feat: features (#1427)

* features

* features

* features

* fix json tags

* add features handler to auth

* mocks for tests

* add setup step

* fixes

* add featurelist to auth api

* grandfather state and typos

* typo

* merge new-eventstore

* fix login policy tests

* label policy in features

* audit log retention

internal/api/authz/authorization.go

@@ -23,6 +23,13 @@ func CheckUserAuthorization(ctx context.Context, req interface{}, token, orgID s
 		return nil, err
 	}
 
+	if requiredAuthOption.Feature != "" {
+		err = CheckOrgFeatures(ctx, verifier, ctxData.OrgID, requiredAuthOption.Feature)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	if requiredAuthOption.Permission == authenticated {
 		return func(parent context.Context) context.Context {
 			return context.WithValue(parent, dataKey, ctxData)
@@ -49,6 +56,10 @@ func CheckUserAuthorization(ctx context.Context, req interface{}, token, orgID s
 	}, nil
 }
 
+func CheckOrgFeatures(ctx context.Context, t *TokenVerifier, orgID string, requiredFeatures ...string) error {
+	return t.authZRepo.CheckOrgFeatures(ctx, orgID, requiredFeatures...)
+}
+
 func checkUserPermissions(req interface{}, userPerms []string, authOpt Option) error {
 	if len(userPerms) == 0 {
 		return errors.ThrowPermissionDenied(nil, "AUTH-5mWD2", "No matching permissions found")

internal/api/authz/config.go

@@ -14,6 +14,7 @@ type MethodMapping map[string]Option
 type Option struct {
 	Permission string
 	CheckParam string
+	Feature    string
 }
 
 func (a *Config) getPermissionsFromRole(role string) []string {

internal/api/authz/permissions_test.go

@@ -34,6 +34,10 @@ func (v *testVerifier) VerifierClientID(ctx context.Context, appName string) (st
 	return "clientID", nil
 }
 
+func (v *testVerifier) CheckOrgFeatures(context.Context, string, ...string) error {
+	return nil
+}
+
 func equalStringArray(a, b []string) bool {
 	if len(a) != len(b) {
 		return false

internal/api/authz/token.go

@@ -25,6 +25,7 @@ type authZRepo interface {
 	SearchMyMemberships(ctx context.Context) ([]*Membership, error)
 	ProjectIDAndOriginsByClientID(ctx context.Context, clientID string) (projectID string, origins []string, err error)
 	ExistsOrg(ctx context.Context, orgID string) error
+	CheckOrgFeatures(ctx context.Context, orgID string, requiredFeatures ...string) error
 }
 
 func Start(authZRepo authZRepo) (v *TokenVerifier) {