This commit is contained in:
506
scripts/zitadel-roles.mjs
Normal file
506
scripts/zitadel-roles.mjs
Normal file
@@ -0,0 +1,506 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* zitadel-roles.mjs — diagnose and repair the OpenClaw Platform project's
|
||||
* role keys + customer authorizations. Group A of the bug triage.
|
||||
*
|
||||
* Subcommands
|
||||
* -----------
|
||||
* diagnose Print the project's current roles and a raw dump
|
||||
* of all authorizations granted on the project.
|
||||
* Read-only. Safe to run any time.
|
||||
*
|
||||
* apply Idempotently create the four canonical role keys
|
||||
* (owner, user, platform_admin, platform_operator)
|
||||
* if they are missing. Existing roles are left as
|
||||
* they are; legacy keys (e.g. "customer") are NOT
|
||||
* deleted by this command — see `migrate-auth`.
|
||||
*
|
||||
* migrate-auth <user> Drop every authorization the given user holds
|
||||
* on the project and replace with a single
|
||||
* authorization carrying ["owner"]. Use after
|
||||
* `apply` to promote a legacy customer to the
|
||||
* new role keys. Idempotent.
|
||||
*
|
||||
* migrate-grants Ensure every existing project grant on the
|
||||
* OpenClaw Platform project includes both
|
||||
* `owner` and `user` role keys. Without `user`
|
||||
* in the grant, `CreateAuthorization` for an
|
||||
* invited member returns Errors.Project.Role.NotFound
|
||||
* (Bug 21). Idempotent: grants already containing
|
||||
* both keys are skipped.
|
||||
*
|
||||
* Env vars (loaded from .env if you run with `node --env-file=.env`):
|
||||
* ZITADEL_ISSUER e.g. https://auth.pieced.ch
|
||||
* ZITADEL_SA_PAT PAT for pieced-sa (IAM_OWNER)
|
||||
* ZITADEL_PROJECT_ID e.g. 367435120493199793
|
||||
*
|
||||
* Examples
|
||||
* --------
|
||||
* node --env-file=.env scripts/zitadel-roles.mjs diagnose
|
||||
* node --env-file=.env scripts/zitadel-roles.mjs apply
|
||||
* node --env-file=.env scripts/zitadel-roles.mjs migrate-auth 12345...
|
||||
*
|
||||
* The script does not import from src/ on purpose — it must be runnable
|
||||
* even when the portal can't start (which is the failure mode we're
|
||||
* here to repair).
|
||||
*/
|
||||
|
||||
const ISSUER = process.env.ZITADEL_ISSUER;
|
||||
const PAT = process.env.ZITADEL_SA_PAT;
|
||||
const PROJECT_ID = process.env.ZITADEL_PROJECT_ID;
|
||||
|
||||
if (!ISSUER || !PAT || !PROJECT_ID) {
|
||||
console.error(
|
||||
"Missing env. Need ZITADEL_ISSUER, ZITADEL_SA_PAT, ZITADEL_PROJECT_ID."
|
||||
);
|
||||
console.error("Run with: node --env-file=.env scripts/zitadel-roles.mjs ...");
|
||||
process.exit(2);
|
||||
}
|
||||
|
||||
// Canonical role set — must match types/index.ts (CustomerRole + PlatformRole).
|
||||
const CANONICAL = [
|
||||
{ key: "owner", displayName: "Customer Owner", group: "Customer" },
|
||||
{ key: "user", displayName: "Customer User", group: "Customer" },
|
||||
{ key: "platform_admin", displayName: "Platform Admin", group: "Platform" },
|
||||
{
|
||||
key: "platform_operator",
|
||||
displayName: "Platform Operator",
|
||||
group: "Platform",
|
||||
},
|
||||
];
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// HTTP plumbing — Connect RPC against ZITADEL v2 services.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function rpc(service, method, body) {
|
||||
const url = `${ISSUER}/${service}/${method}`;
|
||||
const res = await fetch(url, {
|
||||
method: "POST",
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Accept: "application/json",
|
||||
Authorization: `Bearer ${PAT}`,
|
||||
"Connect-Protocol-Version": "1",
|
||||
},
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
const text = await res.text();
|
||||
if (!res.ok) {
|
||||
const err = new Error(`${service}/${method} -> ${res.status}: ${text}`);
|
||||
err.status = res.status;
|
||||
err.body = text;
|
||||
throw err;
|
||||
}
|
||||
return text ? JSON.parse(text) : {};
|
||||
}
|
||||
|
||||
const projectSvc = "zitadel.project.v2.ProjectService";
|
||||
const authSvc = "zitadel.authorization.v2.AuthorizationService";
|
||||
|
||||
async function listProjectRoles() {
|
||||
const data = await rpc(projectSvc, "ListProjectRoles", {
|
||||
projectId: PROJECT_ID,
|
||||
});
|
||||
return Array.isArray(data?.projectRoles) ? data.projectRoles : [];
|
||||
}
|
||||
|
||||
async function addProjectRole(roleKey, displayName, group) {
|
||||
return rpc(projectSvc, "AddProjectRole", {
|
||||
projectId: PROJECT_ID,
|
||||
roleKey,
|
||||
displayName,
|
||||
...(group ? { group } : {}),
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* The Connect RPC filter shape for ListAuthorizations is a oneof variant
|
||||
* map — each filter has a discriminator key matching one of the variants
|
||||
* documented as `authorization_ids|in_user_ids|organization_id|project_id|
|
||||
* role_key|...`. Different ZITADEL services and versions differ on the
|
||||
* exact wrapper naming (e.g. `projectId` vs `projectIdFilter`) and on
|
||||
* whether ID values are bare strings or wrapped in `{ id: "..." }`.
|
||||
*
|
||||
* Rather than guess, we probe candidate shapes until ZITADEL accepts one.
|
||||
* The winner tells us exactly what to bake into `lib/zitadel.ts`. Each
|
||||
* candidate is labelled so the diagnostic output makes the right choice
|
||||
* obvious.
|
||||
*/
|
||||
const FILTER_CANDIDATES = [
|
||||
// No filter at all — ZITADEL returns whatever the SA can see. Slowest
|
||||
// but always works; useful as a control.
|
||||
{
|
||||
label: "no-filter",
|
||||
build: () => ({}),
|
||||
},
|
||||
// Pattern from discussion #8831 (roleKey -> key+method). Plausible
|
||||
// generalisation: project_id -> projectId.id
|
||||
{
|
||||
label: "projectId.id",
|
||||
build: (projectId) => ({ filters: [{ projectId: { id: projectId } }] }),
|
||||
},
|
||||
// Pattern from ProjectService.ListProjects (organizationIdFilter -> organizationId).
|
||||
{
|
||||
label: "projectIdFilter.id",
|
||||
build: (projectId) => ({
|
||||
filters: [{ projectIdFilter: { id: projectId } }],
|
||||
}),
|
||||
},
|
||||
// Same family but with the value field named after the filter, like the
|
||||
// user search API uses (`organizationIdQuery: { organizationId: "..." }`).
|
||||
{
|
||||
label: "projectIdFilter.projectId",
|
||||
build: (projectId) => ({
|
||||
filters: [{ projectIdFilter: { projectId } }],
|
||||
}),
|
||||
},
|
||||
// Bare-string variant — just in case.
|
||||
{
|
||||
label: "projectId (bare string)",
|
||||
build: (projectId) => ({ filters: [{ projectId }] }),
|
||||
},
|
||||
];
|
||||
|
||||
const USER_FILTER_CANDIDATES = [
|
||||
{ label: "userId.id", key: "userId", build: (id) => ({ id }) },
|
||||
{ label: "userIdFilter.id", key: "userIdFilter", build: (id) => ({ id }) },
|
||||
{ label: "userIdFilter.userId", key: "userIdFilter", build: (id) => ({ userId: id }) },
|
||||
];
|
||||
|
||||
/**
|
||||
* Try every candidate; return on the first one that returns 200. Logs each
|
||||
* attempt so a reader can see which shape won.
|
||||
*/
|
||||
async function probeListAuthorizations(extraFilters = []) {
|
||||
for (const c of FILTER_CANDIDATES) {
|
||||
const body = c.build(PROJECT_ID);
|
||||
if (extraFilters.length > 0) {
|
||||
body.filters = (body.filters || []).concat(extraFilters);
|
||||
}
|
||||
body.pagination = { limit: 500 };
|
||||
try {
|
||||
const data = await rpc(authSvc, "ListAuthorizations", body);
|
||||
const count = Array.isArray(data?.authorizations)
|
||||
? data.authorizations.length
|
||||
: 0;
|
||||
console.log(` OK ${c.label.padEnd(28)} -> ${count} authorization(s)`);
|
||||
return { label: c.label, body, data };
|
||||
} catch (err) {
|
||||
const oneLine = String(err.body || err.message)
|
||||
.replace(/\s+/g, " ")
|
||||
.slice(0, 110);
|
||||
console.log(` FAIL ${c.label.padEnd(28)} -> ${oneLine}`);
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
async function listUserAuthorizations(userId) {
|
||||
// Use the same project-filter shape that won the probe, plus a user-id
|
||||
// filter probed independently.
|
||||
const probed = await probeListAuthorizations();
|
||||
if (!probed) throw new Error("No filter shape accepted by ZITADEL");
|
||||
|
||||
for (const u of USER_FILTER_CANDIDATES) {
|
||||
const body = JSON.parse(JSON.stringify(probed.body));
|
||||
body.filters = (body.filters || []).concat([
|
||||
{ [u.key]: u.build(userId) },
|
||||
]);
|
||||
try {
|
||||
const data = await rpc(authSvc, "ListAuthorizations", body);
|
||||
console.log(` user filter ${u.label} accepted.`);
|
||||
return data;
|
||||
} catch (err) {
|
||||
// Try next.
|
||||
}
|
||||
}
|
||||
// Fallback: return all and filter client-side from the user dump.
|
||||
return probed.data;
|
||||
}
|
||||
|
||||
async function deleteAuthorization(authorizationId) {
|
||||
return rpc(authSvc, "DeleteAuthorization", { id: authorizationId });
|
||||
}
|
||||
|
||||
async function createAuthorization(userId, organizationId, roleKeys) {
|
||||
return rpc(authSvc, "CreateAuthorization", {
|
||||
userId,
|
||||
projectId: PROJECT_ID,
|
||||
organizationId,
|
||||
roleKeys,
|
||||
});
|
||||
}
|
||||
|
||||
async function listProjectGrants() {
|
||||
// Same approach as authorizations: skip server-side filters, narrow
|
||||
// client-side by projectId. Pilot scale; cheap.
|
||||
const data = await rpc(projectSvc, "ListProjectGrants", {
|
||||
pagination: { limit: 500 },
|
||||
});
|
||||
const all = Array.isArray(data?.projectGrants) ? data.projectGrants : [];
|
||||
return all.filter((g) => g?.projectId === PROJECT_ID);
|
||||
}
|
||||
|
||||
async function updateProjectGrant(grantedOrganizationId, roleKeys) {
|
||||
return rpc(projectSvc, "UpdateProjectGrant", {
|
||||
projectId: PROJECT_ID,
|
||||
grantedOrganizationId,
|
||||
roleKeys,
|
||||
});
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Subcommands
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
async function diagnose() {
|
||||
console.log(`Project: ${PROJECT_ID}`);
|
||||
console.log(`Issuer: ${ISSUER}\n`);
|
||||
|
||||
console.log("--- Project roles ---");
|
||||
const roles = await listProjectRoles();
|
||||
if (roles.length === 0) {
|
||||
console.log(" (none)");
|
||||
} else {
|
||||
for (const r of roles) {
|
||||
console.log(` key=${r.key.padEnd(20)} displayName=${r.displayName ?? ""} group=${r.group ?? ""}`);
|
||||
}
|
||||
}
|
||||
|
||||
const present = new Set(roles.map((r) => r.key));
|
||||
const missing = CANONICAL.filter((c) => !present.has(c.key));
|
||||
const legacy = roles.filter((r) => !CANONICAL.some((c) => c.key === r.key));
|
||||
|
||||
console.log("\n--- Canonical key check ---");
|
||||
for (const c of CANONICAL) {
|
||||
console.log(` ${present.has(c.key) ? "OK " : "MISS"} ${c.key}`);
|
||||
}
|
||||
if (legacy.length > 0) {
|
||||
console.log("\n Non-canonical keys still on the project:");
|
||||
for (const r of legacy) console.log(` ${r.key}`);
|
||||
console.log(" (consider migrating any authorizations off these.)");
|
||||
}
|
||||
|
||||
console.log("\n--- Authorizations on project (probing filter shape) ---");
|
||||
const probed = await probeListAuthorizations();
|
||||
if (!probed) {
|
||||
console.log(
|
||||
"\nNo filter shape was accepted. Cannot enumerate authorizations."
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
console.log(`\nWinning filter shape: ${probed.label}`);
|
||||
console.log("Raw response (first 2 entries):");
|
||||
const trimmed = {
|
||||
...probed.data,
|
||||
authorizations: (probed.data.authorizations || []).slice(0, 2),
|
||||
};
|
||||
console.log(JSON.stringify(trimmed, null, 2));
|
||||
|
||||
// Parsed view — what `lib/zitadel.ts::listOrgAuthorizations` SHOULD return
|
||||
// once the parser is fixed. Useful for confirming the response field
|
||||
// names without wading through the raw blob.
|
||||
const auths = probed.data.authorizations || [];
|
||||
console.log(`\nParsed (${auths.length} authorization(s)):`);
|
||||
for (const a of auths) {
|
||||
const userId = a.user?.id ?? "?";
|
||||
const userName = a.user?.displayName ?? a.user?.preferredLoginName ?? "";
|
||||
const orgId = a.organization?.id ?? "?";
|
||||
const orgName = a.organization?.name ?? "";
|
||||
const roleKeys = Array.isArray(a.roles)
|
||||
? a.roles.map((r) => r.key).join(",")
|
||||
: "(none)";
|
||||
console.log(
|
||||
` ${a.id?.slice(0, 12) ?? "?"}… user=${userName} (${userId.slice(0, 10)}…) org=${orgName} roles=[${roleKeys}]`
|
||||
);
|
||||
}
|
||||
|
||||
if (missing.length > 0) {
|
||||
console.log(
|
||||
`\nNext step: run \`apply\` to create ${missing.length} missing role(s).`
|
||||
);
|
||||
process.exitCode = 1;
|
||||
} else {
|
||||
console.log("\nAll canonical roles present.");
|
||||
}
|
||||
}
|
||||
|
||||
async function apply() {
|
||||
const existing = await listProjectRoles();
|
||||
const present = new Set(existing.map((r) => r.key));
|
||||
|
||||
let created = 0;
|
||||
for (const c of CANONICAL) {
|
||||
if (present.has(c.key)) {
|
||||
console.log(`SKIP ${c.key} (already exists)`);
|
||||
continue;
|
||||
}
|
||||
try {
|
||||
await addProjectRole(c.key, c.displayName, c.group);
|
||||
console.log(`ADD ${c.key}`);
|
||||
created++;
|
||||
} catch (err) {
|
||||
// ZITADEL returns AlreadyExists if a role with the same key was
|
||||
// created in a race; treat as success so the script stays idempotent.
|
||||
if (
|
||||
err.body &&
|
||||
/already.*exist/i.test(err.body)
|
||||
) {
|
||||
console.log(`SKIP ${c.key} (already exists, race)`);
|
||||
continue;
|
||||
}
|
||||
console.error(`FAIL ${c.key}: ${err.message}`);
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`\nDone. ${created} role(s) created.`);
|
||||
}
|
||||
|
||||
async function migrateAuth(userId) {
|
||||
if (!userId) {
|
||||
console.error("Usage: migrate-auth <userId>");
|
||||
process.exit(2);
|
||||
}
|
||||
|
||||
// Verify owner role exists before we touch anything; otherwise we'd
|
||||
// delete authorizations and fail to recreate them.
|
||||
const roles = await listProjectRoles();
|
||||
if (!roles.some((r) => r.key === "owner")) {
|
||||
console.error("Project has no `owner` role. Run `apply` first.");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
console.log(`Listing authorizations for user ${userId} on project ${PROJECT_ID}...`);
|
||||
const auths = await listUserAuthorizations(userId);
|
||||
const list = Array.isArray(auths?.authorizations) ? auths.authorizations : [];
|
||||
// Filter client-side to the requested user, in case the user filter probe
|
||||
// didn't narrow things down.
|
||||
const userAuths = list.filter((a) => a.user?.id === userId);
|
||||
|
||||
if (userAuths.length === 0) {
|
||||
console.log("No existing authorizations found. Cannot infer organizationId.");
|
||||
console.log("Pass it explicitly via the env: ORG_ID=... or use the portal flow.");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// Pick the organizationId from any of the existing authorizations — it
|
||||
// should be the same across all of them for a single user/project pair.
|
||||
const orgIds = [...new Set(userAuths.map((a) => a.organization?.id).filter(Boolean))];
|
||||
if (orgIds.length !== 1) {
|
||||
console.error(`Expected exactly 1 organizationId, got ${orgIds.length}: ${orgIds.join(", ")}`);
|
||||
process.exit(1);
|
||||
}
|
||||
const orgId = orgIds[0];
|
||||
|
||||
console.log(`Found ${userAuths.length} authorization(s) in org ${orgId}:`);
|
||||
for (const a of userAuths) {
|
||||
const id = a.id ?? "?";
|
||||
const keys = Array.isArray(a.roles) ? a.roles.map((r) => r.key).join(",") : "(none)";
|
||||
console.log(` ${id} roles=[${keys}]`);
|
||||
}
|
||||
|
||||
// Already correct?
|
||||
if (
|
||||
userAuths.length === 1 &&
|
||||
Array.isArray(userAuths[0].roles) &&
|
||||
userAuths[0].roles.length === 1 &&
|
||||
userAuths[0].roles[0].key === "owner"
|
||||
) {
|
||||
console.log("Already correct — no changes needed.");
|
||||
return;
|
||||
}
|
||||
|
||||
console.log("\nDeleting existing authorizations...");
|
||||
for (const a of userAuths) {
|
||||
if (!a.id) continue;
|
||||
await deleteAuthorization(a.id);
|
||||
console.log(` deleted ${a.id}`);
|
||||
}
|
||||
|
||||
console.log("Creating fresh owner authorization...");
|
||||
const created = await createAuthorization(userId, orgId, ["owner"]);
|
||||
console.log(` created ${JSON.stringify(created)}`);
|
||||
console.log("Done.");
|
||||
}
|
||||
|
||||
async function migrateGrants() {
|
||||
// Ensure every existing project grant for the OpenClaw Platform project
|
||||
// includes the `user` role alongside `owner`. Without `user` in the
|
||||
// grant, the granted org cannot invite members in `user` role —
|
||||
// `CreateAuthorization` returns `Errors.Project.Role.NotFound`.
|
||||
//
|
||||
// Idempotent: grants already containing both keys are skipped.
|
||||
// Per UpdateProjectGrant docs, `roleKeys` is REPLACE not MERGE — we
|
||||
// re-send the full desired set every time.
|
||||
const desired = ["owner", "user"];
|
||||
const grants = await listProjectGrants();
|
||||
|
||||
if (grants.length === 0) {
|
||||
console.log("No project grants found on this project.");
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`Found ${grants.length} grant(s) on project ${PROJECT_ID}:`);
|
||||
for (const g of grants) {
|
||||
const current = Array.isArray(g.grantedRoleKeys)
|
||||
? g.grantedRoleKeys
|
||||
: [];
|
||||
const hasAll = desired.every((k) => current.includes(k));
|
||||
const action = hasAll ? "SKIP" : "FIX ";
|
||||
console.log(
|
||||
` ${action} ${g.grantedOrganizationName.padEnd(30)} current=[${current.join(",")}]`
|
||||
);
|
||||
}
|
||||
|
||||
let fixed = 0;
|
||||
for (const g of grants) {
|
||||
const current = Array.isArray(g.grantedRoleKeys)
|
||||
? g.grantedRoleKeys
|
||||
: [];
|
||||
if (desired.every((k) => current.includes(k))) continue;
|
||||
// Preserve any extra roles the grant already has on top of the
|
||||
// desired set (e.g. someone manually added `viewer` for a special
|
||||
// case). Set semantics: union.
|
||||
const merged = [...new Set([...current, ...desired])];
|
||||
try {
|
||||
await updateProjectGrant(g.grantedOrganizationId, merged);
|
||||
console.log(
|
||||
` updated ${g.grantedOrganizationName} -> [${merged.join(",")}]`
|
||||
);
|
||||
fixed++;
|
||||
} catch (err) {
|
||||
console.error(
|
||||
` FAIL ${g.grantedOrganizationName}: ${err.message}`
|
||||
);
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
console.log(`\nDone. ${fixed} grant(s) updated.`);
|
||||
}
|
||||
|
||||
const [, , cmd, ...rest] = process.argv;
|
||||
|
||||
const commands = {
|
||||
diagnose,
|
||||
apply,
|
||||
"migrate-auth": () => migrateAuth(rest[0]),
|
||||
"migrate-grants": migrateGrants,
|
||||
};
|
||||
|
||||
const fn = commands[cmd];
|
||||
if (!fn) {
|
||||
console.error(
|
||||
"Usage: zitadel-roles.mjs <diagnose|apply|migrate-auth <userId>|migrate-grants>"
|
||||
);
|
||||
process.exit(2);
|
||||
}
|
||||
|
||||
fn().catch((err) => {
|
||||
console.error(err.message ?? err);
|
||||
if (err.body) console.error("body:", err.body);
|
||||
process.exit(1);
|
||||
});
|
||||
Reference in New Issue
Block a user