fix: update userschema api to v3alpha definition (#8511)

# Which Problems Are Solved UserSchema API is currently not completely as defined for v3alpha. # How the Problems Are Solved Update the protos and integration tests. # Additional Changes None # Additional Context None
2025-08-11 18:17:35 +00:00 · 2024-09-02 13:24:15 +02:00
parent bbdf9dbb20
commit a9eb50321c
7 changed files with 242 additions and 212 deletions
--- a/proto/zitadel/resources/userschema/v3alpha/user_schema.proto
+++ b/proto/zitadel/resources/userschema/v3alpha/user_schema.proto
@@ -10,37 +10,84 @@ import "zitadel/resources/object/v3alpha/object.proto";

 option go_package = "github.com/zitadel/zitadel/pkg/grpc/resources/userschema/v3alpha;userschema";

-message UserSchema {
+message GetUserSchema {
  // Details provide some base information (such as the last change date) of the schema.
-  zitadel.resources.object.v3alpha.Details details = 2;
-  // Type is a human readable text describing the schema.
-  string type = 3 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "\"employees\""
-    }
-  ];
+  zitadel.resources.object.v3alpha.Details details = 1;
+  UserSchema config = 2;
  // Current state of the schema.
-  State state = 4 [
+  State state = 3 [
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "\"STATE_ACTIVE\""
    }
  ];
  // Revision is a read only version of the schema, each update of the `schema`-field increases the revision.
-  uint32 revision = 5 [
+  uint32 revision = 4 [
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "\"2\""
    }
  ];
-  // JSON schema representation defining the user.
-  google.protobuf.Struct schema = 6 [
+}
+
+message UserSchema {
+  // Type is a human readable word describing the schema.
+  string type = 1 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "{\"$schema\":\"https://example.com/user/employees\",\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\",\"required\":true},\"description\":{\"type\":\"string\"}}}"
+      min_length: 1;
+      max_length: 200;
+      example: "\"employees\"";
    }
  ];
+  oneof data_type {
+    option (validate.required) = true;
+
+    // JSON schema representation defining the user.
+    google.protobuf.Struct schema = 2 [
+      (validate.rules).message = {required: true},
+      (google.api.field_behavior) = REQUIRED,
+      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+        example: "{\"$schema\":\"https://example.com/user/employees\",\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\",\"required\":true},\"description\":{\"type\":\"string\"}}}"
+      }
+    ];
+
+    // (--In the future we will allow to use an external registry.--)
+  }
  // Defines the possible types of authenticators.
-  // This allows creating different user types like human/machine without usage of actions to validate possible authenticators.
+  repeated AuthenticatorType possible_authenticators = 3 [
+    (validate.rules).repeated = {unique: true, items: {enum: {defined_only: true, not_in: [0]}}},
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      example: "[\"AUTHENTICATOR_TYPE_USERNAME\",\"AUTHENTICATOR_TYPE_PASSWORD\",\"AUTHENTICATOR_TYPE_WEBAUTHN\"]";
+    }
+  ];
+}
+
+message PatchUserSchema {
+  // Type is a human readable word describing the schema.
+  optional string type = 2 [
+    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
+    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+      min_length: 1;
+      max_length: 200;
+      example: "\"employees\"";
+    }
+  ];
+  oneof data_type {
+    // JSON schema representation defining the user.
+    google.protobuf.Struct schema = 3 [
+      (validate.rules).message = {required: true},
+      (google.api.field_behavior) = REQUIRED,
+      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
+        example: "{\"$schema\":\"https://example.com/user/employees\",\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\",\"required\":true},\"description\":{\"type\":\"string\"}}}"
+      }
+    ];
+  }
+  // Defines the possible types of authenticators.
+  //
  // Removal of an authenticator does not remove the authenticator on a user.
-  repeated AuthenticatorType possible_authenticators = 7  [
+  repeated AuthenticatorType possible_authenticators = 4 [
+    (validate.rules).repeated = {unique: true, items: {enum: {defined_only: true, not_in: [0]}}},
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      example: "[\"AUTHENTICATOR_TYPE_USERNAME\",\"AUTHENTICATOR_TYPE_PASSWORD\",\"AUTHENTICATOR_TYPE_WEBAUTHN\"]";
    }
--- a/proto/zitadel/resources/userschema/v3alpha/user_schema_service.proto
+++ b/proto/zitadel/resources/userschema/v3alpha/user_schema_service.proto
@@ -43,7 +43,7 @@ option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
  produces: "application/grpc-web+proto";

  host: "$CUSTOM-DOMAIN";
-  base_path: "/";
+  base_path: "/resources/v3alpha/user_schemas";

  external_docs: {
    description: "Detailed information about ZITADEL",
@@ -110,8 +110,8 @@ service ZITADELUserSchemas {
  // Search all matching user schemas. By default, we will return all user schema of your instance. Make sure to include a limit and sorting for pagination.
  rpc SearchUserSchemas (SearchUserSchemasRequest) returns (SearchUserSchemasResponse) {
    option (google.api.http) = {
-      post: "/v3alpha/user_schemas/search"
-      body: "*"
+      post: "/_search"
+      body: "filters"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -144,9 +144,9 @@ service ZITADELUserSchemas {
  // User schema by ID
  //
  // Returns the user schema identified by the requested ID.
-  rpc GetUserSchemaByID (GetUserSchemaByIDRequest) returns (GetUserSchemaByIDResponse) {
+  rpc GetUserSchema (GetUserSchemaRequest) returns (GetUserSchemaResponse) {
    option (google.api.http) = {
-      get: "/v3alpha/user_schemas/{id}"
+      get: "/{id}"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -170,8 +170,8 @@ service ZITADELUserSchemas {
  // Create the first revision of a new user schema. The schema can then be used on users to store and validate their data.
  rpc CreateUserSchema (CreateUserSchemaRequest) returns (CreateUserSchemaResponse) {
    option (google.api.http) = {
-      post: "/v3alpha/user_schemas"
-      body: "*"
+      post: "/"
+      body: "user_schema"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -203,8 +203,8 @@ service ZITADELUserSchemas {
  // Patch an existing user schema to a new revision. Users based on the current revision will not be affected until they are updated.
  rpc PatchUserSchema (PatchUserSchemaRequest) returns (PatchUserSchemaResponse) {
    option (google.api.http) = {
-      patch: "/v3alpha/user_schemas/{id}"
-      body: "*"
+      patch: "/{id}"
+      body: "user_schema"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -228,7 +228,7 @@ service ZITADELUserSchemas {
  // Deactivate an existing user schema and change it into a read-only state. Users based on this schema cannot be updated anymore, but are still able to authenticate.
  rpc DeactivateUserSchema (DeactivateUserSchemaRequest) returns (DeactivateUserSchemaResponse) {
    option (google.api.http) = {
-      post: "/v3alpha/user_schemas/{id}/deactivate"
+      post: "/{id}/_deactivate"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -252,7 +252,7 @@ service ZITADELUserSchemas {
  // Reactivate an previously deactivated user schema and change it into an active state again.
  rpc ReactivateUserSchema (ReactivateUserSchemaRequest) returns (ReactivateUserSchemaResponse) {
    option (google.api.http) = {
-      post: "/v3alpha/user_schemas/{id}/reactivate"
+      post: "/{id}/_reactivate"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -276,7 +276,7 @@ service ZITADELUserSchemas {
  // Delete an existing user schema. This operation is only allowed if there are no associated users to it.
  rpc DeleteUserSchema (DeleteUserSchemaRequest) returns (DeleteUserSchemaResponse) {
    option (google.api.http) = {
-      delete: "/v3alpha/user_schemas/{id}"
+      delete: "/{id}"
    };

    option (zitadel.protoc_gen_zitadel.v2.options) = {
@@ -294,7 +294,6 @@ service ZITADELUserSchemas {
      };
    };
  }
-
 }

 message SearchUserSchemasRequest {
@@ -321,11 +320,10 @@ message SearchUserSchemasResponse {
  // States by which field the results are sorted.
  FieldName sorting_column = 2;
  // The result contains the user schemas, which matched the queries.
-  repeated UserSchema result = 3;
+  repeated GetUserSchema result = 3;
 }

-
-message GetUserSchemaByIDRequest {
+message GetUserSchemaRequest {
  // unique identifier of the schema.
  string id = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},
@@ -338,8 +336,8 @@ message GetUserSchemaByIDRequest {
  ];
 }

-message GetUserSchemaByIDResponse {
-  zitadel.resources.userschema.v3alpha.UserSchema schema = 1;
+message GetUserSchemaResponse {
+  GetUserSchema user_schema = 2;
 }

 message CreateUserSchemaRequest {
@@ -348,51 +346,7 @@ message CreateUserSchemaRequest {
      default: "\"domain from HOST or :authority header\""
    }
  ];
-  CreateUserSchema user_schema = 2 [
-    (validate.rules).message = {
-      required: true
-    }
-  ];
-}
-
-message CreateUserSchema{
-  optional zitadel.object.v3alpha.Instance instance = 4 [
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      default: "\"domain from HOST or :authority header\""
-    }
-  ];
-
-  // Type is a human readable word describing the schema.
-  string type = 1 [
-    (validate.rules).string = {min_len: 1, max_len: 200},
-    (google.api.field_behavior) = REQUIRED,
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      min_length: 1;
-      max_length: 200;
-      example: "\"employees\"";
-    }
-  ];
-  oneof data_type {
-    option (validate.required) = true;
-
-    // JSON schema representation defining the user.
-    google.protobuf.Struct schema = 2 [
-      (validate.rules).message = {required: true},
-      (google.api.field_behavior) = REQUIRED,
-      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-        example: "{\"$schema\":\"https://example.com/user/employees\",\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\",\"required\":true},\"description\":{\"type\":\"string\"}}}"
-      }
-    ];
-
-    // (--In the future we will allow to use an external registry.--)
-  }
-  // Defines the possible types of authenticators.
-  repeated AuthenticatorType possible_authenticators = 3 [
-    (validate.rules).repeated = {unique: true, items: {enum: {defined_only: true, not_in: [0]}}},
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "[\"AUTHENTICATOR_TYPE_USERNAME\",\"AUTHENTICATOR_TYPE_PASSWORD\",\"AUTHENTICATOR_TYPE_WEBAUTHN\"]";
-    }
-  ];
+  UserSchema user_schema = 2;
 }

 message CreateUserSchemaResponse {
@@ -402,42 +356,23 @@ message CreateUserSchemaResponse {


 message PatchUserSchemaRequest {
-  optional zitadel.object.v3alpha.Instance instance = 5 [
+  optional zitadel.object.v3alpha.Instance instance = 1 [
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      default: "\"domain from HOST or :authority header\""
    }
  ];
  // unique identifier of the schema.
-  string id = 1;
-  // Type is a human readable word describing the schema.
-  optional string type = 2 [
+  string id = 2 [
    (validate.rules).string = {min_len: 1, max_len: 200},
    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      min_length: 1;
-      max_length: 200;
-      example: "\"employees\"";
-    }
-  ];
-  oneof data_type {
-    // JSON schema representation defining the user.
-    google.protobuf.Struct schema = 3 [
-      (validate.rules).message = {required: true},
-      (google.api.field_behavior) = REQUIRED,
-      (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-        example: "{\"$schema\":\"https://example.com/user/employees\",\"type\":\"object\",\"properties\":{\"name\":{\"type\":\"string\",\"required\":true},\"description\":{\"type\":\"string\"}}}"
-      }
-    ];
-  }
-  // Defines the possible types of authenticators.
-  //
-  // Removal of an authenticator does not remove the authenticator on a user.
-  repeated AuthenticatorType possible_authenticators = 4 [
-    (validate.rules).repeated = {unique: true, items: {enum: {defined_only: true, not_in: [0]}}},
-    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
-      example: "[\"AUTHENTICATOR_TYPE_USERNAME\",\"AUTHENTICATOR_TYPE_PASSWORD\",\"AUTHENTICATOR_TYPE_WEBAUTHN\"]";
+      min_length: 1,
+      max_length: 200,
+      example: "\"69629026806489455\"";
    }
  ];
+
+  PatchUserSchema user_schema = 3;
 }

 message PatchUserSchemaResponse {
@@ -454,6 +389,7 @@ message DeactivateUserSchemaRequest {
  // unique identifier of the schema.
  string id = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      min_length: 1,
      max_length: 200,
@@ -476,6 +412,7 @@ message ReactivateUserSchemaRequest {
  // unique identifier of the schema.
  string id = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      min_length: 1,
      max_length: 200,
@@ -498,6 +435,7 @@ message DeleteUserSchemaRequest {
  // unique identifier of the schema.
  string id = 1 [
    (validate.rules).string = {min_len: 1, max_len: 200},
+    (google.api.field_behavior) = REQUIRED,
    (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
      min_length: 1,
      max_length: 200,