mirror of
https://github.com/zitadel/zitadel.git
synced 2026-10-31 18:17:46 -05:00
9c047cc36d
* fix(oidc): permission check for admin user impersonation
* fix(oidc): scope impersonation permission check to the subject user
The permission check for (admin) impersonation read the user ID and
resource owner from the OIDC session write model. That write model is
not reduced yet at this point, so both values were empty. As a result
the membership lookup was narrowed to `resource_owner IN ('', instanceID)`,
which drops all org level memberships and breaks every ORG_*_IMPERSONATOR
actor, and the permission was no longer scoped to the impersonated user.
Pass both values explicitly again, as before the check was introduced.
Assert the permission name and its scope in the command unit tests, which
previously ignored all arguments of the permission check.
Add integration tests covering that an actor holding only the
`impersonation` permission may impersonate a regular user but not a user
with a membership, while an actor holding `admin.impersonation` may do
both.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* refactor(query): return context and error from triggerBatch
TriggerBatch did not return the last context as documented, which is required for resetting the request timestamp in the context. Also the previously logged error is now returned instead.
* fix(query): add triggers in admin check
* test(command): expect org active check in admin impersonation cases
The admin impersonation cases of TestCommands_CreateOIDCSession were
missing the org active filter introduced by the Login V2 deactivated
org check, so they failed with Errors.User.NotActive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>