GitHub/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2026-07-25 18:28:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source
This commit is contained in:
Livio Spring
2026-02-25 06:34:17 +01:00
committed by GitHub
parent b2532e9666
commit 0261536243
3 changed files with 112 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/grpc/user/v2/integration_test/user_test.go
+50
View File
@@ -4016,6 +4016,56 @@ func TestServer_UpdateUserTypeHuman(t *testing.T) {
}
},
},
{
name: "verified email",
testCase: func(runId, userId string) testCase {
return testCase{
args: args{
OrgCTX,
&user.UpdateUserRequest{
UserId: userId,
UserType: &user.UpdateUserRequest_Human_{
Human: &user.UpdateUserRequest_Human{
Email: &user.SetHumanEmail{
Email: integration.Email(),
Verification: &user.SetHumanEmail_IsVerified{
IsVerified: true,
},
},
},
},
},
},
wantErr: false,
}
},
},
{
name: "verified email (self-management), error",
testCase: func(runId, userId string) testCase {
Instance.SetUserPassword(LoginCTX, userId, integration.UserPassword, false)
_, token, _, _ := Instance.CreatePasswordSession(t, LoginCTX, userId, integration.UserPassword)
return testCase{
args: args{
integration.WithAuthorizationToken(CTX, token),
&user.UpdateUserRequest{
UserId: userId,
UserType: &user.UpdateUserRequest_Human_{
Human: &user.UpdateUserRequest_Human{
Email: &user.SetHumanEmail{
Email: integration.Email(),
Verification: &user.SetHumanEmail_IsVerified{
IsVerified: true,
},
},
},
},
},
},
wantErr: true,
}
},
},
{
name: "password not complexity conform",
testCase: func(runId, userId string) testCase {
internal/command/user_v2_human.go
+3 -1
View File
@@ -297,7 +297,9 @@ func (c *Commands) ChangeUserHuman(ctx context.Context, human *ChangeHuman, alg
}
if human.Changed() {
if err := c.checkPermissionUpdateUser(ctx, existingHuman.ResourceOwner, existingHuman.AggregateID, !metadataChanged); err != nil {
// Changing metadata or setting email, resp. phone to verified is only allowed with user write permissions, but not for self-management.
requireWritePermission := metadataChanged || (human.Email != nil && human.Email.Verified) || (human.Phone != nil && human.Phone.Verified)
if err := c.checkPermissionUpdateUser(ctx, existingHuman.ResourceOwner, existingHuman.AggregateID, !requireWritePermission); err != nil {
return err
}
}
internal/command/user_v2_human_test.go
+59
View File
@@ -12,6 +12,7 @@ import (
"go.uber.org/mock/gomock"
"golang.org/x/text/language"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/eventstore"
@@ -2699,6 +2700,35 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
},
},
},
{
name: "change human email verified (self-management), not allowed",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
newAddHumanEvent("$plain$x$password", true, true, "", language.English),
),
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: authz.NewMockContext("instance1", "org1", "user1"),
orgID: "org1",
human: &ChangeHuman{
Email: &Email{
Address: "changed@example.com",
Verified: true,
},
},
},
res: res{
err: func(err error) bool {
return errors.Is(err, zerrors.ThrowPermissionDenied(nil, "AUTHZ-HKJD33", "Errors.PermissionDenied"))
},
},
},
{
name: "change human email verified, ok",
fields: fields{
@@ -3019,6 +3049,35 @@ func TestCommandSide_ChangeUserHuman(t *testing.T) {
},
},
},
{
name: "change human phone verified (self-management), not allowed",
fields: fields{
eventstore: expectEventstore(
expectFilter(
eventFromEventPusher(
newAddHumanEvent("$plain$x$password", true, true, "", language.English),
),
),
),
checkPermission: newMockPermissionCheckNotAllowed(),
tarpit: expectTarpit(0),
},
args: args{
ctx: authz.NewMockContext("instance1", "org1", "user1"),
orgID: "org1",
human: &ChangeHuman{
Phone: &Phone{
Number: "+41791234567",
Verified: true,
},
},
},
res: res{
err: func(err error) bool {
return errors.Is(err, zerrors.ThrowPermissionDenied(nil, "AUTHZ-HKJD33", "Errors.PermissionDenied"))
},
},
},
{
name: "change human phone verified, ok",
fields: fields{