mirror of
https://github.com/zitadel/zitadel.git
synced 2025-07-17 18:38:37 +00:00
658ca3606b
# Which Problems Are Solved Add the possibility to filter project resources based on project member roles. # How the Problems Are Solved Extend and refactor existing Pl/PgSQL functions to implement the following: - Solve O(n) complexity in returned resources IDs by returning a boolean filter for instance level permissions. - Individually permitted orgs are returned only if there was no instance permission - Individually permitted projects are returned only if there was no instance permission - Because of the multiple filter terms, use `INNER JOIN`s instead of `WHERE` clauses. # Additional Changes - system permission function no longer query the organization view and therefore can be `immutable`, giving big performance benefits for frequently reused system users. (like our hosted login in Zitadel cloud) - The permitted org and project functions are now defined as `stable` because the don't modify on-disk data. This might give a small performance gain - The Pl/PgSQL functions are now tested using Go unit tests. # Additional Context - Depends on https://github.com/zitadel/zitadel/pull/9677 - Part of https://github.com/zitadel/zitadel/issues/9188 - Closes https://github.com/zitadel/zitadel/issues/9190
38 lines
892 B
Go
38 lines
892 B
Go
package setup
|
|
|
|
import (
|
|
"context"
|
|
"embed"
|
|
"fmt"
|
|
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/internal/database"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
)
|
|
|
|
type InitPermittedOrgsFunction53 struct {
|
|
dbClient *database.DB
|
|
}
|
|
|
|
//go:embed 53/*.sql
|
|
var permittedOrgsFunction53 embed.FS
|
|
|
|
func (mig *InitPermittedOrgsFunction53) Execute(ctx context.Context, _ eventstore.Event) error {
|
|
statements, err := readStatements(permittedOrgsFunction53, "53")
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for _, stmt := range statements {
|
|
logging.WithFields("file", stmt.file, "migration", mig.String()).Info("execute statement")
|
|
if _, err := mig.dbClient.ExecContext(ctx, stmt.query); err != nil {
|
|
return fmt.Errorf("%s %s: %w", mig.String(), stmt.file, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (*InitPermittedOrgsFunction53) String() string {
|
|
return "53_init_permitted_orgs_function_v2"
|
|
}
|