feat: handle instance from context (#3382)

* commander * commander * selber! * move to packages * fix(errors): implement Is interface * test: command * test: commands * add init steps * setup tenant * add default step yaml * possibility to set password * merge v2 into v2-commander * fix: rename iam command side to instance * fix: rename iam command side to instance * fix: rename iam command side to instance * fix: rename iam command side to instance * fix: search query builder can filter events in memory * fix: filters for add member * fix(setup): add `ExternalSecure` to config * chore: name iam to instance * fix: matching * remove unsued func * base url * base url * test(command): filter funcs * test: commands * fix: rename orgiampolicy to domain policy * start from init * commands * config * fix indexes and add constraints * fixes * fix: merge conflicts * fix: protos * fix: md files * setup * add deprecated org iam policy again * typo * fix search query * fix filter * Apply suggestions from code review * remove custom org from org setup * add todos for verification * change apps creation * simplify package structure * fix error * move preparation helper for tests * fix unique constraints * fix config mapping in setup * fix error handling in encryption_keys.go * fix projection config * fix query from old views to projection * fix setup of mgmt api * set iam project and fix instance projection * fix tokens view * fix steps.yaml and defaults.yaml * fix projections * change instance context to interface * instance interceptors and additional events in setup * cleanup * tests for interceptors * fix label policy * add todo * single api endpoint in environment.json Co-authored-by: adlerhurst <silvan.reusser@gmail.com> Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>
2025-08-12 03:57:32 +00:00 · 2022-03-29 11:53:19 +02:00
parent c5b99274d7
commit 958362e6c9
101 changed files with 1520 additions and 274 deletions
--- a/internal/api/grpc/auth/user.go
+++ b/internal/api/grpc/auth/user.go
@@ -152,14 +152,10 @@ func (s *Server) ListMyProjectOrgs(ctx context.Context, req *auth_pb.ListMyProje
 		return nil, err
 	}

-	iam, err := s.query.Instance(ctx)
-	if err != nil {
-		return nil, err
-	}
 	ctxData := authz.GetCtxData(ctx)

 	//client of user is not in project of ZITADEL
-	if ctxData.ProjectID != iam.IAMProjectID {
+	if ctxData.ProjectID != authz.GetInstance(ctx).ProjectID() {
 		userGrantProjectID, err := query.NewUserGrantProjectIDSearchQuery(ctxData.ProjectID)
 		if err != nil {
 			return nil, err
--- a/internal/api/grpc/server/middleware/instance_interceptor.go
+++ b/internal/api/grpc/server/middleware/instance_interceptor.go
@@ -0,0 +1,50 @@
+package middleware
+
+import (
+	"context"
+	"fmt"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/caos/zitadel/internal/api/authz"
+)
+
+type InstanceVerifier interface {
+	GetInstance(ctx context.Context)
+}
+
+func InstanceInterceptor(verifier authz.InstanceVerifier, headerName string) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
+		return setInstance(ctx, req, info, handler, verifier, headerName)
+	}
+}
+
+func setInstance(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler, verifier authz.InstanceVerifier, headerName string) (_ interface{}, err error) {
+	host, err := hostNameFromContext(ctx, headerName)
+	if err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+	instance, err := verifier.InstanceByHost(ctx, host)
+	if err != nil {
+		return nil, status.Error(codes.PermissionDenied, err.Error())
+	}
+	return handler(authz.WithInstance(ctx, instance), req)
+}
+
+func hostNameFromContext(ctx context.Context, headerName string) (string, error) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return "", fmt.Errorf("cannot read metadata")
+	}
+	host, ok := md[headerName]
+	if !ok {
+		return "", fmt.Errorf("cannot find header: %v", headerName)
+	}
+	if len(host) != 1 {
+		return "", fmt.Errorf("invalid host header: %v", host)
+	}
+	return host[0], nil
+}
--- a/internal/api/grpc/server/middleware/instance_interceptor_test.go
+++ b/internal/api/grpc/server/middleware/instance_interceptor_test.go
@@ -0,0 +1,174 @@
+package middleware
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/caos/zitadel/internal/api/authz"
+)
+
+func Test_hostNameFromContext(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		headerName string
+	}
+	type res struct {
+		want string
+		err  bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			"empty context, error",
+			args{
+				ctx:        context.Background(),
+				headerName: "header",
+			},
+			res{
+				want: "",
+				err:  true,
+			},
+		},
+		{
+			"header not found",
+			args{
+				ctx:        metadata.NewIncomingContext(context.Background(), nil),
+				headerName: "header",
+			},
+			res{
+				want: "",
+				err:  true,
+			},
+		},
+		{
+			"header not found",
+			args{
+				ctx:        metadata.NewIncomingContext(context.Background(), metadata.Pairs("header", "value")),
+				headerName: "header",
+			},
+			res{
+				want: "value",
+				err:  false,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := hostNameFromContext(tt.args.ctx, tt.args.headerName)
+			if (err != nil) != tt.res.err {
+				t.Errorf("hostNameFromContext() error = %v, wantErr %v", err, tt.res.err)
+				return
+			}
+			if got != tt.res.want {
+				t.Errorf("hostNameFromContext() got = %v, want %v", got, tt.res.want)
+			}
+		})
+	}
+}
+
+func Test_setInstance(t *testing.T) {
+	type args struct {
+		ctx        context.Context
+		req        interface{}
+		info       *grpc.UnaryServerInfo
+		handler    grpc.UnaryHandler
+		verifier   authz.InstanceVerifier
+		headerName string
+	}
+	type res struct {
+		want interface{}
+		err  bool
+	}
+	tests := []struct {
+		name string
+		args args
+		res  res
+	}{
+		{
+			"hostname not found, error",
+			args{
+				ctx: context.Background(),
+			},
+			res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			"invalid host, error",
+			args{
+				ctx:        metadata.NewIncomingContext(context.Background(), metadata.Pairs("header", "host2")),
+				req:        &mockRequest{},
+				verifier:   &mockInstanceVerifier{"host"},
+				headerName: "header",
+			},
+			res{
+				want: nil,
+				err:  true,
+			},
+		},
+		{
+			"valid host",
+			args{
+				ctx:        metadata.NewIncomingContext(context.Background(), metadata.Pairs("header", "host")),
+				req:        &mockRequest{},
+				verifier:   &mockInstanceVerifier{"host"},
+				headerName: "header",
+				handler: func(ctx context.Context, req interface{}) (interface{}, error) {
+					return req, nil
+				},
+			},
+			res{
+				want: &mockRequest{},
+				err:  false,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := setInstance(tt.args.ctx, tt.args.req, tt.args.info, tt.args.handler, tt.args.verifier, tt.args.headerName)
+			if (err != nil) != tt.res.err {
+				t.Errorf("setInstance() error = %v, wantErr %v", err, tt.res.err)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.res.want) {
+				t.Errorf("setInstance() got = %v, want %v", got, tt.res.want)
+			}
+		})
+	}
+}
+
+type mockRequest struct{}
+
+type mockInstanceVerifier struct {
+	host string
+}
+
+func (m *mockInstanceVerifier) InstanceByHost(ctx context.Context, host string) (authz.Instance, error) {
+	if host != m.host {
+		return nil, fmt.Errorf("invalid host")
+	}
+	return &mockInstance{}, nil
+}
+
+type mockInstance struct{}
+
+func (m *mockInstance) InstanceID() string {
+	return "instanceID"
+}
+
+func (m *mockInstance) ProjectID() string {
+	return "projectID"
+}
+
+func (m *mockInstance) ConsoleClientID() string {
+	return "consoleClientID"
+}
--- a/internal/api/grpc/server/server.go
+++ b/internal/api/grpc/server/server.go
@@ -20,7 +20,7 @@ type Server interface {
 	AuthMethods() authz.MethodMapping
 }

-func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, queries *query.Queries) *grpc.Server {
+func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, queries *query.Queries, hostHeaderName string) *grpc.Server {
 	metricTypes := []metrics.MetricType{metrics.MetricTypeTotalCount, metrics.MetricTypeRequestCount, metrics.MetricTypeStatusCode}
 	return grpc.NewServer(
 		grpc.UnaryInterceptor(
@@ -30,6 +30,7 @@ func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, querie
 				middleware.SentryHandler(),
 				middleware.NoCacheInterceptor(),
 				middleware.ErrorHandler(),
+				middleware.InstanceInterceptor(queries, hostHeaderName),
 				middleware.AuthorizationInterceptor(verifier, authConfig),
 				middleware.TranslationHandler(queries),
 				middleware.ValidationHandler(),