andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-18 05:52:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: allow managing invite code in secret generators (#12109)

Browse Source 
# Which Problems Are Solved

Zitadel exposes the secrets generator configuration through its admin
api. This allows instance admins to manage them on their own and they
can create overwrite the system / runtime defaults (incl. expiration).
This very much needed in multi-instance scenarios such as zitadel.cloud.
Currently the invite code configuration was not manageable through the
API, but only runtime config.

# How the Problems Are Solved

- added the `invite_code` type to the API allowing it to be set and
retrieved.
- added the type to console's management list
- added the type to be stored on instance setup
- change the `GetSecretGenerator` endpoint to fall back to the runtime
config if no config is stored on the instance itself
- ensure the `length` and at least one charset is enabled, return an
error otherwise
- expiry is not enforced, so 0 allows codes with no expiry (current
state)

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10474
This commit is contained in:
Livio Spring
2026-07-01 04:53:16 +00:00
committed by GitHub
parent 782133dbc7
commit 1e0b810dca
44 changed files with 351 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TERMINOLOGY.md
+1
View File
@@ -73,6 +73,7 @@ All user-facing wording in docs, UI, and API descriptions must follow this table
| Password changed | Past-tense wording for password change notification | Password change | Password changed | replace | UI notifications |
| Object descriptions | All resource descriptions must use end-user language | internal / technical wording | clear end-user language | replace | UI + Docs |
| Complement Token | Flow type for actions executed during token creation. In UI use "Complement Token"; in API use `flowType = 2` (CustomiseToken). Docs must not show PreUserinfoCreation=3 for this type. | Compliment Token, CustomiseToken, CustomizeToken | Complement Token | replace | Everywhere |
| Invite Code | One-time code used to invite a user to set up authentication (secret generator and user-invite flows) | Invitation Code, Invitation code | Invite Code | replace | UI + Docs |
## Governance
apps/docs/content/guides/manage/console/default-settings.mdx
+1
View File
@@ -387,6 +387,7 @@ The following secrets can be specified:
- Application secrets
- One Time Password (OTP) - SMS
- One Time Password (OTP) - Email
- Invite Code
<img
src="/docs/img/guides/console/secretappearance.png"
backend/v3/domain/settings.go
+5
View File
@@ -476,6 +476,7 @@ type SecretGeneratorSettingsAttributes struct {
DomainVerification *DomainVerificationAttributes `json:"domainVerification,omitempty"`
OTPSMS *OTPSMSAttributes `json:"otpSms,omitempty"`
OTPEmail *OTPEmailAttributes `json:"otpEmail,omitempty"`
InviteCode *InviteCodeAttributes `json:"inviteCode,omitempty"`
}
type ClientSecretAttributes struct {
@@ -514,6 +515,10 @@ type OTPEmailAttributes struct {
SecretGeneratorAttrsWithExpiry
}
type InviteCodeAttributes struct {
SecretGeneratorAttrsWithExpiry
}
type SecretGeneratorAttrs struct {
Length *uint `json:"length,omitempty"`
IncludeLowerLetters *bool `json:"includeLowerLetters,omitempty"`
backend/v3/storage/database/events_testing/settings_instance_test.go
+8
View File
@@ -1477,6 +1477,14 @@ func TestServer_TestInstanceSecretGeneratorSettingsReduces(t *testing.T) {
assert.Equal(collect, false, *setting.OTPEmail.IncludeUpperLetters)
assert.Equal(collect, true, *setting.OTPEmail.IncludeDigits)
assert.Equal(collect, false, *setting.OTPEmail.IncludeSymbols)
// InviteCode
assert.Equal(collect, uint(6), *setting.InviteCode.Length)
assert.Equal(collect, 72*time.Hour, *setting.InviteCode.Expiry)
assert.Equal(collect, false, *setting.InviteCode.IncludeLowerLetters)
assert.Equal(collect, true, *setting.InviteCode.IncludeUpperLetters)
assert.Equal(collect, true, *setting.InviteCode.IncludeDigits)
assert.Equal(collect, false, *setting.InviteCode.IncludeSymbols)
}, retryDuration, tick)
})
backend/v3/storage/database/repository/settings.go
+7
View File
@@ -1456,6 +1456,9 @@ func (s secretGeneratorSettings) SetSettingFields(value domain.SecretGeneratorSe
if value.OTPEmail != nil {
changes = append(changes, s.SetOTPEmail(*value.OTPEmail))
}
if value.InviteCode != nil {
changes = append(changes, s.SetInviteCode(*value.InviteCode))
}
return db_json.NewJsonChanges(s.SettingsColumn(), changes...)
}
@@ -1495,6 +1498,10 @@ func (s secretGeneratorSettings) SetOTPEmail(value domain.OTPEmailAttributes) db
return db_json.NewFieldChange([]string{"otpEmail"}, value)
}
func (s secretGeneratorSettings) SetInviteCode(value domain.InviteCodeAttributes) db_json.JsonUpdate {
return db_json.NewFieldChange([]string{"inviteCode"}, value)
}
func SecretGeneratorSettingsRepository() domain.SecretGeneratorSettingsRepository {
return &secretGeneratorSettings{
settings{},
backend/v3/storage/database/repository/settings_test.go
+32
View File
@@ -5134,6 +5134,9 @@ func createDefaultSecretGeneratorSettingsAttributes() domain.SecretGeneratorSett
OTPEmail: &domain.OTPEmailAttributes{
SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(thirtyMinutes),
},
InviteCode: &domain.InviteCodeAttributes{
SecretGeneratorAttrsWithExpiry: createDefaultSecretGeneratorAttrsWithExpiry(oneDay * 3),
},
}
}
@@ -5146,3 +5149,32 @@ func createSecretGeneratorSettings(instanceID string, organizationID *string) *d
SecretGeneratorSettingsAttributes: createDefaultSecretGeneratorSettingsAttributes(),
}
}
func TestSecretGeneratorSettingsInviteCodeRoundTrip(t *testing.T) {
tx, rollback := transactionForRollback(t)
defer rollback()
instanceID := createInstance(t, tx)
repo := repository.SecretGeneratorSettingsRepository()
want := createSecretGeneratorSettings(instanceID, nil)
require.NotNil(t, want.InviteCode)
err := repo.Set(t.Context(), tx, want)
require.NoError(t, err)
got, err := repo.Get(t.Context(), tx, database.WithCondition(
repo.UniqueCondition(instanceID, nil, domain.SettingTypeSecretGenerator, domain.SettingStateActive),
))
require.NoError(t, err)
require.NotNil(t, got.InviteCode)
assert.EqualExportedValues(t, want.InviteCode, got.InviteCode)
list, err := repo.List(t.Context(), tx, database.WithCondition(
repo.InstanceIDCondition(instanceID),
))
require.NoError(t, err)
require.Len(t, list, 1)
require.NotNil(t, list[0].InviteCode)
assert.EqualExportedValues(t, want.InviteCode, list[0].InviteCode)
}
cmd/defaults.yaml
+6 -6
View File
@@ -1212,12 +1212,12 @@ DefaultInstance:
IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDEDIGITS
IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_OTPEMAIL_INCLUDESYMBOLS
InviteCode:
Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_LENGTH
Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_EXPIRY
IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDELOWERLETTERS
IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEUPPERLETTERS
IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDEDIGITS
IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INITIALIZEUSERCODE_INCLUDESYMBOLS
Length: 6 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_LENGTH
Expiry: "72h" # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_EXPIRY
IncludeLowerLetters: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDELOWERLETTERS
IncludeUpperLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEUPPERLETTERS
IncludeDigits: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDEDIGITS
IncludeSymbols: false # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_INVITECODE_INCLUDESYMBOLS
SigningKey:
Length: 36 # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_LENGTH
IncludeLowerLetters: true # ZITADEL_DEFAULTINSTANCE_SECRETGENERATORS_SIGNINGKEY_INCLUDELOWERLETTERS
cmd/mirror/projections.go
+1
View File
@@ -177,6 +177,7 @@ func projections(
0,
config.SystemAPIUsers,
false,
config.DefaultInstance.SecretGenerators.ToMap(),
)
logging.OnError(ctx, err).Fatal("unable to start queries")
cmd/setup/setup.go
+1
View File
@@ -535,6 +535,7 @@ func startCommandsQueries(
0, // not needed for projections
nil, // not needed for projections
false,
config.DefaultInstance.SecretGenerators.ToMap(),
)
logging.OnError(ctx, err).Fatal("unable to start queries")
cmd/start/start.go
+1
View File
@@ -248,6 +248,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
config.AuditLogRetention,
config.SystemAPIUsers,
true,
config.DefaultInstance.SecretGenerators.ToMap(),
)
if err != nil {
return fmt.Errorf("cannot start queries: %w", err)
console/src/app/modules/policies/secret-generator/secret-generator.component.ts
+1
View File
@@ -19,6 +19,7 @@ export class SecretGeneratorComponent {
SecretGeneratorType.SECRET_GENERATOR_TYPE_APP_SECRET,
SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_SMS,
SecretGeneratorType.SECRET_GENERATOR_TYPE_OTP_EMAIL,
SecretGeneratorType.SECRET_GENERATOR_TYPE_INVITE_CODE,
];
constructor() {}
console/src/assets/i18n/ar.json
+2 -1
View File
@@ -1608,7 +1608,8 @@
"5": "تهيئة بدون كلمة مرور",
"6": "سر التطبيق",
"7": "OTP - SMS",
"8": "OTP - بريد إلكتروني"
"8": "OTP - بريد إلكتروني",
"9": "رمز الدعوة"
},
"EXPIRY": "انتهاء الصلاحية (بالدقائق)",
"INCLUDEDIGITS": "تضمين أرقام",
console/src/assets/i18n/bg.json
+2 -1
View File
@@ -1615,7 +1615,8 @@
"5": "Инициализация на ключ за достъп",
"6": "Тайна на приложението",
"7": "OTP - SMS",
"8": "OTP – имейл"
"8": "OTP – имейл",
"9": "Код за покана"
},
"EXPIRY": "Изтичане (в минути)",
"INCLUDEDIGITS": "Включете числа",
console/src/assets/i18n/cs.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Inicializace Passkey",
"6": "Tajemství pomocí aplikace",
"7": "OTP - SMS",
"8": "OTP - E-mail"
"8": "OTP - E-mail",
"9": "Kód pozvánky"
},
"EXPIRY": "Expirace (v minutách)",
"INCLUDEDIGITS": "Zahrnout čísla",
console/src/assets/i18n/de.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Passkey Initialisierungscode",
"6": "Anwendungsgeheimnis",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Einladungscode"
},
"EXPIRY": "Ablauf (in Minuten)",
"INCLUDEDIGITS": "Enthält Zahlen",
console/src/assets/i18n/en.json
+2 -1
View File
@@ -1618,7 +1618,8 @@
"5": "Passkey Initialization",
"6": "Application Secret",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Invite Code"
},
"EXPIRY": "Expiration (in minutes)",
"INCLUDEDIGITS": "Include Numbers",
console/src/assets/i18n/es.json
+2 -1
View File
@@ -1614,7 +1614,8 @@
"5": "Inicialización de llave de acceso",
"6": "Secreto de aplicación",
"7": "One Time Password (OTP) - SMS",
"8": "One Time Password (OTP) - email"
"8": "One Time Password (OTP) - email",
"9": "Código de invitación"
},
"EXPIRY": "Caducidad (en minutos)",
"INCLUDEDIGITS": "Incluir números",
console/src/assets/i18n/fr.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Initialisation de clé d'accès",
"6": "Secret de l'application",
"7": "OTP - SMS",
"8": "OTP - e-mail"
"8": "OTP - e-mail",
"9": "Code d'invitation"
},
"EXPIRY": "Expiration (en minutes)",
"INCLUDEDIGITS": "Inclure les chiffres",
console/src/assets/i18n/hu.json
+2 -1
View File
@@ -1611,7 +1611,8 @@
"5": "Passkey inicializálás",
"6": "Alkalmazás titok",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Meghívókód"
},
"EXPIRY": "Lejárat (percben)",
"INCLUDEDIGITS": "Számok bevonása",
console/src/assets/i18n/id.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Inisialisasi Passkey",
"6": "Rahasia Aplikasi",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Kode Undangan"
},
"EXPIRY": "Kedaluwarsa (dalam menit)",
"INCLUDEDIGITS": "Sertakan Angka",
console/src/assets/i18n/it.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Inizializzazione passkey",
"6": "Segreto dell'applicazione",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Codice di invito"
},
"EXPIRY": "Scadenza (in minuti)",
"INCLUDEDIGITS": "Contiene numeri",
console/src/assets/i18n/ja.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "パスキーの初期設定",
"6": "アプリケーションのシークレット",
"7": "OTP - SMS",
"8": "OTP - 電子メール"
"8": "OTP - 電子メール",
"9": "招待コード"
},
"EXPIRY": "有効期限 (分単位)",
"INCLUDEDIGITS": "数字を含める",
console/src/assets/i18n/ko.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "패스키 초기화",
"6": "애플리케이션 시크릿",
"7": "OTP - SMS",
"8": "OTP - 이메일"
"8": "OTP - 이메일",
"9": "초대 코드"
},
"EXPIRY": "만료 시간 (분)",
"INCLUDEDIGITS": "숫자 포함",
console/src/assets/i18n/mk.json
+2 -1
View File
@@ -1614,7 +1614,8 @@
"5": "Иницијализација на Passkey",
"6": "Апликациска тајна",
"7": "OTP - СМС",
"8": "OTP - е-пошта"
"8": "OTP - е-пошта",
"9": "Код за покана"
},
"EXPIRY": "Истекување (во минути)",
"INCLUDEDIGITS": "Вклучи цифри",
console/src/assets/i18n/nl.json
+2 -1
View File
@@ -1613,7 +1613,8 @@
"5": "Passkey Initialisatie",
"6": "Applicatie Secret",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Uitnodigingscode"
},
"EXPIRY": "Vervaldatum (in minuten)",
"INCLUDEDIGITS": "Inclusief Nummers",
console/src/assets/i18n/pl.json
+2 -1
View File
@@ -1612,7 +1612,8 @@
"5": "Inicjalizacja passkey",
"6": "Sekret aplikacji",
"7": "OTP - SMS",
"8": "OTP — e-mail"
"8": "OTP — e-mail",
"9": "Kod zaproszenia"
},
"EXPIRY": "Wygaśnięcie (w minutach)",
"INCLUDEDIGITS": "Dołącz cyfry",
console/src/assets/i18n/pt.json
+2 -1
View File
@@ -1614,7 +1614,8 @@
"5": "Inicialização passkey",
"6": "Segredo do aplicativo",
"7": "OTP - SMS",
"8": "OTP - e-mail"
"8": "OTP - e-mail",
"9": "Código de convite"
},
"EXPIRY": "Expiração (em minutos)",
"INCLUDEDIGITS": "Incluir números",
console/src/assets/i18n/ro.json
+2 -1
View File
@@ -1611,7 +1611,8 @@
"5": "Inițializarea Passkey",
"6": "Secretul aplicației",
"7": "OTP - SMS",
"8": "OTP - E-mail"
"8": "OTP - E-mail",
"9": "Cod de invitație"
},
"EXPIRY": "Expirare (în minute)",
"INCLUDEDIGITS": "Includeți numere",
console/src/assets/i18n/ru.json
+2 -1
View File
@@ -1672,7 +1672,8 @@
"5": "Инициализация ключа доступа",
"6": "Ключ приложения",
"7": "OTP — SMS",
"8": "OTP – электронная почта"
"8": "OTP – электронная почта",
"9": "Код приглашения"
},
"EXPIRY": "Срок действия (в минутах)",
"INCLUDEDIGITS": "Содержит цифры",
console/src/assets/i18n/sv.json
+2 -1
View File
@@ -1617,7 +1617,8 @@
"5": "Passkey-initiering",
"6": "Applikations-hemlighet",
"7": "OTP - SMS",
"8": "OTP - E-post"
"8": "OTP - E-post",
"9": "Inbjudningskod"
},
"EXPIRY": "Utgång (på minuter)",
"INCLUDEDIGITS": "Inkludera siffror",
console/src/assets/i18n/tr.json
+2 -1
View File
@@ -1616,7 +1616,8 @@
"5": "Passkey Başlatma",
"6": "Uygulama Gizli Anahtarı",
"7": "OTP - SMS",
"8": "OTP - E-posta"
"8": "OTP - E-posta",
"9": "Davet Kodu"
},
"EXPIRY": "Son kullanma (dakika cinsinden)",
"INCLUDEDIGITS": "Sayıları Dahil Et",
console/src/assets/i18n/uk.json
+2 -1
View File
@@ -1617,7 +1617,8 @@
"5": "Ініціалізація ключа доступу",
"6": "Секрет додатка",
"7": "OTP - SMS",
"8": "OTP - Email"
"8": "OTP - Email",
"9": "Код запрошення"
},
"EXPIRY": "Термін дії (у хвилинах)",
"INCLUDEDIGITS": "Включити цифри",
console/src/assets/i18n/zh.json
+2 -1
View File
@@ -1616,7 +1616,8 @@
"5": "Passkey 初始化",
"6": "应用密钥",
"7": "OTP - SMS",
"8": "OTP - 电子邮件"
"8": "OTP - 电子邮件",
"9": "邀请码"
},
"EXPIRY": "过期时间 (以分钟为单位)",
"INCLUDEDIGITS": "包含数字",
internal/api/grpc/admin/iam_settings_converter.go
+4
View File
@@ -105,6 +105,8 @@ func SecretGeneratorTypeToPb(generatorType domain.SecretGeneratorType) settings_
return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_SMS
case domain.SecretGeneratorTypeOTPEmail:
return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL
case domain.SecretGeneratorTypeInviteCode:
return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE
default:
return settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_UNSPECIFIED
}
@@ -128,6 +130,8 @@ func SecretGeneratorTypeToDomain(generatorType settings_pb.SecretGeneratorType)
return domain.SecretGeneratorTypeOTPSMS
case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_OTP_EMAIL:
return domain.SecretGeneratorTypeOTPEmail
case settings_pb.SecretGeneratorType_SECRET_GENERATOR_TYPE_INVITE_CODE:
return domain.SecretGeneratorTypeInviteCode
default:
return domain.SecretGeneratorTypeUnspecified
}
internal/command/instance.go
+17
View File
@@ -163,6 +163,22 @@ type SecretGenerators struct {
SigningKey *crypto.GeneratorConfig
}
func (s *SecretGenerators) ToMap() map[domain.SecretGeneratorType]*crypto.GeneratorConfig {
return map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
domain.SecretGeneratorTypeInitCode: s.InitializeUserCode,
domain.SecretGeneratorTypeVerifyEmailCode: s.EmailVerificationCode,
domain.SecretGeneratorTypeVerifyPhoneCode: s.PhoneVerificationCode,
domain.SecretGeneratorTypeVerifyDomain: s.DomainVerification,
domain.SecretGeneratorTypePasswordResetCode: s.PasswordVerificationCode,
domain.SecretGeneratorTypePasswordlessInitCode: s.PasswordlessInitCode,
domain.SecretGeneratorTypeAppSecret: s.ClientSecret,
domain.SecretGeneratorTypeOTPSMS: s.OTPSMS,
domain.SecretGeneratorTypeOTPEmail: s.OTPEmail,
domain.SecretGeneratorTypeInviteCode: s.InviteCode,
domain.SecretGeneratorTypeSigningKey: s.SigningKey,
}
}
type ZitadelConfig struct {
instanceID string
orgID string
@@ -326,6 +342,7 @@ func setupInstanceElements(instanceAgg *instance.Aggregate, setup *InstanceSetup
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeVerifyDomain, setup.SecretGenerators.DomainVerification),
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPSMS, setup.SecretGenerators.OTPSMS),
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeOTPEmail, setup.SecretGenerators.OTPEmail),
prepareAddSecretGeneratorConfig(instanceAgg, domain.SecretGeneratorTypeInviteCode, setup.SecretGenerators.InviteCode),
prepareAddDefaultPasswordComplexityPolicy(
instanceAgg,
internal/command/instance_settings.go
+6 -3
View File
@@ -35,8 +35,8 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
if !typ.Valid() {
return nil, zerrors.ThrowInvalidArgument(nil, "V2-FGqVj", "Errors.InvalidArgument")
}
if config.Length < 1 {
return nil, zerrors.ThrowInvalidArgument(nil, "V2-jEqCt", "Errors.InvalidArgument")
if err := config.Valid(); err != nil {
return nil, err
}
return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
writeModel := NewInstanceSecretGeneratorConfigWriteModel(ctx, typ)
@@ -71,9 +71,12 @@ func prepareAddSecretGeneratorConfig(a *instance.Aggregate, typ domain.SecretGen
}
func (c *Commands) ChangeSecretGeneratorConfig(ctx context.Context, generatorType domain.SecretGeneratorType, config *crypto.GeneratorConfig) (*domain.ObjectDetails, error) {
if generatorType == domain.SecretGeneratorTypeUnspecified {
if !generatorType.Valid() {
return nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-33k9f", "Errors.SecretGenerator.TypeMissing")
}
if err := config.Valid(); err != nil {
return nil, err
}
generatorWriteModel, err := c.getSecretConfig(ctx, generatorType)
if err != nil {
internal/command/instance_settings_test.go
+62 -26
View File
@@ -2,6 +2,7 @@ package command
import (
"context"
"errors"
"testing"
"time"
@@ -218,6 +219,52 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
},
},
},
{
name: "secret generator config invalid (length), invalid error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
generator: &crypto.GeneratorConfig{
Length: 0,
Expiry: 2 * time.Hour,
IncludeLowerLetters: true,
IncludeUpperLetters: true,
IncludeDigits: true,
IncludeSymbols: true,
},
generatorType: domain.SecretGeneratorTypeInitCode,
},
res: res{
err: func(err error) bool {
return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument"))
},
},
},
{
name: "secret generator config invalid (charset), invalid error",
fields: fields{
eventstore: expectEventstore(),
},
args: args{
ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
generator: &crypto.GeneratorConfig{
Length: 8,
Expiry: 2 * time.Hour,
IncludeLowerLetters: false,
IncludeUpperLetters: false,
IncludeDigits: false,
IncludeSymbols: false,
},
generatorType: domain.SecretGeneratorTypeInitCode,
},
res: res{
err: func(err error) bool {
return errors.Is(err, zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument"))
},
},
},
{
name: "generator removed, new added ok",
fields: fields{
@@ -332,15 +379,21 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
),
),
expectPush(
newSecretGeneratorChangedEvent(context.Background(),
func() *instance.SecretGeneratorChangedEvent {
changes := []instance.SecretGeneratorChanges{
instance.ChangeSecretGeneratorLength(8),
instance.ChangeSecretGeneratorExpiry(2 * time.Hour),
instance.ChangeSecretGeneratorIncludeUpperLetters(false),
instance.ChangeSecretGeneratorIncludeDigits(false),
instance.ChangeSecretGeneratorIncludeSymbols(false),
}
event, _ := instance.NewSecretGeneratorChangeEvent(context.Background(),
&instance.NewAggregate("INSTANCE").Aggregate,
domain.SecretGeneratorTypeInitCode,
8,
time.Hour*2,
false,
false,
false,
false,
),
changes,
)
return event
}(),
),
),
},
@@ -349,7 +402,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
generator: &crypto.GeneratorConfig{
Length: 8,
Expiry: 2 * time.Hour,
IncludeLowerLetters: false,
IncludeLowerLetters: true,
IncludeUpperLetters: false,
IncludeDigits: false,
IncludeSymbols: false,
@@ -523,20 +576,3 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
})
}
}
func newSecretGeneratorChangedEvent(ctx context.Context, generatorType domain.SecretGeneratorType, length uint, expiry time.Duration, lowerCase, upperCase, digits, symbols bool) *instance.SecretGeneratorChangedEvent {
changes := []instance.SecretGeneratorChanges{
instance.ChangeSecretGeneratorLength(length),
instance.ChangeSecretGeneratorExpiry(expiry),
instance.ChangeSecretGeneratorIncludeLowerLetters(lowerCase),
instance.ChangeSecretGeneratorIncludeUpperLetters(upperCase),
instance.ChangeSecretGeneratorIncludeDigits(digits),
instance.ChangeSecretGeneratorIncludeSymbols(symbols),
}
event, _ := instance.NewSecretGeneratorChangeEvent(ctx,
&instance.NewAggregate("INSTANCE").Aggregate,
generatorType,
changes,
)
return event
}
internal/command/instance_test.go
+3
View File
@@ -331,6 +331,7 @@ func instanceElementsFilters() []expect {
expectFilter(),
expectFilter(),
expectFilter(),
expectFilter(),
}
}
@@ -348,6 +349,7 @@ func instanceElementsEvents(ctx context.Context, instanceID, instanceName string
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeVerifyDomain, 32, 0, true, true, true, false),
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPSMS, 8, 5*time.Minute, false, false, true, false),
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeOTPEmail, 8, 5*time.Minute, false, false, true, false),
instance.NewSecretGeneratorAddedEvent(ctx, &instanceAgg.Aggregate, domain.SecretGeneratorTypeInviteCode, 6, 72*time.Hour, false, true, true, false),
}
}
@@ -362,6 +364,7 @@ func instanceElementsConfig() *SecretGenerators {
DomainVerification: &crypto.GeneratorConfig{Length: 32, IncludeLowerLetters: true, IncludeUpperLetters: true, IncludeDigits: true},
OTPSMS: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
OTPEmail: &crypto.GeneratorConfig{Length: 8, Expiry: 5 * time.Minute, IncludeDigits: true},
InviteCode: &crypto.GeneratorConfig{Length: 6, Expiry: 72 * time.Hour, IncludeUpperLetters: true, IncludeDigits: true},
}
}
internal/crypto/code.go
+10
View File
@@ -23,6 +23,16 @@ type GeneratorConfig struct {
IncludeSymbols bool
}
func (c *GeneratorConfig) Valid() error {
if c.Length < 1 {
return zerrors.ThrowInvalidArgument(nil, "CRYPTO-FVJ2x", "Errors.InvalidArgument")
}
if !c.IncludeLowerLetters && !c.IncludeUpperLetters && !c.IncludeDigits && !c.IncludeSymbols {
return zerrors.ThrowInvalidArgument(nil, "CRYPTO-Ckl2s", "Errors.InvalidArgument")
}
return nil
}
//go:generate mockgen -source code.go -destination ./code_mock.go -package crypto
type Generator interface {
internal/query/projection/settings_relational.go
+6 -2
View File
@@ -1584,8 +1584,12 @@ func setSecretGeneratorSettingsAttrs(generatorType legacy_domain.SecretGenerator
secretGeneratorSettingsAttrs.OTPEmail = &domain.OTPEmailAttributes{
SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
}
case legacy_domain.SecretGeneratorTypeInviteCode, legacy_domain.SecretGeneratorTypeSigningKey:
// do nothing as these secret generators are not persisted in the settings
case legacy_domain.SecretGeneratorTypeInviteCode:
secretGeneratorSettingsAttrs.InviteCode = &domain.InviteCodeAttributes{
SecretGeneratorAttrsWithExpiry: attrsWithExpiry,
}
case legacy_domain.SecretGeneratorTypeSigningKey:
// do nothing as this secret generator is not persisted in the settings
case legacy_domain.SecretGeneratorTypeUnspecified:
return domain.SecretGeneratorSettingsAttributes{}, zerrors.ThrowInvalidArgumentf(nil, "HANDL-2n3fK", "unspecified secret generator type")
default:
internal/query/query.go
+3
View File
@@ -45,6 +45,7 @@ type Queries struct {
zitadelRoles []authz.RoleMapping
multifactors domain.MultifactorConfigs
defaultAuditLogRetention time.Duration
defaultSecretGenerators map[domain.SecretGeneratorType]*crypto.GeneratorConfig
}
func StartQueries(
@@ -62,6 +63,7 @@ func StartQueries(
defaultAuditLogRetention time.Duration,
systemAPIUsers map[string]*authz.SystemAPIUser,
startProjections bool,
secretGeneratorDefaults map[domain.SecretGeneratorType]*crypto.GeneratorConfig,
) (repo *Queries, err error) {
repo = &Queries{
eventstore: es,
@@ -84,6 +86,7 @@ func StartQueries(
},
},
defaultAuditLogRetention: defaultAuditLogRetention,
defaultSecretGenerators: secretGeneratorDefaults,
}
repo.checkPermission = permissionCheck(repo)
internal/query/secret_generator_test.go
+107
View File
@@ -9,6 +9,12 @@ import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/database"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/zerrors"
)
@@ -70,6 +76,9 @@ var (
"include_symbols",
"count",
}
expectedSecretGeneratorByTypeQuery = regexp.QuoteMeta(prepareSecretGeneratorStmt +
` WHERE projections.secret_generators2.generator_type = $1 AND projections.secret_generators2.instance_id = $2`)
secretGeneratorByTypeInstanceID = "instanceID"
)
func Test_SecretGeneratorsPrepares(t *testing.T) {
@@ -314,3 +323,101 @@ func Test_SecretGeneratorsPrepares(t *testing.T) {
})
}
}
func TestQueries_SecretGeneratorByType(t *testing.T) {
ctx := authz.NewMockContext(secretGeneratorByTypeInstanceID, "orgID", "loginClient")
generatorType := domain.SecretGeneratorTypeInviteCode
queryArgs := []driver.Value{generatorType, secretGeneratorByTypeInstanceID}
inviteCodeDefault := &crypto.GeneratorConfig{
Length: 6,
Expiry: 72 * time.Hour,
IncludeUpperLetters: true,
IncludeDigits: true,
}
tests := []struct {
name string
mock sqlExpectation
defaultSecretGenerators map[domain.SecretGeneratorType]*crypto.GeneratorConfig
want *SecretGenerator
wantErr error
}{
{
name: "found in DB",
mock: mockQuery(expectedSecretGeneratorByTypeQuery, prepareSecretGeneratorCols, []driver.Value{
"agg-id",
domain.SecretGeneratorTypeInviteCode,
testNow,
testNow,
"ro",
uint64(20211108),
6,
72 * time.Hour,
false,
true,
true,
false,
}, queryArgs...),
want: &SecretGenerator{
AggregateID: "agg-id",
GeneratorType: domain.SecretGeneratorTypeInviteCode,
CreationDate: testNow,
ChangeDate: testNow,
ResourceOwner: "ro",
Sequence: 20211108,
Length: 6,
Expiry: 72 * time.Hour,
IncludeLowerLetters: false,
IncludeUpperLetters: true,
IncludeDigits: true,
IncludeSymbols: false,
},
},
{
name: "not found, default exists",
mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{
domain.SecretGeneratorTypeInviteCode: inviteCodeDefault,
},
want: &SecretGenerator{
AggregateID: secretGeneratorByTypeInstanceID,
ResourceOwner: secretGeneratorByTypeInstanceID,
GeneratorType: domain.SecretGeneratorTypeInviteCode,
Length: 6,
Expiry: 72 * time.Hour,
IncludeUpperLetters: true,
IncludeDigits: true,
},
},
{
name: "not found, no default",
mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrNoRows, queryArgs...),
defaultSecretGenerators: map[domain.SecretGeneratorType]*crypto.GeneratorConfig{},
wantErr: sql.ErrNoRows,
},
{
name: "DB internal error",
mock: mockQueryErr(expectedSecretGeneratorByTypeQuery, sql.ErrConnDone, queryArgs...),
wantErr: sql.ErrConnDone,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
execMock(t, tt.mock, func(db *sql.DB) {
q := &Queries{
client: &database.DB{
DB: db,
},
defaultSecretGenerators: tt.defaultSecretGenerators,
}
got, err := q.SecretGeneratorByType(ctx, generatorType)
if tt.wantErr != nil {
require.ErrorIs(t, err, tt.wantErr)
} else {
require.NoError(t, err)
}
assert.Equal(t, tt.want, got)
})
})
}
}
internal/query/secret_generators.go
+22 -1
View File
@@ -139,8 +139,29 @@ func (q *Queries) SecretGeneratorByType(ctx context.Context, generatorType domai
generator, err = scan(row)
return err
}, query, args...)
if err == nil {
return generator, nil
}
if !errors.Is(err, sql.ErrNoRows) {
logging.OnError(err).WithField("type", generatorType).WithField("instance_id", instanceID).Error("secret generator by type")
return generator, err
return nil, err
}
// if the config was not (yet) stored on the database, fall back to the system / runtime config
defaultConfig, ok := q.defaultSecretGenerators[generatorType]
if !ok {
return nil, err // return the initial not found error
}
return &SecretGenerator{
AggregateID: instanceID,
ResourceOwner: instanceID,
GeneratorType: generatorType,
Length: defaultConfig.Length,
Expiry: defaultConfig.Expiry,
IncludeLowerLetters: defaultConfig.IncludeLowerLetters,
IncludeUpperLetters: defaultConfig.IncludeUpperLetters,
IncludeDigits: defaultConfig.IncludeDigits,
IncludeSymbols: defaultConfig.IncludeSymbols,
}, nil
}
func (q *Queries) SearchSecretGenerators(ctx context.Context, queries *SecretGeneratorSearchQueries) (secretGenerators *SecretGenerators, err error) {
proto/zitadel/settings.proto
+1
View File
@@ -56,6 +56,7 @@ enum SecretGeneratorType {
SECRET_GENERATOR_TYPE_APP_SECRET = 6;
SECRET_GENERATOR_TYPE_OTP_SMS = 7;
SECRET_GENERATOR_TYPE_OTP_EMAIL = 8;
SECRET_GENERATOR_TYPE_INVITE_CODE = 9;
}
message SMTPConfig {