mirror of
https://github.com/zitadel/zitadel.git
synced 2025-03-01 10:57:27 +00:00
0cb0380826
# Which Problems Are Solved Performance issue for GRPC call `zitadel.user.v2.UserService.ListUsers` due to lack of org filtering on `ListUsers` # Additional Context Replace this example with links to related issues, discussions, discord threads, or other sources with more context. Use the Closing #issue syntax for issues that are resolved with this PR. - Closes https://github.com/zitadel/zitadel/issues/9191 --------- Co-authored-by: Iraq Jaber <IraqJaber@gmail.com> Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
38 lines
1.3 KiB
Go
38 lines
1.3 KiB
Go
package query
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
sq "github.com/Masterminds/squirrel"
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
)
|
|
|
|
const (
|
|
// eventstore.permitted_orgs(instanceid text, userid text, perm text, filter_orgs text)
|
|
wherePermittedOrgsClause = "%s = ANY(eventstore.permitted_orgs(?, ?, ?, ?))"
|
|
)
|
|
|
|
// wherePermittedOrgs sets a `WHERE` clause to the query that filters the orgs
|
|
// for which the authenticated user has the requested permission for.
|
|
// The user ID is taken from the context.
|
|
//
|
|
// The `orgIDColumn` specifies the table column to which this filter must be applied,
|
|
// and is typically the `resource_owner` column in ZITADEL.
|
|
// We use full identifiers in the query builder so this function should be
|
|
// called with something like `UserResourceOwnerCol.identifier()` for example.
|
|
func wherePermittedOrgs(ctx context.Context, query sq.SelectBuilder, filterOrgIds, orgIDColumn, permission string) sq.SelectBuilder {
|
|
userID := authz.GetCtxData(ctx).UserID
|
|
logging.WithFields("permission_check_v2_flag", authz.GetFeatures(ctx).PermissionCheckV2, "org_id_column", orgIDColumn, "permission", permission, "user_id", userID).Debug("permitted orgs check used")
|
|
|
|
return query.Where(
|
|
fmt.Sprintf(wherePermittedOrgsClause, orgIDColumn),
|
|
authz.GetInstance(ctx).InstanceID(),
|
|
userID,
|
|
permission,
|
|
filterOrgIds,
|
|
)
|
|
}
|