feat: multiple domains (#188)

* check uniqueness on create and register user

* change user email, reserve release unique email

* usergrant unique aggregate

* usergrant uniqueness

* validate UserGrant

* fix tests

* domain is set on username in all orgs

* domain in admin

* org domain sql

* zitadel domain org name

* org domains

* org iam policy

* default org iam policy

* SETUP

* load login names

* login by login name

* login name

* fix: merge master

* fix: merge master

* Update internal/user/repository/eventsourcing/user.go

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* fix: fix unique domains

* fix: rename env variable

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
Co-authored-by: Livio Amstutz <livio.a@gmail.com>

internal/management/repository/eventsourcing/eventstore/org.go

@@ -2,16 +2,15 @@ package eventstore
 
 import (
 	"context"
-	"strings"
-
 	"github.com/caos/zitadel/internal/api/auth"
-	"github.com/caos/zitadel/internal/model"
+	global_model "github.com/caos/zitadel/internal/model"
+	"github.com/caos/zitadel/internal/org/repository/view/model"
+	"strings"
 
 	"github.com/caos/zitadel/internal/errors"
 	mgmt_view "github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
 	org_model "github.com/caos/zitadel/internal/org/model"
 	org_es "github.com/caos/zitadel/internal/org/repository/eventsourcing"
-	"github.com/caos/zitadel/internal/org/repository/view"
 )
 
 type OrgRepository struct {
@@ -26,12 +25,12 @@ func (repo *OrgRepository) OrgByID(ctx context.Context, id string) (*org_model.O
 	return repo.OrgEventstore.OrgByID(ctx, org)
 }
 
-func (repo *OrgRepository) OrgByDomainGlobal(ctx context.Context, domain string) (*org_model.OrgView, error) {
-	org, err := repo.View.OrgByDomain(domain)
+func (repo *OrgRepository) OrgByDomainGlobal(ctx context.Context, domain string) (*org_model.Org, error) {
+	verifiedDomain, err := repo.View.VerifiedOrgDomain(domain)
 	if err != nil {
 		return nil, err
 	}
-	return view.OrgToModel(org), nil
+	return repo.OrgByID(ctx, verifiedDomain.OrgID)
 }
 
 func (repo *OrgRepository) UpdateOrg(ctx context.Context, org *org_model.Org) (*org_model.Org, error) {
@@ -46,6 +45,31 @@ func (repo *OrgRepository) ReactivateOrg(ctx context.Context, id string) (*org_m
 	return repo.OrgEventstore.ReactivateOrg(ctx, id)
 }
 
+func (repo *OrgRepository) SearchMyOrgDomains(ctx context.Context, request *org_model.OrgDomainSearchRequest) (*org_model.OrgDomainSearchResponse, error) {
+	request.EnsureLimit(repo.SearchLimit)
+	request.Queries = append(request.Queries, &org_model.OrgDomainSearchQuery{Key: org_model.ORGDOMAINSEARCHKEY_ORG_ID, Method: global_model.SEARCHMETHOD_EQUALS, Value: auth.GetCtxData(ctx).OrgID})
+	domains, count, err := repo.View.SearchOrgDomains(request)
+	if err != nil {
+		return nil, err
+	}
+	return &org_model.OrgDomainSearchResponse{
+		Offset:      request.Offset,
+		Limit:       request.Limit,
+		TotalResult: uint64(count),
+		Result:      model.OrgDomainsToModel(domains),
+	}, nil
+}
+
+func (repo *OrgRepository) AddMyOrgDomain(ctx context.Context, domain *org_model.OrgDomain) (*org_model.OrgDomain, error) {
+	domain.AggregateID = auth.GetCtxData(ctx).OrgID
+	return repo.OrgEventstore.AddOrgDomain(ctx, domain)
+}
+
+func (repo *OrgRepository) RemoveMyOrgDomain(ctx context.Context, domain string) error {
+	d := org_model.NewOrgDomain(auth.GetCtxData(ctx).OrgID, domain)
+	return repo.OrgEventstore.RemoveOrgDomain(ctx, d)
+}
+
 func (repo *OrgRepository) OrgChanges(ctx context.Context, id string, lastSequence uint64, limit uint64) (*org_model.OrgChanges, error) {
 	changes, err := repo.OrgEventstore.OrgChanges(ctx, id, lastSequence, limit)
 	if err != nil {
@@ -76,7 +100,7 @@ func (repo *OrgRepository) RemoveMyOrgMember(ctx context.Context, userID string)
 
 func (repo *OrgRepository) SearchMyOrgMembers(ctx context.Context, request *org_model.OrgMemberSearchRequest) (*org_model.OrgMemberSearchResponse, error) {
 	request.EnsureLimit(repo.SearchLimit)
-	request.Queries[len(request.Queries)-1] = &org_model.OrgMemberSearchQuery{Key: org_model.ORGMEMBERSEARCHKEY_ORG_ID, Method: model.SEARCHMETHOD_EQUALS, Value: auth.GetCtxData(ctx).OrgID}
+	request.Queries[len(request.Queries)-1] = &org_model.OrgMemberSearchQuery{Key: org_model.ORGMEMBERSEARCHKEY_ORG_ID, Method: global_model.SEARCHMETHOD_EQUALS, Value: auth.GetCtxData(ctx).OrgID}
 	members, count, err := repo.View.SearchOrgMembers(request)
 	if err != nil {
 		return nil, err
@@ -85,7 +109,7 @@ func (repo *OrgRepository) SearchMyOrgMembers(ctx context.Context, request *org_
 		Offset:      request.Offset,
 		Limit:       request.Limit,
 		TotalResult: uint64(count),
-		Result:      view.OrgMembersToModel(members),
+		Result:      model.OrgMembersToModel(members),
 	}, nil
 }
 

internal/management/repository/eventsourcing/eventstore/user.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/caos/zitadel/internal/api/auth"
 	"github.com/caos/zitadel/internal/management/repository/eventsourcing/view"
+	org_event "github.com/caos/zitadel/internal/org/repository/eventsourcing"
 	policy_event "github.com/caos/zitadel/internal/policy/repository/eventsourcing"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	usr_event "github.com/caos/zitadel/internal/user/repository/eventsourcing"
@@ -15,6 +16,7 @@ type UserRepo struct {
 	SearchLimit  uint64
 	UserEvents   *usr_event.UserEventstore
 	PolicyEvents *policy_event.PolicyEventstore
+	OrgEvents    *org_event.OrgEventstore
 	View         *view.View
 }
 
@@ -23,11 +25,15 @@ func (repo *UserRepo) UserByID(ctx context.Context, id string) (project *usr_mod
 }
 
 func (repo *UserRepo) CreateUser(ctx context.Context, user *usr_model.User) (*usr_model.User, error) {
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	pwPolicy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, auth.GetCtxData(ctx).OrgID)
 	if err != nil {
 		return nil, err
 	}
-	return repo.UserEvents.CreateUser(ctx, user, policy)
+	orgPolicy, err := repo.OrgEvents.GetOrgIamPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	if err != nil {
+		return nil, err
+	}
+	return repo.UserEvents.CreateUser(ctx, user, pwPolicy, orgPolicy)
 }
 
 func (repo *UserRepo) RegisterUser(ctx context.Context, user *usr_model.User, resourceOwner string) (*usr_model.User, error) {
@@ -35,11 +41,15 @@ func (repo *UserRepo) RegisterUser(ctx context.Context, user *usr_model.User, re
 	if resourceOwner != "" {
 		policyResourceOwner = resourceOwner
 	}
-	policy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, policyResourceOwner)
+	pwPolicy, err := repo.PolicyEvents.GetPasswordComplexityPolicy(ctx, policyResourceOwner)
 	if err != nil {
 		return nil, err
 	}
-	return repo.UserEvents.RegisterUser(ctx, user, policy, resourceOwner)
+	orgPolicy, err := repo.OrgEvents.GetOrgIamPolicy(ctx, auth.GetCtxData(ctx).OrgID)
+	if err != nil {
+		return nil, err
+	}
+	return repo.UserEvents.RegisterUser(ctx, user, pwPolicy, orgPolicy, resourceOwner)
 }
 
 func (repo *UserRepo) DeactivateUser(ctx context.Context, id string) (*usr_model.User, error) {

internal/management/repository/eventsourcing/handler/handler.go

@@ -43,6 +43,7 @@ func Register(configs Configs, bulkLimit, errorCount uint64, view *view.View, ev
 		&UserGrant{handler: handler{view, bulkLimit, configs.cycleDuration("UserGrant"), errorCount}, projectEvents: repos.ProjectEvents, userEvents: repos.UserEvents, orgEvents: repos.OrgEvents},
 		&Org{handler: handler{view, bulkLimit, configs.cycleDuration("Org"), errorCount}},
 		&OrgMember{handler: handler{view, bulkLimit, configs.cycleDuration("OrgMember"), errorCount}, userEvents: repos.UserEvents},
+		&OrgDomain{handler: handler{view, bulkLimit, configs.cycleDuration("OrgDomain"), errorCount}},
 	}
 }
 

internal/management/repository/eventsourcing/handler/org.go

@@ -2,13 +2,13 @@ package handler
 
 import (
 	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	org_model "github.com/caos/zitadel/internal/org/repository/view/model"
 	"time"
 
 	"github.com/caos/logging"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
 	"github.com/caos/zitadel/internal/eventstore/spooler"
 	"github.com/caos/zitadel/internal/org/repository/eventsourcing"
-	"github.com/caos/zitadel/internal/org/repository/view"
 )
 
 type Org struct {
@@ -34,7 +34,7 @@ func (o *Org) EventQuery() (*es_models.SearchQuery, error) {
 }
 
 func (o *Org) Process(event *es_models.Event) error {
-	org := new(view.OrgView)
+	org := new(org_model.OrgView)
 
 	switch event.Type {
 	case model.OrgAdded:

internal/management/repository/eventsourcing/handler/org_domain.go

@@ -0,0 +1,100 @@
+package handler
+
+import (
+	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	org_model "github.com/caos/zitadel/internal/org/repository/view/model"
+	"time"
+
+	"github.com/caos/logging"
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+)
+
+type OrgDomain struct {
+	handler
+}
+
+const (
+	orgDomainTable = "management.org_domains"
+)
+
+func (d *OrgDomain) MinimumCycleDuration() time.Duration { return d.cycleDuration }
+
+func (d *OrgDomain) ViewModel() string {
+	return orgDomainTable
+}
+
+func (d *OrgDomain) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := d.view.GetLatestOrgDomainSequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.OrgAggregate).
+		LatestSequenceFilter(sequence), nil
+}
+
+func (d *OrgDomain) Process(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.OrgAggregate:
+		err = d.processOrgDomain(event)
+	}
+	return err
+}
+
+func (d *OrgDomain) processOrgDomain(event *models.Event) (err error) {
+	domain := new(org_model.OrgDomainView)
+	switch event.Type {
+	case model.OrgDomainAdded:
+		domain.AppendEvent(event)
+	case model.OrgDomainVerified:
+		err = domain.SetData(event)
+		if err != nil {
+			return err
+		}
+		domain, err = d.view.OrgDomainByOrgIDAndDomain(event.AggregateID, domain.Domain)
+		if err != nil {
+			return err
+		}
+		domain.AppendEvent(event)
+	case model.OrgDomainPrimarySet:
+		err = domain.SetData(event)
+		if err != nil {
+			return err
+		}
+		domain, err = d.view.OrgDomainByOrgIDAndDomain(event.AggregateID, domain.Domain)
+		if err != nil {
+			return err
+		}
+		existingDomains, err := d.view.OrgDomainsByOrgID(event.AggregateID)
+		if err != nil {
+			return err
+		}
+		for _, existing := range existingDomains {
+			existing.Primary = false
+			err := d.view.PutOrgDomain(existing, 0)
+			if err != nil {
+				return err
+			}
+		}
+		domain.AppendEvent(event)
+	case model.OrgDomainRemoved:
+		err = domain.SetData(event)
+		if err != nil {
+			return err
+		}
+		return d.view.DeleteOrgDomain(domain.Domain, event.Sequence)
+	default:
+		return d.view.ProcessedOrgDomainSequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return d.view.PutOrgDomain(domain, domain.Sequence)
+}
+
+func (d *OrgDomain) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-us4sj", "id", event.AggregateID).WithError(err).Warn("something went wrong in orgdomain handler")
+	return spooler.HandleError(event, err, d.view.GetLatestOrgDomainFailedEvent, d.view.ProcessedOrgDomainFailedEvent, d.view.ProcessedOrgDomainSequence, d.errorCountUntilSkip)
+}

internal/management/repository/eventsourcing/handler/org_member.go

@@ -3,13 +3,13 @@ package handler
 import (
 	"context"
 	"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
+	org_model "github.com/caos/zitadel/internal/org/repository/view/model"
 	"time"
 
 	"github.com/caos/logging"
 	"github.com/caos/zitadel/internal/eventstore/models"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
 	"github.com/caos/zitadel/internal/eventstore/spooler"
-	view_model "github.com/caos/zitadel/internal/org/repository/view"
 	usr_model "github.com/caos/zitadel/internal/user/model"
 	usr_event "github.com/caos/zitadel/internal/user/repository/eventsourcing"
 	usr_es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
@@ -51,7 +51,7 @@ func (m *OrgMember) Process(event *models.Event) (err error) {
 }
 
 func (m *OrgMember) processOrgMember(event *models.Event) (err error) {
-	member := new(view_model.OrgMemberView)
+	member := new(org_model.OrgMemberView)
 	switch event.Type {
 	case model.OrgMemberAdded:
 		member.AppendEvent(event)
@@ -106,7 +106,7 @@ func (m *OrgMember) processUser(event *models.Event) (err error) {
 	return nil
 }
 
-func (m *OrgMember) fillData(member *view_model.OrgMemberView) (err error) {
+func (m *OrgMember) fillData(member *org_model.OrgMemberView) (err error) {
 	user, err := m.userEvents.UserByID(context.Background(), member.UserID)
 	if err != nil {
 		return err
@@ -115,7 +115,7 @@ func (m *OrgMember) fillData(member *view_model.OrgMemberView) (err error) {
 	return nil
 }
 
-func (m *OrgMember) fillUserData(member *view_model.OrgMemberView, user *usr_model.User) {
+func (m *OrgMember) fillUserData(member *org_model.OrgMemberView, user *usr_model.User) {
 	member.UserName = user.UserName
 	member.FirstName = user.FirstName
 	member.LastName = user.LastName

internal/management/repository/eventsourcing/handler/project_grant.go

@@ -95,7 +95,6 @@ func (p *ProjectGrant) Process(event *models.Event) (err error) {
 }
 
 func (p *ProjectGrant) fillOrgData(grantedProject *view_model.ProjectGrantView, org *org_model.Org) {
-	grantedProject.OrgDomain = org.Domain
 	grantedProject.OrgName = org.Name
 }
 

internal/management/repository/eventsourcing/handler/user_grant.go

@@ -169,7 +169,6 @@ func (u *UserGrant) fillProjectData(grant *view_model.UserGrantView, project *pr
 }
 
 func (u *UserGrant) fillOrgData(grant *view_model.UserGrantView, org *org_model.Org) {
-	grant.OrgDomain = org.Domain
 	grant.OrgName = org.Name
 }
 

internal/management/repository/eventsourcing/repository.go

@@ -22,6 +22,7 @@ import (
 
 type Config struct {
 	SearchLimit uint64
+	Domain      string
 	Eventstore  es_int.Config
 	View        types.SQL
 	Spooler     spooler.SpoolerConfig
@@ -80,7 +81,8 @@ func Start(conf Config, systemDefaults sd.SystemDefaults, roles []string) (*EsRe
 	if err != nil {
 		return nil, err
 	}
-	org := es_org.StartOrg(es_org.OrgConfig{Eventstore: es})
+	org := es_org.StartOrg(es_org.OrgConfig{Eventstore: es, IAMDomain: conf.Domain}, systemDefaults)
+
 	iam, err := es_iam.StartIam(es_iam.IamConfig{
 		Eventstore: es,
 		Cache:      conf.Eventstore.Cache,
@@ -95,7 +97,7 @@ func Start(conf Config, systemDefaults sd.SystemDefaults, roles []string) (*EsRe
 		spooler:       spool,
 		OrgRepository: eventstore.OrgRepository{conf.SearchLimit, org, view, roles},
 		ProjectRepo:   eventstore.ProjectRepo{conf.SearchLimit, project, view, roles},
-		UserRepo:      eventstore.UserRepo{conf.SearchLimit, user, policy, view},
+		UserRepo:      eventstore.UserRepo{conf.SearchLimit, user, policy, org, view},
 		UserGrantRepo: eventstore.UserGrantRepo{conf.SearchLimit, usergrant, view},
 		PolicyRepo:    eventstore.PolicyRepo{policy},
 		IamRepository: eventstore.IamRepository{iam},

internal/management/repository/eventsourcing/view/org.go

@@ -2,6 +2,7 @@ package view
 
 import (
 	org_view "github.com/caos/zitadel/internal/org/repository/view"
+	"github.com/caos/zitadel/internal/org/repository/view/model"
 	"github.com/caos/zitadel/internal/view"
 )
 
@@ -9,15 +10,11 @@ const (
 	orgTable = "management.orgs"
 )
 
-func (v *View) OrgByID(orgID string) (*org_view.OrgView, error) {
+func (v *View) OrgByID(orgID string) (*model.OrgView, error) {
 	return org_view.OrgByID(v.Db, orgTable, orgID)
 }
 
-func (v *View) OrgByDomain(domain string) (*org_view.OrgView, error) {
-	return org_view.GetGlobalOrgByDomain(v.Db, orgTable, domain)
-}
-
-func (v *View) PutOrg(org *org_view.OrgView) error {
+func (v *View) PutOrg(org *model.OrgView) error {
 	err := org_view.PutOrg(v.Db, orgTable, org)
 	if err != nil {
 		return err

internal/management/repository/eventsourcing/view/org_domain.go

@@ -0,0 +1,63 @@
+package view
+
+import (
+	org_model "github.com/caos/zitadel/internal/org/model"
+	"github.com/caos/zitadel/internal/org/repository/view"
+	"github.com/caos/zitadel/internal/org/repository/view/model"
+	global_view "github.com/caos/zitadel/internal/view"
+)
+
+const (
+	orgDomainTable = "management.org_domains"
+)
+
+func (v *View) OrgDomainByOrgIDAndDomain(orgID, domain string) (*model.OrgDomainView, error) {
+	return view.OrgDomainByOrgIDAndDomain(v.Db, orgDomainTable, orgID, domain)
+}
+
+func (v *View) OrgDomainsByOrgID(domain string) ([]*model.OrgDomainView, error) {
+	return view.OrgDomainsByOrgID(v.Db, orgDomainTable, domain)
+}
+
+func (v *View) VerifiedOrgDomain(domain string) (*model.OrgDomainView, error) {
+	return view.VerifiedOrgDomain(v.Db, orgDomainTable, domain)
+}
+
+func (v *View) SearchOrgDomains(request *org_model.OrgDomainSearchRequest) ([]*model.OrgDomainView, int, error) {
+	return view.SearchOrgDomains(v.Db, orgDomainTable, request)
+}
+
+func (v *View) PutOrgDomain(org *model.OrgDomainView, sequence uint64) error {
+	err := view.PutOrgDomain(v.Db, orgDomainTable, org)
+	if err != nil {
+		return err
+	}
+	if sequence != 0 {
+		return v.ProcessedOrgDomainSequence(sequence)
+	}
+	return nil
+}
+
+func (v *View) DeleteOrgDomain(domain string, eventSequence uint64) error {
+	err := view.DeleteOrgDomain(v.Db, orgDomainTable, domain)
+	if err != nil {
+		return nil
+	}
+	return v.ProcessedOrgDomainSequence(eventSequence)
+}
+
+func (v *View) GetLatestOrgDomainSequence() (uint64, error) {
+	return v.latestSequence(orgDomainTable)
+}
+
+func (v *View) ProcessedOrgDomainSequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(orgDomainTable, eventSequence)
+}
+
+func (v *View) GetLatestOrgDomainFailedEvent(sequence uint64) (*global_view.FailedEvent, error) {
+	return v.latestFailedEvent(orgDomainTable, sequence)
+}
+
+func (v *View) ProcessedOrgDomainFailedEvent(failedEvent *global_view.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}

internal/management/repository/eventsourcing/view/org_member.go

@@ -3,6 +3,7 @@ package view
 import (
 	org_model "github.com/caos/zitadel/internal/org/model"
 	"github.com/caos/zitadel/internal/org/repository/view"
+	"github.com/caos/zitadel/internal/org/repository/view/model"
 	global_view "github.com/caos/zitadel/internal/view"
 )
 
@@ -10,19 +11,19 @@ const (
 	orgMemberTable = "management.org_members"
 )
 
-func (v *View) OrgMemberByIDs(orgID, userID string) (*view.OrgMemberView, error) {
+func (v *View) OrgMemberByIDs(orgID, userID string) (*model.OrgMemberView, error) {
 	return view.OrgMemberByIDs(v.Db, orgMemberTable, orgID, userID)
 }
 
-func (v *View) SearchOrgMembers(request *org_model.OrgMemberSearchRequest) ([]*view.OrgMemberView, int, error) {
+func (v *View) SearchOrgMembers(request *org_model.OrgMemberSearchRequest) ([]*model.OrgMemberView, int, error) {
 	return view.SearchOrgMembers(v.Db, orgMemberTable, request)
 }
 
-func (v *View) OrgMembersByUserID(userID string) ([]*view.OrgMemberView, error) {
+func (v *View) OrgMembersByUserID(userID string) ([]*model.OrgMemberView, error) {
 	return view.OrgMembersByUserID(v.Db, orgMemberTable, userID)
 }
 
-func (v *View) PutOrgMember(org *view.OrgMemberView, sequence uint64) error {
+func (v *View) PutOrgMember(org *model.OrgMemberView, sequence uint64) error {
 	err := view.PutOrgMember(v.Db, orgMemberTable, org)
 	if err != nil {
 		return err