andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-07 06:42:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: correctly send links to login v2 in email notifications (#10711)

Browse Source 
# Which Problems Are Solved

There were still some emails (passkey registration and domain claimed)
sent with links pointing to login v1 even when the login v2 was enabled
for the instance.
Also while looking into the issue, it was discovered that some links
pointing to login V2 were not correctly generated.


# How the Problems Are Solved

- Added default paths for passkey registration and domain claimed
notifications
- Fixed the existing paths to properly handle concatenation (resp. use
`url.ResolveReference`)
  - Change their go types (from string) to `*url.URL` 
  - Added a mapstructure hook for string to url
- Removed unnecessary `InstanceSetupFeatures` and corresponding
conversions
- Refactored the methods on the `login.DefaultPaths` struct and added an
interface to the `Commands` to only need to pass a single config (and
not every method)
- Added an `OriginURL` method to the `DomainCtx` to prevent going from
url to string and back
- Added the use of the templates in case of enabled login v2 for passkey
registration and domain claimed)

# Additional Changes

None

# Additional Context

closes #10643

---------

Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>
This commit is contained in:
Stefan Benz
2026-02-13 13:06:56 +00:00
committed by GitHub
co-authored by Max Peintner Livio Spring Livio Spring Max Peintner Gayathri Vijayan
parent 382aec2d61
commit 2a2d5392a3
48 changed files with 1323 additions and 450 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/notification/handlers/user_notifier.go
+7 -6
View File
@@ -2,6 +2,7 @@ package handlers
import (
"context"
"net/url"
"time"
http_util "github.com/zitadel/zitadel/internal/api/http"
@@ -89,7 +90,7 @@ const (
type userNotifier struct {
queries *NotificationQueries
otpEmailTmpl string
otpEmailTmpl func(origin *url.URL) string
queue Queue
maxAttempts uint8
@@ -101,7 +102,7 @@ func NewUserNotifier(
commands Commands,
queries *NotificationQueries,
channels types.ChannelChains,
otpEmailTmpl string,
otpEmailTmpl func(origin *url.URL) string,
workerConfig WorkerConfig,
queue Queue,
) *handler.Handler {
@@ -530,7 +531,7 @@ func (u *userNotifier) reduceSessionOTPEmailChallenged(event eventstore.Event) (
if err != nil {
return err
}
origin := http_util.DomainContext(ctx).Origin()
origin := http_util.DomainContext(ctx).OriginURL()
args := otpArgs(ctx, e.Expiry)
args.SessionID = e.Aggregate().ID
@@ -539,7 +540,7 @@ func (u *userNotifier) reduceSessionOTPEmailChallenged(event eventstore.Event) (
Aggregate: e.Aggregate(),
UserID: s.UserFactor.UserID,
UserResourceOwner: s.UserFactor.ResourceOwner,
TriggeredAtOrigin: origin,
TriggeredAtOrigin: origin.String(),
EventType: e.EventType,
NotificationType: domain.NotificationTypeEmail,
MessageType: domain.VerifyEmailOTPMessageType,
@@ -555,11 +556,11 @@ func (u *userNotifier) reduceSessionOTPEmailChallenged(event eventstore.Event) (
}), nil
}
func (u *userNotifier) otpEmailTemplate(origin string, e *session.OTPEmailChallengedEvent) string {
func (u *userNotifier) otpEmailTemplate(origin *url.URL, e *session.OTPEmailChallengedEvent) string {
if e.URLTmpl != "" {
return e.URLTmpl
}
return origin + u.otpEmailTmpl
return u.otpEmailTmpl(origin)
}
func otpArgs(ctx context.Context, expiry time.Duration) *domain.NotificationArguments {
internal/notification/handlers/user_notifier_legacy.go
+14 -13
View File
@@ -3,6 +3,7 @@ package handlers
import (
"context"
"errors"
"net/url"
"strings"
"time"
@@ -25,7 +26,7 @@ type userNotifierLegacy struct {
commands Commands
queries *NotificationQueries
channels types.ChannelChains
otpEmailTmpl string
otpEmailTmpl func(origin *url.URL) string
}
func NewUserNotifierLegacy(
@@ -34,7 +35,7 @@ func NewUserNotifierLegacy(
commands Commands,
queries *NotificationQueries,
channels types.ChannelChains,
otpEmailTmpl string,
otpEmailTmpl func(origin *url.URL) string,
) *handler.Handler {
return handler.NewHandler(ctx, &config, &userNotifierLegacy{
commands: commands,
@@ -421,8 +422,8 @@ func (u *userNotifierLegacy) reduceOTPEmailCodeAdded(event eventstore.Event) (*h
if e.AuthRequestInfo != nil {
authRequestID = e.AuthRequestInfo.ID
}
url := func(code, origin string, _ *query.NotifyUser) (string, error) {
return login.OTPLink(origin, authRequestID, code, domain.MFATypeOTPEmail), nil
url := func(code string, origin *url.URL, _ *query.NotifyUser) (string, error) {
return login.OTPLink(origin.String(), authRequestID, code, domain.MFATypeOTPEmail), nil
}
return u.reduceOTPEmail(
e,
@@ -450,11 +451,11 @@ func (u *userNotifierLegacy) reduceSessionOTPEmailChallenged(event eventstore.Ev
if err != nil {
return nil, err
}
url := func(code, origin string, user *query.NotifyUser) (string, error) {
link := func(code string, origin *url.URL, user *query.NotifyUser) (string, error) {
var buf strings.Builder
urlTmpl := origin + u.otpEmailTmpl
if e.URLTmpl != "" {
urlTmpl = e.URLTmpl
urlTmpl := e.URLTmpl
if urlTmpl == "" {
urlTmpl = u.otpEmailTmpl(origin)
}
if err := domain.RenderOTPEmailURLTemplate(&buf, urlTmpl, code, user.ID, user.PreferredLoginName, user.DisplayName, e.Aggregate().ID, user.PreferredLanguage); err != nil {
return "", err
@@ -467,7 +468,7 @@ func (u *userNotifierLegacy) reduceSessionOTPEmailChallenged(event eventstore.Ev
e.Expiry,
s.UserFactor.UserID,
s.UserFactor.ResourceOwner,
url,
link,
u.commands.OTPEmailSent,
user.HumanOTPEmailCodeAddedType,
user.HumanOTPEmailCodeSentType,
@@ -480,7 +481,7 @@ func (u *userNotifierLegacy) reduceOTPEmail(
expiry time.Duration,
userID,
resourceOwner string,
urlTmpl func(code, origin string, user *query.NotifyUser) (string, error),
urlTmpl func(code string, origin *url.URL, user *query.NotifyUser) (string, error),
sentCommand func(ctx context.Context, userID string, resourceOwner string) (err error),
eventTypes ...eventstore.EventType,
) (*handler.Statement, error) {
@@ -518,12 +519,12 @@ func (u *userNotifierLegacy) reduceOTPEmail(
if err != nil {
return nil, err
}
url, err := urlTmpl(plainCode, http_util.DomainContext(ctx).Origin(), notifyUser)
link, err := urlTmpl(plainCode, http_util.DomainContext(ctx).OriginURL(), notifyUser)
if err != nil {
return nil, err
}
notify := types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, event.Type())
err = notify.SendOTPEmailCode(ctx, url, plainCode, expiry)
err = notify.SendOTPEmailCode(ctx, link, plainCode, expiry)
if err != nil {
if errors.Is(err, &channels.CancelError{}) {
// if the notification was canceled, we don't want to return the error, so there is no retry
@@ -577,7 +578,7 @@ func (u *userNotifierLegacy) reduceDomainClaimed(event eventstore.Event) (*handl
return err
}
err = types.SendEmail(ctx, u.channels, string(template.Template), translator, notifyUser, colors, event.Type()).
SendDomainClaimed(ctx, notifyUser, e.UserName)
SendDomainClaimed(ctx, notifyUser, e.UserName, e.URLTemplate)
if err != nil {
if errors.Is(err, &channels.CancelError{}) {
// if the notification was canceled, we don't want to return the error, so there is no retry
internal/notification/handlers/user_notifier_legacy_test.go
+4 -1
View File
@@ -3,6 +3,7 @@ package handlers
import (
"database/sql"
"fmt"
"net/url"
"testing"
"time"
@@ -1972,7 +1973,9 @@ func newUserNotifierLegacy(t *testing.T, ctrl *gomock.Controller, queries *mock.
smtpAlg,
f.SMSTokenCrypto,
),
otpEmailTmpl: defaultOTPEmailTemplate,
otpEmailTmpl: func(origin *url.URL) string {
return origin.String() + defaultOTPEmailTemplate
},
channels: &notificationChannels{
Chain: *senders.ChainChannels(channel),
EmailConfig: &email.Config{
internal/notification/handlers/user_notifier_test.go
+4 -1
View File
@@ -4,6 +4,7 @@ import (
"context"
"database/sql"
"fmt"
"net/url"
"testing"
"time"
@@ -1936,7 +1937,9 @@ func newUserNotifier(t *testing.T, ctrl *gomock.Controller, queries *mock.MockQu
smtpAlg,
f.SMSTokenCrypto,
),
otpEmailTmpl: defaultOTPEmailTemplate,
otpEmailTmpl: func(origin *url.URL) string {
return origin.String() + defaultOTPEmailTemplate
},
}
}
internal/notification/projections.go
+3 -1
View File
@@ -3,6 +3,7 @@ package notification
import (
"context"
"fmt"
"net/url"
"github.com/zitadel/logging"
@@ -35,7 +36,8 @@ func Register(
commands *command.Commands,
queries *query.Queries,
es *eventstore.Eventstore,
otpEmailTmpl, fileSystemPath string,
otpEmailTmpl func(origin *url.URL) string,
fileSystemPath string,
userEncryption, smtpEncryption, smsEncryption crypto.EncryptionAlgorithm,
queue *queue.Queue,
) {
internal/notification/types/domain_claimed.go
+23 -3
View File
@@ -10,11 +10,31 @@ import (
"github.com/zitadel/zitadel/internal/query"
)
func (notify Notify) SendDomainClaimed(ctx context.Context, user *query.NotifyUser, username string) error {
url := login.LoginLink(http_utils.DomainContext(ctx).Origin(), user.ResourceOwner)
func (notify Notify) SendDomainClaimed(ctx context.Context, user *query.NotifyUser, username, urlTemplate string) error {
index := strings.LastIndex(user.LastEmail, "@")
domainSuffix := user.LastEmail[index+1:]
var url string
if urlTemplate == "" {
url = login.LoginLink(http_utils.DomainContext(ctx).Origin(), user.ResourceOwner)
} else {
var buf strings.Builder
if err := domain.RenderURLTemplate(&buf, urlTemplate, &DomainClaimedData{
Domain: domainSuffix,
TempUsername: username,
OrgID: user.ResourceOwner,
}); err != nil {
return err
}
url = buf.String()
}
args := make(map[string]interface{})
args["TempUsername"] = username
args["Domain"] = user.LastEmail[index+1:]
args["Domain"] = domainSuffix
return notify(url, args, domain.DomainClaimedMessageType, true)
}
type DomainClaimedData struct {
TempUsername string
Domain string
OrgID string
}