mirror of
https://github.com/zitadel/zitadel.git
synced 2025-12-06 09:12:19 +00:00
fa83c39510
# Which Problems Are Solved
This PR fixes the self-management of users for metadata and own removal
and improves the corresponding permission checks.
While looking into the problems, I also noticed that there's a bug in
the metadata mapping when using `api.metadata.push` in actions v1 and
that re-adding a previously existing key after its removal was not
possible.
# How the Problems Are Solved
- Added a parameter `allowSelfManagement` to checkPermissionOnUser to
not require a permission if a user is changing its own data.
- Updated use of `NewPermissionCheckUserWrite` including prevention of
self-management for metadata.
- Pass permission check to the command side (for metadata functions) to
allow it implicitly for login v1 and actions v1.
- Use of json.Marshal for the metadata mapping (as with
`AppendMetadata`)
- Check the metadata state when comparing the value.
# Additional Changes
- added a variadic `roles` parameter to the `CreateOrgMembership`
integration test helper function to allow defining specific roles.
# Additional Context
- noted internally while testing v4.1.x
- requires backport to v4.x
- closes https://github.com/zitadel/zitadel/issues/10470
- relates to https://github.com/zitadel/zitadel/pull/10426
(cherry picked from commit 5329d50509)
75 lines
3.2 KiB
Go
75 lines
3.2 KiB
Go
package domain
|
|
|
|
import "context"
|
|
|
|
type Permissions struct {
|
|
Permissions []string
|
|
}
|
|
|
|
func (p *Permissions) AppendPermissions(ctxID string, permissions ...string) {
|
|
for _, permission := range permissions {
|
|
p.appendPermission(ctxID, permission)
|
|
}
|
|
}
|
|
|
|
func (p *Permissions) appendPermission(ctxID, permission string) {
|
|
if ctxID != "" {
|
|
permission = permission + ":" + ctxID
|
|
}
|
|
for _, existingPermission := range p.Permissions {
|
|
if existingPermission == permission {
|
|
return
|
|
}
|
|
}
|
|
p.Permissions = append(p.Permissions, permission)
|
|
}
|
|
|
|
type PermissionCheck func(ctx context.Context, permission, resourceOwnerID, aggregateID string) (err error)
|
|
|
|
const (
|
|
PermissionUserWrite = "user.write"
|
|
PermissionUserRead = "user.read"
|
|
PermissionUserDelete = "user.delete"
|
|
PermissionUserDeleteSelf = "user.self.delete"
|
|
PermissionUserCredentialWrite = "user.credential.write"
|
|
PermissionSessionWrite = "session.write"
|
|
PermissionSessionRead = "session.read"
|
|
PermissionSessionLink = "session.link"
|
|
PermissionSessionDelete = "session.delete"
|
|
PermissionOrgRead = "org.read"
|
|
PermissionIDPRead = "iam.idp.read"
|
|
PermissionOrgIDPRead = "org.idp.read"
|
|
PermissionProjectCreate = "project.create"
|
|
PermissionProjectWrite = "project.write"
|
|
PermissionProjectRead = "project.read"
|
|
PermissionProjectDelete = "project.delete"
|
|
PermissionProjectGrantWrite = "project.grant.write"
|
|
PermissionProjectGrantRead = "project.grant.read"
|
|
PermissionProjectGrantDelete = "project.grant.delete"
|
|
PermissionProjectRoleWrite = "project.role.write"
|
|
PermissionProjectRoleRead = "project.role.read"
|
|
PermissionProjectRoleDelete = "project.role.delete"
|
|
PermissionProjectAppWrite = "project.app.write"
|
|
PermissionProjectAppDelete = "project.app.delete"
|
|
PermissionProjectAppRead = "project.app.read"
|
|
PermissionInstanceMemberWrite = "iam.member.write"
|
|
PermissionInstanceMemberDelete = "iam.member.delete"
|
|
PermissionInstanceMemberRead = "iam.member.read"
|
|
PermissionOrgMemberWrite = "org.member.write"
|
|
PermissionOrgMemberDelete = "org.member.delete"
|
|
PermissionOrgMemberRead = "org.member.read"
|
|
PermissionProjectMemberWrite = "project.member.write"
|
|
PermissionProjectMemberDelete = "project.member.delete"
|
|
PermissionProjectMemberRead = "project.member.read"
|
|
PermissionProjectGrantMemberWrite = "project.grant.member.write"
|
|
PermissionProjectGrantMemberDelete = "project.grant.member.delete"
|
|
PermissionProjectGrantMemberRead = "project.grant.member.read"
|
|
PermissionUserGrantWrite = "user.grant.write"
|
|
PermissionUserGrantRead = "user.grant.read"
|
|
PermissionUserGrantDelete = "user.grant.delete"
|
|
)
|
|
|
|
// ProjectPermissionCheck is used as a check for preconditions dependent on application, project, user resourceowner and usergrants.
|
|
// Configurable on the project the application belongs to through the flags related to authentication.
|
|
type ProjectPermissionCheck func(ctx context.Context, clientID, userID string) (err error)
|