mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-24 00:28:18 +00:00
8a5badddf6
* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix test * fix ports and enable console Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
159 lines
5.3 KiB
Go
159 lines
5.3 KiB
Go
package eventstore
|
|
|
|
import (
|
|
"context"
|
|
"github.com/caos/zitadel/internal/api/auth"
|
|
"github.com/caos/zitadel/internal/auth/repository/eventsourcing/view"
|
|
authz_repo "github.com/caos/zitadel/internal/authz/repository/eventsourcing"
|
|
caos_errs "github.com/caos/zitadel/internal/errors"
|
|
global_model "github.com/caos/zitadel/internal/model"
|
|
org_model "github.com/caos/zitadel/internal/org/model"
|
|
org_view "github.com/caos/zitadel/internal/org/repository/view"
|
|
grant_model "github.com/caos/zitadel/internal/usergrant/model"
|
|
"github.com/caos/zitadel/internal/usergrant/repository/view/model"
|
|
)
|
|
|
|
type UserGrantRepo struct {
|
|
SearchLimit uint64
|
|
View *view.View
|
|
IamID string
|
|
Auth auth.Config
|
|
AuthZRepo *authz_repo.EsRepository
|
|
}
|
|
|
|
func (repo *UserGrantRepo) SearchMyUserGrants(ctx context.Context, request *grant_model.UserGrantSearchRequest) (*grant_model.UserGrantSearchResponse, error) {
|
|
request.EnsureLimit(repo.SearchLimit)
|
|
request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.USERGRANTSEARCHKEY_USER_ID, Method: global_model.SEARCHMETHOD_EQUALS, Value: auth.GetCtxData(ctx).UserID})
|
|
grants, count, err := repo.View.SearchUserGrants(request)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &grant_model.UserGrantSearchResponse{
|
|
Offset: request.Offset,
|
|
Limit: request.Limit,
|
|
TotalResult: uint64(count),
|
|
Result: model.UserGrantsToModel(grants),
|
|
}, nil
|
|
}
|
|
|
|
func (repo *UserGrantRepo) SearchMyProjectOrgs(ctx context.Context, request *grant_model.UserGrantSearchRequest) (*grant_model.ProjectOrgSearchResponse, error) {
|
|
request.EnsureLimit(repo.SearchLimit)
|
|
ctxData := auth.GetCtxData(ctx)
|
|
if ctxData.ProjectID == "" {
|
|
return nil, caos_errs.ThrowPreconditionFailed(nil, "APP-7lqva", "Could not get ProjectID")
|
|
}
|
|
if ctxData.ProjectID == repo.AuthZRepo.IamProjectID {
|
|
isAdmin, err := repo.IsIamAdmin(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if isAdmin {
|
|
return repo.SearchAdminOrgs(request)
|
|
}
|
|
}
|
|
request.Queries = append(request.Queries, &grant_model.UserGrantSearchQuery{Key: grant_model.USERGRANTSEARCHKEY_PROJECT_ID, Method: global_model.SEARCHMETHOD_EQUALS, Value: ctxData.ProjectID})
|
|
|
|
grants, err := repo.SearchMyUserGrants(ctx, request)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return grantRespToOrgResp(grants), nil
|
|
}
|
|
|
|
func (repo *UserGrantRepo) SearchMyZitadelPermissions(ctx context.Context) ([]string, error) {
|
|
grant, err := repo.AuthZRepo.ResolveGrants(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
permissions := &grant_model.Permissions{Permissions: []string{}}
|
|
for _, role := range grant.Roles {
|
|
roleName, ctxID := auth.SplitPermission(role)
|
|
for _, mapping := range repo.Auth.RolePermissionMappings {
|
|
if mapping.Role == roleName {
|
|
permissions.AppendPermissions(ctxID, mapping.Permissions...)
|
|
}
|
|
}
|
|
}
|
|
return permissions.Permissions, nil
|
|
}
|
|
|
|
func (repo *UserGrantRepo) SearchAdminOrgs(request *grant_model.UserGrantSearchRequest) (*grant_model.ProjectOrgSearchResponse, error) {
|
|
searchRequest := &org_model.OrgSearchRequest{}
|
|
if len(request.Queries) > 0 {
|
|
for _, q := range request.Queries {
|
|
if q.Key == grant_model.USERGRANTSEARCHKEY_ORG_NAME {
|
|
searchRequest.Queries = append(searchRequest.Queries, &org_model.OrgSearchQuery{Key: org_model.ORGSEARCHKEY_ORG_NAME, Method: q.Method, Value: q.Value})
|
|
}
|
|
}
|
|
}
|
|
orgs, count, err := repo.View.SearchOrgs(searchRequest)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return orgRespToOrgResp(orgs, count), nil
|
|
}
|
|
|
|
func (repo *UserGrantRepo) IsIamAdmin(ctx context.Context) (bool, error) {
|
|
grantSearch := &grant_model.UserGrantSearchRequest{
|
|
Queries: []*grant_model.UserGrantSearchQuery{
|
|
&grant_model.UserGrantSearchQuery{Key: grant_model.USERGRANTSEARCHKEY_RESOURCEOWNER, Method: global_model.SEARCHMETHOD_EQUALS, Value: repo.IamID},
|
|
}}
|
|
result, err := repo.SearchMyUserGrants(ctx, grantSearch)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
if result.TotalResult == 0 {
|
|
return false, nil
|
|
}
|
|
return true, nil
|
|
}
|
|
|
|
func grantRespToOrgResp(grants *grant_model.UserGrantSearchResponse) *grant_model.ProjectOrgSearchResponse {
|
|
resp := &grant_model.ProjectOrgSearchResponse{
|
|
TotalResult: grants.TotalResult,
|
|
}
|
|
resp.Result = make([]*grant_model.Org, len(grants.Result))
|
|
for i, g := range grants.Result {
|
|
resp.Result[i] = &grant_model.Org{OrgID: g.ResourceOwner, OrgName: g.OrgName}
|
|
}
|
|
return resp
|
|
}
|
|
|
|
func orgRespToOrgResp(orgs []*org_view.OrgView, count int) *grant_model.ProjectOrgSearchResponse {
|
|
resp := &grant_model.ProjectOrgSearchResponse{
|
|
TotalResult: uint64(count),
|
|
}
|
|
resp.Result = make([]*grant_model.Org, len(orgs))
|
|
for i, o := range orgs {
|
|
resp.Result[i] = &grant_model.Org{OrgID: o.ID, OrgName: o.Name}
|
|
}
|
|
return resp
|
|
}
|
|
|
|
func mergeOrgAndAdminGrant(ctxData auth.CtxData, orgGrant, iamAdminGrant *model.UserGrantView) (grant *auth.Grant) {
|
|
if orgGrant != nil {
|
|
roles := orgGrant.RoleKeys
|
|
if iamAdminGrant != nil {
|
|
roles = addIamAdminRoles(roles, iamAdminGrant.RoleKeys)
|
|
}
|
|
grant = &auth.Grant{OrgID: orgGrant.ResourceOwner, Roles: roles}
|
|
} else if iamAdminGrant != nil {
|
|
grant = &auth.Grant{
|
|
OrgID: ctxData.OrgID,
|
|
Roles: iamAdminGrant.RoleKeys,
|
|
}
|
|
}
|
|
return grant
|
|
}
|
|
|
|
func addIamAdminRoles(orgRoles, iamAdminRoles []string) []string {
|
|
result := make([]string, 0)
|
|
result = append(result, iamAdminRoles...)
|
|
for _, role := range orgRoles {
|
|
if !auth.ExistsPerm(result, role) {
|
|
result = append(result, role)
|
|
}
|
|
}
|
|
return result
|
|
}
|