mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-13 03:24:26 +00:00
8a5badddf6
* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix test * fix ports and enable console Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
199 lines
6.6 KiB
Go
199 lines
6.6 KiB
Go
package eventsourcing
|
|
|
|
import (
|
|
"context"
|
|
"github.com/caos/zitadel/internal/errors"
|
|
es_models "github.com/caos/zitadel/internal/eventstore/models"
|
|
org_model "github.com/caos/zitadel/internal/org/model"
|
|
"github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
|
|
)
|
|
|
|
func OrgByIDQuery(id string, latestSequence uint64) (*es_models.SearchQuery, error) {
|
|
if id == "" {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dke74", "id should be filled")
|
|
}
|
|
return OrgQuery(latestSequence).
|
|
AggregateIDFilter(id), nil
|
|
}
|
|
|
|
func OrgDomainUniqueQuery(domain string) *es_models.SearchQuery {
|
|
return es_models.NewSearchQuery().
|
|
AggregateTypeFilter(model.OrgDomainAggregate).
|
|
AggregateIDFilter(domain).
|
|
OrderDesc().
|
|
SetLimit(1)
|
|
}
|
|
|
|
func OrgNameUniqueQuery(name string) *es_models.SearchQuery {
|
|
return es_models.NewSearchQuery().
|
|
AggregateTypeFilter(model.OrgNameAggregate).
|
|
AggregateIDFilter(name).
|
|
OrderDesc().
|
|
SetLimit(1)
|
|
}
|
|
|
|
func OrgQuery(latestSequence uint64) *es_models.SearchQuery {
|
|
return es_models.NewSearchQuery().
|
|
AggregateTypeFilter(model.OrgAggregate).
|
|
LatestSequenceFilter(latestSequence)
|
|
}
|
|
|
|
func OrgAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, id string, sequence uint64) (*es_models.Aggregate, error) {
|
|
return aggCreator.NewAggregate(ctx, id, model.OrgAggregate, model.OrgVersion, sequence)
|
|
}
|
|
|
|
func orgCreatedAggregates(ctx context.Context, aggCreator *es_models.AggregateCreator, org *model.Org) (_ []*es_models.Aggregate, err error) {
|
|
if org == nil {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-kdie7", "org should not be nil")
|
|
}
|
|
|
|
domainAgrregate, err := uniqueDomainAggregate(ctx, aggCreator, org.AggregateID, org.Domain)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
nameAggregate, err := uniqueNameAggregate(ctx, aggCreator, org.AggregateID, org.Name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
agg, err := aggCreator.NewAggregate(ctx, org.AggregateID, model.OrgAggregate, model.OrgVersion, org.Sequence, es_models.OverwriteResourceOwner(org.AggregateID))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
agg, err = agg.AppendEvent(model.OrgAdded, org)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return []*es_models.Aggregate{
|
|
agg,
|
|
domainAgrregate,
|
|
nameAggregate,
|
|
}, nil
|
|
}
|
|
|
|
func OrgUpdateAggregates(ctx context.Context, aggCreator *es_models.AggregateCreator, existing *model.Org, updated *model.Org) ([]*es_models.Aggregate, error) {
|
|
if existing == nil {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dk83d", "existing org must not be nil")
|
|
}
|
|
if updated == nil {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-dhr74", "updated org must not be nil")
|
|
}
|
|
changes := existing.Changes(updated)
|
|
if len(changes) == 0 {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-E0hc5", "no changes")
|
|
}
|
|
|
|
aggregates := make([]*es_models.Aggregate, 0, 3)
|
|
|
|
if name, ok := changes["name"]; ok {
|
|
nameAggregate, err := uniqueNameAggregate(ctx, aggCreator, "", name.(string))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
aggregates = append(aggregates, nameAggregate)
|
|
}
|
|
|
|
if name, ok := changes["domain"]; ok {
|
|
domainAggregate, err := uniqueDomainAggregate(ctx, aggCreator, "", name.(string))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
aggregates = append(aggregates, domainAggregate)
|
|
}
|
|
|
|
orgAggregate, err := OrgAggregate(ctx, aggCreator, existing.AggregateID, existing.Sequence)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
orgAggregate, err = orgAggregate.AppendEvent(model.OrgChanged, changes)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
aggregates = append(aggregates, orgAggregate)
|
|
|
|
return aggregates, nil
|
|
}
|
|
|
|
func orgDeactivateAggregate(aggCreator *es_models.AggregateCreator, org *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
|
|
return func(ctx context.Context) (*es_models.Aggregate, error) {
|
|
if org == nil {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-R03z8", "existing org must not be nil")
|
|
}
|
|
if org.State == int32(org_model.ORGSTATE_INACTIVE) {
|
|
return nil, errors.ThrowInvalidArgument(nil, "EVENT-mcPH0", "org already inactive")
|
|
}
|
|
agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return agg.AppendEvent(model.OrgDeactivated, nil)
|
|
}
|
|
}
|
|
|
|
func orgReactivateAggregate(aggCreator *es_models.AggregateCreator, org *model.Org) func(ctx context.Context) (*es_models.Aggregate, error) {
|
|
return func(ctx context.Context) (*es_models.Aggregate, error) {
|
|
if org == nil {
|
|
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-cTHLd", "existing org must not be nil")
|
|
}
|
|
if org.State == int32(org_model.ORGSTATE_ACTIVE) {
|
|
return nil, errors.ThrowInvalidArgument(nil, "EVENT-pUSMs", "org already active")
|
|
}
|
|
agg, err := OrgAggregate(ctx, aggCreator, org.AggregateID, org.Sequence)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return agg.AppendEvent(model.OrgReactivated, nil)
|
|
}
|
|
}
|
|
|
|
func uniqueDomainAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, resourceOwner, domain string) (*es_models.Aggregate, error) {
|
|
aggregate, err := aggCreator.NewAggregate(ctx, domain, model.OrgDomainAggregate, model.OrgVersion, 0)
|
|
if resourceOwner != "" {
|
|
aggregate, err = aggCreator.NewAggregate(ctx, domain, model.OrgDomainAggregate, model.OrgVersion, 0, es_models.OverwriteResourceOwner(resourceOwner))
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
aggregate, err = aggregate.AppendEvent(model.OrgDomainReserved, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return aggregate.SetPrecondition(OrgDomainUniqueQuery(domain), isReservedValidation(aggregate, model.OrgDomainReserved)), nil
|
|
}
|
|
|
|
func uniqueNameAggregate(ctx context.Context, aggCreator *es_models.AggregateCreator, resourceOwner, name string) (aggregate *es_models.Aggregate, err error) {
|
|
aggregate, err = aggCreator.NewAggregate(ctx, name, model.OrgNameAggregate, model.OrgVersion, 0)
|
|
if resourceOwner != "" {
|
|
aggregate, err = aggCreator.NewAggregate(ctx, name, model.OrgNameAggregate, model.OrgVersion, 0, es_models.OverwriteResourceOwner(resourceOwner))
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
aggregate, err = aggregate.AppendEvent(model.OrgNameReserved, nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return aggregate.SetPrecondition(OrgNameUniqueQuery(name), isReservedValidation(aggregate, model.OrgNameReserved)), nil
|
|
}
|
|
|
|
func isReservedValidation(aggregate *es_models.Aggregate, resevedEventType es_models.EventType) func(...*es_models.Event) error {
|
|
return func(events ...*es_models.Event) error {
|
|
if len(events) == 0 {
|
|
aggregate.PreviousSequence = 0
|
|
return nil
|
|
}
|
|
if events[0].Type == resevedEventType {
|
|
return errors.ThrowPreconditionFailed(nil, "EVENT-eJQqe", "org already reseved")
|
|
}
|
|
aggregate.PreviousSequence = events[0].Sequence
|
|
return nil
|
|
}
|
|
}
|