package eventsourcing import ( "context" "github.com/caos/zitadel/internal/errors" es_models "github.com/caos/zitadel/internal/eventstore/models" "github.com/caos/zitadel/internal/iam/repository/eventsourcing/model" ) func IAMByIDQuery(id string, latestSequence uint64) (*es_models.SearchQuery, error) { if id == "" { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-0soe4", "Errors.IAM.IDMissing") } return IAMQuery(latestSequence). AggregateIDFilter(id), nil } func IAMQuery(latestSequence uint64) *es_models.SearchQuery { return es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). LatestSequenceFilter(latestSequence) } func IAMAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, iam *model.IAM) (*es_models.Aggregate, error) { if iam == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-lo04e", "Errors.Internal") } return aggCreator.NewAggregate(ctx, iam.AggregateID, model.IAMAggregate, model.IAMVersion, iam.Sequence) } func IAMAggregateOverwriteContext(ctx context.Context, aggCreator *es_models.AggregateCreator, iam *model.IAM, resourceOwnerID string, userID string) (*es_models.Aggregate, error) { if iam == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dis83", "Errors.Internal") } return aggCreator.NewAggregate(ctx, iam.AggregateID, model.IAMAggregate, model.IAMVersion, iam.Sequence, es_models.OverwriteResourceOwner(resourceOwnerID), es_models.OverwriteEditorUser(userID)) } func IAMSetupStartedAggregate(aggCreator *es_models.AggregateCreator, iam *model.IAM) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { agg, err := IAMAggregate(ctx, aggCreator, iam) if err != nil { return nil, err } return agg.AppendEvent(model.IAMSetupStarted, &struct{ Step model.Step }{Step: iam.SetUpStarted}) } } func IAMSetupDoneAggregate(aggCreator *es_models.AggregateCreator, iam *model.IAM) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { agg, err := IAMAggregate(ctx, aggCreator, iam) if err != nil { return nil, err } return agg.AppendEvent(model.IAMSetupDone, &struct{ Step model.Step }{Step: iam.SetUpDone}) } } func IAMSetupDoneEvent(ctx context.Context, agg *es_models.Aggregate, iam *model.IAM) (*es_models.Aggregate, error) { return agg.AppendEvent(model.IAMSetupDone, &struct{ Step model.Step }{Step: iam.SetUpDone}) } func IAMSetGlobalOrgAggregate(aggCreator *es_models.AggregateCreator, iam *model.IAM, globalOrg string) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if globalOrg == "" { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-8siwa", "Errors.IAM.GlobalOrgMissing") } agg, err := IAMAggregate(ctx, aggCreator, iam) if err != nil { return nil, err } return agg.AppendEvent(model.GlobalOrgSet, &model.IAM{GlobalOrgID: globalOrg}) } } func IAMSetIamProjectAggregate(aggCreator *es_models.AggregateCreator, iam *model.IAM, projectID string) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if projectID == "" { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-sjuw3", "Errors.IAM.IamProjectIDMisisng") } agg, err := IAMAggregate(ctx, aggCreator, iam) if err != nil { return nil, err } return agg.AppendEvent(model.IAMProjectSet, &model.IAM{IAMProjectID: projectID}) } } func IAMMemberAddedAggregate(aggCreator *es_models.AggregateCreator, existingIAM *model.IAM, member *model.IAMMember) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if member == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-9sope", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existingIAM) if err != nil { return nil, err } return agg.AppendEvent(model.IAMMemberAdded, member) } } func IAMMemberChangedAggregate(aggCreator *es_models.AggregateCreator, existingIAM *model.IAM, member *model.IAMMember) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if member == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-38skf", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existingIAM) if err != nil { return nil, err } return agg.AppendEvent(model.IAMMemberChanged, member) } } func IAMMemberRemovedAggregate(aggCreator *es_models.AggregateCreator, existingIAM *model.IAM, member *model.IAMMember) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if member == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-90lsw", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existingIAM) if err != nil { return nil, err } return agg.AppendEvent(model.IAMMemberRemoved, member) } } func IDPConfigAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, idp *model.IDPConfig) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if idp == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-MSn7d", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } agg, err = agg.AppendEvent(model.IDPConfigAdded, idp) if err != nil { return nil, err } if idp.OIDCIDPConfig != nil { return agg.AppendEvent(model.OIDCIDPConfigAdded, idp.OIDCIDPConfig) } return agg, nil } } func IDPConfigChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, idp *model.IDPConfig) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if idp == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Amc7s", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } var changes map[string]interface{} for _, i := range existing.IDPs { if i.IDPConfigID == idp.IDPConfigID { changes = i.Changes(idp) } } return agg.AppendEvent(model.IDPConfigChanged, changes) } } func IDPConfigRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, idp *model.IDPConfig, provider *model.IDPProvider) (*es_models.Aggregate, error) { if idp == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-se23g", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } agg, err = agg.AppendEvent(model.IDPConfigRemoved, &model.IDPConfigID{IDPConfigID: idp.IDPConfigID}) if err != nil { return nil, err } if provider != nil { return agg.AppendEvent(model.LoginPolicyIDPProviderCascadeRemoved, &model.IDPConfigID{IDPConfigID: idp.IDPConfigID}) } return agg, nil } func IDPConfigDeactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, idp *model.IDPConfig) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if idp == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slfi3", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } return agg.AppendEvent(model.IDPConfigDeactivated, &model.IDPConfigID{IDPConfigID: idp.IDPConfigID}) } } func IDPConfigReactivatedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, idp *model.IDPConfig) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if idp == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } return agg.AppendEvent(model.IDPConfigReactivated, &model.IDPConfigID{IDPConfigID: idp.IDPConfigID}) } } func OIDCIDPConfigChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, config *model.OIDCIDPConfig) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if config == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-slf32", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } var changes map[string]interface{} for _, idp := range existing.IDPs { if idp.IDPConfigID == config.IDPConfigID && idp.OIDCIDPConfig != nil { changes = idp.OIDCIDPConfig.Changes(config) } } if len(changes) <= 1 { return nil, errors.ThrowPreconditionFailedf(nil, "EVENT-Cml9s", "Errors.NoChangesFound") } return agg.AppendEvent(model.OIDCIDPConfigChanged, changes) } } func LabelPolicyAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.LabelPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-e248Y", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.LabelPolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingLabelPolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.LabelPolicyAdded, policy) } } func checkExistingLabelPolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.LabelPolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-KyLIK", "Errors.IAM.LabelPolicy.AlreadyExists") } } return nil } } func LabelPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.LabelPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-uP6HQ", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultLabelPolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-hZE24", "Errors.NoChangesFound") } return agg.AppendEvent(model.LabelPolicyChanged, changes) } } func LoginPolicyAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.LoginPolicy) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smla8", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.LoginPolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingLoginPolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.LoginPolicyAdded, policy) } func LoginPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.LoginPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Mlco9", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultLoginPolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smk8d", "Errors.NoChangesFound") } return agg.AppendEvent(model.LoginPolicyChanged, changes) } } func LoginPolicyIDPProviderAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, provider *model.IDPProvider) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if provider == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sml9d", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). AggregateIDFilter(existing.AggregateID) validation := checkExistingLoginPolicyIDPProviderValidation(provider.IDPConfigID) agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.LoginPolicyIDPProviderAdded, provider) } } func LoginPolicyIDPProviderRemovedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, provider *model.IDPProviderID) (*es_models.Aggregate, error) { if provider == nil || existing == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Sml9d", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } return agg.AppendEvent(model.LoginPolicyIDPProviderRemoved, provider) } func LoginPolicySecondFactorAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, mfa *model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if mfa == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-4Gm9s", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). AggregateIDFilter(existing.AggregateID) validation := checkExistingLoginPolicySecondFactorValidation(mfa.MFAType) agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.LoginPolicySecondFactorAdded, mfa) } } func LoginPolicySecondFactorRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, mfa *model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if mfa == nil || existing == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-5Bm9s", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } return agg.AppendEvent(model.LoginPolicySecondFactorRemoved, mfa) } } func LoginPolicyMultiFactorAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, mfa *model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if mfa == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-4Gm9s", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). AggregateIDFilter(existing.AggregateID) validation := checkExistingLoginPolicyMultiFactorValidation(mfa.MFAType) agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.LoginPolicyMultiFactorAdded, mfa) } } func LoginPolicyMultiFactorRemovedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, mfa *model.MFA) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if mfa == nil || existing == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-6Mso9", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } return agg.AppendEvent(model.LoginPolicyMultiFactorRemoved, mfa) } } func PasswordComplexityPolicyAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordComplexityPolicy) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smla8", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.PasswordComplexityPolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingPasswordComplexityPolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.PasswordComplexityPolicyAdded, policy) } func PasswordComplexityPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordComplexityPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Mlco9", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultPasswordComplexityPolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-Smk8d", "Errors.NoChangesFound") } return agg.AppendEvent(model.PasswordComplexityPolicyChanged, changes) } } func PasswordAgePolicyAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordAgePolicy) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-T7sui", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.PasswordAgePolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingPasswordAgePolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.PasswordAgePolicyAdded, policy) } func PasswordAgePolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordAgePolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-3Gs0o", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultPasswordAgePolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-3Wdos", "Errors.NoChangesFound") } return agg.AppendEvent(model.PasswordAgePolicyChanged, changes) } } func PasswordLockoutPolicyAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordLockoutPolicy) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-w5Tds", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.PasswordLockoutPolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingPasswordLockoutPolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.PasswordLockoutPolicyAdded, policy) } func PasswordLockoutPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.PasswordLockoutPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-2D0fs", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultPasswordLockoutPolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-7Hsk9", "Errors.NoChangesFound") } return agg.AppendEvent(model.PasswordLockoutPolicyChanged, changes) } } func OrgIAMPolicyAddedAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.OrgIAMPolicy) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-w5Tds", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } validationQuery := es_models.NewSearchQuery(). AggregateTypeFilter(model.IAMAggregate). EventTypesFilter(model.OrgIAMPolicyAdded). AggregateIDFilter(existing.AggregateID) validation := checkExistingOrgIAMPolicyValidation() agg.SetPrecondition(validationQuery, validation) return agg.AppendEvent(model.OrgIAMPolicyAdded, policy) } func OrgIAMPolicyChangedAggregate(aggCreator *es_models.AggregateCreator, existing *model.IAM, policy *model.OrgIAMPolicy) func(ctx context.Context) (*es_models.Aggregate, error) { return func(ctx context.Context) (*es_models.Aggregate, error) { if policy == nil { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-2D0fs", "Errors.Internal") } agg, err := IAMAggregate(ctx, aggCreator, existing) if err != nil { return nil, err } changes := existing.DefaultOrgIAMPolicy.Changes(policy) if len(changes) == 0 { return nil, errors.ThrowPreconditionFailed(nil, "EVENT-7Hsk9", "Errors.NoChangesFound") } return agg.AppendEvent(model.OrgIAMPolicyChanged, changes) } } func checkExistingLoginPolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.LoginPolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-Ski9d", "Errors.IAM.LoginPolicy.AlreadyExists") } } return nil } } func checkExistingPasswordComplexityPolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.PasswordComplexityPolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-Ski9d", "Errors.IAM.PasswordComplexityPolicy.AlreadyExists") } } return nil } } func checkExistingPasswordAgePolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.PasswordAgePolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-Ski9d", "Errors.IAM.PasswordAgePolicy.AlreadyExists") } } return nil } } func checkExistingPasswordLockoutPolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.PasswordLockoutPolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-Ski9d", "Errors.IAM.PasswordLockoutPolicy.AlreadyExists") } } return nil } } func checkExistingOrgIAMPolicyValidation() func(...*es_models.Event) error { return func(events ...*es_models.Event) error { for _, event := range events { switch event.Type { case model.OrgIAMPolicyAdded: return errors.ThrowPreconditionFailed(nil, "EVENT-bSm8f", "Errors.IAM.OrgIAMPolicy.AlreadyExists") } } return nil } } func checkExistingLoginPolicyIDPProviderValidation(idpConfigID string) func(...*es_models.Event) error { return func(events ...*es_models.Event) error { idpConfigs := make([]*model.IDPConfig, 0) idps := make([]*model.IDPProvider, 0) for _, event := range events { switch event.Type { case model.IDPConfigAdded: config := new(model.IDPConfig) err := config.SetData(event) if err != nil { return err } idpConfigs = append(idpConfigs, config) case model.IDPConfigRemoved: config := new(model.IDPConfig) err := config.SetData(event) if err != nil { return err } for i := len(idpConfigs) - 1; i >= 0; i-- { if idpConfigs[i].IDPConfigID == config.IDPConfigID { idpConfigs[i] = idpConfigs[len(idpConfigs)-1] idpConfigs[len(idpConfigs)-1] = nil idpConfigs = idpConfigs[:len(idpConfigs)-1] break } } case model.LoginPolicyIDPProviderAdded: idp := new(model.IDPProvider) err := idp.SetData(event) if err != nil { return err } idps = append(idps, idp) case model.LoginPolicyIDPProviderRemoved: idp := new(model.IDPProvider) err := idp.SetData(event) if err != nil { return err } for i := len(idps) - 1; i >= 0; i-- { if idps[i].IDPConfigID == idp.IDPConfigID { idps[i] = idps[len(idps)-1] idps[len(idps)-1] = nil idps = idps[:len(idps)-1] break } } } } exists := false for _, p := range idpConfigs { if p.IDPConfigID == idpConfigID { exists = true } } if !exists { return errors.ThrowPreconditionFailed(nil, "EVENT-Djlo9", "Errors.IAM.IdpNotExisting") } for _, p := range idps { if p.IDPConfigID == idpConfigID { return errors.ThrowPreconditionFailed(nil, "EVENT-us5Zw", "Errors.IAM.LoginPolicy.IdpProviderAlreadyExisting") } } return nil } } func checkExistingLoginPolicySecondFactorValidation(mfaType int32) func(...*es_models.Event) error { return func(events ...*es_models.Event) error { mfas := make([]int32, 0) for _, event := range events { switch event.Type { case model.LoginPolicySecondFactorAdded: idp := new(model.MFA) err := idp.SetData(event) if err != nil { return err } mfas = append(mfas, idp.MFAType) case model.LoginPolicySecondFactorRemoved: mfa := new(model.MFA) err := mfa.SetData(event) if err != nil { return err } for i := len(mfas) - 1; i >= 0; i-- { if mfas[i] == mfa.MFAType { mfas[i] = mfas[len(mfas)-1] mfas[len(mfas)-1] = 0 mfas = mfas[:len(mfas)-1] break } } } } for _, m := range mfas { if m == mfaType { return errors.ThrowPreconditionFailed(nil, "EVENT-3vmHd", "Errors.IAM.LoginPolicy.MFA.AlreadyExisting") } } return nil } } func checkExistingLoginPolicyMultiFactorValidation(mfaType int32) func(...*es_models.Event) error { return func(events ...*es_models.Event) error { mfas := make([]int32, 0) for _, event := range events { switch event.Type { case model.LoginPolicyMultiFactorAdded: idp := new(model.MFA) err := idp.SetData(event) if err != nil { return err } mfas = append(mfas, idp.MFAType) case model.LoginPolicyMultiFactorRemoved: mfa := new(model.MFA) err := mfa.SetData(event) if err != nil { return err } for i := len(mfas) - 1; i >= 0; i-- { if mfas[i] == mfa.MFAType { mfas[i] = mfas[len(mfas)-1] mfas[len(mfas)-1] = 0 mfas = mfas[:len(mfas)-1] break } } } } for _, m := range mfas { if m == mfaType { return errors.ThrowPreconditionFailed(nil, "EVENT-6Hsj89", "Errors.IAM.LoginPolicy.MFA.AlreadyExisting") } } return nil } }