feat(action v2): add JWT and JWE payload type options (#11196)

# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
2026-10-30 02:52:16 +00:00 · 2025-12-29 13:35:53 +00:00
parent 72c8f0192c
commit 791d0587aa
124 changed files with 5040 additions and 782 deletions
@@ -2,7 +2,7 @@ import { ChangeDetectionStrategy, Component, computed, effect, EventEmitter, Inp
 import { combineLatestWith, Observable, ReplaySubject } from 'rxjs';
 import { filter, map, startWith } from 'rxjs/operators';
 import { MatTableDataSource } from '@angular/material/table';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
+import { Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
 import { toSignal } from '@angular/core/rxjs-interop';
 import { CorrectlyTypedExecution } from '../../actions-two-add-action/actions-two-add-action-dialog.component';

@@ -13,10 +13,10 @@ import {
 } from '../actions-two-add-action/actions-two-add-action-dialog.component';
 import { MatDialog } from '@angular/material/dialog';
 import { MessageInitShape } from '@bufbuild/protobuf';
-import { SetExecutionRequestSchema } from '@zitadel/proto/zitadel/action/v2beta/action_service_pb';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
+import { SetExecutionRequestSchema } from '@zitadel/proto/zitadel/action/v2/action_service_pb';
+import { Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
 import { InfoSectionType } from '../../info-section/info-section.component';
-import { ExecutionFieldName } from '@zitadel/proto/zitadel/action/v2beta/query_pb';
+import { ExecutionFieldName } from '@zitadel/proto/zitadel/action/v2/query_pb';

@Component({
  selector: 'cnsl-actions-two-actions',
@@ -14,7 +14,7 @@ import { ToastService } from 'src/app/services/toast.service';
 import { MatCheckboxModule } from '@angular/material/checkbox';
 import { atLeastOneFieldValidator, requiredValidator } from 'src/app/modules/form-field/validators/validators';
 import { Message } from '@bufbuild/protobuf';
-import { Condition } from '@zitadel/proto/zitadel/action/v2beta/execution_pb';
+import { Condition } from '@zitadel/proto/zitadel/action/v2/execution_pb';
 import { distinctUntilChanged, startWith, takeUntil } from 'rxjs/operators';
 import { CreateQueryResult } from '@tanstack/angular-query-experimental';
 import { toSignal } from '@angular/core/rxjs-interop';
@@ -10,9 +10,9 @@ import {
 } from './actions-two-add-action-condition/actions-two-add-action-condition.component';
 import { ActionsTwoAddActionTargetComponent } from './actions-two-add-action-target/actions-two-add-action-target.component';
 import { CommonModule } from '@angular/common';
-import { Condition, Execution } from '@zitadel/proto/zitadel/action/v2beta/execution_pb';
+import { Condition, Execution } from '@zitadel/proto/zitadel/action/v2/execution_pb';
 import { Subject } from 'rxjs';
-import { SetExecutionRequestSchema } from '@zitadel/proto/zitadel/action/v2beta/action_service_pb';
+import { SetExecutionRequestSchema } from '@zitadel/proto/zitadel/action/v2/action_service_pb';

 enum Page {
  Type,
@@ -21,7 +21,7 @@ import { ToastService } from 'src/app/services/toast.service';
 import { MatAutocompleteModule } from '@angular/material/autocomplete';
 import { InputModule } from 'src/app/modules/input/input.module';
 import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
+import { Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
 import { MatSelectModule } from '@angular/material/select';
 import { ActionConditionPipeModule } from 'src/app/pipes/action-condition-pipe/action-condition-pipe.module';
 import { MatTableDataSource, MatTableModule } from '@angular/material/table';
@@ -31,6 +31,18 @@
      </span>
    </cnsl-form-field>

+    <cnsl-form-field class="full-width">
+      <cnsl-label>{{ 'ACTIONSTWO.TARGET.CREATE.PAYLOAD_TYPE' | translate }}</cnsl-label>
+      <mat-select [formControl]="targetForm.controls.payloadType" name="payloadType">
+        <mat-option *ngFor="let type of payloadTypes" [value]="type">
+          {{ 'ACTIONSTWO.TARGET.CREATE.PAYLOAD_TYPES.' + type | translate }}
+        </mat-option>
+      </mat-select>
+      <span class="name-hint cnsl-secondary-text types-description">
+        {{ 'ACTIONSTWO.TARGET.CREATE.PAYLOAD_TYPE_DESCRIPTION' | translate }}
+      </span>
+    </cnsl-form-field>
+
    <cnsl-form-field class="full-width">
      <cnsl-label>{{ 'ACTIONSTWO.TARGET.CREATE.TIMEOUT' | translate }}</cnsl-label>
      <input cnslInput type="number" placeholder="10" [formControl]="targetForm.controls.timeout" />
@@ -10,11 +10,9 @@ import { requiredValidator } from '../../form-field/validators/validators';
 import { MessageInitShape } from '@bufbuild/protobuf';
 import { DurationSchema } from '@bufbuild/protobuf/wkt';
 import { MatSelectModule } from '@angular/material/select';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
-import {
-  CreateTargetRequestSchema,
-  UpdateTargetRequestSchema,
-} from '@zitadel/proto/zitadel/action/v2beta/action_service_pb';
+import { PayloadType, Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
+import { CreateTargetRequestSchema, UpdateTargetRequestSchema } from '@zitadel/proto/zitadel/action/v2/action_service_pb';
+import { getEnumKeyFromValue, getEnumKeys } from 'src/app/utils/enum.utils';

 type TargetTypes = ActionTwoAddTargetDialogComponent['targetTypes'][number];

@@ -36,6 +34,7 @@ type TargetTypes = ActionTwoAddTargetDialogComponent['targetTypes'][number];
 export class ActionTwoAddTargetDialogComponent {
  protected readonly targetTypes = ['restCall', 'restWebhook', 'restAsync'] as const;
  protected readonly targetForm: ReturnType<typeof this.buildTargetForm>;
+  protected readonly payloadTypes = getEnumKeys(PayloadType);

  constructor(
    private fb: FormBuilder,
@@ -56,6 +55,8 @@ export class ActionTwoAddTargetDialogComponent {
      endpoint: data.target.endpoint,
      timeout: Number(data.target.timeout?.seconds),
      type: this.data.target?.targetType?.case ?? 'restWebhook',
+      payloadType:
+        getEnumKeyFromValue(PayloadType, this.data.target?.payloadType ?? PayloadType.UNSPECIFIED) || this.payloadTypes[0],
      interruptOnError:
        data.target.targetType.case === 'restWebhook' || data.target.targetType.case === 'restCall'
          ? data.target.targetType.value.interruptOnError
@@ -70,6 +71,10 @@ export class ActionTwoAddTargetDialogComponent {
        nonNullable: true,
        validators: [requiredValidator],
      }),
+      payloadType: new FormControl<(typeof this.payloadTypes)[number]>(this.payloadTypes[0], {
+        nonNullable: true,
+        validators: [requiredValidator],
+      }),
      endpoint: new FormControl<string>('', { nonNullable: true, validators: [requiredValidator] }),
      timeout: new FormControl<number>(10, { nonNullable: true, validators: [requiredValidator] }),
      interruptOnError: new FormControl<boolean>(false, { nonNullable: true }),
@@ -81,7 +86,7 @@ export class ActionTwoAddTargetDialogComponent {
      return;
    }

-    const { type, name, endpoint, timeout, interruptOnError } = this.targetForm.getRawValue();
+    const { type, name, endpoint, timeout, interruptOnError, payloadType } = this.targetForm.getRawValue();

    const timeoutDuration: MessageInitShape<typeof DurationSchema> = {
      seconds: BigInt(timeout),
@@ -100,6 +105,7 @@ export class ActionTwoAddTargetDialogComponent {
      endpoint,
      timeout: timeoutDuration,
      targetType,
+      payloadType: PayloadType[payloadType],
    };

    this.dialogRef.close(
@@ -2,7 +2,7 @@ import { ChangeDetectionStrategy, Component, effect, EventEmitter, Input, Output
 import { ReplaySubject } from 'rxjs';
 import { filter, startWith } from 'rxjs/operators';
 import { MatTableDataSource } from '@angular/material/table';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
+import { Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
 import { toSignal } from '@angular/core/rxjs-interop';

@Component({
@@ -7,11 +7,8 @@ import { catchError, map, startWith, switchMap } from 'rxjs/operators';
 import { MatDialog } from '@angular/material/dialog';
 import { ActionTwoAddTargetDialogComponent } from '../actions-two-add-target/actions-two-add-target-dialog.component';
 import { MessageInitShape } from '@bufbuild/protobuf';
-import { Target } from '@zitadel/proto/zitadel/action/v2beta/target_pb';
-import {
-  CreateTargetRequestSchema,
-  UpdateTargetRequestSchema,
-} from '@zitadel/proto/zitadel/action/v2beta/action_service_pb';
+import { Target } from '@zitadel/proto/zitadel/action/v2/target_pb';
+import { CreateTargetRequestSchema, UpdateTargetRequestSchema } from '@zitadel/proto/zitadel/action/v2/action_service_pb';
 import { InfoSectionType } from '../../info-section/info-section.component';

@Component({