andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-09 15:45:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: native app links for passkeys (#12580)

Browse Source 
# Which Problems Are Solved

- Native iOS/Android passkeys need OS trust files on the ZITADEL domain;
without them, Associated Domains / App Links verification fails.
- Operators could not configure iOS Team ID + Bundle ID or Android
package name + SHA-256 fingerprints on OIDC apps.
- `/.well-known/apple-app-site-association` and
`/.well-known/assetlinks.json` were not served from application config.

# How the Problems Are Solved

- Add iOS/Android app-link fields on OIDC app create/update (Application
API v2 + Management), with validation.
- Persist and project those fields; query active app-link configs
instance-wide.
- Serve AASA (`webcredentials`) and Digital Asset Links
(`get_login_creds`) from well-known paths, with configurable
`Cache-Control` and fingerprint normalization at serve time.
- Console UI to edit the fields, with links to the well-known endpoints.
- Operator docs for configuration, endpoints, caching, and verification.

# Additional Changes

- Document on API fields that well-known responses may be HTTP-cached
and platform verifiers may delay propagation.
- Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`;
`0` → `no-store`).

# Additional Context

- Closes #12497
- Implemented and reviewed as stack:
  - #12531 API contract
  - #12532 storage wiring
  - #12536 well-known endpoints
  - #12537 console
  - #12547 docs

---------

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Livio Spring
2026-08-12 08:04:27 +02:00
committed by GitHub
co-authored by Cursor
parent 2bd42e8fc4
commit 318bfc36d7
68 changed files with 3227 additions and 467 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/grpc/application/v2/convert/oidc_app.go
+91 -38
View File
@@ -15,30 +15,36 @@ func CreateOIDCAppRequestToDomain(name, appID, projectID string, req *applicatio
if err != nil {
return nil, err
}
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(req.GetIos())
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(req.GetAndroid())
return &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{
AggregateID: projectID,
},
AppID: appID,
AppName: name,
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
RedirectUris: req.GetRedirectUris(),
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
DevMode: &req.DevelopmentMode,
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
AdditionalOrigins: req.GetAdditionalOrigins(),
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
AppID: appID,
AppName: name,
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
RedirectUris: req.GetRedirectUris(),
ResponseTypes: oidcResponseTypesToDomain(req.GetResponseTypes()),
GrantTypes: oidcGrantTypesToDomain(req.GetGrantTypes()),
ApplicationType: gu.Ptr(oidcApplicationTypeToDomain(req.GetApplicationType())),
AuthMethodType: gu.Ptr(oidcAuthMethodTypeToDomain(req.GetAuthMethodType())),
PostLogoutRedirectUris: req.GetPostLogoutRedirectUris(),
DevMode: &req.DevelopmentMode,
AccessTokenType: gu.Ptr(oidcTokenTypeToDomain(req.GetAccessTokenType())),
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
AdditionalOrigins: req.GetAdditionalOrigins(),
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
IOSTeamID: iosTeamID,
IOSBundleID: iosBundleID,
AndroidPackageName: androidPackageName,
AndroidSHA256CertFingerprints: androidFingerprints,
}, nil
}
@@ -47,28 +53,35 @@ func UpdateOIDCAppConfigRequestToDomain(appID, projectID string, app *applicatio
if err != nil {
return nil, err
}
// nested messages: omit = no change; present (incl. empty) = set/clear
iosTeamID, iosBundleID := iosAppLinkConfigToDomain(app.Ios)
androidPackageName, androidFingerprints := androidAppLinkConfigToDomain(app.Android)
return &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{
AggregateID: projectID,
},
AppID: appID,
RedirectUris: app.RedirectUris,
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
DevMode: app.DevelopmentMode,
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
AdditionalOrigins: app.AdditionalOrigins,
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
BackChannelLogoutURI: app.BackChannelLogoutUri,
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
AppID: appID,
RedirectUris: app.RedirectUris,
ResponseTypes: oidcResponseTypesToDomain(app.ResponseTypes),
GrantTypes: oidcGrantTypesToDomain(app.GrantTypes),
ApplicationType: oidcApplicationTypeToDomainPtr(app.ApplicationType),
AuthMethodType: oidcAuthMethodTypeToDomainPtr(app.AuthMethodType),
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
DevMode: app.DevelopmentMode,
AccessTokenType: oidcTokenTypeToDomainPtr(app.AccessTokenType),
AccessTokenRoleAssertion: app.AccessTokenRoleAssertion,
IDTokenRoleAssertion: app.IdTokenRoleAssertion,
IDTokenUserinfoAssertion: app.IdTokenUserinfoAssertion,
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
AdditionalOrigins: app.AdditionalOrigins,
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
BackChannelLogoutURI: app.BackChannelLogoutUri,
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
IOSTeamID: iosTeamID,
IOSBundleID: iosBundleID,
AndroidPackageName: androidPackageName,
AndroidSHA256CertFingerprints: androidFingerprints,
}, nil
}
@@ -213,10 +226,50 @@ func appOIDCConfigToPb(oidcApp *query.OIDCApp) *application.Application_OidcConf
SkipNativeAppSuccessPage: oidcApp.SkipNativeAppSuccessPage,
BackChannelLogoutUri: oidcApp.BackChannelLogoutURI,
LoginVersion: loginVersionToPb(oidcApp.LoginVersion, oidcApp.LoginBaseURI),
Ios: iosAppLinkConfigToPb(oidcApp.IOSTeamID, oidcApp.IOSBundleID),
Android: androidAppLinkConfigToPb(oidcApp.AndroidPackageName, oidcApp.AndroidSHA256CertFingerprints),
},
}
}
func iosAppLinkConfigToDomain(cfg *application.IOSAppLinkConfig) (teamID, bundleID *string) {
if cfg == nil {
return nil, nil
}
return gu.Ptr(cfg.GetTeamId()), gu.Ptr(cfg.GetBundleId())
}
func androidAppLinkConfigToDomain(cfg *application.AndroidAppLinkConfig) (packageName *string, fingerprints []string) {
if cfg == nil {
return nil, nil
}
fps := cfg.GetSha256CertFingerprints()
if fps == nil {
fps = []string{}
}
return gu.Ptr(cfg.GetPackageName()), fps
}
func iosAppLinkConfigToPb(teamID, bundleID string) *application.IOSAppLinkConfig {
if teamID == "" && bundleID == "" {
return nil
}
return &application.IOSAppLinkConfig{
TeamId: teamID,
BundleId: bundleID,
}
}
func androidAppLinkConfigToPb(packageName string, fingerprints []string) *application.AndroidAppLinkConfig {
if packageName == "" && len(fingerprints) == 0 {
return nil
}
return &application.AndroidAppLinkConfig{
PackageName: packageName,
Sha256CertFingerprints: fingerprints,
}
}
func oidcResponseTypesFromModel(responseTypes []domain.OIDCResponseType) []application.OIDCResponseType {
oidcResponseTypes := make([]application.OIDCResponseType, len(responseTypes))
for i, responseType := range responseTypes {
internal/api/grpc/application/v2/convert/oidc_app_test.go
+130 -41
View File
@@ -66,29 +66,41 @@ func TestCreateOIDCAppRequestToDomain(t *testing.T) {
LoginVersion: &application.LoginVersion{Version: &application.LoginVersion_LoginV2{LoginV2: &application.LoginV2{
BaseUri: gu.Ptr("https://login"),
}}},
Ios: &application.IOSAppLinkConfig{
TeamId: "TEAMID",
BundleId: "com.example.app",
},
Android: &application.AndroidAppLinkConfig{
PackageName: "com.example.app",
Sha256CertFingerprints: []string{"AA:BB:CC"},
},
},
expectedModel: &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
AppName: "all fields set",
AppID: "app1",
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
RedirectUris: []string{"https://redirect"},
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
PostLogoutRedirectUris: []string{"https://logout"},
DevMode: gu.Ptr(true),
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
AccessTokenRoleAssertion: gu.Ptr(true),
IDTokenRoleAssertion: gu.Ptr(true),
IDTokenUserinfoAssertion: gu.Ptr(true),
ClockSkew: gu.Ptr(5 * time.Second),
AdditionalOrigins: []string{"https://origin"},
SkipNativeAppSuccessPage: gu.Ptr(true),
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
LoginVersion: gu.Ptr(domain.LoginVersion2),
LoginBaseURI: gu.Ptr("https://login"),
ObjectRoot: models.ObjectRoot{AggregateID: "project1"},
AppName: "all fields set",
AppID: "app1",
OIDCVersion: gu.Ptr(domain.OIDCVersionV1),
RedirectUris: []string{"https://redirect"},
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
ApplicationType: gu.Ptr(domain.OIDCApplicationTypeWeb),
AuthMethodType: gu.Ptr(domain.OIDCAuthMethodTypeBasic),
PostLogoutRedirectUris: []string{"https://logout"},
DevMode: gu.Ptr(true),
AccessTokenType: gu.Ptr(domain.OIDCTokenTypeBearer),
AccessTokenRoleAssertion: gu.Ptr(true),
IDTokenRoleAssertion: gu.Ptr(true),
IDTokenUserinfoAssertion: gu.Ptr(true),
ClockSkew: gu.Ptr(5 * time.Second),
AdditionalOrigins: []string{"https://origin"},
SkipNativeAppSuccessPage: gu.Ptr(true),
BackChannelLogoutURI: gu.Ptr("https://backchannel"),
LoginVersion: gu.Ptr(domain.LoginVersion2),
LoginBaseURI: gu.Ptr("https://login"),
IOSTeamID: gu.Ptr("TEAMID"),
IOSBundleID: gu.Ptr("com.example.app"),
AndroidPackageName: gu.Ptr("com.example.app"),
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
},
},
}
@@ -182,6 +194,71 @@ func TestUpdateOIDCAppConfigRequestToDomain(t *testing.T) {
LoginBaseURI: gu.Ptr("https://login"),
},
},
{
testName: "omit app links leaves nil",
appID: "app1",
projectID: "proj1",
req: &application.UpdateOIDCApplicationConfigurationRequest{},
expectedModel: &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
AppID: "app1",
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
ClockSkew: gu.Ptr(time.Duration(0)),
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
LoginBaseURI: gu.Ptr(""),
},
},
{
testName: "set app links",
appID: "app1",
projectID: "proj1",
req: &application.UpdateOIDCApplicationConfigurationRequest{
Ios: &application.IOSAppLinkConfig{
TeamId: "TEAMID",
BundleId: "com.example.app",
},
Android: &application.AndroidAppLinkConfig{
PackageName: "com.example.app",
Sha256CertFingerprints: []string{"AA:BB:CC"},
},
},
expectedModel: &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
AppID: "app1",
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
ClockSkew: gu.Ptr(time.Duration(0)),
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
LoginBaseURI: gu.Ptr(""),
IOSTeamID: gu.Ptr("TEAMID"),
IOSBundleID: gu.Ptr("com.example.app"),
AndroidPackageName: gu.Ptr("com.example.app"),
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
},
},
{
testName: "clear app links with empty messages",
appID: "app1",
projectID: "proj1",
req: &application.UpdateOIDCApplicationConfigurationRequest{
Ios: &application.IOSAppLinkConfig{},
Android: &application.AndroidAppLinkConfig{},
},
expectedModel: &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{AggregateID: "proj1"},
AppID: "app1",
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
ClockSkew: gu.Ptr(time.Duration(0)),
LoginVersion: gu.Ptr(domain.LoginVersionUnspecified),
LoginBaseURI: gu.Ptr(""),
IOSTeamID: gu.Ptr(""),
IOSBundleID: gu.Ptr(""),
AndroidPackageName: gu.Ptr(""),
AndroidSHA256CertFingerprints: []string{},
},
},
}
for _, tc := range tt {
@@ -453,26 +530,30 @@ func TestAppOIDCConfigToPb(t *testing.T) {
{
name: "full config",
input: &query.OIDCApp{
RedirectURIs: []string{"https://example.com/callback"},
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
AppType: domain.OIDCApplicationTypeWeb,
ClientID: "client123",
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
ComplianceProblems: []string{"problem1", "problem2"},
IsDevMode: true,
AccessTokenType: domain.OIDCTokenTypeBearer,
AssertAccessTokenRole: true,
AssertIDTokenRole: true,
AssertIDTokenUserinfo: true,
ClockSkew: 5 * time.Second,
AdditionalOrigins: []string{"https://app.example.com"},
AllowedOrigins: []string{"https://allowed.example.com"},
SkipNativeAppSuccessPage: true,
BackChannelLogoutURI: "https://example.com/backchannel",
LoginVersion: domain.LoginVersion2,
LoginBaseURI: gu.Ptr("https://login.example.com"),
RedirectURIs: []string{"https://example.com/callback"},
ResponseTypes: []domain.OIDCResponseType{domain.OIDCResponseTypeCode},
GrantTypes: []domain.OIDCGrantType{domain.OIDCGrantTypeAuthorizationCode},
AppType: domain.OIDCApplicationTypeWeb,
ClientID: "client123",
AuthMethodType: domain.OIDCAuthMethodTypeBasic,
PostLogoutRedirectURIs: []string{"https://example.com/logout"},
ComplianceProblems: []string{"problem1", "problem2"},
IsDevMode: true,
AccessTokenType: domain.OIDCTokenTypeBearer,
AssertAccessTokenRole: true,
AssertIDTokenRole: true,
AssertIDTokenUserinfo: true,
ClockSkew: 5 * time.Second,
AdditionalOrigins: []string{"https://app.example.com"},
AllowedOrigins: []string{"https://allowed.example.com"},
SkipNativeAppSuccessPage: true,
BackChannelLogoutURI: "https://example.com/backchannel",
LoginVersion: domain.LoginVersion2,
LoginBaseURI: gu.Ptr("https://login.example.com"),
IOSTeamID: "TEAMID",
IOSBundleID: "com.example.app",
AndroidPackageName: "com.example.app",
AndroidSHA256CertFingerprints: []string{"AA:BB:CC"},
},
expected: &application.Application_OidcConfiguration{
OidcConfiguration: &application.OIDCConfiguration{
@@ -506,6 +587,14 @@ func TestAppOIDCConfigToPb(t *testing.T) {
},
},
},
Ios: &application.IOSAppLinkConfig{
TeamId: "TEAMID",
BundleId: "com.example.app",
},
Android: &application.AndroidAppLinkConfig{
PackageName: "com.example.app",
Sha256CertFingerprints: []string{"AA:BB:CC"},
},
},
},
},
internal/api/grpc/application/v2/integration_test/app_link_test.go
+159
View File
@@ -0,0 +1,159 @@
//go:build integration
package app_test
import (
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
"github.com/zitadel/zitadel/internal/integration"
"github.com/zitadel/zitadel/pkg/grpc/application/v2"
)
func TestOIDCAppLinkConfig(t *testing.T) {
p := instance.CreateProject(IAMOwnerCtx, t, instance.DefaultOrg.GetId(), integration.ProjectName(), false, false)
ios := &application.IOSAppLinkConfig{
TeamId: "ABCDE12345",
BundleId: "com.example.app",
}
android := &application.AndroidAppLinkConfig{
PackageName: "com.example.app",
Sha256CertFingerprints: []string{"AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99"},
}
t.Run("create with incomplete ios config is rejected", func(t *testing.T) {
_, err := instance.Client.ApplicationV2.CreateApplication(IAMOwnerCtx, &application.CreateApplicationRequest{
ProjectId: p.GetId(),
Name: integration.ApplicationName(),
ApplicationType: &application.CreateApplicationRequest_OidcConfiguration{
OidcConfiguration: baseOIDCCreateRequest(iosOnlyTeamID()),
},
})
require.Equal(t, codes.InvalidArgument, status.Code(err))
})
t.Run("create get update omit and clear round trip", func(t *testing.T) {
created, err := instance.Client.ApplicationV2.CreateApplication(IAMOwnerCtx, &application.CreateApplicationRequest{
ProjectId: p.GetId(),
Name: integration.ApplicationName(),
ApplicationType: &application.CreateApplicationRequest_OidcConfiguration{
OidcConfiguration: baseOIDCCreateRequestWithAppLinks(ios, android),
},
})
require.NoError(t, err)
require.NotEmpty(t, created.GetApplicationId())
assertOIDCAppLinks(t, created.GetApplicationId(), ios, android)
updatedIos := &application.IOSAppLinkConfig{
TeamId: "NEWTEAM123",
BundleId: "com.example.app.updated",
}
updatedAndroid := &application.AndroidAppLinkConfig{
PackageName: "com.example.app.updated",
Sha256CertFingerprints: []string{"11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00"},
}
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
ProjectId: p.GetId(),
ApplicationId: created.GetApplicationId(),
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
Ios: updatedIos,
Android: updatedAndroid,
},
},
})
require.NoError(t, err)
assertOIDCAppLinks(t, created.GetApplicationId(), updatedIos, updatedAndroid)
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
ProjectId: p.GetId(),
ApplicationId: created.GetApplicationId(),
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
PostLogoutRedirectUris: []string{"http://example.com/home-omitted"},
},
},
})
require.NoError(t, err)
assertOIDCAppLinks(t, created.GetApplicationId(), updatedIos, updatedAndroid)
_, err = instance.Client.ApplicationV2.UpdateApplication(IAMOwnerCtx, &application.UpdateApplicationRequest{
ProjectId: p.GetId(),
ApplicationId: created.GetApplicationId(),
ApplicationType: &application.UpdateApplicationRequest_OidcConfiguration{
OidcConfiguration: &application.UpdateOIDCApplicationConfigurationRequest{
Ios: &application.IOSAppLinkConfig{},
Android: &application.AndroidAppLinkConfig{},
},
},
})
require.NoError(t, err)
assertOIDCAppLinks(t, created.GetApplicationId(), nil, nil)
})
}
func baseOIDCCreateRequest(opts ...func(*application.CreateOIDCApplicationRequest)) *application.CreateOIDCApplicationRequest {
req := &application.CreateOIDCApplicationRequest{
RedirectUris: []string{"http://example.com"},
ResponseTypes: []application.OIDCResponseType{application.OIDCResponseType_OIDC_RESPONSE_TYPE_CODE},
GrantTypes: []application.OIDCGrantType{application.OIDCGrantType_OIDC_GRANT_TYPE_AUTHORIZATION_CODE},
ApplicationType: application.OIDCApplicationType_OIDC_APP_TYPE_NATIVE,
AuthMethodType: application.OIDCAuthMethodType_OIDC_AUTH_METHOD_TYPE_NONE,
PostLogoutRedirectUris: []string{"http://example.com/home"},
Version: application.OIDCVersion_OIDC_VERSION_1_0,
AccessTokenType: application.OIDCTokenType_OIDC_TOKEN_TYPE_BEARER,
}
for _, opt := range opts {
opt(req)
}
return req
}
func baseOIDCCreateRequestWithAppLinks(ios *application.IOSAppLinkConfig, android *application.AndroidAppLinkConfig) *application.CreateOIDCApplicationRequest {
return baseOIDCCreateRequest(func(req *application.CreateOIDCApplicationRequest) {
req.Ios = ios
req.Android = android
})
}
func iosOnlyTeamID() func(*application.CreateOIDCApplicationRequest) {
return func(req *application.CreateOIDCApplicationRequest) {
req.Ios = &application.IOSAppLinkConfig{TeamId: "ABCDE12345"}
}
}
func assertOIDCAppLinks(t *testing.T, appID string, wantIOS *application.IOSAppLinkConfig, wantAndroid *application.AndroidAppLinkConfig) {
t.Helper()
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(IAMOwnerCtx, time.Minute)
require.EventuallyWithT(t, func(ct *assert.CollectT) {
res, err := instance.Client.ApplicationV2.GetApplication(IAMOwnerCtx, &application.GetApplicationRequest{
ApplicationId: appID,
})
require.NoError(ct, err)
cfg := res.GetApplication().GetOidcConfiguration()
require.NotNil(ct, cfg)
if wantIOS == nil {
assert.Nil(ct, cfg.GetIos())
} else {
require.NotNil(ct, cfg.GetIos())
assert.Equal(ct, wantIOS.GetTeamId(), cfg.GetIos().GetTeamId())
assert.Equal(ct, wantIOS.GetBundleId(), cfg.GetIos().GetBundleId())
}
if wantAndroid == nil {
assert.Nil(ct, cfg.GetAndroid())
} else {
require.NotNil(ct, cfg.GetAndroid())
assert.Equal(ct, wantAndroid.GetPackageName(), cfg.GetAndroid().GetPackageName())
assert.Equal(ct, wantAndroid.GetSha256CertFingerprints(), cfg.GetAndroid().GetSha256CertFingerprints())
}
}, retryDuration, tick)
}
internal/api/grpc/management/project_application_converter.go
+50 -37
View File
@@ -47,29 +47,35 @@ func AddOIDCAppRequestToDomain(req *mgmt_pb.AddOIDCAppRequest) (*domain.OIDCApp,
if err != nil {
return nil, err
}
iosTeamID, iosBundleID := app_grpc.IOSAppLinkConfigToDomain(req.GetIos())
androidPackageName, androidFingerprints := app_grpc.AndroidAppLinkConfigToDomain(req.GetAndroid())
return &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{
AggregateID: req.ProjectId,
},
AppName: req.Name,
OIDCVersion: gu.Ptr(app_grpc.OIDCVersionToDomain(req.Version)),
RedirectUris: req.RedirectUris,
ResponseTypes: app_grpc.OIDCResponseTypesToDomain(req.ResponseTypes),
GrantTypes: app_grpc.OIDCGrantTypesToDomain(req.GrantTypes),
ApplicationType: gu.Ptr(app_grpc.OIDCApplicationTypeToDomain(req.AppType)),
AuthMethodType: gu.Ptr(app_grpc.OIDCAuthMethodTypeToDomain(req.AuthMethodType)),
PostLogoutRedirectUris: req.PostLogoutRedirectUris,
DevMode: gu.Ptr(req.GetDevMode()),
AccessTokenType: gu.Ptr(app_grpc.OIDCTokenTypeToDomain(req.AccessTokenType)),
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
AdditionalOrigins: req.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
LoginVersion: gu.Ptr(loginVersion),
LoginBaseURI: gu.Ptr(loginBaseURI),
AppName: req.Name,
OIDCVersion: gu.Ptr(app_grpc.OIDCVersionToDomain(req.Version)),
RedirectUris: req.RedirectUris,
ResponseTypes: app_grpc.OIDCResponseTypesToDomain(req.ResponseTypes),
GrantTypes: app_grpc.OIDCGrantTypesToDomain(req.GrantTypes),
ApplicationType: gu.Ptr(app_grpc.OIDCApplicationTypeToDomain(req.AppType)),
AuthMethodType: gu.Ptr(app_grpc.OIDCAuthMethodTypeToDomain(req.AuthMethodType)),
PostLogoutRedirectUris: req.PostLogoutRedirectUris,
DevMode: gu.Ptr(req.GetDevMode()),
AccessTokenType: gu.Ptr(app_grpc.OIDCTokenTypeToDomain(req.AccessTokenType)),
AccessTokenRoleAssertion: gu.Ptr(req.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(req.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(req.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(req.GetClockSkew().AsDuration()),
AdditionalOrigins: req.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(req.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(req.GetBackChannelLogoutUri()),
LoginVersion: gu.Ptr(loginVersion),
LoginBaseURI: gu.Ptr(loginBaseURI),
IOSTeamID: iosTeamID,
IOSBundleID: iosBundleID,
AndroidPackageName: androidPackageName,
AndroidSHA256CertFingerprints: androidFingerprints,
}, nil
}
@@ -112,28 +118,35 @@ func UpdateOIDCAppConfigRequestToDomain(app *mgmt_pb.UpdateOIDCAppConfigRequest)
if err != nil {
return nil, err
}
// nested messages: omit = no change; present (incl. empty) = set/clear
iosTeamID, iosBundleID := app_grpc.IOSAppLinkConfigToDomain(app.Ios)
androidPackageName, androidFingerprints := app_grpc.AndroidAppLinkConfigToDomain(app.Android)
return &domain.OIDCApp{
ObjectRoot: models.ObjectRoot{
AggregateID: app.ProjectId,
},
AppID: app.AppId,
RedirectUris: app.RedirectUris,
ResponseTypes: app_grpc.OIDCResponseTypesToDomain(app.ResponseTypes),
GrantTypes: app_grpc.OIDCGrantTypesToDomain(app.GrantTypes),
ApplicationType: gu.Ptr(app_grpc.OIDCApplicationTypeToDomain(app.AppType)),
AuthMethodType: gu.Ptr(app_grpc.OIDCAuthMethodTypeToDomain(app.AuthMethodType)),
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
DevMode: gu.Ptr(app.GetDevMode()),
AccessTokenType: gu.Ptr(app_grpc.OIDCTokenTypeToDomain(app.AccessTokenType)),
AccessTokenRoleAssertion: gu.Ptr(app.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(app.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(app.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
AdditionalOrigins: app.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(app.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(app.GetBackChannelLogoutUri()),
LoginVersion: gu.Ptr(loginVersion),
LoginBaseURI: gu.Ptr(loginBaseURI),
AppID: app.AppId,
RedirectUris: app.RedirectUris,
ResponseTypes: app_grpc.OIDCResponseTypesToDomain(app.ResponseTypes),
GrantTypes: app_grpc.OIDCGrantTypesToDomain(app.GrantTypes),
ApplicationType: gu.Ptr(app_grpc.OIDCApplicationTypeToDomain(app.AppType)),
AuthMethodType: gu.Ptr(app_grpc.OIDCAuthMethodTypeToDomain(app.AuthMethodType)),
PostLogoutRedirectUris: app.PostLogoutRedirectUris,
DevMode: gu.Ptr(app.GetDevMode()),
AccessTokenType: gu.Ptr(app_grpc.OIDCTokenTypeToDomain(app.AccessTokenType)),
AccessTokenRoleAssertion: gu.Ptr(app.GetAccessTokenRoleAssertion()),
IDTokenRoleAssertion: gu.Ptr(app.GetIdTokenRoleAssertion()),
IDTokenUserinfoAssertion: gu.Ptr(app.GetIdTokenUserinfoAssertion()),
ClockSkew: gu.Ptr(app.GetClockSkew().AsDuration()),
AdditionalOrigins: app.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(app.GetSkipNativeAppSuccessPage()),
BackChannelLogoutURI: gu.Ptr(app.GetBackChannelLogoutUri()),
LoginVersion: gu.Ptr(loginVersion),
LoginBaseURI: gu.Ptr(loginBaseURI),
IOSTeamID: iosTeamID,
IOSBundleID: iosBundleID,
AndroidPackageName: androidPackageName,
AndroidSHA256CertFingerprints: androidFingerprints,
}, nil
}
internal/api/grpc/project/application.go
+41
View File
@@ -3,6 +3,7 @@ package project
import (
"net/url"
"github.com/muhlemmer/gu"
"google.golang.org/protobuf/types/known/durationpb"
object_grpc "github.com/zitadel/zitadel/internal/api/grpc/object"
@@ -68,6 +69,8 @@ func AppOIDCConfigToPb(app *query.OIDCApp) *app_pb.App_OidcConfig {
SkipNativeAppSuccessPage: app.SkipNativeAppSuccessPage,
BackChannelLogoutUri: app.BackChannelLogoutURI,
LoginVersion: loginVersionToPb(app.LoginVersion, app.LoginBaseURI),
Ios: iosAppLinkConfigToPb(app.IOSTeamID, app.IOSBundleID),
Android: androidAppLinkConfigToPb(app.AndroidPackageName, app.AndroidSHA256CertFingerprints),
},
}
}
@@ -345,3 +348,41 @@ func LoginVersionToDomain(version *app_pb.LoginVersion) (domain.LoginVersion, st
return domain.LoginVersionUnspecified, "", nil
}
}
func IOSAppLinkConfigToDomain(cfg *app_pb.IOSAppLinkConfig) (teamID, bundleID *string) {
if cfg == nil {
return nil, nil
}
return gu.Ptr(cfg.GetTeamId()), gu.Ptr(cfg.GetBundleId())
}
func AndroidAppLinkConfigToDomain(cfg *app_pb.AndroidAppLinkConfig) (packageName *string, fingerprints []string) {
if cfg == nil {
return nil, nil
}
fps := cfg.GetSha256CertFingerprints()
if fps == nil {
fps = []string{}
}
return gu.Ptr(cfg.GetPackageName()), fps
}
func iosAppLinkConfigToPb(teamID, bundleID string) *app_pb.IOSAppLinkConfig {
if teamID == "" && bundleID == "" {
return nil
}
return &app_pb.IOSAppLinkConfig{
TeamId: teamID,
BundleId: bundleID,
}
}
func androidAppLinkConfigToPb(packageName string, fingerprints []string) *app_pb.AndroidAppLinkConfig {
if packageName == "" && len(fingerprints) == 0 {
return nil
}
return &app_pb.AndroidAppLinkConfig{
PackageName: packageName,
Sha256CertFingerprints: fingerprints,
}
}
internal/api/well_known/integration_test/well_known_test.go
+187
View File
@@ -0,0 +1,187 @@
//go:build integration
package well_known_test
import (
"context"
"encoding/json"
"io"
"net/http"
"os"
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/zitadel/zitadel/internal/api/well_known"
"github.com/zitadel/zitadel/internal/integration"
"github.com/zitadel/zitadel/pkg/grpc/application/v2"
)
var (
CTX context.Context
IAMOwnerCtx context.Context
Instance *integration.Instance
)
func TestMain(m *testing.M) {
os.Exit(func() int {
ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
defer cancel()
Instance = integration.NewInstance(ctx)
CTX = ctx
IAMOwnerCtx = Instance.WithAuthorization(ctx, integration.UserTypeIAMOwner)
return m.Run()
}())
}
func TestWellKnownAppLinks(t *testing.T) {
issuer := Instance.OIDCIssuer()
t.Run("empty when no apps configured", func(t *testing.T) {
assertEventuallyJSON(t, issuer+well_known.AppleAppSiteAssociationPath, map[string]any{
"webcredentials": map[string]any{
"apps": []any{},
},
})
assertEventuallyJSON(t, issuer+well_known.AssetLinksPath, []any{})
})
project := Instance.CreateProject(IAMOwnerCtx, t, Instance.DefaultOrg.GetId(), integration.ProjectName(), false, false)
ios1 := &application.IOSAppLinkConfig{TeamId: "TEAMAAAAAA", BundleId: "com.example.one"}
android1 := &application.AndroidAppLinkConfig{
PackageName: "com.example.one",
Sha256CertFingerprints: []string{"11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11"},
}
createOIDCAppWithLinks(t, project.GetId(), ios1, android1)
ios2 := &application.IOSAppLinkConfig{TeamId: "TEAMBBBBBB", BundleId: "com.example.two"}
createOIDCAppWithLinks(t, project.GetId(), ios2, nil)
android2 := &application.AndroidAppLinkConfig{
PackageName: "com.example.two",
Sha256CertFingerprints: []string{"22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22:22"},
}
createOIDCAppWithLinks(t, project.GetId(), nil, android2)
// duplicate iOS app id should be deduped in AASA
createOIDCAppWithLinks(t, project.GetId(), ios1, nil)
assertEventuallyJSONUnorderedApps(t, issuer,
[]string{
"TEAMAAAAAA.com.example.one",
"TEAMBBBBBB.com.example.two",
},
[]any{
map[string]any{
"relation": []any{"delegate_permission/common.get_login_creds"},
"target": map[string]any{
"namespace": "android_app",
"package_name": "com.example.one",
"sha256_cert_fingerprints": []any{android1.Sha256CertFingerprints[0]},
},
},
map[string]any{
"relation": []any{"delegate_permission/common.get_login_creds"},
"target": map[string]any{
"namespace": "android_app",
"package_name": "com.example.two",
"sha256_cert_fingerprints": []any{android2.Sha256CertFingerprints[0]},
},
},
},
)
}
func createOIDCAppWithLinks(t *testing.T, projectID string, ios *application.IOSAppLinkConfig, android *application.AndroidAppLinkConfig) {
t.Helper()
_, err := Instance.Client.ApplicationV2.CreateApplication(IAMOwnerCtx, &application.CreateApplicationRequest{
ProjectId: projectID,
Name: integration.ApplicationName(),
ApplicationType: &application.CreateApplicationRequest_OidcConfiguration{
OidcConfiguration: &application.CreateOIDCApplicationRequest{
RedirectUris: []string{"http://example.com"},
ResponseTypes: []application.OIDCResponseType{application.OIDCResponseType_OIDC_RESPONSE_TYPE_CODE},
GrantTypes: []application.OIDCGrantType{application.OIDCGrantType_OIDC_GRANT_TYPE_AUTHORIZATION_CODE},
ApplicationType: application.OIDCApplicationType_OIDC_APP_TYPE_NATIVE,
AuthMethodType: application.OIDCAuthMethodType_OIDC_AUTH_METHOD_TYPE_NONE,
Version: application.OIDCVersion_OIDC_VERSION_1_0,
AccessTokenType: application.OIDCTokenType_OIDC_TOKEN_TYPE_BEARER,
Ios: ios,
Android: android,
},
},
})
require.NoError(t, err)
}
func assertEventuallyJSON(t *testing.T, url string, want any) {
t.Helper()
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(CTX, time.Minute)
require.EventuallyWithT(t, func(ct *assert.CollectT) {
resp, err := http.Get(url)
if !assert.NoError(ct, err) {
return
}
defer func() {
_, _ = io.Copy(io.Discard, resp.Body)
_ = resp.Body.Close()
}()
if !assert.Equal(ct, http.StatusOK, resp.StatusCode) {
return
}
assert.Contains(ct, resp.Header.Get("Content-Type"), "application/json")
assert.Equal(ct, "public, max-age=300", resp.Header.Get("Cache-Control"))
body, err := io.ReadAll(resp.Body)
if !assert.NoError(ct, err) {
return
}
var got any
if !assert.NoError(ct, json.Unmarshal(body, &got)) {
return
}
assert.Equal(ct, want, got)
}, retryDuration, tick)
}
func assertEventuallyJSONUnorderedApps(t *testing.T, url string, wantApps []string, wantAssetLinks []any) {
t.Helper()
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(CTX, time.Minute)
require.EventuallyWithT(t, func(ct *assert.CollectT) {
aasaResp, err := http.Get(url + well_known.AppleAppSiteAssociationPath)
if !assert.NoError(ct, err) {
return
}
defer aasaResp.Body.Close()
if !assert.Equal(ct, http.StatusOK, aasaResp.StatusCode) {
return
}
var aasa struct {
WebCredentials struct {
Apps []string `json:"apps"`
} `json:"webcredentials"`
}
if !assert.NoError(ct, json.NewDecoder(aasaResp.Body).Decode(&aasa)) {
return
}
assert.ElementsMatch(ct, wantApps, aasa.WebCredentials.Apps)
assetResp, err := http.Get(url + well_known.AssetLinksPath)
if !assert.NoError(ct, err) {
return
}
defer assetResp.Body.Close()
if !assert.Equal(ct, http.StatusOK, assetResp.StatusCode) {
return
}
var got []any
if !assert.NoError(ct, json.NewDecoder(assetResp.Body).Decode(&got)) {
return
}
assert.ElementsMatch(ct, wantAssetLinks, got)
}, retryDuration, tick)
}
internal/api/well_known/well_known.go
+196
View File
@@ -0,0 +1,196 @@
package well_known
import (
"context"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"fmt"
"net/http"
"strings"
"time"
"github.com/zitadel/zitadel/backend/v3/instrumentation/logging"
http_util "github.com/zitadel/zitadel/internal/api/http"
"github.com/zitadel/zitadel/internal/query"
)
const (
AppleAppSiteAssociationPath = "/.well-known/apple-app-site-association"
AssetLinksPath = "/.well-known/assetlinks.json"
)
// HandlerPrefixes are registered with [api.API.RegisterHandlerPrefixes].
var HandlerPrefixes = []string{
AppleAppSiteAssociationPath,
AssetLinksPath,
}
// Config holds runtime options for the well-known handlers.
type Config struct {
// AppLinksCacheControlMaxAge sets the Cache-Control max-age for
// apple-app-site-association and assetlinks.json responses.
// 0 sets Cache-Control: no-store.
AppLinksCacheControlMaxAge time.Duration
}
type appLinkQuerier interface {
SearchOIDCAppLinkConfigs(ctx context.Context) ([]*query.OIDCAppLinkConfig, error)
}
type Handler struct {
queries appLinkQuerier
cacheControlMaxAge time.Duration
}
func NewHandler(queries appLinkQuerier, config Config) *Handler {
return &Handler{
queries: queries,
cacheControlMaxAge: config.AppLinksCacheControlMaxAge,
}
}
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
switch r.URL.Path {
case AppleAppSiteAssociationPath:
h.serveAppleAppSiteAssociation(w, r)
case AssetLinksPath:
h.serveAssetLinks(w, r)
default:
http.NotFound(w, r)
}
}
type appleAppSiteAssociation struct {
WebCredentials appleWebCredentials `json:"webcredentials"`
}
type appleWebCredentials struct {
Apps []string `json:"apps"`
}
type assetLink struct {
Relation []string `json:"relation"`
Target assetLinkTarget `json:"target"`
}
type assetLinkTarget struct {
Namespace string `json:"namespace"`
PackageName string `json:"package_name"`
SHA256CertFingerprints []string `json:"sha256_cert_fingerprints"`
}
func (h *Handler) serveAppleAppSiteAssociation(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet && r.Method != http.MethodHead {
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
return
}
configs, err := h.queries.SearchOIDCAppLinkConfigs(r.Context())
if err != nil {
logging.Error(r.Context(), "unable to query OIDC app link configs for apple-app-site-association", "err", err)
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
h.writeJSON(w, r, buildAppleAppSiteAssociation(configs))
}
func (h *Handler) serveAssetLinks(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodGet && r.Method != http.MethodHead {
http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
return
}
configs, err := h.queries.SearchOIDCAppLinkConfigs(r.Context())
if err != nil {
logging.Error(r.Context(), "unable to query OIDC app link configs for assetlinks.json", "err", err)
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
return
}
h.writeJSON(w, r, buildAssetLinks(r.Context(), configs))
}
func buildAppleAppSiteAssociation(configs []*query.OIDCAppLinkConfig) appleAppSiteAssociation {
apps := make([]string, 0)
seen := make(map[string]struct{})
for _, cfg := range configs {
if cfg.IOSTeamID == "" || cfg.IOSBundleID == "" {
continue
}
appID := cfg.IOSTeamID + "." + cfg.IOSBundleID
if _, ok := seen[appID]; ok {
continue
}
seen[appID] = struct{}{}
apps = append(apps, appID)
}
return appleAppSiteAssociation{
WebCredentials: appleWebCredentials{Apps: apps},
}
}
func buildAssetLinks(ctx context.Context, configs []*query.OIDCAppLinkConfig) []assetLink {
links := make([]assetLink, 0)
for _, cfg := range configs {
if cfg.AndroidPackageName == "" || len(cfg.AndroidSHA256CertFingerprints) == 0 {
continue
}
links = append(links, assetLink{
Relation: []string{"delegate_permission/common.get_login_creds"},
Target: assetLinkTarget{
Namespace: "android_app",
PackageName: cfg.AndroidPackageName,
SHA256CertFingerprints: normalizeSHA256Fingerprints(ctx, cfg.AndroidSHA256CertFingerprints),
},
})
}
return links
}
// normalizeSHA256Fingerprints returns colon-separated uppercase hex fingerprints
// for assetlinks.json. Normalization is applied at serve time only so stored /
// client state can keep the format clients sent.
func normalizeSHA256Fingerprints(ctx context.Context, fps []string) []string {
out := make([]string, len(fps))
for i, fp := range fps {
out[i] = normalizeSHA256Fingerprint(ctx, fp)
}
return out
}
func normalizeSHA256Fingerprint(ctx context.Context, fp string) string {
if strings.Contains(fp, ":") {
return strings.ToUpper(fp) // already 32 valid pairs per API validation; only case may vary
}
raw, err := hex.DecodeString(fp) // guaranteed 64 hex chars
if err != nil || len(raw) != sha256.Size {
logging.Warn(ctx, "stored android sha256 fingerprint is not canonical hex; serving as-is",
"fingerprint", fp, "err", err)
return strings.ToUpper(fp)
}
parts := make([]string, len(raw))
for i, b := range raw {
parts[i] = fmt.Sprintf("%02X", b)
}
return strings.Join(parts, ":")
}
func (h *Handler) writeJSON(w http.ResponseWriter, r *http.Request, v any) {
w.Header().Set("Content-Type", "application/json")
h.setCacheControl(w)
w.WriteHeader(http.StatusOK)
if r.Method == http.MethodHead {
return
}
if err := json.NewEncoder(w).Encode(v); err != nil {
logging.Error(r.Context(), "unable to encode well-known response", "err", err)
}
}
func (h *Handler) setCacheControl(w http.ResponseWriter) {
if h.cacheControlMaxAge <= 0 {
w.Header().Set(http_util.CacheControl, "no-store")
return
}
w.Header().Set(http_util.CacheControl,
fmt.Sprintf("public, max-age=%d", int(h.cacheControlMaxAge/time.Second)),
)
}
internal/api/well_known/well_known_test.go
+241
View File
@@ -0,0 +1,241 @@
package well_known
import (
"context"
"net/http"
"net/http/httptest"
"testing"
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
http_util "github.com/zitadel/zitadel/internal/api/http"
"github.com/zitadel/zitadel/internal/query"
)
func TestBuildAppleAppSiteAssociation(t *testing.T) {
t.Parallel()
tt := []struct {
name string
configs []*query.OIDCAppLinkConfig
wantApps []string
}{
{
name: "empty",
configs: nil,
wantApps: []string{},
},
{
name: "skips incomplete ios",
configs: []*query.OIDCAppLinkConfig{
{IOSTeamID: "TEAM"},
{IOSBundleID: "com.example"},
},
wantApps: []string{},
},
{
name: "aggregates and dedupes",
configs: []*query.OIDCAppLinkConfig{
{IOSTeamID: "TEAM1", IOSBundleID: "com.one"},
{IOSTeamID: "TEAM2", IOSBundleID: "com.two"},
{IOSTeamID: "TEAM1", IOSBundleID: "com.one"},
{AndroidPackageName: "com.android", AndroidSHA256CertFingerprints: []string{"AA"}},
},
wantApps: []string{"TEAM1.com.one", "TEAM2.com.two"},
},
}
for _, tc := range tt {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
got := buildAppleAppSiteAssociation(tc.configs)
assert.Equal(t, tc.wantApps, got.WebCredentials.Apps)
})
}
}
func TestBuildAssetLinks(t *testing.T) {
t.Parallel()
tt := []struct {
name string
configs []*query.OIDCAppLinkConfig
want []assetLink
}{
{
name: "empty",
configs: nil,
want: []assetLink{},
},
{
name: "skips incomplete android",
configs: []*query.OIDCAppLinkConfig{
{AndroidPackageName: "com.example"},
{AndroidSHA256CertFingerprints: []string{"AA"}},
},
want: []assetLink{},
},
{
name: "aggregates and normalizes fingerprints",
configs: []*query.OIDCAppLinkConfig{
{
IOSTeamID: "TEAM",
IOSBundleID: "com.ios",
AndroidPackageName: "com.one",
AndroidSHA256CertFingerprints: []string{"aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899"},
},
{
AndroidPackageName: "com.two",
AndroidSHA256CertFingerprints: []string{
"cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb",
"eeff00112233445566778899aabbccddeeff00112233445566778899aabbccdd",
},
},
},
want: []assetLink{
{
Relation: []string{"delegate_permission/common.get_login_creds"},
Target: assetLinkTarget{
Namespace: "android_app",
PackageName: "com.one",
SHA256CertFingerprints: []string{
"AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
},
},
},
{
Relation: []string{"delegate_permission/common.get_login_creds"},
Target: assetLinkTarget{
Namespace: "android_app",
PackageName: "com.two",
SHA256CertFingerprints: []string{
"CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB",
"EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD",
},
},
},
},
},
}
for _, tc := range tt {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
assert.Equal(t, tc.want, buildAssetLinks(t.Context(), tc.configs))
})
}
}
func TestNormalizeSHA256Fingerprint(t *testing.T) {
t.Parallel()
tt := []struct {
name string
in string
want string
}{
{
name: "already canonical",
in: "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
want: "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
},
{
name: "lowercase with colons",
in: "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
want: "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
},
{
name: "lowercase without separators",
in: "aabbccddeeff00112233445566778899aabbccddeeff00112233445566778899",
want: "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99",
},
{
name: "invalid continuous hex uppercased",
in: "aabb",
want: "AABB",
},
{
name: "colon form uppercased without reparse",
in: "aa:bb",
want: "AA:BB",
},
}
for _, tc := range tt {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
assert.Equal(t, tc.want, normalizeSHA256Fingerprint(t.Context(), tc.in))
})
}
}
type stubAppLinkQuerier struct {
configs []*query.OIDCAppLinkConfig
err error
}
func (s stubAppLinkQuerier) SearchOIDCAppLinkConfigs(_ context.Context) ([]*query.OIDCAppLinkConfig, error) {
return s.configs, s.err
}
func TestHandlerCacheControl(t *testing.T) {
t.Parallel()
tt := []struct {
name string
maxAge time.Duration
wantHeader string
}{
{
name: "default max-age",
maxAge: 5 * time.Minute,
wantHeader: "public, max-age=300",
},
{
name: "no-store when zero",
maxAge: 0,
wantHeader: "no-store",
},
{
name: "no-store when negative",
maxAge: -time.Minute,
wantHeader: "no-store",
},
}
for _, tc := range tt {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
h := NewHandler(stubAppLinkQuerier{}, Config{AppLinksCacheControlMaxAge: tc.maxAge})
for _, path := range []string{AppleAppSiteAssociationPath, AssetLinksPath} {
req := httptest.NewRequest(http.MethodGet, path, nil)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, req)
require.Equal(t, http.StatusOK, rec.Code)
assert.Equal(t, tc.wantHeader, rec.Header().Get(http_util.CacheControl), path)
assert.NotContains(t, rec.Header().Get(http_util.CacheControl), "stale-while-revalidate")
}
})
}
}
func TestHandlerHeadOmitsBody(t *testing.T) {
t.Parallel()
h := NewHandler(stubAppLinkQuerier{}, Config{AppLinksCacheControlMaxAge: 5 * time.Minute})
for _, path := range []string{AppleAppSiteAssociationPath, AssetLinksPath} {
t.Run(path, func(t *testing.T) {
t.Parallel()
req := httptest.NewRequest(http.MethodHead, path, nil)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, req)
require.Equal(t, http.StatusOK, rec.Code)
assert.Equal(t, "application/json", rec.Header().Get("Content-Type"))
assert.Equal(t, "public, max-age=300", rec.Header().Get(http_util.CacheControl))
assert.Empty(t, rec.Body.Bytes())
})
}
}
internal/command/instance_domain_test.go
+4 -1
View File
@@ -158,7 +158,10 @@ func TestCommandSide_AddInstanceDomain(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectPush(
internal/command/instance_test.go
+8 -2
View File
@@ -125,7 +125,10 @@ func oidcAppEvents(ctx context.Context, orgID, projectID, id, name, clientID str
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
}
}
@@ -468,7 +471,10 @@ func generatedDomainFilters(instanceID, orgID, projectID, appID, generatedDomain
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
expectFilter(
func() eventstore.Event {
internal/command/project_application_oidc.go
+44 -19
View File
@@ -20,24 +20,28 @@ import (
type addOIDCApp struct {
AddApp
Version domain.OIDCVersion
RedirectUris []string
ResponseTypes []domain.OIDCResponseType
GrantTypes []domain.OIDCGrantType
ApplicationType domain.OIDCApplicationType
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectUris []string
DevMode bool
AccessTokenType domain.OIDCTokenType
AccessTokenRoleAssertion bool
IDTokenRoleAssertion bool
IDTokenUserinfoAssertion bool
ClockSkew time.Duration
AdditionalOrigins []string
SkipSuccessPageForNativeApp bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI string
Version domain.OIDCVersion
RedirectUris []string
ResponseTypes []domain.OIDCResponseType
GrantTypes []domain.OIDCGrantType
ApplicationType domain.OIDCApplicationType
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectUris []string
DevMode bool
AccessTokenType domain.OIDCTokenType
AccessTokenRoleAssertion bool
IDTokenRoleAssertion bool
IDTokenUserinfoAssertion bool
ClockSkew time.Duration
AdditionalOrigins []string
SkipSuccessPageForNativeApp bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI string
IOSTeamID string
IOSBundleID string
AndroidPackageName string
AndroidSHA256CertFingerprints []string
ClientID string
ClientSecret string
@@ -118,6 +122,10 @@ func (c *Commands) AddOIDCAppCommand(app *addOIDCApp) preparation.Validation {
app.BackChannelLogoutURI,
app.LoginVersion,
app.LoginBaseURI,
app.IOSTeamID,
app.IOSBundleID,
app.AndroidPackageName,
app.AndroidSHA256CertFingerprints,
),
}, nil
}, nil
@@ -251,6 +259,10 @@ func (c *Commands) pushOIDCApplication(ctx context.Context, addedApplication *OI
backchannelLogoutURI,
gu.Value(oidcApp.LoginVersion),
strings.TrimSpace(gu.Value(oidcApp.LoginBaseURI)),
strings.TrimSpace(gu.Value(oidcApp.IOSTeamID)),
strings.TrimSpace(gu.Value(oidcApp.IOSBundleID)),
strings.TrimSpace(gu.Value(oidcApp.AndroidPackageName)),
trimStringSliceWhiteSpaces(oidcApp.AndroidSHA256CertFingerprints),
))
events = append(events, extraEvents...)
@@ -340,7 +352,7 @@ func (c *Commands) UpdateOIDCApplication(ctx context.Context, oidc *domain.OIDCA
// UpdateDynamicOIDCClient). It reports whether anything actually changed.
func (c *Commands) oidcApplicationChangeEvent(ctx context.Context, existingOIDC *OIDCApplicationWriteModel, oidc *domain.OIDCApp) (*project_repo.OIDCConfigChangedEvent, bool, error) {
projectAgg := ProjectAggregateFromWriteModelWithCTX(ctx, &existingOIDC.WriteModel)
var backChannelLogout, loginBaseURI *string
var backChannelLogout, loginBaseURI, iosTeamID, iosBundleID, androidPackageName *string
if oidc.BackChannelLogoutURI != nil {
bcl, err := c.validateBackchannelLogoutURI(oidc)
if err != nil {
@@ -352,6 +364,15 @@ func (c *Commands) oidcApplicationChangeEvent(ctx context.Context, existingOIDC
if oidc.LoginBaseURI != nil {
loginBaseURI = gu.Ptr(strings.TrimSpace(*oidc.LoginBaseURI))
}
if oidc.IOSTeamID != nil {
iosTeamID = gu.Ptr(strings.TrimSpace(*oidc.IOSTeamID))
}
if oidc.IOSBundleID != nil {
iosBundleID = gu.Ptr(strings.TrimSpace(*oidc.IOSBundleID))
}
if oidc.AndroidPackageName != nil {
androidPackageName = gu.Ptr(strings.TrimSpace(*oidc.AndroidPackageName))
}
return existingOIDC.NewChangedEvent(
ctx,
@@ -375,6 +396,10 @@ func (c *Commands) oidcApplicationChangeEvent(ctx context.Context, existingOIDC
backChannelLogout,
oidc.LoginVersion,
loginBaseURI,
iosTeamID,
iosBundleID,
androidPackageName,
trimStringSliceWhiteSpaces(oidc.AndroidSHA256CertFingerprints),
)
}
internal/command/project_application_oidc_dcr_test.go
+13 -3
View File
@@ -234,7 +234,10 @@ func TestCommandSide_AddDynamicOIDCClient(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
// The registration access token (RFC 7592 §3) is persisted in the same
// push as the application, so a registered client is never left
// unmanageable.
@@ -336,7 +339,10 @@ func TestCommandSide_AddDynamicOIDCClient(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
project.NewOIDCConfigRegistrationTokenChangedEvent(context.Background(),
&project.NewAggregate("project1", "org1").Aggregate,
"app1",
@@ -581,7 +587,11 @@ func TestCommandSide_UpdateDynamicOIDCClient(t *testing.T) {
domain.OIDCApplicationTypeWeb, domain.OIDCAuthMethodTypeNone,
[]string{}, false, domain.OIDCTokenTypeBearer,
false, false, false, 0, []string{}, false, "",
domain.LoginVersionUnspecified, "")),
domain.LoginVersionUnspecified, "",
"",
"",
"",
nil)),
}
}
sameMetadata := &domain.OIDCApp{
internal/command/project_application_oidc_model.go
+70 -26
View File
@@ -14,32 +14,36 @@ import (
type OIDCApplicationWriteModel struct {
eventstore.WriteModel
AppID string
AppName string
ClientID string
HashedSecret string
ClientSecretString string
RedirectUris []string
ResponseTypes []domain.OIDCResponseType
GrantTypes []domain.OIDCGrantType
ApplicationType domain.OIDCApplicationType
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectUris []string
OIDCVersion domain.OIDCVersion
Compliance *domain.Compliance
DevMode bool
AccessTokenType domain.OIDCTokenType
AccessTokenRoleAssertion bool
IDTokenRoleAssertion bool
IDTokenUserinfoAssertion bool
ClockSkew time.Duration
State domain.AppState
AdditionalOrigins []string
SkipNativeAppSuccessPage bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI string
oidc bool
AppID string
AppName string
ClientID string
HashedSecret string
ClientSecretString string
RedirectUris []string
ResponseTypes []domain.OIDCResponseType
GrantTypes []domain.OIDCGrantType
ApplicationType domain.OIDCApplicationType
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectUris []string
OIDCVersion domain.OIDCVersion
Compliance *domain.Compliance
DevMode bool
AccessTokenType domain.OIDCTokenType
AccessTokenRoleAssertion bool
IDTokenRoleAssertion bool
IDTokenUserinfoAssertion bool
ClockSkew time.Duration
State domain.AppState
AdditionalOrigins []string
SkipNativeAppSuccessPage bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI string
IOSTeamID string
IOSBundleID string
AndroidPackageName string
AndroidSHA256CertFingerprints []string
oidc bool
}
func NewOIDCApplicationWriteModelWithAppID(projectID, appID, resourceOwner string) *OIDCApplicationWriteModel {
@@ -140,6 +144,10 @@ func (wm *OIDCApplicationWriteModel) Reduce() error {
wm.BackChannelLogoutURI = ""
wm.LoginVersion = domain.LoginVersionUnspecified
wm.LoginBaseURI = ""
wm.IOSTeamID = ""
wm.IOSBundleID = ""
wm.AndroidPackageName = ""
wm.AndroidSHA256CertFingerprints = nil
wm.oidc = false
wm.AppName = e.Name
wm.State = domain.AppStateActive
@@ -189,6 +197,10 @@ func (wm *OIDCApplicationWriteModel) Reduce() error {
wm.BackChannelLogoutURI = ""
wm.LoginVersion = domain.LoginVersionUnspecified
wm.LoginBaseURI = ""
wm.IOSTeamID = ""
wm.IOSBundleID = ""
wm.AndroidPackageName = ""
wm.AndroidSHA256CertFingerprints = nil
wm.oidc = false
wm.State = domain.AppStateRemoved
}
@@ -218,6 +230,10 @@ func (wm *OIDCApplicationWriteModel) appendAddOIDCEvent(e *project.OIDCConfigAdd
wm.BackChannelLogoutURI = e.BackChannelLogoutURI
wm.LoginVersion = e.LoginVersion
wm.LoginBaseURI = e.LoginBaseURI
wm.IOSTeamID = e.IOSTeamID
wm.IOSBundleID = e.IOSBundleID
wm.AndroidPackageName = e.AndroidPackageName
wm.AndroidSHA256CertFingerprints = e.AndroidSHA256CertFingerprints
}
func (wm *OIDCApplicationWriteModel) appendChangeOIDCEvent(e *project.OIDCConfigChangedEvent) {
@@ -275,6 +291,18 @@ func (wm *OIDCApplicationWriteModel) appendChangeOIDCEvent(e *project.OIDCConfig
if e.LoginBaseURI != nil {
wm.LoginBaseURI = *e.LoginBaseURI
}
if e.IOSTeamID != nil {
wm.IOSTeamID = *e.IOSTeamID
}
if e.IOSBundleID != nil {
wm.IOSBundleID = *e.IOSBundleID
}
if e.AndroidPackageName != nil {
wm.AndroidPackageName = *e.AndroidPackageName
}
if e.AndroidSHA256CertFingerprints != nil {
wm.AndroidSHA256CertFingerprints = *e.AndroidSHA256CertFingerprints
}
}
func (wm *OIDCApplicationWriteModel) Query() *eventstore.SearchQueryBuilder {
@@ -320,6 +348,10 @@ func (wm *OIDCApplicationWriteModel) NewChangedEvent(
backChannelLogoutURI *string,
loginVersion *domain.LoginVersion,
loginBaseURI *string,
iosTeamID *string,
iosBundleID *string,
androidPackageName *string,
androidSHA256CertFingerprints []string,
) (*project.OIDCConfigChangedEvent, bool, error) {
changes := make([]project.OIDCConfigChanges, 0)
var err error
@@ -378,6 +410,18 @@ func (wm *OIDCApplicationWriteModel) NewChangedEvent(
if loginBaseURI != nil && wm.LoginBaseURI != *loginBaseURI {
changes = append(changes, project.ChangeOIDCLoginBaseURI(*loginBaseURI))
}
if iosTeamID != nil && wm.IOSTeamID != *iosTeamID {
changes = append(changes, project.ChangeIOSTeamID(*iosTeamID))
}
if iosBundleID != nil && wm.IOSBundleID != *iosBundleID {
changes = append(changes, project.ChangeIOSBundleID(*iosBundleID))
}
if androidPackageName != nil && wm.AndroidPackageName != *androidPackageName {
changes = append(changes, project.ChangeAndroidPackageName(*androidPackageName))
}
if androidSHA256CertFingerprints != nil && !slices.Equal(wm.AndroidSHA256CertFingerprints, androidSHA256CertFingerprints) {
changes = append(changes, project.ChangeAndroidSHA256CertFingerprints(androidSHA256CertFingerprints))
}
if len(changes) == 0 {
return nil, false, nil
internal/command/project_application_oidc_model_test.go
+88
View File
@@ -0,0 +1,88 @@
package command
import (
"context"
"testing"
"github.com/muhlemmer/gu"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/zitadel/zitadel/internal/eventstore"
"github.com/zitadel/zitadel/internal/repository/project"
)
func TestOIDCApplicationWriteModel_NewChangedEvent_AppLinks(t *testing.T) {
t.Parallel()
agg := &project.NewAggregate("project-id", "org-id").Aggregate
base := func() *OIDCApplicationWriteModel {
return &OIDCApplicationWriteModel{
WriteModel: eventstore.WriteModel{
AggregateID: "project-id",
ResourceOwner: "org-id",
},
AppID: "app-id",
IOSTeamID: "OLDTEAM",
IOSBundleID: "com.old.app",
AndroidPackageName: "com.old.app",
AndroidSHA256CertFingerprints: []string{"AA:AA"},
}
}
t.Run("omit keeps existing", func(t *testing.T) {
t.Parallel()
wm := base()
event, hasChanged, err := wm.NewChangedEvent(
context.Background(), agg, "app-id",
nil, nil, nil, nil, nil, nil, nil, nil,
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
nil, nil, nil, nil,
)
require.NoError(t, err)
assert.False(t, hasChanged)
assert.Nil(t, event)
})
t.Run("set changes fields", func(t *testing.T) {
t.Parallel()
wm := base()
event, hasChanged, err := wm.NewChangedEvent(
context.Background(), agg, "app-id",
nil, nil, nil, nil, nil, nil, nil, nil,
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
gu.Ptr("NEWTEAM"),
gu.Ptr("com.new.app"),
gu.Ptr("com.new.app"),
[]string{"BB:BB"},
)
require.NoError(t, err)
require.True(t, hasChanged)
require.NotNil(t, event)
assert.Equal(t, gu.Ptr("NEWTEAM"), event.IOSTeamID)
assert.Equal(t, gu.Ptr("com.new.app"), event.IOSBundleID)
assert.Equal(t, gu.Ptr("com.new.app"), event.AndroidPackageName)
assert.Equal(t, &[]string{"BB:BB"}, event.AndroidSHA256CertFingerprints)
})
t.Run("clear with empty values", func(t *testing.T) {
t.Parallel()
wm := base()
event, hasChanged, err := wm.NewChangedEvent(
context.Background(), agg, "app-id",
nil, nil, nil, nil, nil, nil, nil, nil,
nil, nil, nil, nil, nil, nil, nil, nil, nil, nil,
gu.Ptr(""),
gu.Ptr(""),
gu.Ptr(""),
[]string{},
)
require.NoError(t, err)
require.True(t, hasChanged)
require.NotNil(t, event)
assert.Equal(t, gu.Ptr(""), event.IOSTeamID)
assert.Equal(t, gu.Ptr(""), event.IOSBundleID)
assert.Equal(t, gu.Ptr(""), event.AndroidPackageName)
assert.Equal(t, &[]string{}, event.AndroidSHA256CertFingerprints)
})
}
internal/command/project_application_oidc_test.go
+52 -13
View File
@@ -176,7 +176,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -244,7 +247,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -312,7 +318,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -380,7 +389,10 @@ func TestAddOIDCApp(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
},
},
},
@@ -534,7 +546,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1", "client1"),
@@ -643,7 +658,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "client1"),
@@ -753,7 +771,10 @@ func TestCommandSide_AddOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "app1", "client1"),
@@ -1072,7 +1093,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1147,7 +1171,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion2,
"https://login.test.ch",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1222,7 +1249,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"https://test.ch/backchannel",
domain.LoginVersion1,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1316,7 +1346,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1376,7 +1409,10 @@ func TestCommandSide_ChangeOIDCApplication(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectFilter(),
@@ -1531,7 +1567,10 @@ func TestCommandSide_ChangeOIDCApplicationSecret(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectPush(
internal/command/project_application_secret_test.go
+4 -1
View File
@@ -118,7 +118,10 @@ func TestCommandSide_ChangeApplicationSecret(t *testing.T) {
"",
domain.LoginVersionUnspecified,
"",
),
"",
"",
"",
nil),
),
),
expectPush(
internal/command/project_converter.go
+36 -23
View File
@@ -29,32 +29,45 @@ func projectGrantWriteModelToProjectGrant(writeModel *ProjectGrantWriteModel) *d
func oidcWriteModelToOIDCConfig(writeModel *OIDCApplicationWriteModel) *domain.OIDCApp {
return &domain.OIDCApp{
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
AppID: writeModel.AppID,
AppName: writeModel.AppName,
State: writeModel.State,
ClientID: writeModel.ClientID,
RedirectUris: writeModel.RedirectUris,
ResponseTypes: writeModel.ResponseTypes,
GrantTypes: writeModel.GrantTypes,
ApplicationType: gu.Ptr(writeModel.ApplicationType),
AuthMethodType: gu.Ptr(writeModel.AuthMethodType),
PostLogoutRedirectUris: writeModel.PostLogoutRedirectUris,
OIDCVersion: gu.Ptr(writeModel.OIDCVersion),
DevMode: gu.Ptr(writeModel.DevMode),
AccessTokenType: gu.Ptr(writeModel.AccessTokenType),
AccessTokenRoleAssertion: gu.Ptr(writeModel.AccessTokenRoleAssertion),
IDTokenRoleAssertion: gu.Ptr(writeModel.IDTokenRoleAssertion),
IDTokenUserinfoAssertion: gu.Ptr(writeModel.IDTokenUserinfoAssertion),
ClockSkew: gu.Ptr(writeModel.ClockSkew),
AdditionalOrigins: writeModel.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(writeModel.SkipNativeAppSuccessPage),
BackChannelLogoutURI: gu.Ptr(writeModel.BackChannelLogoutURI),
LoginVersion: gu.Ptr(writeModel.LoginVersion),
LoginBaseURI: gu.Ptr(writeModel.LoginBaseURI),
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
AppID: writeModel.AppID,
AppName: writeModel.AppName,
State: writeModel.State,
ClientID: writeModel.ClientID,
RedirectUris: writeModel.RedirectUris,
ResponseTypes: writeModel.ResponseTypes,
GrantTypes: writeModel.GrantTypes,
ApplicationType: gu.Ptr(writeModel.ApplicationType),
AuthMethodType: gu.Ptr(writeModel.AuthMethodType),
PostLogoutRedirectUris: writeModel.PostLogoutRedirectUris,
OIDCVersion: gu.Ptr(writeModel.OIDCVersion),
DevMode: gu.Ptr(writeModel.DevMode),
AccessTokenType: gu.Ptr(writeModel.AccessTokenType),
AccessTokenRoleAssertion: gu.Ptr(writeModel.AccessTokenRoleAssertion),
IDTokenRoleAssertion: gu.Ptr(writeModel.IDTokenRoleAssertion),
IDTokenUserinfoAssertion: gu.Ptr(writeModel.IDTokenUserinfoAssertion),
ClockSkew: gu.Ptr(writeModel.ClockSkew),
AdditionalOrigins: writeModel.AdditionalOrigins,
SkipNativeAppSuccessPage: gu.Ptr(writeModel.SkipNativeAppSuccessPage),
BackChannelLogoutURI: gu.Ptr(writeModel.BackChannelLogoutURI),
LoginVersion: gu.Ptr(writeModel.LoginVersion),
LoginBaseURI: gu.Ptr(writeModel.LoginBaseURI),
IOSTeamID: emptyStringPtr(writeModel.IOSTeamID),
IOSBundleID: emptyStringPtr(writeModel.IOSBundleID),
AndroidPackageName: emptyStringPtr(writeModel.AndroidPackageName),
AndroidSHA256CertFingerprints: writeModel.AndroidSHA256CertFingerprints,
}
}
// emptyStringPtr returns nil for empty strings so unset app-link fields stay
// distinguishable from explicitly set values in equality checks / APIs.
func emptyStringPtr(s string) *string {
if s == "" {
return nil
}
return gu.Ptr(s)
}
func samlWriteModelToSAMLConfig(writeModel *SAMLApplicationWriteModel) *domain.SAMLApp {
return &domain.SAMLApp{
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
internal/domain/application_oidc.go
+24 -1
View File
@@ -7,6 +7,8 @@ import (
"strings"
"time"
"github.com/muhlemmer/gu"
http_util "github.com/zitadel/zitadel/internal/api/http"
"github.com/zitadel/zitadel/internal/eventstore/v1/models"
)
@@ -49,6 +51,14 @@ type OIDCApp struct {
BackChannelLogoutURI *string
LoginVersion *LoginVersion
LoginBaseURI *string
// IOSTeamID and IOSBundleID are Associated Domains / passkey trust fields.
// Both must be set together, or both empty. Composed as TEAMID.BUNDLEID in AASA.
IOSTeamID *string
IOSBundleID *string
// AndroidPackageName and AndroidSHA256CertFingerprints are Digital Asset Links /
// passkey trust fields. Package name is required when fingerprints are non-empty.
AndroidPackageName *string
AndroidSHA256CertFingerprints []string
State AppState
}
@@ -138,7 +148,7 @@ const (
)
func (a *OIDCApp) IsValid() bool {
if (a.ClockSkew != nil && (*a.ClockSkew > time.Second*5 || *a.ClockSkew < time.Second*0)) || !a.OriginsValid() {
if (a.ClockSkew != nil && (*a.ClockSkew > time.Second*5 || *a.ClockSkew < time.Second*0)) || !a.OriginsValid() || !a.AppLinkConfigValid() {
return false
}
grantTypes := a.getRequiredGrantTypes()
@@ -154,6 +164,19 @@ func (a *OIDCApp) IsValid() bool {
return true
}
// AppLinkConfigValid checks sibling rules for iOS/Android association fields.
// Nil and blank (after trim) are treated the same: both iOS fields must be set or
// both empty; Android package name is required whenever fingerprints are present.
func (a *OIDCApp) AppLinkConfigValid() bool {
teamID := strings.TrimSpace(gu.Value(a.IOSTeamID))
bundleID := strings.TrimSpace(gu.Value(a.IOSBundleID))
if (teamID == "") != (bundleID == "") {
return false
}
packageName := strings.TrimSpace(gu.Value(a.AndroidPackageName))
return len(a.AndroidSHA256CertFingerprints) == 0 || packageName != ""
}
func (a *OIDCApp) OriginsValid() bool {
for _, origin := range a.AdditionalOrigins {
if !http_util.IsOrigin(strings.TrimSpace(origin)) {
internal/domain/application_oidc_test.go
+81
View File
@@ -669,3 +669,84 @@ func TestOIDCOriginAllowList(t *testing.T) {
})
}
}
func TestOIDCApp_AppLinkConfigValid(t *testing.T) {
tests := []struct {
name string
app *OIDCApp
want bool
}{
{
name: "empty config",
app: &OIDCApp{},
want: true,
},
{
name: "ios both set",
app: &OIDCApp{
IOSTeamID: gu.Ptr("TEAMID"),
IOSBundleID: gu.Ptr("com.example.app"),
},
want: true,
},
{
name: "ios team only",
app: &OIDCApp{
IOSTeamID: gu.Ptr("TEAMID"),
},
want: false,
},
{
name: "ios bundle only",
app: &OIDCApp{
IOSBundleID: gu.Ptr("com.example.app"),
},
want: false,
},
{
name: "ios both empty strings",
app: &OIDCApp{
IOSTeamID: gu.Ptr(""),
IOSBundleID: gu.Ptr(""),
},
want: true,
},
{
name: "android package only",
app: &OIDCApp{
AndroidPackageName: gu.Ptr("com.example.app"),
},
want: true,
},
{
name: "android package and fingerprints",
app: &OIDCApp{
AndroidPackageName: gu.Ptr("com.example.app"),
AndroidSHA256CertFingerprints: []string{"AA:BB"},
},
want: true,
},
{
name: "android fingerprints without package",
app: &OIDCApp{
AndroidSHA256CertFingerprints: []string{"AA:BB"},
},
want: false,
},
{
name: "android fingerprints with empty package",
app: &OIDCApp{
AndroidPackageName: gu.Ptr(" "),
AndroidSHA256CertFingerprints: []string{"AA:BB"},
},
want: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := tt.app.AppLinkConfigValid(); got != tt.want {
t.Errorf("AppLinkConfigValid() = %v, want %v", got, tt.want)
}
})
}
}
internal/query/app.go
+111 -59
View File
@@ -43,27 +43,31 @@ type App struct {
}
type OIDCApp struct {
RedirectURIs database.TextArray[string]
ResponseTypes database.NumberArray[domain.OIDCResponseType]
GrantTypes database.NumberArray[domain.OIDCGrantType]
AppType domain.OIDCApplicationType
ClientID string
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectURIs database.TextArray[string]
Version domain.OIDCVersion
ComplianceProblems database.TextArray[string]
IsDevMode bool
AccessTokenType domain.OIDCTokenType
AssertAccessTokenRole bool
AssertIDTokenRole bool
AssertIDTokenUserinfo bool
ClockSkew time.Duration
AdditionalOrigins database.TextArray[string]
AllowedOrigins database.TextArray[string]
SkipNativeAppSuccessPage bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI *string
RedirectURIs database.TextArray[string]
ResponseTypes database.NumberArray[domain.OIDCResponseType]
GrantTypes database.NumberArray[domain.OIDCGrantType]
AppType domain.OIDCApplicationType
ClientID string
AuthMethodType domain.OIDCAuthMethodType
PostLogoutRedirectURIs database.TextArray[string]
Version domain.OIDCVersion
ComplianceProblems database.TextArray[string]
IsDevMode bool
AccessTokenType domain.OIDCTokenType
AssertAccessTokenRole bool
AssertIDTokenRole bool
AssertIDTokenUserinfo bool
ClockSkew time.Duration
AdditionalOrigins database.TextArray[string]
AllowedOrigins database.TextArray[string]
SkipNativeAppSuccessPage bool
BackChannelLogoutURI string
LoginVersion domain.LoginVersion
LoginBaseURI *string
IOSTeamID string
IOSBundleID string
AndroidPackageName string
AndroidSHA256CertFingerprints database.TextArray[string]
}
type SAMLApp struct {
@@ -278,6 +282,22 @@ var (
name: projection.AppOIDCConfigColumnLoginBaseURI,
table: appOIDCConfigsTable,
}
AppOIDCConfigColumnIOSTeamID = Column{
name: projection.AppOIDCConfigColumnIOSTeamID,
table: appOIDCConfigsTable,
}
AppOIDCConfigColumnIOSBundleID = Column{
name: projection.AppOIDCConfigColumnIOSBundleID,
table: appOIDCConfigsTable,
}
AppOIDCConfigColumnAndroidPackageName = Column{
name: projection.AppOIDCConfigColumnAndroidPackageName,
table: appOIDCConfigsTable,
}
AppOIDCConfigColumnAndroidSHA256CertFingerprints = Column{
name: projection.AppOIDCConfigColumnAndroidSHA256CertFingerprints,
table: appOIDCConfigsTable,
}
)
func (q *Queries) AppByProjectAndAppID(ctx context.Context, shouldTriggerBulk bool, projectID, appID string) (app *App, err error) {
@@ -725,6 +745,10 @@ func prepareAppQuery(activeOnly bool) (sq.SelectBuilder, func(*sql.Row) (*App, e
AppOIDCConfigColumnBackChannelLogoutURI.identifier(),
AppOIDCConfigColumnLoginVersion.identifier(),
AppOIDCConfigColumnLoginBaseURI.identifier(),
AppOIDCConfigColumnIOSTeamID.identifier(),
AppOIDCConfigColumnIOSBundleID.identifier(),
AppOIDCConfigColumnAndroidPackageName.identifier(),
AppOIDCConfigColumnAndroidSHA256CertFingerprints.identifier(),
AppSAMLConfigColumnAppID.identifier(),
AppSAMLConfigColumnEntityID.identifier(),
@@ -794,6 +818,10 @@ func scanApp(row *sql.Row) (*App, error) {
&oidcConfig.backChannelLogoutURI,
&oidcConfig.loginVersion,
&oidcConfig.loginBaseURI,
&oidcConfig.iosTeamID,
&oidcConfig.iosBundleID,
&oidcConfig.androidPackageName,
&oidcConfig.androidSHA256CertFingerprints,
&samlConfig.appID,
&samlConfig.entityID,
@@ -848,6 +876,10 @@ func prepareOIDCAppQuery() (sq.SelectBuilder, func(*sql.Row) (*App, error)) {
AppOIDCConfigColumnBackChannelLogoutURI.identifier(),
AppOIDCConfigColumnLoginVersion.identifier(),
AppOIDCConfigColumnLoginBaseURI.identifier(),
AppOIDCConfigColumnIOSTeamID.identifier(),
AppOIDCConfigColumnIOSBundleID.identifier(),
AppOIDCConfigColumnAndroidPackageName.identifier(),
AppOIDCConfigColumnAndroidSHA256CertFingerprints.identifier(),
).From(appsTable.identifier()).
Join(join(AppOIDCConfigColumnAppID, AppColumnID)).
PlaceholderFormat(sq.Dollar), func(row *sql.Row) (*App, error) {
@@ -887,6 +919,10 @@ func prepareOIDCAppQuery() (sq.SelectBuilder, func(*sql.Row) (*App, error)) {
&oidcConfig.backChannelLogoutURI,
&oidcConfig.loginVersion,
&oidcConfig.loginBaseURI,
&oidcConfig.iosTeamID,
&oidcConfig.iosBundleID,
&oidcConfig.androidPackageName,
&oidcConfig.androidSHA256CertFingerprints,
)
if err != nil {
@@ -1004,6 +1040,10 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
AppOIDCConfigColumnBackChannelLogoutURI.identifier(),
AppOIDCConfigColumnLoginVersion.identifier(),
AppOIDCConfigColumnLoginBaseURI.identifier(),
AppOIDCConfigColumnIOSTeamID.identifier(),
AppOIDCConfigColumnIOSBundleID.identifier(),
AppOIDCConfigColumnAndroidPackageName.identifier(),
AppOIDCConfigColumnAndroidSHA256CertFingerprints.identifier(),
AppSAMLConfigColumnAppID.identifier(),
AppSAMLConfigColumnEntityID.identifier(),
@@ -1061,6 +1101,10 @@ func prepareAppsQuery() (sq.SelectBuilder, func(*sql.Rows) (*Apps, error)) {
&oidcConfig.backChannelLogoutURI,
&oidcConfig.loginVersion,
&oidcConfig.loginBaseURI,
&oidcConfig.iosTeamID,
&oidcConfig.iosBundleID,
&oidcConfig.androidPackageName,
&oidcConfig.androidSHA256CertFingerprints,
&samlConfig.appID,
&samlConfig.entityID,
@@ -1148,26 +1192,30 @@ func prepareLoginVersionBySAMLAppID() (sq.SelectBuilder, func(*sql.Row) (domain.
}
type sqlOIDCConfig struct {
appID sql.NullString
version sql.NullInt32
clientID sql.NullString
redirectUris database.TextArray[string]
applicationType sql.NullInt16
authMethodType sql.NullInt16
postLogoutRedirectUris database.TextArray[string]
devMode sql.NullBool
accessTokenType sql.NullInt16
accessTokenRoleAssertion sql.NullBool
iDTokenRoleAssertion sql.NullBool
iDTokenUserinfoAssertion sql.NullBool
clockSkew sql.NullInt64
additionalOrigins database.TextArray[string]
responseTypes database.NumberArray[domain.OIDCResponseType]
grantTypes database.NumberArray[domain.OIDCGrantType]
skipNativeAppSuccessPage sql.NullBool
backChannelLogoutURI sql.NullString
loginVersion sql.NullInt16
loginBaseURI sql.NullString
appID sql.NullString
version sql.NullInt32
clientID sql.NullString
redirectUris database.TextArray[string]
applicationType sql.NullInt16
authMethodType sql.NullInt16
postLogoutRedirectUris database.TextArray[string]
devMode sql.NullBool
accessTokenType sql.NullInt16
accessTokenRoleAssertion sql.NullBool
iDTokenRoleAssertion sql.NullBool
iDTokenUserinfoAssertion sql.NullBool
clockSkew sql.NullInt64
additionalOrigins database.TextArray[string]
responseTypes database.NumberArray[domain.OIDCResponseType]
grantTypes database.NumberArray[domain.OIDCGrantType]
skipNativeAppSuccessPage sql.NullBool
backChannelLogoutURI sql.NullString
loginVersion sql.NullInt16
loginBaseURI sql.NullString
iosTeamID sql.NullString
iosBundleID sql.NullString
androidPackageName sql.NullString
androidSHA256CertFingerprints database.TextArray[string]
}
func (c sqlOIDCConfig) set(app *App) {
@@ -1175,24 +1223,28 @@ func (c sqlOIDCConfig) set(app *App) {
return
}
app.OIDCConfig = &OIDCApp{
Version: domain.OIDCVersion(c.version.Int32),
ClientID: c.clientID.String,
RedirectURIs: c.redirectUris,
AppType: domain.OIDCApplicationType(c.applicationType.Int16),
AuthMethodType: domain.OIDCAuthMethodType(c.authMethodType.Int16),
PostLogoutRedirectURIs: c.postLogoutRedirectUris,
IsDevMode: c.devMode.Bool,
AccessTokenType: domain.OIDCTokenType(c.accessTokenType.Int16),
AssertAccessTokenRole: c.accessTokenRoleAssertion.Bool,
AssertIDTokenRole: c.iDTokenRoleAssertion.Bool,
AssertIDTokenUserinfo: c.iDTokenUserinfoAssertion.Bool,
ClockSkew: time.Duration(c.clockSkew.Int64),
AdditionalOrigins: c.additionalOrigins,
ResponseTypes: c.responseTypes,
GrantTypes: c.grantTypes,
SkipNativeAppSuccessPage: c.skipNativeAppSuccessPage.Bool,
BackChannelLogoutURI: c.backChannelLogoutURI.String,
LoginVersion: domain.LoginVersion(c.loginVersion.Int16),
Version: domain.OIDCVersion(c.version.Int32),
ClientID: c.clientID.String,
RedirectURIs: c.redirectUris,
AppType: domain.OIDCApplicationType(c.applicationType.Int16),
AuthMethodType: domain.OIDCAuthMethodType(c.authMethodType.Int16),
PostLogoutRedirectURIs: c.postLogoutRedirectUris,
IsDevMode: c.devMode.Bool,
AccessTokenType: domain.OIDCTokenType(c.accessTokenType.Int16),
AssertAccessTokenRole: c.accessTokenRoleAssertion.Bool,
AssertIDTokenRole: c.iDTokenRoleAssertion.Bool,
AssertIDTokenUserinfo: c.iDTokenUserinfoAssertion.Bool,
ClockSkew: time.Duration(c.clockSkew.Int64),
AdditionalOrigins: c.additionalOrigins,
ResponseTypes: c.responseTypes,
GrantTypes: c.grantTypes,
SkipNativeAppSuccessPage: c.skipNativeAppSuccessPage.Bool,
BackChannelLogoutURI: c.backChannelLogoutURI.String,
LoginVersion: domain.LoginVersion(c.loginVersion.Int16),
IOSTeamID: c.iosTeamID.String,
IOSBundleID: c.iosBundleID.String,
AndroidPackageName: c.androidPackageName.String,
AndroidSHA256CertFingerprints: c.androidSHA256CertFingerprints,
}
if c.loginBaseURI.Valid {
app.OIDCConfig.LoginBaseURI = &c.loginBaseURI.String
internal/query/app_link.go
+100
View File
@@ -0,0 +1,100 @@
package query
import (
"context"
"database/sql"
"strings"
sq "github.com/Masterminds/squirrel"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/database"
"github.com/zitadel/zitadel/internal/domain"
"github.com/zitadel/zitadel/internal/telemetry/tracing"
"github.com/zitadel/zitadel/internal/zerrors"
)
// OIDCAppLinkConfig holds iOS/Android association fields for one active OIDC app.
type OIDCAppLinkConfig struct {
AppID string
IOSTeamID string
IOSBundleID string
AndroidPackageName string
AndroidSHA256CertFingerprints []string
}
// SearchOIDCAppLinkConfigs returns association fields for active OIDC apps in the
// current instance that have at least one iOS or Android app-link field set.
func (q *Queries) SearchOIDCAppLinkConfigs(ctx context.Context) (configs []*OIDCAppLinkConfig, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
query, scan := prepareOIDCAppLinkConfigsQuery()
iosTeamIDCol := AppOIDCConfigColumnIOSTeamID.identifier()
iosBundleIDCol := AppOIDCConfigColumnIOSBundleID.identifier()
androidPackageCol := AppOIDCConfigColumnAndroidPackageName.identifier()
stmt, args, err := query.Where(sq.And{
sq.Eq{
AppOIDCConfigColumnInstanceID.identifier(): authz.GetInstance(ctx).InstanceID(),
AppColumnState.identifier(): domain.AppStateActive,
},
sq.Or{
sq.Expr("COALESCE(" + iosTeamIDCol + ", '') <> ''"),
sq.Expr("COALESCE(" + iosBundleIDCol + ", '') <> ''"),
sq.Expr("COALESCE(" + androidPackageCol + ", '') <> ''"),
},
}).OrderBy(AppOIDCConfigColumnAppID.identifier()).ToSql()
if err != nil {
return nil, zerrors.ThrowInvalidArgument(err, "QUERY-ApLn1", "Errors.Query.InvalidRequest")
}
err = q.client.QueryContext(ctx, func(rows *sql.Rows) error {
configs, err = scan(rows)
return err
}, stmt, args...)
if err != nil {
return nil, zerrors.ThrowInternal(err, "QUERY-ApLn2", "Errors.Internal")
}
return configs, nil
}
func prepareOIDCAppLinkConfigsQuery() (sq.SelectBuilder, func(*sql.Rows) ([]*OIDCAppLinkConfig, error)) {
return sq.Select(
AppOIDCConfigColumnAppID.identifier(),
AppOIDCConfigColumnIOSTeamID.identifier(),
AppOIDCConfigColumnIOSBundleID.identifier(),
AppOIDCConfigColumnAndroidPackageName.identifier(),
AppOIDCConfigColumnAndroidSHA256CertFingerprints.identifier(),
).From(appOIDCConfigsTable.identifier()).
Join(join(AppColumnID, AppOIDCConfigColumnAppID)).
PlaceholderFormat(sq.Dollar),
func(rows *sql.Rows) ([]*OIDCAppLinkConfig, error) {
configs := make([]*OIDCAppLinkConfig, 0)
for rows.Next() {
var (
appID sql.NullString
iosTeamID sql.NullString
iosBundleID sql.NullString
androidPackage sql.NullString
fingerprints database.TextArray[string]
)
if err := rows.Scan(
&appID,
&iosTeamID,
&iosBundleID,
&androidPackage,
&fingerprints,
); err != nil {
return nil, zerrors.ThrowInternal(err, "QUERY-ApLn3", "Errors.Internal")
}
configs = append(configs, &OIDCAppLinkConfig{
AppID: appID.String,
IOSTeamID: strings.TrimSpace(iosTeamID.String),
IOSBundleID: strings.TrimSpace(iosBundleID.String),
AndroidPackageName: strings.TrimSpace(androidPackage.String),
AndroidSHA256CertFingerprints: fingerprints,
})
}
return configs, nil
}
}
internal/query/app_test.go
+96
View File
@@ -51,6 +51,10 @@ var (
` projections.apps7_oidc_configs.back_channel_logout_uri,` +
` projections.apps7_oidc_configs.login_version,` +
` projections.apps7_oidc_configs.login_base_uri,` +
` projections.apps7_oidc_configs.ios_team_id,` +
` projections.apps7_oidc_configs.ios_bundle_id,` +
` projections.apps7_oidc_configs.android_package_name,` +
` projections.apps7_oidc_configs.android_sha256_cert_fingerprints,` +
//saml config
` projections.apps7_saml_configs.app_id,` +
` projections.apps7_saml_configs.entity_id,` +
@@ -99,6 +103,10 @@ var (
` projections.apps7_oidc_configs.back_channel_logout_uri,` +
` projections.apps7_oidc_configs.login_version,` +
` projections.apps7_oidc_configs.login_base_uri,` +
` projections.apps7_oidc_configs.ios_team_id,` +
` projections.apps7_oidc_configs.ios_bundle_id,` +
` projections.apps7_oidc_configs.android_package_name,` +
` projections.apps7_oidc_configs.android_sha256_cert_fingerprints,` +
//saml config
` projections.apps7_saml_configs.app_id,` +
` projections.apps7_saml_configs.entity_id,` +
@@ -172,6 +180,10 @@ var (
"back_channel_logout_uri",
"login_version",
"login_base_uri",
"ios_team_id",
"ios_bundle_id",
"android_package_name",
"android_sha256_cert_fingerprints",
//saml config
"app_id",
"entity_id",
@@ -248,6 +260,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -319,6 +335,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -393,6 +413,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"app-id",
"https://test.com/saml/metadata",
@@ -469,6 +493,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -563,6 +591,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -657,6 +689,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -751,6 +787,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -845,6 +885,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -939,6 +983,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1033,6 +1081,10 @@ func Test_AppsPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersion2,
"https://login.ch/",
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1075,6 +1127,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1117,6 +1173,10 @@ func Test_AppsPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"saml-app-id",
"https://test.com/saml/metadata",
@@ -1302,6 +1362,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1367,6 +1431,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1437,6 +1505,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1526,6 +1598,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1615,6 +1691,10 @@ func Test_AppPrepare(t *testing.T) {
nil,
nil,
nil,
nil,
nil,
nil,
nil,
// saml config
"app-id",
"https://test.com/saml/metadata",
@@ -1688,6 +1768,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1777,6 +1861,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1866,6 +1954,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
@@ -1955,6 +2047,10 @@ func Test_AppPrepare(t *testing.T) {
"back.channel.logout.ch",
domain.LoginVersionUnspecified,
nil,
nil,
nil,
nil,
nil,
// saml config
nil,
nil,
internal/query/projection/app.go
+48 -24
View File
@@ -38,30 +38,34 @@ const (
AppAPIConfigColumnClientSecret = "client_secret"
AppAPIConfigColumnAuthMethod = "auth_method"
appOIDCTableSuffix = "oidc_configs"
AppOIDCConfigColumnAppID = "app_id"
AppOIDCConfigColumnInstanceID = "instance_id"
AppOIDCConfigColumnVersion = "version"
AppOIDCConfigColumnClientID = "client_id"
AppOIDCConfigColumnClientSecret = "client_secret"
AppOIDCConfigColumnRedirectUris = "redirect_uris"
AppOIDCConfigColumnResponseTypes = "response_types"
AppOIDCConfigColumnGrantTypes = "grant_types"
AppOIDCConfigColumnApplicationType = "application_type"
AppOIDCConfigColumnAuthMethodType = "auth_method_type"
AppOIDCConfigColumnPostLogoutRedirectUris = "post_logout_redirect_uris"
AppOIDCConfigColumnDevMode = "is_dev_mode"
AppOIDCConfigColumnAccessTokenType = "access_token_type"
AppOIDCConfigColumnAccessTokenRoleAssertion = "access_token_role_assertion"
AppOIDCConfigColumnIDTokenRoleAssertion = "id_token_role_assertion"
AppOIDCConfigColumnIDTokenUserinfoAssertion = "id_token_userinfo_assertion"
AppOIDCConfigColumnClockSkew = "clock_skew"
AppOIDCConfigColumnAdditionalOrigins = "additional_origins"
AppOIDCConfigColumnSkipNativeAppSuccessPage = "skip_native_app_success_page"
AppOIDCConfigColumnBackChannelLogoutURI = "back_channel_logout_uri"
AppOIDCConfigColumnLoginVersion = "login_version"
AppOIDCConfigColumnLoginBaseURI = "login_base_uri"
AppOIDCConfigColumnRegistrationToken = "registration_token"
appOIDCTableSuffix = "oidc_configs"
AppOIDCConfigColumnAppID = "app_id"
AppOIDCConfigColumnInstanceID = "instance_id"
AppOIDCConfigColumnVersion = "version"
AppOIDCConfigColumnClientID = "client_id"
AppOIDCConfigColumnClientSecret = "client_secret"
AppOIDCConfigColumnRedirectUris = "redirect_uris"
AppOIDCConfigColumnResponseTypes = "response_types"
AppOIDCConfigColumnGrantTypes = "grant_types"
AppOIDCConfigColumnApplicationType = "application_type"
AppOIDCConfigColumnAuthMethodType = "auth_method_type"
AppOIDCConfigColumnPostLogoutRedirectUris = "post_logout_redirect_uris"
AppOIDCConfigColumnDevMode = "is_dev_mode"
AppOIDCConfigColumnAccessTokenType = "access_token_type"
AppOIDCConfigColumnAccessTokenRoleAssertion = "access_token_role_assertion"
AppOIDCConfigColumnIDTokenRoleAssertion = "id_token_role_assertion"
AppOIDCConfigColumnIDTokenUserinfoAssertion = "id_token_userinfo_assertion"
AppOIDCConfigColumnClockSkew = "clock_skew"
AppOIDCConfigColumnAdditionalOrigins = "additional_origins"
AppOIDCConfigColumnSkipNativeAppSuccessPage = "skip_native_app_success_page"
AppOIDCConfigColumnBackChannelLogoutURI = "back_channel_logout_uri"
AppOIDCConfigColumnLoginVersion = "login_version"
AppOIDCConfigColumnLoginBaseURI = "login_base_uri"
AppOIDCConfigColumnIOSTeamID = "ios_team_id"
AppOIDCConfigColumnIOSBundleID = "ios_bundle_id"
AppOIDCConfigColumnAndroidPackageName = "android_package_name"
AppOIDCConfigColumnAndroidSHA256CertFingerprints = "android_sha256_cert_fingerprints"
AppOIDCConfigColumnRegistrationToken = "registration_token"
appSAMLTableSuffix = "saml_configs"
AppSAMLConfigColumnAppID = "app_id"
@@ -134,6 +138,10 @@ func (*appProjection) Init() *old_handler.Check {
handler.NewColumn(AppOIDCConfigColumnBackChannelLogoutURI, handler.ColumnTypeText, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnLoginVersion, handler.ColumnTypeEnum, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnLoginBaseURI, handler.ColumnTypeText, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnIOSTeamID, handler.ColumnTypeText, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnIOSBundleID, handler.ColumnTypeText, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnAndroidPackageName, handler.ColumnTypeText, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnAndroidSHA256CertFingerprints, handler.ColumnTypeTextArray, handler.Nullable()),
handler.NewColumn(AppOIDCConfigColumnRegistrationToken, handler.ColumnTypeText, handler.Nullable()),
},
handler.NewPrimaryKey(AppOIDCConfigColumnInstanceID, AppOIDCConfigColumnAppID),
@@ -519,6 +527,10 @@ func (p *appProjection) reduceOIDCConfigAdded(event eventstore.Event) (*handler.
handler.NewCol(AppOIDCConfigColumnBackChannelLogoutURI, e.BackChannelLogoutURI),
handler.NewCol(AppOIDCConfigColumnLoginVersion, e.LoginVersion),
handler.NewCol(AppOIDCConfigColumnLoginBaseURI, e.LoginBaseURI),
handler.NewCol(AppOIDCConfigColumnIOSTeamID, e.IOSTeamID),
handler.NewCol(AppOIDCConfigColumnIOSBundleID, e.IOSBundleID),
handler.NewCol(AppOIDCConfigColumnAndroidPackageName, e.AndroidPackageName),
handler.NewCol(AppOIDCConfigColumnAndroidSHA256CertFingerprints, database.TextArray[string](e.AndroidSHA256CertFingerprints)),
},
handler.WithTableSuffix(appOIDCTableSuffix),
),
@@ -596,6 +608,18 @@ func (p *appProjection) reduceOIDCConfigChanged(event eventstore.Event) (*handle
if e.LoginBaseURI != nil {
cols = append(cols, handler.NewCol(AppOIDCConfigColumnLoginBaseURI, *e.LoginBaseURI))
}
if e.IOSTeamID != nil {
cols = append(cols, handler.NewCol(AppOIDCConfigColumnIOSTeamID, *e.IOSTeamID))
}
if e.IOSBundleID != nil {
cols = append(cols, handler.NewCol(AppOIDCConfigColumnIOSBundleID, *e.IOSBundleID))
}
if e.AndroidPackageName != nil {
cols = append(cols, handler.NewCol(AppOIDCConfigColumnAndroidPackageName, *e.AndroidPackageName))
}
if e.AndroidSHA256CertFingerprints != nil {
cols = append(cols, handler.NewCol(AppOIDCConfigColumnAndroidSHA256CertFingerprints, database.TextArray[string](*e.AndroidSHA256CertFingerprints)))
}
if len(cols) == 0 {
return handler.NewNoOpStatement(e), nil
internal/query/projection/app_test.go
+56 -2
View File
@@ -572,7 +572,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page, back_channel_logout_uri, login_version, login_base_uri) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)",
expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page, back_channel_logout_uri, login_version, login_base_uri, ios_team_id, ios_bundle_id, android_package_name, android_sha256_cert_fingerprints) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26)",
expectedArgs: []interface{}{
"app-id",
"instance-id",
@@ -596,6 +596,10 @@ func TestAppProjection_reduces(t *testing.T) {
"back.channel.one.ch",
domain.LoginVersion2,
"https://login.ch/",
"",
"",
"",
database.TextArray[string](nil),
},
},
{
@@ -650,7 +654,7 @@ func TestAppProjection_reduces(t *testing.T) {
executer: &testExecuter{
executions: []execution{
{
expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page, back_channel_logout_uri, login_version, login_base_uri) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)",
expectedStmt: "INSERT INTO projections.apps7_oidc_configs (app_id, instance_id, version, client_id, client_secret, redirect_uris, response_types, grant_types, application_type, auth_method_type, post_logout_redirect_uris, is_dev_mode, access_token_type, access_token_role_assertion, id_token_role_assertion, id_token_userinfo_assertion, clock_skew, additional_origins, skip_native_app_success_page, back_channel_logout_uri, login_version, login_base_uri, ios_team_id, ios_bundle_id, android_package_name, android_sha256_cert_fingerprints) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26)",
expectedArgs: []interface{}{
"app-id",
"instance-id",
@@ -674,6 +678,10 @@ func TestAppProjection_reduces(t *testing.T) {
"back.channel.one.ch",
domain.LoginVersion2,
"https://login.ch/",
"",
"",
"",
database.TextArray[string](nil),
},
},
{
@@ -761,6 +769,52 @@ func TestAppProjection_reduces(t *testing.T) {
},
},
},
{
name: "project reduceOIDCConfigChanged app links",
args: args{
event: getEvent(
testEvent(
project.OIDCConfigChangedType,
project.AggregateType,
[]byte(`{
"appId": "app-id",
"iosTeamId": "TEAMID",
"iosBundleId": "com.example.app",
"androidPackageName": "com.example.app",
"androidSha256CertFingerprints": ["AA:BB:CC"]
}`),
), project.OIDCConfigChangedEventMapper),
},
reduce: (&appProjection{}).reduceOIDCConfigChanged,
want: wantReduce{
aggregateType: eventstore.AggregateType("project"),
sequence: 15,
executer: &testExecuter{
executions: []execution{
{
expectedStmt: "UPDATE projections.apps7_oidc_configs SET (ios_team_id, ios_bundle_id, android_package_name, android_sha256_cert_fingerprints) = ($1, $2, $3, $4) WHERE (app_id = $5) AND (instance_id = $6)",
expectedArgs: []interface{}{
"TEAMID",
"com.example.app",
"com.example.app",
database.TextArray[string]{"AA:BB:CC"},
"app-id",
"instance-id",
},
},
{
expectedStmt: "UPDATE projections.apps7 SET (change_date, sequence) = ($1, $2) WHERE (id = $3) AND (instance_id = $4)",
expectedArgs: []interface{}{
anyArg{},
uint64(15),
"app-id",
"instance-id",
},
},
},
},
},
},
{
name: "project reduceOIDCConfigChanged noop",
args: args{
internal/repository/project/oidc_config.go
+115 -58
View File
@@ -2,6 +2,7 @@ package project
import (
"context"
"slices"
"time"
"github.com/zitadel/zitadel/internal/crypto"
@@ -31,23 +32,27 @@ type OIDCConfigAddedEvent struct {
ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
HashedSecret string `json:"hashedSecret,omitempty"`
RedirectUris []string `json:"redirectUris,omitempty"`
ResponseTypes []domain.OIDCResponseType `json:"responseTypes,omitempty"`
GrantTypes []domain.OIDCGrantType `json:"grantTypes,omitempty"`
ApplicationType domain.OIDCApplicationType `json:"applicationType,omitempty"`
AuthMethodType domain.OIDCAuthMethodType `json:"authMethodType,omitempty"`
PostLogoutRedirectUris []string `json:"postLogoutRedirectUris,omitempty"`
DevMode bool `json:"devMode,omitempty"`
AccessTokenType domain.OIDCTokenType `json:"accessTokenType,omitempty"`
AccessTokenRoleAssertion bool `json:"accessTokenRoleAssertion,omitempty"`
IDTokenRoleAssertion bool `json:"idTokenRoleAssertion,omitempty"`
IDTokenUserinfoAssertion bool `json:"idTokenUserinfoAssertion,omitempty"`
ClockSkew time.Duration `json:"clockSkew,omitempty"`
AdditionalOrigins []string `json:"additionalOrigins,omitempty"`
SkipNativeAppSuccessPage bool `json:"skipNativeAppSuccessPage,omitempty"`
BackChannelLogoutURI string `json:"backChannelLogoutURI,omitempty"`
LoginVersion domain.LoginVersion `json:"loginVersion,omitempty"`
LoginBaseURI string `json:"loginBaseURI,omitempty"`
RedirectUris []string `json:"redirectUris,omitempty"`
ResponseTypes []domain.OIDCResponseType `json:"responseTypes,omitempty"`
GrantTypes []domain.OIDCGrantType `json:"grantTypes,omitempty"`
ApplicationType domain.OIDCApplicationType `json:"applicationType,omitempty"`
AuthMethodType domain.OIDCAuthMethodType `json:"authMethodType,omitempty"`
PostLogoutRedirectUris []string `json:"postLogoutRedirectUris,omitempty"`
DevMode bool `json:"devMode,omitempty"`
AccessTokenType domain.OIDCTokenType `json:"accessTokenType,omitempty"`
AccessTokenRoleAssertion bool `json:"accessTokenRoleAssertion,omitempty"`
IDTokenRoleAssertion bool `json:"idTokenRoleAssertion,omitempty"`
IDTokenUserinfoAssertion bool `json:"idTokenUserinfoAssertion,omitempty"`
ClockSkew time.Duration `json:"clockSkew,omitempty"`
AdditionalOrigins []string `json:"additionalOrigins,omitempty"`
SkipNativeAppSuccessPage bool `json:"skipNativeAppSuccessPage,omitempty"`
BackChannelLogoutURI string `json:"backChannelLogoutURI,omitempty"`
LoginVersion domain.LoginVersion `json:"loginVersion,omitempty"`
LoginBaseURI string `json:"loginBaseURI,omitempty"`
IOSTeamID string `json:"iosTeamId,omitempty"`
IOSBundleID string `json:"iosBundleId,omitempty"`
AndroidPackageName string `json:"androidPackageName,omitempty"`
AndroidSHA256CertFingerprints []string `json:"androidSha256CertFingerprints,omitempty"`
}
func (e *OIDCConfigAddedEvent) Payload() interface{} {
@@ -82,6 +87,10 @@ func NewOIDCConfigAddedEvent(
backChannelLogoutURI string,
loginVersion domain.LoginVersion,
loginBaseURI string,
iosTeamID string,
iosBundleID string,
androidPackageName string,
androidSHA256CertFingerprints []string,
) *OIDCConfigAddedEvent {
return &OIDCConfigAddedEvent{
BaseEvent: *eventstore.NewBaseEventForPush(
@@ -89,27 +98,31 @@ func NewOIDCConfigAddedEvent(
aggregate,
OIDCConfigAddedType,
),
Version: version,
AppID: appID,
ClientID: clientID,
HashedSecret: hashedSecret,
RedirectUris: redirectUris,
ResponseTypes: responseTypes,
GrantTypes: grantTypes,
ApplicationType: applicationType,
AuthMethodType: authMethodType,
PostLogoutRedirectUris: postLogoutRedirectUris,
DevMode: devMode,
AccessTokenType: accessTokenType,
AccessTokenRoleAssertion: accessTokenRoleAssertion,
IDTokenRoleAssertion: idTokenRoleAssertion,
IDTokenUserinfoAssertion: idTokenUserinfoAssertion,
ClockSkew: clockSkew,
AdditionalOrigins: additionalOrigins,
SkipNativeAppSuccessPage: skipNativeAppSuccessPage,
BackChannelLogoutURI: backChannelLogoutURI,
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
Version: version,
AppID: appID,
ClientID: clientID,
HashedSecret: hashedSecret,
RedirectUris: redirectUris,
ResponseTypes: responseTypes,
GrantTypes: grantTypes,
ApplicationType: applicationType,
AuthMethodType: authMethodType,
PostLogoutRedirectUris: postLogoutRedirectUris,
DevMode: devMode,
AccessTokenType: accessTokenType,
AccessTokenRoleAssertion: accessTokenRoleAssertion,
IDTokenRoleAssertion: idTokenRoleAssertion,
IDTokenUserinfoAssertion: idTokenUserinfoAssertion,
ClockSkew: clockSkew,
AdditionalOrigins: additionalOrigins,
SkipNativeAppSuccessPage: skipNativeAppSuccessPage,
BackChannelLogoutURI: backChannelLogoutURI,
LoginVersion: loginVersion,
LoginBaseURI: loginBaseURI,
IOSTeamID: iosTeamID,
IOSBundleID: iosBundleID,
AndroidPackageName: androidPackageName,
AndroidSHA256CertFingerprints: androidSHA256CertFingerprints,
}
}
@@ -204,7 +217,19 @@ func (e *OIDCConfigAddedEvent) Validate(cmd eventstore.Command) bool {
if e.LoginVersion != c.LoginVersion {
return false
}
return e.LoginBaseURI == c.LoginBaseURI
if e.LoginBaseURI != c.LoginBaseURI {
return false
}
if e.IOSTeamID != c.IOSTeamID {
return false
}
if e.IOSBundleID != c.IOSBundleID {
return false
}
if e.AndroidPackageName != c.AndroidPackageName {
return false
}
return slices.Equal(e.AndroidSHA256CertFingerprints, c.AndroidSHA256CertFingerprints)
}
func OIDCConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
@@ -223,25 +248,29 @@ func OIDCConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error
type OIDCConfigChangedEvent struct {
eventstore.BaseEvent `json:"-"`
Version *domain.OIDCVersion `json:"oidcVersion,omitempty"`
AppID string `json:"appId"`
RedirectUris *[]string `json:"redirectUris,omitempty"`
ResponseTypes *[]domain.OIDCResponseType `json:"responseTypes,omitempty"`
GrantTypes *[]domain.OIDCGrantType `json:"grantTypes,omitempty"`
ApplicationType *domain.OIDCApplicationType `json:"applicationType,omitempty"`
AuthMethodType *domain.OIDCAuthMethodType `json:"authMethodType,omitempty"`
PostLogoutRedirectUris *[]string `json:"postLogoutRedirectUris,omitempty"`
DevMode *bool `json:"devMode,omitempty"`
AccessTokenType *domain.OIDCTokenType `json:"accessTokenType,omitempty"`
AccessTokenRoleAssertion *bool `json:"accessTokenRoleAssertion,omitempty"`
IDTokenRoleAssertion *bool `json:"idTokenRoleAssertion,omitempty"`
IDTokenUserinfoAssertion *bool `json:"idTokenUserinfoAssertion,omitempty"`
ClockSkew *time.Duration `json:"clockSkew,omitempty"`
AdditionalOrigins *[]string `json:"additionalOrigins,omitempty"`
SkipNativeAppSuccessPage *bool `json:"skipNativeAppSuccessPage,omitempty"`
BackChannelLogoutURI *string `json:"backChannelLogoutURI,omitempty"`
LoginVersion *domain.LoginVersion `json:"loginVersion,omitempty"`
LoginBaseURI *string `json:"loginBaseURI,omitempty"`
Version *domain.OIDCVersion `json:"oidcVersion,omitempty"`
AppID string `json:"appId"`
RedirectUris *[]string `json:"redirectUris,omitempty"`
ResponseTypes *[]domain.OIDCResponseType `json:"responseTypes,omitempty"`
GrantTypes *[]domain.OIDCGrantType `json:"grantTypes,omitempty"`
ApplicationType *domain.OIDCApplicationType `json:"applicationType,omitempty"`
AuthMethodType *domain.OIDCAuthMethodType `json:"authMethodType,omitempty"`
PostLogoutRedirectUris *[]string `json:"postLogoutRedirectUris,omitempty"`
DevMode *bool `json:"devMode,omitempty"`
AccessTokenType *domain.OIDCTokenType `json:"accessTokenType,omitempty"`
AccessTokenRoleAssertion *bool `json:"accessTokenRoleAssertion,omitempty"`
IDTokenRoleAssertion *bool `json:"idTokenRoleAssertion,omitempty"`
IDTokenUserinfoAssertion *bool `json:"idTokenUserinfoAssertion,omitempty"`
ClockSkew *time.Duration `json:"clockSkew,omitempty"`
AdditionalOrigins *[]string `json:"additionalOrigins,omitempty"`
SkipNativeAppSuccessPage *bool `json:"skipNativeAppSuccessPage,omitempty"`
BackChannelLogoutURI *string `json:"backChannelLogoutURI,omitempty"`
LoginVersion *domain.LoginVersion `json:"loginVersion,omitempty"`
LoginBaseURI *string `json:"loginBaseURI,omitempty"`
IOSTeamID *string `json:"iosTeamId,omitempty"`
IOSBundleID *string `json:"iosBundleId,omitempty"`
AndroidPackageName *string `json:"androidPackageName,omitempty"`
AndroidSHA256CertFingerprints *[]string `json:"androidSha256CertFingerprints,omitempty"`
}
func (e *OIDCConfigChangedEvent) Payload() interface{} {
@@ -398,6 +427,34 @@ func ChangeOIDCLoginBaseURI(loginBaseURI string) func(event *OIDCConfigChangedEv
}
}
func ChangeIOSTeamID(iosTeamID string) func(event *OIDCConfigChangedEvent) {
return func(e *OIDCConfigChangedEvent) {
e.IOSTeamID = &iosTeamID
}
}
func ChangeIOSBundleID(iosBundleID string) func(event *OIDCConfigChangedEvent) {
return func(e *OIDCConfigChangedEvent) {
e.IOSBundleID = &iosBundleID
}
}
func ChangeAndroidPackageName(androidPackageName string) func(event *OIDCConfigChangedEvent) {
return func(e *OIDCConfigChangedEvent) {
e.AndroidPackageName = &androidPackageName
}
}
func ChangeAndroidSHA256CertFingerprints(fingerprints []string) func(event *OIDCConfigChangedEvent) {
return func(e *OIDCConfigChangedEvent) {
if fingerprints == nil {
// explicitly set them to empty so we can differentiate "not set" in the event in case of no changes
fingerprints = make([]string, 0)
}
e.AndroidSHA256CertFingerprints = &fingerprints
}
}
func OIDCConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
e := &OIDCConfigChangedEvent{
BaseEvent: *eventstore.BaseEventFromRepo(event),