TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-12 02:54:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): update user grants before check (#5406)

Browse Source
This commit is contained in:
Silvan 2023-03-13 08:03:49 +01:00 committed by GitHub
parent 0c704966a2
commit eb4f7c5d7c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 23 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/api/grpc/admin/export.go
View File

@ -966,7 +966,7 @@ func (s *Server) getNecessaryUserGrantsForOrg(ctx context.Context, org string, p
return nil, err
}
queriedUserGrants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantSearchOrg}}, false)
queriedUserGrants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantSearchOrg}}, true, false)
if err != nil {
return nil, err
}

6
internal/api/grpc/auth/user.go
View File

@ -31,7 +31,7 @@ func (s *Server) RemoveMyUser(ctx context.Context, _ *auth_pb.RemoveMyUserReques
return nil, err
}
queries := &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantUserID}}
grants, err := s.query.UserGrants(ctx, queries, false)
grants, err := s.query.UserGrants(ctx, queries, true, false)
if err != nil {
return nil, err
}
@ -125,7 +125,7 @@ func (s *Server) ListMyUserGrants(ctx context.Context, req *auth_pb.ListMyUserGr
if err != nil {
return nil, err
}
res, err := s.query.UserGrants(ctx, queries, false)
res, err := s.query.UserGrants(ctx, queries, false, false)
if err != nil {
return nil, err
}
@ -154,7 +154,7 @@ func (s *Server) ListMyProjectOrgs(ctx context.Context, req *auth_pb.ListMyProje
return nil, err
}
grants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantProjectID, userGrantUserID}}, false)
grants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantProjectID, userGrantUserID}}, false, false)
if err != nil {
return nil, err
}

4
internal/api/grpc/management/project.go
View File

@ -172,7 +172,7 @@ func (s *Server) RemoveProject(ctx context.Context, req *mgmt_pb.RemoveProjectRe
}
grants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{projectQuery},
}, false)
}, true, false)
if err != nil {
return nil, err
}
@ -257,7 +257,7 @@ func (s *Server) RemoveProjectRole(ctx context.Context, req *mgmt_pb.RemoveProje
}
userGrants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{projectQuery, rolesQuery},
}, false)
}, false, false)
if err != nil {
return nil, err

4
internal/api/grpc/management/project_grant.go
View File

@ -90,7 +90,7 @@ func (s *Server) UpdateProjectGrant(ctx context.Context, req *mgmt_pb.UpdateProj
}
grants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{projectQuery, grantQuery},
}, false)
}, true, false)
if err != nil {
return nil, err
}
@ -138,7 +138,7 @@ func (s *Server) RemoveProjectGrant(ctx context.Context, req *mgmt_pb.RemoveProj
}
userGrants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{projectQuery, grantQuery},
}, true)
}, false, true)
if err != nil {
return nil, err
}

2
internal/api/grpc/management/user.go
View File

@ -342,7 +342,7 @@ func (s *Server) removeUserDependencies(ctx context.Context, userID string) ([]*
}
grants, err := s.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{userGrantUserQuery},
}, true)
}, true, true)
if err != nil {
return nil, nil, err
}

2
internal/api/grpc/management/user_grant.go
View File

@ -33,7 +33,7 @@ func (s *Server) ListUserGrants(ctx context.Context, req *mgmt_pb.ListUserGrantR
if err != nil {
return nil, err
}
res, err := s.query.UserGrants(ctx, queries, false)
res, err := s.query.UserGrants(ctx, queries, false, false)
if err != nil {
return nil, err
}

2
internal/api/oidc/client.go
View File

@ -649,7 +649,7 @@ func (o *OPStorage) assertRoles(ctx context.Context, userID, applicationID strin
}
grants, err := o.query.UserGrants(ctx, &query.UserGrantsQueries{
Queries: []query.SearchQuery{projectQuery, userIDQuery},
}, false)
}, true, false)
if err != nil {
return nil, nil, err
}

6
internal/auth/repository/eventsourcing/eventstore/auth_request.go
View File

@ -1471,10 +1471,8 @@ func projectRequired(ctx context.Context, request *domain.AuthRequest, projectPr
}
_, err = projectProvider.OrgProjectMappingByIDs(request.UserOrgID, project.ID, request.InstanceID)
if errors.IsNotFound(err) {
// if not found there is no error returned
return true, nil
}
if err != nil {
return false, err
}
return false, nil
return false, err
}

2
internal/auth/repository/eventsourcing/repository.go
View File

@ -127,7 +127,7 @@ func (q queryViewWrapper) UserGrantsByProjectAndUserID(ctx context.Context, proj
return nil, err
}
queries := &query.UserGrantsQueries{Queries: []query.SearchQuery{userGrantUserID, userGrantProjectID}}
grants, err := q.Queries.UserGrants(ctx, queries, false)
grants, err := q.Queries.UserGrants(ctx, queries, true, false)
if err != nil {
return nil, err
}

10
internal/query/user_grant.go
View File

@ -8,6 +8,8 @@ import (
sq "github.com/Masterminds/squirrel"
"github.com/zitadel/logging"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/api/call"
"github.com/zitadel/zitadel/internal/database"
@ -245,10 +247,16 @@ func (q *Queries) UserGrant(ctx context.Context, shouldTriggerBulk bool, withOwn
return scan(row)
}
func (q *Queries) UserGrants(ctx context.Context, queries *UserGrantsQueries, withOwnerRemoved bool) (_ *UserGrants, err error) {
func (q *Queries) UserGrants(ctx context.Context, queries *UserGrantsQueries, shouldTriggerBulk, withOwnerRemoved bool) (_ *UserGrants, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
if shouldTriggerBulk {
logging.OnError(
projection.UserGrantProjection.Trigger(ctx),
).Debug("unable to trigger")
}
query, scan := prepareUserGrantsQuery(ctx, q.client)
eq := sq.Eq{UserGrantInstanceID.identifier(): authz.GetInstance(ctx).InstanceID()}
if !withOwnerRemoved {