mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 20:57:31 +00:00
feat: user profile requests in resource APIs (#10151)
# Which Problems Are Solved The commands for the resource based v2beta AuthorizationService API are added. Authorizations, previously knows as user grants, give a user in a specific organization and project context roles. The project can be owned or granted. The given roles can be used to restrict access within the projects applications. The commands for the resource based v2beta InteralPermissionService API are added. Administrators, previously knows as memberships, give a user in a specific organization and project context roles. The project can be owned or granted. The give roles give the user permissions to manage different resources in Zitadel. API definitions from https://github.com/zitadel/zitadel/issues/9165 are implemented. Contains endpoints for user metadata. # How the Problems Are Solved ### New Methods - CreateAuthorization - UpdateAuthorization - DeleteAuthorization - ActivateAuthorization - DeactivateAuthorization - ListAuthorizations - CreateAdministrator - UpdateAdministrator - DeleteAdministrator - ListAdministrators - SetUserMetadata to set metadata on a user - DeleteUserMetadata to delete metadata on a user - ListUserMetadata to query for metadata of a user ## Deprecated Methods ### v1.ManagementService - GetUserGrantByID - ListUserGrants - AddUserGrant - UpdateUserGrant - DeactivateUserGrant - ReactivateUserGrant - RemoveUserGrant - BulkRemoveUserGrant ### v1.AuthService - ListMyUserGrants - ListMyProjectPermissions # Additional Changes - Permission checks for metadata functionality on query and command side - correct existence checks for resources, for example you can only be an administrator on an existing project - combined all member tables to singular query for the administrators - add permission checks for command an query side functionality - combined functions on command side where necessary for easier maintainability # Additional Context Closes #9165 --------- Co-authored-by: Elio Bischof <elio@zitadel.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Livio Spring <livio.a@gmail.com>
This commit is contained in:
Stefan Benz
@@ -4,6 +4,7 @@ import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"errors"
|
||||
"slices"
|
||||
"time"
|
||||
|
||||
sq "github.com/Masterminds/squirrel"
|
||||
@@ -44,8 +45,9 @@ type UserGrant struct {
|
||||
OrgName string `json:"org_name,omitempty"`
|
||||
OrgPrimaryDomain string `json:"org_primary_domain,omitempty"`
|
||||
|
||||
ProjectID string `json:"project_id,omitempty"`
|
||||
ProjectName string `json:"project_name,omitempty"`
|
||||
ProjectResourceOwner string `json:"project_resource_owner,omitempty"`
|
||||
ProjectID string `json:"project_id,omitempty"`
|
||||
ProjectName string `json:"project_name,omitempty"`
|
||||
|
||||
GrantedOrgID string `json:"granted_org_id,omitempty"`
|
||||
GrantedOrgName string `json:"granted_org_name,omitempty"`
|
||||
@@ -57,6 +59,27 @@ type UserGrants struct {
|
||||
UserGrants []*UserGrant
|
||||
}
|
||||
|
||||
func userGrantsCheckPermission(ctx context.Context, grants *UserGrants, permissionCheck domain.PermissionCheck) {
|
||||
grants.UserGrants = slices.DeleteFunc(grants.UserGrants,
|
||||
func(grant *UserGrant) bool {
|
||||
return userGrantCheckPermission(ctx, grant.ResourceOwner, grant.ProjectID, grant.GrantID, grant.UserID, permissionCheck) != nil
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
func userGrantCheckPermission(ctx context.Context, resourceOwner, projectID, grantID, userID string, permissionCheck domain.PermissionCheck) error {
|
||||
// you should always be able to read your own permissions
|
||||
if authz.GetCtxData(ctx).UserID == userID {
|
||||
return nil
|
||||
}
|
||||
// check permission on the project grant
|
||||
if grantID != "" {
|
||||
return permissionCheck(ctx, domain.PermissionUserGrantRead, resourceOwner, grantID)
|
||||
}
|
||||
// check on project
|
||||
return permissionCheck(ctx, domain.PermissionUserGrantRead, resourceOwner, projectID)
|
||||
}
|
||||
|
||||
type UserGrantsQueries struct {
|
||||
SearchRequest
|
||||
Queries []SearchQuery
|
||||
@@ -70,6 +93,21 @@ func (q *UserGrantsQueries) toQuery(query sq.SelectBuilder) sq.SelectBuilder {
|
||||
return query
|
||||
}
|
||||
|
||||
func userGrantPermissionCheckV2(ctx context.Context, query sq.SelectBuilder, enabled bool, queries *UserGrantsQueries) sq.SelectBuilder {
|
||||
if !enabled {
|
||||
return query
|
||||
}
|
||||
join, args := PermissionClause(
|
||||
ctx,
|
||||
UserGrantResourceOwner,
|
||||
domain.PermissionUserGrantRead,
|
||||
SingleOrgPermissionOption(queries.Queries),
|
||||
WithProjectsPermissionOption(UserGrantProjectID),
|
||||
OwnedRowsPermissionOption(UserGrantUserID),
|
||||
)
|
||||
return query.JoinClause(join, args...)
|
||||
}
|
||||
|
||||
func NewUserGrantUserIDSearchQuery(id string) (SearchQuery, error) {
|
||||
return NewTextQuery(UserGrantUserID, id, TextEquals)
|
||||
}
|
||||
@@ -86,6 +124,10 @@ func NewUserGrantResourceOwnerSearchQuery(id string) (SearchQuery, error) {
|
||||
return NewTextQuery(UserGrantResourceOwner, id, TextEquals)
|
||||
}
|
||||
|
||||
func NewUserGrantUserResourceOwnerSearchQuery(id string) (SearchQuery, error) {
|
||||
return NewTextQuery(UserResourceOwnerCol, id, TextEquals)
|
||||
}
|
||||
|
||||
func NewUserGrantGrantIDSearchQuery(id string) (SearchQuery, error) {
|
||||
return NewTextQuery(UserGrantGrantID, id, TextEquals)
|
||||
}
|
||||
@@ -94,6 +136,14 @@ func NewUserGrantIDSearchQuery(id string) (SearchQuery, error) {
|
||||
return NewTextQuery(UserGrantID, id, TextEquals)
|
||||
}
|
||||
|
||||
func NewUserGrantInIDsSearchQuery(ids []string) (SearchQuery, error) {
|
||||
list := make([]interface{}, len(ids))
|
||||
for i, value := range ids {
|
||||
list[i] = value
|
||||
}
|
||||
return NewListQuery(UserGrantID, list, ListIn)
|
||||
}
|
||||
|
||||
func NewUserGrantUserTypeQuery(typ domain.UserType) (SearchQuery, error) {
|
||||
return NewNumberQuery(UserTypeCol, typ, NumberEquals)
|
||||
}
|
||||
@@ -254,7 +304,19 @@ func (q *Queries) UserGrant(ctx context.Context, shouldTriggerBulk bool, queries
|
||||
return grant, err
|
||||
}
|
||||
|
||||
func (q *Queries) UserGrants(ctx context.Context, queries *UserGrantsQueries, shouldTriggerBulk bool) (grants *UserGrants, err error) {
|
||||
func (q *Queries) UserGrants(ctx context.Context, queries *UserGrantsQueries, shouldTriggerBulk bool, permissionCheck domain.PermissionCheck) (*UserGrants, error) {
|
||||
permissionCheckV2 := PermissionV2(ctx, permissionCheck)
|
||||
grants, err := q.userGrants(ctx, queries, shouldTriggerBulk, permissionCheckV2)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if permissionCheck != nil && !authz.GetFeatures(ctx).PermissionCheckV2 {
|
||||
userGrantsCheckPermission(ctx, grants, permissionCheck)
|
||||
}
|
||||
return grants, nil
|
||||
}
|
||||
|
||||
func (q *Queries) userGrants(ctx context.Context, queries *UserGrantsQueries, shouldTriggerBulk bool, permissionCheckV2 bool) (grants *UserGrants, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -266,6 +328,7 @@ func (q *Queries) UserGrants(ctx context.Context, queries *UserGrantsQueries, sh
|
||||
}
|
||||
|
||||
query, scan := prepareUserGrantsQuery()
|
||||
query = userGrantPermissionCheckV2(ctx, query, permissionCheckV2, queries)
|
||||
eq := sq.Eq{UserGrantInstanceID.identifier(): authz.GetInstance(ctx).InstanceID()}
|
||||
stmt, args, err := queries.toQuery(query).Where(eq).ToSql()
|
||||
if err != nil {
|
||||
@@ -316,6 +379,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
|
||||
|
||||
UserGrantProjectID.identifier(),
|
||||
ProjectColumnName.identifier(),
|
||||
ProjectColumnResourceOwner.identifier(),
|
||||
|
||||
GrantedOrgColumnId.identifier(),
|
||||
GrantedOrgColumnName.identifier(),
|
||||
@@ -326,7 +390,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
|
||||
LeftJoin(join(HumanUserIDCol, UserGrantUserID)).
|
||||
LeftJoin(join(OrgColumnID, UserGrantResourceOwner)).
|
||||
LeftJoin(join(ProjectColumnID, UserGrantProjectID)).
|
||||
LeftJoin(join(GrantedOrgColumnId, UserResourceOwnerCol)).
|
||||
LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
|
||||
LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
|
||||
LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
|
||||
Where(
|
||||
sq.Eq{LoginNameIsPrimaryCol.identifier(): true},
|
||||
@@ -348,7 +413,8 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
|
||||
orgName sql.NullString
|
||||
orgDomain sql.NullString
|
||||
|
||||
projectName sql.NullString
|
||||
projectName sql.NullString
|
||||
projectResourceOwner sql.NullString
|
||||
|
||||
grantedOrgID sql.NullString
|
||||
grantedOrgName sql.NullString
|
||||
@@ -381,6 +447,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
|
||||
|
||||
&g.ProjectID,
|
||||
&projectName,
|
||||
&projectResourceOwner,
|
||||
|
||||
&grantedOrgID,
|
||||
&grantedOrgName,
|
||||
@@ -405,6 +472,7 @@ func prepareUserGrantQuery() (sq.SelectBuilder, func(*sql.Row) (*UserGrant, erro
|
||||
g.OrgName = orgName.String
|
||||
g.OrgPrimaryDomain = orgDomain.String
|
||||
g.ProjectName = projectName.String
|
||||
g.ProjectResourceOwner = projectResourceOwner.String
|
||||
g.GrantedOrgID = grantedOrgID.String
|
||||
g.GrantedOrgName = grantedOrgName.String
|
||||
g.GrantedOrgDomain = grantedOrgDomain.String
|
||||
@@ -439,6 +507,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
|
||||
|
||||
UserGrantProjectID.identifier(),
|
||||
ProjectColumnName.identifier(),
|
||||
ProjectColumnResourceOwner.identifier(),
|
||||
|
||||
GrantedOrgColumnId.identifier(),
|
||||
GrantedOrgColumnName.identifier(),
|
||||
@@ -451,7 +520,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
|
||||
LeftJoin(join(HumanUserIDCol, UserGrantUserID)).
|
||||
LeftJoin(join(OrgColumnID, UserGrantResourceOwner)).
|
||||
LeftJoin(join(ProjectColumnID, UserGrantProjectID)).
|
||||
LeftJoin(join(GrantedOrgColumnId, UserResourceOwnerCol)).
|
||||
LeftJoin(join(ProjectGrantColumnGrantID, UserGrantGrantID) + " AND " + ProjectGrantColumnProjectID.identifier() + " = " + UserGrantProjectID.identifier()).
|
||||
LeftJoin(join(GrantedOrgColumnId, ProjectGrantColumnGrantedOrgID)).
|
||||
LeftJoin(join(LoginNameUserIDCol, UserGrantUserID)).
|
||||
Where(
|
||||
sq.Eq{LoginNameIsPrimaryCol.identifier(): true},
|
||||
@@ -480,7 +550,8 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
|
||||
grantedOrgName sql.NullString
|
||||
grantedOrgDomain sql.NullString
|
||||
|
||||
projectName sql.NullString
|
||||
projectName sql.NullString
|
||||
projectResourceOwner sql.NullString
|
||||
)
|
||||
|
||||
err := rows.Scan(
|
||||
@@ -509,6 +580,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
|
||||
|
||||
&g.ProjectID,
|
||||
&projectName,
|
||||
&projectResourceOwner,
|
||||
|
||||
&grantedOrgID,
|
||||
&grantedOrgName,
|
||||
@@ -532,6 +604,7 @@ func prepareUserGrantsQuery() (sq.SelectBuilder, func(*sql.Rows) (*UserGrants, e
|
||||
g.OrgName = orgName.String
|
||||
g.OrgPrimaryDomain = orgDomain.String
|
||||
g.ProjectName = projectName.String
|
||||
g.ProjectResourceOwner = projectResourceOwner.String
|
||||
g.GrantedOrgID = grantedOrgID.String
|
||||
g.GrantedOrgName = grantedOrgName.String
|
||||
g.GrantedOrgDomain = grantedOrgDomain.String
|
||||
|
||||
Reference in New Issue
Block a user