+}
+
+func (s *Server) MethodPrefix() string {
+	return internal_permission.InternalPermissionService_ServiceDesc.ServiceName
+}
+
+func (s *Server) AuthMethods() authz.MethodMapping {
+	return internal_permission.InternalPermissionService_AuthMethods
+}
+
+func (s *Server) RegisterGateway() server.RegisterGatewayFunc {
+	return internal_permission.RegisterInternalPermissionServiceHandler
+}