feat: user service v2 create, update and remove (#6996)

* feat: user service v2 remove user * feat: user service v2 add user human * feat: user service v2 change user human * feat: user service v2 change user human unit tests * feat: user service v2 reactivate, deactivate, lock, unlock user * feat: user service v2 integration tests * fix: merge back origin/main * lint: linter corrections * fix: move permission check for isVerfied and password change * fix: add deprecated notices and other review comments * fix: consistent naming in proto * fix: errors package renaming * fix: remove / delete user renaming in integration test * fix: machine user status changes through user v2 api * fix: linting changes * fix: linting changes * fix: changes from review * fix: changes from review * fix: changes from review * fix: changes from review * fix: changes from review --------- Co-authored-by: Tim Möhlmann <tim+github@zitadel.com> Co-authored-by: Livio Spring <livio.a@gmail.com>
2025-08-11 21:37:32 +00:00 · 2023-12-21 10:03:37 +01:00
parent acb604c045
commit a0a82b59e1
34 changed files with 9368 additions and 98 deletions
--- a/proto/zitadel/user/v2beta/email.proto
+++ b/proto/zitadel/user/v2beta/email.proto
@@ -27,6 +27,18 @@ message SetHumanEmail {
  }
 }

+message HumanEmail {
+  string email = 1 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"mini@mouse.com\"";
+    }
+  ];
+  bool is_verified = 2;
+}
+
+
 message SendEmailVerificationCode {
  optional string url_template = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},
--- a/proto/zitadel/user/v2beta/password.proto
+++ b/proto/zitadel/user/v2beta/password.proto
@@ -55,3 +55,31 @@ enum NotificationType {
  NOTIFICATION_TYPE_Email = 1;
  NOTIFICATION_TYPE_SMS = 2;
 }
+
+message SetPassword {
+  oneof password_type {
+    Password password = 1;
+    HashedPassword hashed_password = 2;
+  }
+  oneof verification {
+    string current_password = 3 [
+      (validate.rules).string = {min_len: 1, max_len: 200},
+      (google.api.field_behavior) = REQUIRED,
+      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+        min_length: 1;
+        max_length: 200;
+        example: "\"Secr3tP4ssw0rd!\"";
+      }
+    ];
+    string verification_code = 4 [
+      (validate.rules).string = {min_len: 1, max_len: 20},
+      (google.api.field_behavior) = REQUIRED,
+      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+        min_length: 1;
+        max_length: 20;
+        example: "\"SKJd342k\"";
+        description: "\"the verification code generated during password reset request\"";
+      }
+    ];
+  }
+}
--- a/proto/zitadel/user/v2beta/phone.proto
+++ b/proto/zitadel/user/v2beta/phone.proto
@@ -24,6 +24,16 @@ message SetHumanPhone {
    }
 }

+message HumanPhone {
+    string phone = 1 [
+        (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+            max_length: 200;
+            example: "\"+41791234567\"";
+        }
+    ];
+    bool is_verified = 2;
+}
+
 message SendPhoneVerificationCode {}

 message ReturnPhoneVerificationCode {}
--- a/proto/zitadel/user/v2beta/user.proto
+++ b/proto/zitadel/user/v2beta/user.proto
@@ -7,10 +7,9 @@ option go_package = "github.com/zitadel/zitadel/pkg/grpc/user/v2beta;user";
 import "google/api/field_behavior.proto";
 import "protoc-gen-openapiv2/options/annotations.proto";
 import "validate/validate.proto";
-
-message User {
-  string id = 1;
-}
+import "zitadel/object/v2beta/object.proto";
+import "zitadel/user/v2beta/email.proto";
+import "zitadel/user/v2beta/phone.proto";

 enum Gender {
  GENDER_UNSPECIFIED = 0;
@@ -66,6 +65,45 @@ message SetHumanProfile {
  ];
 }

+message HumanProfile {
+  string given_name = 1  [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"Minnie\"";
+    }
+  ];
+  string family_name = 2  [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"Mouse\"";
+    }
+  ];
+  optional string nick_name = 3 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      max_length: 200;
+      example: "\"Mini\"";
+    }
+  ];
+  optional string display_name = 4 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      max_length: 200;
+      example: "\"Minnie Mouse\"";
+    }
+  ];
+  optional string preferred_language = 5 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      max_length: 10;
+      example: "\"en\"";
+    }
+  ];
+  optional zitadel.user.v2beta.Gender gender = 6 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "\"GENDER_FEMALE\"";
+    }
+  ];
+}

 message SetMetadataEntry {
  string key = 1 [
@@ -88,3 +126,44 @@ message SetMetadataEntry {
    }
  ];
 }
+
+message HumanUser {
+  string user_id = 1 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "\"d654e6ba-70a3-48ef-a95d-37c8d8a7901a\"";
+    }
+  ];
+  UserState state = 2 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      description: "current state of the user";
+    }
+  ];
+  string username = 3 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "\"minnie-mouse\"";
+    }
+  ];
+  repeated string login_names = 4 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "[\"gigi@zitadel.com\", \"gigi@zitadel.zitadel.ch\"]";
+    }
+  ];
+  string preferred_login_name = 5 [
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "\"gigi@zitadel.com\"";
+    }
+  ];
+  HumanProfile profile = 6;
+  HumanEmail email = 7;
+  HumanPhone phone = 8;
+}
+
+enum UserState {
+  USER_STATE_UNSPECIFIED = 0;
+  USER_STATE_ACTIVE = 1;
+  USER_STATE_INACTIVE = 2;
+  USER_STATE_DELETED = 3;
+  USER_STATE_LOCKED = 4;
+  USER_STATE_SUSPEND = 5;
+  USER_STATE_INITIAL = 6;
+}
--- a/proto/zitadel/user/v2beta/user_service.proto
+++ b/proto/zitadel/user/v2beta/user_service.proto
@@ -238,6 +238,149 @@ service UserService {
    };
  }

+  rpc UpdateHumanUser(UpdateHumanUserRequest) returns (UpdateHumanUserResponse) {
+    option (google.api.http) = {
+      put: "/v2beta/users/{user_id}"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "authenticated"
+      }
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Update User";
+      description: "Update all information from a user."
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
+  rpc DeactivateUser(DeactivateUserRequest) returns (DeactivateUserResponse) {
+    option (google.api.http) = {
+      post: "/v2beta/users/{user_id}/deactivate"
+      body: "*"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "authenticated"
+      }
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Deactivate user";
+      description: "The state of the user will be changed to 'deactivated'. The user will not be able to log in anymore. The endpoint returns an error if the user is already in the state 'deactivated'. Use deactivate user when the user should not be able to use the account anymore, but you still need access to the user data."
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
+  rpc ReactivateUser(ReactivateUserRequest) returns (ReactivateUserResponse) {
+    option (google.api.http) = {
+      post: "/v2beta/users/{user_id}/reactivate"
+      body: "*"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "authenticated"
+      }
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Reactivate user";
+      description: "Reactivate a user with the state 'deactivated'. The user will be able to log in again afterward. The endpoint returns an error if the user is not in the state 'deactivated'."
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
+  rpc LockUser(LockUserRequest) returns (LockUserResponse) {
+    option (google.api.http) = {
+      post: "/v2beta/users/{user_id}/lock"
+      body: "*"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "authenticated"
+      }
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Lock user";
+      description: "The state of the user will be changed to 'locked'. The user will not be able to log in anymore. The endpoint returns an error if the user is already in the state 'locked'. Use this endpoint if the user should not be able to log in temporarily because of an event that happened (wrong password, etc.)"
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
+  rpc UnlockUser(UnlockUserRequest) returns (UnlockUserResponse) {
+    option (google.api.http) = {
+      post: "/v2beta/users/{user_id}/unlock"
+      body: "*"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "authenticated"
+      }
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Unlock user";
+      description: "Unlock a user with the state 'locked'. The user will be able to log in again afterward. The endpoint returns an error if the user is not in the state 'locked'."
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
+  rpc DeleteUser(DeleteUserRequest) returns (DeleteUserResponse) {
+    option (google.api.http) = {
+      delete: "/v2beta/users/{user_id}"
+    };
+
+    option (zitadel.protoc_gen_zitadel.v2.options) = {
+      auth_option: {
+        permission: "user.delete"
+      }
+    };
+
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      summary: "Delete user";
+      description: "The state of the user will be changed to 'deleted'. The user will not be able to log in anymore. Endpoints requesting this user will return an error 'User not found"
+      responses: {
+        key: "200"
+        value: {
+          description: "OK";
+        }
+      };
+    };
+  }
+
  rpc RegisterPasskey (RegisterPasskeyRequest) returns (RegisterPasskeyResponse) {
    option (google.api.http) = {
      post: "/v2beta/users/{user_id}/passkeys"
@@ -804,6 +947,133 @@ message VerifyPhoneResponse{
  zitadel.object.v2beta.Details details = 1;
 }

+message DeleteUserRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+    }];
+}
+
+message DeleteUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+}
+
+message GetUserByIDRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+      description: "User ID of the user you like to get."
+    }
+  ];
+}
+
+message GetUserByIDResponse {
+  zitadel.object.v2beta.Details details = 1;
+  HumanUser user = 2;
+}
+
+message UpdateHumanUserRequest{
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"d654e6ba-70a3-48ef-a95d-37c8d8a7901a\"";
+    }
+  ];
+  optional string username = 2 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"minnie-mouse\"";
+    }
+  ];
+  optional SetHumanProfile profile = 3;
+  optional SetHumanEmail email = 4;
+  optional SetHumanPhone phone = 5;
+  optional SetPassword password = 6;
+}
+
+message UpdateHumanUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+  optional string email_code = 2;
+  optional string phone_code = 3;
+}
+
+message DeactivateUserRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+    }
+  ];
+}
+
+message DeactivateUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+}
+
+
+message ReactivateUserRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+    }
+  ];
+}
+
+message ReactivateUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+}
+
+message LockUserRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+    }
+  ];
+}
+
+message LockUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+}
+
+message UnlockUserRequest {
+  string user_id = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"69629012906488334\"";
+    }
+  ];
+}
+
+message UnlockUserResponse {
+  zitadel.object.v2beta.Details details = 1;
+}
+
 message RegisterPasskeyRequest{
  string user_id = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},