fix: User checks (#139)

* check uniqueness on create and register user

* change user email, reserve release unique email

* usergrant unique aggregate

* usergrant uniqueness

* validate UserGrant

* fix tests

internal/usergrant/repository/eventsourcing/eventstore.go

@@ -59,7 +59,6 @@ func (es *UserGrantEventStore) AddUserGrant(ctx context.Context, grant *grant_mo
 	if grant == nil || !grant.IsValid() {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-sdiw3", "User grant invalid")
 	}
-	//TODO: Check Uniqueness
 	id, err := es.idGenerator.NextID()
 	if err != nil {
 		return nil, err
@@ -68,8 +67,11 @@ func (es *UserGrantEventStore) AddUserGrant(ctx context.Context, grant *grant_mo
 
 	repoGrant := model.UserGrantFromModel(grant)
 
-	addAggregate := UserGrantAddedAggregate(es.Eventstore.AggregateCreator(), repoGrant)
-	err = es_sdk.Push(ctx, es.PushAggregates, repoGrant.AppendEvents, addAggregate)
+	addAggregates, err := UserGrantAddedAggregate(ctx, es.Eventstore.AggregateCreator(), repoGrant)
+	if err != nil {
+		return nil, err
+	}
+	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoGrant.AppendEvents, addAggregates...)
 	if err != nil {
 		return nil, err
 	}
@@ -103,8 +105,11 @@ func (es *UserGrantEventStore) RemoveUserGrant(ctx context.Context, grantID stri
 	}
 	repoExisting := model.UserGrantFromModel(existing)
 	repoGrant := &model.UserGrant{ObjectRoot: models.ObjectRoot{AggregateID: grantID}}
-	projectAggregate := UserGrantRemovedAggregate(es.Eventstore.AggregateCreator(), repoExisting, repoGrant)
-	err = es_sdk.Push(ctx, es.PushAggregates, repoExisting.AppendEvents, projectAggregate)
+	projectAggregates, err := UserGrantRemovedAggregate(ctx, es.Eventstore.AggregateCreator(), repoExisting, repoGrant)
+	if err != nil {
+		return err
+	}
+	err = es_sdk.PushAggregates(ctx, es.PushAggregates, repoExisting.AppendEvents, projectAggregates...)
 	if err != nil {
 		return err
 	}

internal/usergrant/repository/eventsourcing/model/types.go

@@ -4,11 +4,13 @@ import "github.com/caos/zitadel/internal/eventstore/models"
 
 const (
 	UserGrantAggregate       models.AggregateType = "usergrant"
-	UserGrantUniqueAggregate models.AggregateType = "usergrant-unique"
+	UserGrantUniqueAggregate models.AggregateType = "usergrant.unique"
 
 	UserGrantAdded       models.EventType = "user.grant.added"
 	UserGrantChanged     models.EventType = "user.grant.changed"
 	UserGrantRemoved     models.EventType = "user.grant.removed"
 	UserGrantDeactivated models.EventType = "user.grant.deactivated"
 	UserGrantReactivated models.EventType = "user.grant.reactivated"
+	UserGrantReserved    models.EventType = "user.grant.reserved"
+	UserGrantReleased    models.EventType = "user.grant.released"
 )

internal/usergrant/repository/eventsourcing/user_grant.go

@@ -2,8 +2,13 @@ package eventsourcing
 
 import (
 	"context"
+	"github.com/caos/zitadel/internal/api/auth"
 	"github.com/caos/zitadel/internal/errors"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	org_model "github.com/caos/zitadel/internal/org/model"
+	proj_model "github.com/caos/zitadel/internal/project/model"
+	proj_es_model "github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
+	usr_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
 	"github.com/caos/zitadel/internal/usergrant/repository/eventsourcing/model"
 )
 
@@ -21,6 +26,15 @@ func UserGrantQuery(latestSequence uint64) *es_models.SearchQuery {
 		LatestSequenceFilter(latestSequence)
 }
 
+func UserGrantUniqueQuery(resourceOwner, projectID, userID string) *es_models.SearchQuery {
+	grantID := resourceOwner + projectID + userID
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserGrantUniqueAggregate).
+		AggregateIDFilter(grantID).
+		OrderDesc().
+		SetLimit(1)
+}
+
 func UserGrantAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, grant *model.UserGrant) (*es_models.Aggregate, error) {
 	if grant == nil {
 		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "existing grant should not be nil")
@@ -28,14 +42,57 @@ func UserGrantAggregate(ctx context.Context, aggCreator *es_models.AggregateCrea
 	return aggCreator.NewAggregate(ctx, grant.AggregateID, model.UserGrantAggregate, model.UserGrantVersion, grant.Sequence)
 }
 
-func UserGrantAddedAggregate(aggCreator *es_models.AggregateCreator, grant *model.UserGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
-	return func(ctx context.Context) (*es_models.Aggregate, error) {
-		agg, err := UserGrantAggregate(ctx, aggCreator, grant)
-		if err != nil {
-			return nil, err
-		}
-		return agg.AppendEvent(model.UserGrantAdded, grant)
+func UserGrantAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, grant *model.UserGrant) ([]*es_models.Aggregate, error) {
+	agg, err := UserGrantAggregate(ctx, aggCreator, grant)
+	if err != nil {
+		return nil, err
 	}
+	validationQuery := es_models.NewSearchQuery().
+		AggregateTypeFilter(usr_model.UserAggregate, org_model.OrgAggregate, proj_es_model.ProjectAggregate).
+		AggregateIDsFilter(grant.UserID, auth.GetCtxData(ctx).OrgID, grant.ProjectID)
+
+	validation := addUserGrantValidation(auth.GetCtxData(ctx).OrgID, grant)
+	agg, err = agg.SetPrecondition(validationQuery, validation).AppendEvent(model.UserGrantAdded, grant)
+	if err != nil {
+		return nil, err
+	}
+
+	uniqueAggregate, err := reservedUniqueUserGrantAggregate(ctx, aggCreator, grant)
+	if err != nil {
+		return nil, err
+	}
+	return []*es_models.Aggregate{
+		agg,
+		uniqueAggregate,
+	}, nil
+}
+
+func reservedUniqueUserGrantAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, grant *model.UserGrant) (*es_models.Aggregate, error) {
+	grantID := auth.GetCtxData(ctx).OrgID + grant.ProjectID + grant.UserID
+	aggregate, err := aggCreator.NewAggregate(ctx, grantID, model.UserGrantUniqueAggregate, model.UserGrantVersion, 0)
+	if err != nil {
+		return nil, err
+	}
+	aggregate, err = aggregate.AppendEvent(model.UserGrantReserved, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return aggregate.SetPrecondition(UserGrantUniqueQuery(auth.GetCtxData(ctx).OrgID, grant.ProjectID, grant.UserID), isEventValidation(aggregate, model.UserGrantReserved)), nil
+}
+
+func releasedUniqueUserGrantAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, grant *model.UserGrant) (aggregate *es_models.Aggregate, err error) {
+	grantID := grant.ResourceOwner + grant.ProjectID + grant.UserID
+	aggregate, err = aggCreator.NewAggregate(ctx, grantID, model.UserGrantUniqueAggregate, model.UserGrantVersion, 0)
+	if err != nil {
+		return nil, err
+	}
+	aggregate, err = aggregate.AppendEvent(model.UserGrantReleased, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return aggregate.SetPrecondition(UserGrantUniqueQuery(grant.ResourceOwner, grant.ProjectID, grant.UserID), isEventValidation(aggregate, model.UserGrantReleased)), nil
 }
 
 func UserGrantChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.UserGrant, grant *model.UserGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
@@ -78,15 +135,109 @@ func UserGrantReactivatedAggregate(aggCreator *es_models.AggregateCreator, exist
 	}
 }
 
-func UserGrantRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.UserGrant, grant *model.UserGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
-	return func(ctx context.Context) (*es_models.Aggregate, error) {
-		if grant == nil {
-			return nil, errors.ThrowPreconditionFailed(nil, "EVENT-lo21s", "grant should not be nil")
+func UserGrantRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.UserGrant, grant *model.UserGrant) ([]*es_models.Aggregate, error) {
+	if grant == nil {
+		return nil, errors.ThrowPreconditionFailed(nil, "EVENT-lo21s", "grant should not be nil")
+	}
+	agg, err := UserGrantAggregate(ctx, aggCreator, existing)
+	if err != nil {
+		return nil, err
+	}
+	agg, err = agg.AppendEvent(model.UserGrantRemoved, nil)
+	if err != nil {
+		return nil, err
+	}
+	uniqueAggregate, err := releasedUniqueUserGrantAggregate(ctx, aggCreator, existing)
+	if err != nil {
+		return nil, err
+	}
+	return []*es_models.Aggregate{
+		agg,
+		uniqueAggregate,
+	}, nil
+}
+
+func isEventValidation(aggregate *es_models.Aggregate, eventType es_models.EventType) func(...*es_models.Event) error {
+	return func(events ...*es_models.Event) error {
+		if len(events) == 0 {
+			aggregate.PreviousSequence = 0
+			return nil
 		}
-		agg, err := UserGrantAggregate(ctx, aggCreator, existing)
-		if err != nil {
-			return nil, err
+		if events[0].Type == eventType {
+			return errors.ThrowPreconditionFailedf(nil, "EVENT-eJQqe", "user_grant is already %v", eventType)
 		}
-		return agg.AppendEvent(model.UserGrantRemoved, nil)
+		aggregate.PreviousSequence = events[0].Sequence
+		return nil
 	}
 }
+
+func addUserGrantValidation(resourceOwner string, grant *model.UserGrant) func(...*es_models.Event) error {
+	return func(events ...*es_models.Event) error {
+		existsOrg := false
+		existsUser := false
+		project := new(proj_es_model.Project)
+		for _, event := range events {
+			switch event.AggregateType {
+			case usr_model.UserAggregate:
+				switch event.Type {
+				case usr_model.UserAdded, usr_model.UserRegistered:
+					existsUser = true
+				case usr_model.UserRemoved:
+					existsUser = false
+				}
+			case org_model.OrgAggregate:
+				switch event.Type {
+				case org_model.OrgAdded:
+					existsOrg = true
+				case org_model.OrgRemoved:
+					existsOrg = false
+				}
+			case proj_es_model.ProjectAggregate:
+				project.AppendEvent(event)
+			}
+		}
+		if existsOrg && existsUser && checkProjectConditions(resourceOwner, grant, project) {
+			return nil
+		}
+		return errors.ThrowPreconditionFailed(nil, "EVENT-3OfIm", "conditions not met")
+	}
+}
+
+func checkProjectConditions(resourceOwner string, grant *model.UserGrant, project *proj_es_model.Project) bool {
+	if project.State == int32(proj_model.PROJECTSTATE_REMOVED) {
+		return false
+	}
+	if resourceOwner == project.ResourceOwner {
+		return checkIfProjectHasRoles(grant.RoleKeys, project.Roles)
+	}
+
+	if _, projectGrant := proj_es_model.GetProjectGrantByResourceOwner(project.Grants, resourceOwner); projectGrant != nil {
+		return checkIfProjectGrantHasRoles(grant.RoleKeys, projectGrant.RoleKeys)
+	}
+	return false
+}
+
+func checkIfProjectHasRoles(roles []string, existing []*proj_es_model.ProjectRole) bool {
+	for _, roleKey := range roles {
+		if _, role := proj_es_model.GetProjectRole(existing, roleKey); role == nil {
+			return false
+		}
+	}
+	return true
+}
+
+func checkIfProjectGrantHasRoles(roles []string, existing []string) bool {
+	roleExists := false
+	for _, roleKey := range roles {
+		for _, existingRoleKey := range existing {
+			if roleKey == existingRoleKey {
+				roleExists = true
+				continue
+			}
+		}
+		if !roleExists {
+			return false
+		}
+	}
+	return true
+}

internal/usergrant/repository/eventsourcing/user_grant_test.go

@@ -51,15 +51,15 @@ func TestUserGrantAddedAggregate(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			agg, err := UserGrantAddedAggregate(tt.args.aggCreator, tt.args.grant)(tt.args.ctx)
+			aggregates, err := UserGrantAddedAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.grant)
 
-			if tt.res.errFunc == nil && len(agg.Events) != tt.res.eventLen {
-				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			if tt.res.errFunc == nil && len(aggregates[0].Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(aggregates[0].Events))
 			}
-			if tt.res.errFunc == nil && agg.Events[0].Type != tt.res.eventType {
-				t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventType, agg.Events[0].Type.String())
+			if tt.res.errFunc == nil && aggregates[0].Events[0].Type != tt.res.eventType {
+				t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventType, aggregates[0].Events[0].Type.String())
 			}
-			if tt.res.errFunc == nil && agg.Events[0].Data == nil {
+			if tt.res.errFunc == nil && aggregates[0].Events[0].Data == nil {
 				t.Errorf("should have data in event")
 			}
 			if tt.res.errFunc != nil && !tt.res.errFunc(err) {
@@ -230,14 +230,14 @@ func TestUserGrantRemovedAggregate(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			agg, err := UserGrantRemovedAggregate(tt.args.aggCreator, tt.args.existing, tt.args.new)(tt.args.ctx)
+			aggregates, err := UserGrantRemovedAggregate(tt.args.ctx, tt.args.aggCreator, tt.args.existing, tt.args.new)
 
-			if tt.res.errFunc == nil && len(agg.Events) != tt.res.eventLen {
-				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(agg.Events))
+			if tt.res.errFunc == nil && len(aggregates[0].Events) != tt.res.eventLen {
+				t.Errorf("got wrong event len: expected: %v, actual: %v ", tt.res.eventLen, len(aggregates[0].Events))
 			}
 			for i := 0; i < tt.res.eventLen; i++ {
-				if tt.res.errFunc == nil && agg.Events[i].Type != tt.res.eventTypes[i] {
-					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], agg.Events[i].Type.String())
+				if tt.res.errFunc == nil && aggregates[0].Events[i].Type != tt.res.eventTypes[i] {
+					t.Errorf("got wrong event type: expected: %v, actual: %v ", tt.res.eventTypes[i], aggregates[0].Events[i].Type.String())
 				}
 			}