feat: label policy (#1708)

* feat: label policy proto extension * feat: label policy and activate event * feat: label policy asset events * feat: label policy asset commands * feat: add storage key * feat: storage key validation * feat: label policy asset tests * feat: label policy query side * feat: avatar * feat: avatar event * feat: human avatar * feat: avatar read side * feat: font on iam label policy * feat: label policy font * feat: possiblity to create bucket on put file * uplaoder * login policy logo * set bucket prefix * feat: avatar upload * feat: avatar upload * feat: use assets on command side * feat: fix human avatar removed event * feat: remove human avatar * feat: mock asset storage * feat: remove human avatar * fix(operator): add configuration of asset storage to zitadel operator * feat(console): private labeling policy (#1697) * private labeling component, routing, preview * font, colors, upload, i18n * show logo * fix: uniqueness (#1710) * fix: uniqueconstraint to lower * feat: change org * feat: org change test * feat: change org * fix: tests * fix: handle domain claims correctly * feat: update org Co-authored-by: fabi <[email protected]> * fix: handle domain claimed event correctly for service users (#1711) * fix: handle domain claimed event correctly on user view * fix: ignore domain claimed events for email notifications * fix: change org * handle org changed in read models correctly * fix: change org in user grant handler Co-authored-by: fabi <[email protected]> * fix: correct value (#1695) * docs(api): correct link (#1712) * upload service Co-authored-by: Livio Amstutz <[email protected]> Co-authored-by: fabi <[email protected]> Co-authored-by: Florian Forster <[email protected]> * feat: fix tests, * feat: remove assets from label policy * fix npm, set environment * lint ts * remove stylelinting * fix(operator): add mapping for console with changed unit tests * fix(operator): add secrets as env variables to pod * feat: remove human avatar * fix(operator): add secrets as env variables to pod * feat: map label policy * feat: labelpolicy, admin, mgmt, adv settings (#1715) * fetch label policy, mgmt, admin service * feat: advanced beh, links, add, update * lint ts * feat: watermark * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: remove human avatar * feat: custom css * css * css * css * css * css * getobject * feat: dynamic handler * feat: varibale css * content info * css overwrite * feat: variablen css * feat: generate css file * feat: dark mode * feat: dark mode * fix logo css * feat: upload logos * dark mode with cookie * feat: handle images in login * avatar css and begin font * feat: avatar * feat: user avatar * caching of static assets in login * add avatar.js to main.html * feat: header dont show logo if no url * feat: label policy colors * feat: mock asset storage * feat: mock asset storage * feat: fix tests * feat: user avatar * feat: header logo * avatar * avatar * make it compatible with go 1.15 * feat: remove unused logos * fix handler * fix: styling error handling * fonts * fix: download func * switch to mux * fix: change upload api to assets * fix build * fix: download avatar * fix: download logos * fix: my avatar * font * fix: remove error msg popup possibility * fix: docs * fix: svalidate colors * rem msg popup from frontend * fix: email with private labeling * fix: tests * fix: email templates * fix: change migration version * fix: fix duplicate imports * fix(console): assets, service url, upload, policy current and preview (#1781) * upload endpoint, layout * fetch current, preview, fix upload * cleanup private labeling * fix linting * begin generated asset handler * generate asset api in dockerfile * features for label policy * features for label policy * features * flag for asset generator * change asset generator flag * fix label policy view in grpc * fix: layout, activate policy (#1786) * theme switcher up on top * change layout * activate policy * feat(console): label policy back color, layout (#1788) * theme switcher up on top * change layout * activate policy * fix overwrite value fc * reset policy, reset service * autosave policy, preview desc, layout impv * layout, i18n * background colors, inject material styles * load images * clean, lint * fix layout * set custom hex * fix content size conversion * remove font format in generated css * fix features for assets * fix(console): label policy colors, image downloads, preview (#1804) * load images * colors, images binding * lint * refresh emitter * lint * propagate font colors * upload error handling * label policy feature check * add blob in csp for console * log * fix: feature edits for label policy, refresh state on upload (#1807) * show error on load image, stop spinner * fix merge * fix migration versions * fix assets * fix csp * fix background color * scss * fix build * lint scss * fix statik for console * fix features check for label policy * cleanup * lint * public links * fix notifications * public links * feat: merge main * feat: fix translation files * fix migration * set api domain * fix logo in email * font face in email * font face in email * validate assets on upload * cleanup * add missing translations * add missing translations Co-authored-by: Livio Amstutz <[email protected]> Co-authored-by: Stefan Benz <[email protected]> Co-authored-by: Max Peintner <[email protected]> Co-authored-by: Florian Forster <[email protected]>
2026-10-31 19:42:15 +00:00 · 2021-06-04 14:53:51 +02:00
parent c0d9d86b09
commit 73d37459bb
257 changed files with 18247 additions and 7177 deletions
@@ -11,12 +11,15 @@ import (
 	"github.com/caos/zitadel/internal/api/http/middleware"
 	auth_repository "github.com/caos/zitadel/internal/auth/repository"
 	"github.com/caos/zitadel/internal/auth/repository/eventsourcing"
+	"github.com/caos/zitadel/internal/cache"
+	cache_config "github.com/caos/zitadel/internal/cache/config"
 	"github.com/caos/zitadel/internal/command"
 	"github.com/caos/zitadel/internal/config/systemdefaults"
 	"github.com/caos/zitadel/internal/crypto"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/form"
 	"github.com/caos/zitadel/internal/id"
+	"github.com/caos/zitadel/internal/static"
 	"github.com/caos/zitadel/internal/query"
 	_ "github.com/caos/zitadel/internal/ui/login/statik"
 	usr_model "github.com/caos/zitadel/internal/user/model"
@@ -32,6 +35,8 @@ type Login struct {
 	parser              *form.Parser
 	command             *command.Commands
 	query               *query.Queries
+	staticStorage       static.Storage
+	staticCache         cache.Cache
 	authRepo            auth_repository.Repository
 	baseURL             string
 	zitadelURL          string
@@ -49,6 +54,7 @@ type Config struct {
 	CSRF                  CSRF
 	UserAgentCookieConfig *middleware.UserAgentCookieConfig
 	Cache                 middleware.CacheConfig
+	StaticCache           cache_config.CacheConfig
 }

 type CSRF struct {
@@ -62,7 +68,7 @@ const (
 	handlerPrefix = "/login"
 )

-func CreateLogin(config Config, command *command.Commands, query *query.Queries, authRepo *eventsourcing.EsRepository, systemDefaults systemdefaults.SystemDefaults, localDevMode bool) (*Login, string) {
+func CreateLogin(config Config, command *command.Commands, query *query.Queries, authRepo *eventsourcing.EsRepository, staticStorage static.Storage, systemDefaults systemdefaults.SystemDefaults, localDevMode bool) (*Login, string) {
 	aesCrypto, err := crypto.NewAESCrypto(systemDefaults.IDPConfigVerificationKey)
 	if err != nil {
 		logging.Log("HANDL-s90ew").WithError(err).Debug("error create new aes crypto")
@@ -73,6 +79,7 @@ func CreateLogin(config Config, command *command.Commands, query *query.Queries,
 		zitadelURL:          config.ZitadelURL,
 		command:             command,
 		query:               query,
+		staticStorage:       staticStorage,
 		authRepo:            authRepo,
 		IDPConfigAesCrypto:  aesCrypto,
 		iamDomain:           systemDefaults.Domain,
@@ -81,6 +88,9 @@ func CreateLogin(config Config, command *command.Commands, query *query.Queries,
 	if localDevMode {
 		prefix = handlerPrefix
 	}
+	login.staticCache, err = config.StaticCache.Config.NewCache()
+	logging.Log("CONFI-dgg31").OnError(err).Panic("unable to create storage cache")
+
 	statikFS, err := fs.NewWithNamespace("login")
 	logging.Log("CONFI-Ga21f").OnError(err).Panic("unable to create filesystem")

@@ -92,7 +102,7 @@ func CreateLogin(config Config, command *command.Commands, query *query.Queries,
 	userAgentCookie, err := middleware.NewUserAgentHandler(config.UserAgentCookieConfig, id.SonyFlakeGenerator, localDevMode)
 	logging.Log("CONFI-Dvwf2").OnError(err).Panic("unable to create userAgentInterceptor")
 	login.router = CreateRouter(login, statikFS, csrf, cache, security, userAgentCookie, middleware.TelemetryHandler(EndpointResources))
-	login.renderer = CreateRenderer(prefix, statikFS, config.LanguageCookieName, config.DefaultLanguage)
+	login.renderer = CreateRenderer(prefix, statikFS, staticStorage, config.LanguageCookieName, config.DefaultLanguage)
 	login.parser = form.NewParser()
 	return login, handlerPrefix
 }
@@ -3,10 +3,13 @@ package handler
 import (
 	"errors"
 	"fmt"
-	"github.com/caos/zitadel/internal/domain"
 	"html/template"
 	"net/http"
 	"path"
+	"strings"
+
+	"github.com/caos/zitadel/internal/domain"
+	"github.com/caos/zitadel/internal/static"

 	"github.com/caos/logging"
 	"github.com/gorilla/csrf"
@@ -25,12 +28,14 @@ const (

 type Renderer struct {
 	*renderer.Renderer
-	pathPrefix string
+	pathPrefix    string
+	staticStorage static.Storage
 }

-func CreateRenderer(pathPrefix string, staticDir http.FileSystem, cookieName string, defaultLanguage language.Tag) *Renderer {
+func CreateRenderer(pathPrefix string, staticDir http.FileSystem, staticStorage static.Storage, cookieName string, defaultLanguage language.Tag) *Renderer {
 	r := &Renderer{
-		pathPrefix: pathPrefix,
+		pathPrefix:    pathPrefix,
+		staticStorage: staticStorage,
 	}
 	tmplMapping := map[string]string{
 		tmplError:                    "error.html",
@@ -69,6 +74,35 @@ func CreateRenderer(pathPrefix string, staticDir http.FileSystem, cookieName str
 		"resourceThemeUrl": func(file, theme string) string {
 			return path.Join(r.pathPrefix, EndpointResources, "themes", theme, file)
 		},
+		"hasCustomPolicy": func(policy *domain.LabelPolicy) bool {
+			if policy != nil {
+				return true
+			}
+			return false
+		},
+		"hasWatermark": func(policy *domain.LabelPolicy) bool {
+			if policy != nil && policy.DisableWatermark {
+				return false
+			}
+			return true
+		},
+		"variablesCssFileUrl": func(orgID string, policy *domain.LabelPolicy) string {
+			cssFile := domain.CssPath + "/" + domain.CssVariablesFileName
+			return path.Join(r.pathPrefix, fmt.Sprintf("%s?%s=%s&%s=%v&%s=%s", EndpointDynamicResources, "orgId", orgID, "default-policy", policy.Default, "filename", cssFile))
+		},
+		"customLogoResource": func(orgID string, policy *domain.LabelPolicy, darkMode bool) string {
+			fileName := policy.LogoURL
+			if darkMode && policy.LogoDarkURL != "" {
+				fileName = policy.LogoDarkURL
+			}
+			if fileName == "" {
+				return ""
+			}
+			return path.Join(r.pathPrefix, fmt.Sprintf("%s?%s=%s&%s=%v&%s=%s", EndpointDynamicResources, "orgId", orgID, "default-policy", policy.Default, "filename", fileName))
+		},
+		"avatarResource": func(orgID, avatar string) string {
+			return path.Join(r.pathPrefix, fmt.Sprintf("%s?%s=%s&%s=%v&%s=%s", EndpointDynamicResources, "orgId", orgID, "default-policy", false, "filename", avatar))
+		},
 		"loginUrl": func() string {
 			return path.Join(r.pathPrefix, EndpointLogin)
 		},
@@ -272,6 +306,7 @@ func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, title
 		Title:                  title,
 		Theme:                  l.getTheme(r),
 		ThemeMode:              l.getThemeMode(r),
+		DarkMode:               l.isDarkMode(r),
 		OrgID:                  l.getOrgID(authReq),
 		OrgName:                l.getOrgName(authReq),
 		PrimaryDomain:          l.getOrgPrimaryDomain(authReq),
@@ -282,22 +317,27 @@ func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, title
 	}
 	if authReq != nil {
 		baseData.LoginPolicy = authReq.LoginPolicy
+		baseData.LabelPolicy = authReq.LabelPolicy
 		baseData.IDPProviders = authReq.AllowedExternalIDPs
+	} else {
+		//TODO: How to handle LabelPolicy if no auth req (eg Register)
 	}
 	return baseData
 }

 func (l *Login) getProfileData(authReq *domain.AuthRequest) profileData {
-	var userName, loginName, displayName string
+	var userName, loginName, displayName, avatar string
 	if authReq != nil {
 		userName = authReq.UserName
 		loginName = authReq.LoginName
 		displayName = authReq.DisplayName
+		avatar = authReq.AvatarKey
 	}
 	return profileData{
 		UserName:    userName,
 		LoginName:   loginName,
 		DisplayName: displayName,
+		AvatarKey:   avatar,
 	}
 }

@@ -316,7 +356,18 @@ func (l *Login) getTheme(r *http.Request) string {
 }

 func (l *Login) getThemeMode(r *http.Request) string {
-	return "lgn-dark-theme" //TODO: impl
+	if l.isDarkMode(r) {
+		return "lgn-dark-theme"
+	}
+	return "lgn-light-theme"
+}
+
+func (l *Login) isDarkMode(r *http.Request) bool {
+	cookie, err := r.Cookie("mode")
+	if err != nil {
+		return false
+	}
+	return strings.HasSuffix(cookie.Value, "dark")
 }

 func (l *Login) getOrgID(authReq *domain.AuthRequest) string {
@@ -379,6 +430,7 @@ type baseData struct {
 	Title                  string
 	Theme                  string
 	ThemeMode              string
+	DarkMode               bool
 	OrgID                  string
 	OrgName                string
 	PrimaryDomain          string
@@ -388,6 +440,7 @@ type baseData struct {
 	Nonce                  string
 	LoginPolicy            *domain.LoginPolicy
 	IDPProviders           []*domain.IDPProvider
+	LabelPolicy            *domain.LabelPolicy
 }

 type errorData struct {
@@ -408,6 +461,7 @@ type profileData struct {
 	LoginName   string
 	UserName    string
 	DisplayName string
+	AvatarKey   string
 }

 type passwordData struct {
@@ -1,9 +1,99 @@
 package handler

 import (
+	"context"
+	"io/ioutil"
 	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/caos/logging"
+
+	"github.com/caos/zitadel/internal/domain"
+	caos_errs "github.com/caos/zitadel/internal/errors"
 )

+type dynamicResourceData struct {
+	OrgID         string `schema:"orgId"`
+	DefaultPolicy bool   `schema:"default-policy"`
+	FileName      string `schema:"filename"`
+}
+
 func (l *Login) handleResources(staticDir http.FileSystem) http.Handler {
 	return http.FileServer(staticDir)
 }
+
+func (l *Login) handleDynamicResources(w http.ResponseWriter, r *http.Request) {
+	data := new(dynamicResourceData)
+	err := l.getParseData(r, data)
+	if err != nil {
+		return
+	}
+
+	bucketName := domain.IAMID
+	if data.OrgID != "" && !data.DefaultPolicy {
+		bucketName = data.OrgID
+	}
+
+	etag := r.Header.Get("If-None-Match")
+	asset, info, err := l.getStatic(r.Context(), bucketName, data.FileName)
+	if info != nil && info.ETag == etag {
+		w.WriteHeader(304)
+		return
+	}
+	if err != nil {
+		return
+	}
+
+	w.Header().Set("content-length", strconv.FormatInt(info.Size, 10))
+	w.Header().Set("content-type", info.ContentType)
+	w.Header().Set("ETag", info.ETag)
+	w.Write(asset)
+}
+
+func (l *Login) getStatic(ctx context.Context, bucketName, fileName string) ([]byte, *domain.AssetInfo, error) {
+	s := new(staticAsset)
+	key := bucketName + "-" + fileName
+	err := l.staticCache.Get(key, s)
+	if err == nil && s.Info != nil && (s.Info.Expiration.After(time.Now().Add(-1 * time.Minute))) { //TODO: config?
+		return s.Data, s.Info, nil
+	}
+
+	info, err := l.staticStorage.GetObjectInfo(ctx, bucketName, fileName)
+	if err != nil {
+		if caos_errs.IsNotFound(err) {
+			return nil, nil, err
+		}
+		return s.Data, s.Info, err
+	}
+	if s.Info != nil && s.Info.ETag == info.ETag {
+		if info.Expiration.After(s.Info.Expiration) {
+			s.Info = info
+			l.cacheStatic(bucketName, fileName, s)
+		}
+		return s.Data, s.Info, nil
+	}
+
+	reader, _, err := l.staticStorage.GetObject(ctx, bucketName, fileName)
+	if err != nil {
+		return s.Data, s.Info, err
+	}
+	s.Data, err = ioutil.ReadAll(reader)
+	if err != nil {
+		return nil, nil, err
+	}
+	s.Info = info
+	l.cacheStatic(bucketName, fileName, s)
+	return s.Data, s.Info, nil
+}
+
+func (l *Login) cacheStatic(bucketName, fileName string, s *staticAsset) {
+	key := bucketName + "-" + fileName
+	err := l.staticCache.Set(key, &s)
+	logging.Log("HANDLER-dfht2").OnError(err).Warnf("caching of asset %s: %s failed", bucketName, fileName)
+}
+
+type staticAsset struct {
+	Data []byte
+	Info *domain.AssetInfo
+}
@@ -37,7 +37,8 @@ const (
 	EndpointLogoutDone               = "/logout/done"
 	EndpointExternalNotFoundOption   = "/externaluser/option"

-	EndpointResources = "/resources"
+	EndpointResources        = "/resources"
+	EndpointDynamicResources = "/resources/dynamic"
 )

 func CreateRouter(login *Login, staticDir http.FileSystem, interceptors ...mux.MiddlewareFunc) *mux.Router {
@@ -77,6 +78,7 @@ func CreateRouter(login *Login, staticDir http.FileSystem, interceptors ...mux.M
 	router.HandleFunc(EndpointExternalRegister, login.handleExternalRegister).Methods(http.MethodGet)
 	router.HandleFunc(EndpointExternalRegisterCallback, login.handleExternalRegisterCallback).Methods(http.MethodGet)
 	router.HandleFunc(EndpointLogoutDone, login.handleLogoutDone).Methods(http.MethodGet)
+	router.HandleFunc(EndpointDynamicResources, login.handleDynamicResources).Methods(http.MethodGet)
 	router.PathPrefix(EndpointResources).Handler(login.handleResources(staticDir)).Methods(http.MethodGet)
 	router.HandleFunc(EndpointRegisterOrg, login.handleRegisterOrg).Methods(http.MethodGet)
 	router.HandleFunc(EndpointRegisterOrg, login.handleRegisterOrgCheck).Methods(http.MethodPost)