mirror of
https://github.com/andwati/zitadel.git
synced 2026-11-06 22:32:16 +00:00
feat(action v2): add JWT and JWE payload type options (#11196)
# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Livio Spring
co-authored by
Marco A.
conblem
Silvan
Marco A.
conblem
Silvan
parent
72c8f0192c
commit
791d0587aa
+1
-1
@@ -207,7 +207,7 @@ func (a *API) registerConnectServer(service server.ConnectServer) {
|
||||
connect_middleware.AuthorizationInterceptor(a.verifier, a.systemAuthZ, a.authConfig),
|
||||
connect_middleware.TranslationHandler(),
|
||||
connect_middleware.QuotaExhaustedInterceptor(a.accessInterceptor.AccessService(), system_pb.SystemService_ServiceDesc.ServiceName),
|
||||
connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm),
|
||||
connect_middleware.ExecutionHandler(a.targetEncryptionAlgorithm, a.queries.GetActiveSigningWebKey),
|
||||
connect_middleware.ValidationHandler(),
|
||||
connect_middleware.ServiceHandler(),
|
||||
connect_middleware.ActivityInterceptor(),
|
||||
|
||||
@@ -72,8 +72,9 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
// create target for target changes
|
||||
targetCreatedName := integration.TargetName()
|
||||
targetCreatedURL := "https://nonexistent"
|
||||
targetCreatedPayloadType := action.PayloadType_PAYLOAD_TYPE_JSON
|
||||
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false, targetCreatedPayloadType)
|
||||
|
||||
// request received by target
|
||||
wantRequest := &middleware.ContextInfoRequest{
|
||||
@@ -89,7 +90,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
// replace original request with different targetID
|
||||
urlRequest, closeRequest, calledRequest, _ := integration.TestServerCallProto(wantRequest, 0, http.StatusOK, changedRequest)
|
||||
|
||||
targetRequest := waitForTarget(ctx, t, instance, urlRequest, target_domain.TargetTypeCall, false)
|
||||
targetRequest := waitForTarget(ctx, t, instance, urlRequest, target_domain.TargetTypeCall, false, targetCreatedPayloadType)
|
||||
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionRequestFullMethod(fullMethod), []string{targetRequest.GetId()})
|
||||
|
||||
@@ -105,9 +106,10 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
PayloadType: targetCreatedPayloadType,
|
||||
},
|
||||
}
|
||||
|
||||
@@ -122,9 +124,10 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
PayloadType: targetCreatedPayloadType,
|
||||
},
|
||||
}
|
||||
// content for update
|
||||
@@ -138,9 +141,10 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
PayloadType: targetCreatedPayloadType,
|
||||
}
|
||||
|
||||
// response received by target
|
||||
@@ -157,7 +161,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
// after request with different targetID, return changed response
|
||||
targetResponseURL, closeResponse, calledResponse, _ := integration.TestServerCallProto(wantResponse, 0, http.StatusOK, changedResponse)
|
||||
|
||||
targetResponse := waitForTarget(ctx, t, instance, targetResponseURL, target_domain.TargetTypeCall, false)
|
||||
targetResponse := waitForTarget(ctx, t, instance, targetResponseURL, target_domain.TargetTypeCall, false, targetCreatedPayloadType)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionResponseFullMethod(fullMethod), []string{targetResponse.GetId()})
|
||||
return func() {
|
||||
closeRequest()
|
||||
@@ -195,7 +199,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
wantRequest := &middleware.ContextInfoRequest{FullMethod: fullMethod, InstanceID: instance.ID(), OrgID: orgID, ProjectID: projectID, UserID: userID, Request: middleware.Message{Message: request}}
|
||||
urlRequest, closeRequest, calledRequest, _ := integration.TestServerCallProto(wantRequest, 0, http.StatusInternalServerError, nil)
|
||||
|
||||
targetRequest := waitForTarget(ctx, t, instance, urlRequest, target_domain.TargetTypeCall, true)
|
||||
targetRequest := waitForTarget(ctx, t, instance, urlRequest, target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionRequestFullMethod(fullMethod), []string{targetRequest.GetId()})
|
||||
// GetTarget with used target
|
||||
request.Id = targetRequest.GetId()
|
||||
@@ -222,8 +226,9 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
// create target for target changes
|
||||
targetCreatedName := integration.TargetName()
|
||||
targetCreatedURL := "https://nonexistent"
|
||||
targetCreatedPayloadType := action.PayloadType_PAYLOAD_TYPE_JSON
|
||||
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false, targetCreatedPayloadType)
|
||||
|
||||
// GetTarget with used target
|
||||
request.Id = targetCreated.GetId()
|
||||
@@ -240,9 +245,10 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Endpoint: targetCreatedURL,
|
||||
SigningKey: targetCreated.GetSigningKey(),
|
||||
PayloadType: targetCreatedPayloadType,
|
||||
},
|
||||
}
|
||||
|
||||
@@ -259,7 +265,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
// after request with different targetID, return changed response
|
||||
targetResponseURL, closeResponse, calledResponse, _ := integration.TestServerCallProto(wantResponse, 0, http.StatusInternalServerError, nil)
|
||||
|
||||
targetResponse := waitForTarget(ctx, t, instance, targetResponseURL, target_domain.TargetTypeCall, true)
|
||||
targetResponse := waitForTarget(ctx, t, instance, targetResponseURL, target_domain.TargetTypeCall, true, targetCreatedPayloadType)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionResponseFullMethod(fullMethod), []string{targetResponse.GetId()})
|
||||
return func() {
|
||||
closeResponse()
|
||||
@@ -307,7 +313,7 @@ func TestServer_ExecutionTarget_Event(t *testing.T) {
|
||||
urlRequest, closeF, calledF, resetF := integration.TestServerCall(nil, 0, http.StatusOK, nil)
|
||||
defer closeF()
|
||||
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true)
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(isolatedIAMOwnerCTX, t, instance, conditionEvent(event), []string{targetResponse.GetId()})
|
||||
|
||||
tests := []struct {
|
||||
@@ -365,7 +371,7 @@ func TestServer_ExecutionTarget_Event_LongerThanTargetTimeout(t *testing.T) {
|
||||
urlRequest, closeF, calledF, resetF := integration.TestServerCall(nil, 5*time.Second, http.StatusOK, nil)
|
||||
defer closeF()
|
||||
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true)
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(isolatedIAMOwnerCTX, t, instance, conditionEvent(event), []string{targetResponse.GetId()})
|
||||
|
||||
tests := []struct {
|
||||
@@ -416,7 +422,7 @@ func TestServer_ExecutionTarget_Event_LongerThanTransactionTimeout(t *testing.T)
|
||||
urlRequest, closeF, calledF, resetF := integration.TestServerCall(nil, 1*time.Second, http.StatusOK, nil)
|
||||
defer closeF()
|
||||
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true)
|
||||
targetResponse := waitForTarget(isolatedIAMOwnerCTX, t, instance, urlRequest, target_domain.TargetTypeWebhook, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(isolatedIAMOwnerCTX, t, instance, conditionEvent(event), []string{targetResponse.GetId()})
|
||||
|
||||
tests := []struct {
|
||||
@@ -499,8 +505,8 @@ func waitForExecutionOnCondition(ctx context.Context, t *testing.T, instance *in
|
||||
}, retryDuration, tick, "timeout waiting for expected execution result")
|
||||
}
|
||||
|
||||
func waitForTarget(ctx context.Context, t *testing.T, instance *integration.Instance, endpoint string, ty target_domain.TargetType, interrupt bool) *action.CreateTargetResponse {
|
||||
resp := instance.CreateTarget(ctx, t, "", endpoint, ty, interrupt)
|
||||
func waitForTarget(ctx context.Context, t *testing.T, instance *integration.Instance, endpoint string, ty target_domain.TargetType, interrupt bool, payloadType action.PayloadType) *action.CreateTargetResponse {
|
||||
resp := instance.CreateTarget(ctx, t, "", endpoint, ty, interrupt, payloadType)
|
||||
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(ctx, time.Minute)
|
||||
require.EventuallyWithT(t, func(ttt *assert.CollectT) {
|
||||
@@ -779,7 +785,7 @@ func expectPreUserinfoExecution(ctx context.Context, t *testing.T, instance *int
|
||||
|
||||
targetURL, closeF, _, _ := integration.TestServerCall(expectedContextInfo, 0, http.StatusOK, response)
|
||||
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true)
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionFunction("preuserinfo"), []string{targetResp.GetId()})
|
||||
return userResp.GetUserId(), closeF
|
||||
}
|
||||
@@ -1087,7 +1093,7 @@ func expectPreAccessTokenExecution(ctx context.Context, t *testing.T, instance *
|
||||
|
||||
targetURL, closeF, _, _ := integration.TestServerCall(expectedContextInfo, 0, http.StatusOK, response)
|
||||
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true)
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionFunction("preaccesstoken"), []string{targetResp.GetId()})
|
||||
return userResp.GetUserId(), closeF
|
||||
}
|
||||
@@ -1252,7 +1258,7 @@ func expectPreSAMLResponseExecution(ctx context.Context, t *testing.T, instance
|
||||
|
||||
targetURL, closeF, _, _ := integration.TestServerCall(expectedContextInfo, 0, http.StatusOK, response)
|
||||
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true)
|
||||
targetResp := waitForTarget(ctx, t, instance, targetURL, target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
waitForExecutionOnCondition(ctx, t, instance, conditionFunction("presamlresponse"), []string{targetResp.GetId()})
|
||||
|
||||
return userResp.GetUserId(), closeF
|
||||
|
||||
@@ -18,7 +18,7 @@ import (
|
||||
func TestServer_SetExecution_Request(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -175,7 +175,7 @@ func assertSetExecutionResponse(t *testing.T, creationDate, setDate time.Time, e
|
||||
func TestServer_SetExecution_Response(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -319,7 +319,7 @@ func TestServer_SetExecution_Response(t *testing.T) {
|
||||
func TestServer_SetExecution_Event(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -482,7 +482,7 @@ func TestServer_SetExecution_Event(t *testing.T) {
|
||||
func TestServer_SetExecution_Function(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
|
||||
@@ -11,6 +11,7 @@ import (
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/types/known/durationpb"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
|
||||
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
@@ -54,7 +55,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -71,7 +72,8 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
TargetType: &action.Target_RestWebhook{
|
||||
RestWebhook: &action.RESTWebhook{},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -81,7 +83,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeAsync, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -98,7 +100,8 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
TargetType: &action.Target_RestAsync{
|
||||
RestAsync: &action.RESTAsync{},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -108,7 +111,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, true)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -127,7 +130,8 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -137,7 +141,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, false)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -156,7 +160,8 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -166,7 +171,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -185,7 +190,8 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -261,7 +267,7 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListTargetsRequest, response *action.ListTargetsResponse) {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_InTargetIdsFilter{
|
||||
InTargetIdsFilter: &action.InTargetIDsFilter{
|
||||
TargetIds: []string{resp.GetId()},
|
||||
@@ -291,7 +297,8 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -301,7 +308,7 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListTargetsRequest, response *action.ListTargetsResponse) {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_TargetNameFilter{
|
||||
TargetNameFilter: &action.TargetNameFilter{
|
||||
TargetName: name,
|
||||
@@ -331,7 +338,8 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -344,9 +352,9 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
name1 := integration.TargetName()
|
||||
name2 := integration.TargetName()
|
||||
name3 := integration.TargetName()
|
||||
resp1 := instance.CreateTarget(ctx, t, name1, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp2 := instance.CreateTarget(ctx, t, name2, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
resp3 := instance.CreateTarget(ctx, t, name3, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
resp1 := instance.CreateTarget(ctx, t, name1, "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
resp2 := instance.CreateTarget(ctx, t, name2, "https://example.com", target_domain.TargetTypeCall, true, action.PayloadType_PAYLOAD_TYPE_JWT)
|
||||
resp3 := instance.CreateTarget(ctx, t, name3, "https://example.com", target_domain.TargetTypeAsync, false, action.PayloadType_PAYLOAD_TYPE_JWE)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_InTargetIdsFilter{
|
||||
InTargetIdsFilter: &action.InTargetIDsFilter{
|
||||
TargetIds: []string{resp1.GetId(), resp2.GetId(), resp3.GetId()},
|
||||
@@ -386,7 +394,8 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
TargetType: &action.Target_RestAsync{
|
||||
RestAsync: &action.RESTAsync{},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JWE,
|
||||
},
|
||||
{
|
||||
Endpoint: "https://example.com",
|
||||
@@ -395,7 +404,8 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JWT,
|
||||
},
|
||||
{
|
||||
Endpoint: "https://example.com",
|
||||
@@ -404,7 +414,8 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
Timeout: durationpb.New(5 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
},
|
||||
},
|
||||
@@ -445,7 +456,7 @@ func assertPaginationResponse(t *assert.CollectT, expected *filter.PaginationRes
|
||||
func TestServer_ListExecutions(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
@@ -523,7 +534,7 @@ func TestServer_ListExecutions(t *testing.T) {
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListExecutionsRequest, response *action.ListExecutionsResponse) {
|
||||
target := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
target := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
// add target as Filter to the request
|
||||
request.Filters[0] = &action.ExecutionSearchFilter{
|
||||
Filter: &action.ExecutionSearchFilter_TargetFilter{
|
||||
@@ -781,3 +792,334 @@ func TestServer_ListExecutions(t *testing.T) {
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_ListPublicKeys(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
activeKey, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
changeDate, err := instance.Client.ActionV2.ActivatePublicKey(isolatedIAMOwnerCTX, &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: activeKey.GetKeyId(),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
expirationDate := timestamppb.New(time.Now().Add(24 * time.Hour))
|
||||
inactiveKey, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
ExpirationDate: expirationDate,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
anotherKey, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
req *action.ListPublicKeysRequest
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
want *action.ListPublicKeysResponse
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "missing permission",
|
||||
args: args{
|
||||
ctx: instance.WithAuthorizationToken(context.Background(), integration.UserTypeOrgOwner),
|
||||
req: &action.ListPublicKeysRequest{},
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "invalid target id",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: "notfound",
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list all",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
TotalResult: 3,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: anotherKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: anotherKey.GetCreationDate(),
|
||||
ChangeDate: anotherKey.GetCreationDate(),
|
||||
},
|
||||
{
|
||||
KeyId: inactiveKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: expirationDate,
|
||||
CreationDate: inactiveKey.GetCreationDate(),
|
||||
ChangeDate: inactiveKey.GetCreationDate(),
|
||||
},
|
||||
{
|
||||
KeyId: activeKey.GetKeyId(),
|
||||
Active: true,
|
||||
PublicKey: publicKeyBytes,
|
||||
Fingerprint: fingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: activeKey.GetCreationDate(),
|
||||
ChangeDate: changeDate.GetChangeDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list only active",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
Filters: []*action.PublicKeySearchFilter{
|
||||
{
|
||||
Filter: &action.PublicKeySearchFilter_ActiveFilter{
|
||||
ActiveFilter: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
TotalResult: 1,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: activeKey.GetKeyId(),
|
||||
Active: true,
|
||||
PublicKey: publicKeyBytes,
|
||||
Fingerprint: fingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: activeKey.GetCreationDate(),
|
||||
ChangeDate: changeDate.GetChangeDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list only inactive",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
Filters: []*action.PublicKeySearchFilter{
|
||||
{
|
||||
Filter: &action.PublicKeySearchFilter_ActiveFilter{
|
||||
ActiveFilter: false,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
TotalResult: 2,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: anotherKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: anotherKey.GetCreationDate(),
|
||||
ChangeDate: anotherKey.GetCreationDate(),
|
||||
},
|
||||
{
|
||||
KeyId: inactiveKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: expirationDate,
|
||||
CreationDate: inactiveKey.GetCreationDate(),
|
||||
ChangeDate: inactiveKey.GetCreationDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list with expiration date filter (boefore or equals)",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
Filters: []*action.PublicKeySearchFilter{
|
||||
{
|
||||
Filter: &action.PublicKeySearchFilter_ExpirationDateFilter{
|
||||
ExpirationDateFilter: &filter.TimestampFilter{
|
||||
Timestamp: expirationDate,
|
||||
Method: filter.TimestampFilterMethod_TIMESTAMP_FILTER_METHOD_BEFORE_OR_EQUALS,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
TotalResult: 1,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: inactiveKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: expirationDate,
|
||||
CreationDate: inactiveKey.GetCreationDate(),
|
||||
ChangeDate: inactiveKey.GetCreationDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list with expiration date filter (after incl. no expiration)",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
Filters: []*action.PublicKeySearchFilter{
|
||||
{
|
||||
Filter: &action.PublicKeySearchFilter_ExpirationDateFilter{
|
||||
ExpirationDateFilter: &filter.TimestampFilter{
|
||||
Timestamp: expirationDate,
|
||||
Method: filter.TimestampFilterMethod_TIMESTAMP_FILTER_METHOD_AFTER,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
AppliedLimit: 100,
|
||||
TotalResult: 2,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: anotherKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: anotherKey.GetCreationDate(),
|
||||
ChangeDate: anotherKey.GetCreationDate(),
|
||||
},
|
||||
{
|
||||
KeyId: activeKey.GetKeyId(),
|
||||
Active: true,
|
||||
PublicKey: publicKeyBytes,
|
||||
Fingerprint: fingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: activeKey.GetCreationDate(),
|
||||
ChangeDate: changeDate.GetChangeDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "list by key id",
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ListPublicKeysRequest{
|
||||
TargetId: targetID,
|
||||
Filters: []*action.PublicKeySearchFilter{
|
||||
{
|
||||
Filter: &action.PublicKeySearchFilter_KeyIdsFilter{
|
||||
KeyIdsFilter: &filter.InIDsFilter{
|
||||
Ids: []string{activeKey.GetKeyId(), anotherKey.GetKeyId()},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
SortingColumn: action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_CHANGE_DATE,
|
||||
Pagination: &filter.PaginationRequest{
|
||||
Limit: 1,
|
||||
Offset: 1,
|
||||
Asc: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
want: &action.ListPublicKeysResponse{
|
||||
Pagination: &filter.PaginationResponse{
|
||||
TotalResult: 2,
|
||||
AppliedLimit: 1,
|
||||
},
|
||||
PublicKeys: []*action.PublicKey{
|
||||
{
|
||||
KeyId: anotherKey.GetKeyId(),
|
||||
Active: false,
|
||||
PublicKey: rsaPublicKeyBytes,
|
||||
Fingerprint: rsaFingerprint,
|
||||
ExpirationDate: nil,
|
||||
CreationDate: anotherKey.GetCreationDate(),
|
||||
ChangeDate: anotherKey.GetCreationDate(),
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
retryDuration, tick := integration.WaitForAndTickWithMaxDuration(isolatedIAMOwnerCTX, 10*time.Second)
|
||||
require.EventuallyWithT(t, func(ttt *assert.CollectT) {
|
||||
got, err := instance.Client.ActionV2.ListPublicKeys(tt.args.ctx, tt.args.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(ttt, err, "Error: "+err.Error())
|
||||
return
|
||||
}
|
||||
assert.NoError(ttt, err)
|
||||
assertPublicKeys(ttt, tt.want, got)
|
||||
}, retryDuration, tick, "timeout waiting for expected public keys")
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func assertPublicKeys(ttt *assert.CollectT, want *action.ListPublicKeysResponse, got *action.ListPublicKeysResponse) {
|
||||
assert.EqualExportedValues(ttt, want.Pagination, got.Pagination)
|
||||
assert.Len(ttt, got.PublicKeys, len(want.PublicKeys))
|
||||
for i := range want.PublicKeys {
|
||||
assert.Equal(ttt, want.PublicKeys[i].GetKeyId(), got.PublicKeys[i].GetKeyId())
|
||||
assert.Equal(ttt, want.PublicKeys[i].GetActive(), got.PublicKeys[i].GetActive())
|
||||
assert.Equal(ttt, want.PublicKeys[i].GetFingerprint(), got.PublicKeys[i].GetFingerprint())
|
||||
assert.Equal(ttt, want.PublicKeys[i].GetPublicKey(), got.PublicKeys[i].GetPublicKey())
|
||||
assertDateWithinRangeClockSkew(ttt, got.PublicKeys[i].GetExpirationDate().AsTime(), want.PublicKeys[i].GetExpirationDate().AsTime(), want.PublicKeys[i].GetExpirationDate().AsTime())
|
||||
assertDateWithinRangeClockSkew(ttt, got.PublicKeys[i].GetCreationDate().AsTime(), want.PublicKeys[i].GetCreationDate().AsTime(), want.PublicKeys[i].GetCreationDate().AsTime())
|
||||
assertDateWithinRangeClockSkew(ttt, got.PublicKeys[i].GetChangeDate().AsTime(), want.PublicKeys[i].GetChangeDate().AsTime(), want.PublicKeys[i].GetChangeDate().AsTime())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,13 +4,25 @@ package action_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/sha256"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/muhlemmer/gu"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/types/known/durationpb"
|
||||
"google.golang.org/protobuf/types/known/timestamppb"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/crypto"
|
||||
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
||||
"github.com/zitadel/zitadel/internal/integration"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/action/v2"
|
||||
@@ -25,7 +37,7 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
signingKey bool
|
||||
}
|
||||
alreadyExistingTargetName := integration.TargetName()
|
||||
instance.CreateTarget(isolatedIAMOwnerCTX, t, alreadyExistingTargetName, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
instance.CreateTarget(isolatedIAMOwnerCTX, t, alreadyExistingTargetName, "https://example.com", target_domain.TargetTypeAsync, false, action.PayloadType_PAYLOAD_TYPE_JSON)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
@@ -115,7 +127,8 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
TargetType: &action.CreateTargetRequest_RestAsync{
|
||||
RestAsync: &action.RESTAsync{},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
want: want{
|
||||
id: true,
|
||||
@@ -134,7 +147,8 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
want: want{
|
||||
id: true,
|
||||
@@ -153,7 +167,8 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
want: want{
|
||||
id: true,
|
||||
@@ -172,7 +187,8 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
InterruptOnError: false,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
want: want{
|
||||
id: true,
|
||||
@@ -192,7 +208,8 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
},
|
||||
want: want{
|
||||
id: true,
|
||||
@@ -262,7 +279,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "missing permission",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -289,7 +306,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "no change, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -307,7 +324,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change name, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -325,7 +342,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "regenerate signingkey, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -343,7 +360,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change type, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -365,7 +382,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change url, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -383,7 +400,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change timeout, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -398,10 +415,28 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
signingKey: false,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "change timeout, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.UpdateTargetRequest{
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JWT,
|
||||
},
|
||||
},
|
||||
want: want{
|
||||
change: true,
|
||||
changeDate: true,
|
||||
signingKey: false,
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "change type async, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeAsync, false).GetId()
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeAsync, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -497,7 +532,7 @@ func TestServer_DeleteTarget(t *testing.T) {
|
||||
ctx: iamOwnerCtx,
|
||||
prepare: func(request *action.DeleteTargetRequest) (time.Time, time.Time) {
|
||||
creationDate := time.Now().UTC()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
return creationDate, time.Time{}
|
||||
},
|
||||
@@ -509,7 +544,7 @@ func TestServer_DeleteTarget(t *testing.T) {
|
||||
ctx: iamOwnerCtx,
|
||||
prepare: func(request *action.DeleteTargetRequest) (time.Time, time.Time) {
|
||||
creationDate := time.Now().UTC()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
request.Id = targetID
|
||||
instance.DeleteTarget(iamOwnerCtx, t, targetID)
|
||||
return creationDate, time.Now().UTC()
|
||||
@@ -546,3 +581,496 @@ func assertDeleteTargetResponse(t *testing.T, creationDate, deletionDate time.Ti
|
||||
assert.Nil(t, actualResp.DeletionDate)
|
||||
}
|
||||
}
|
||||
|
||||
var (
|
||||
publicKey = func() *ecdsa.PublicKey {
|
||||
privateKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
return &privateKey.PublicKey
|
||||
}()
|
||||
publicKeyBytes = func() []byte {
|
||||
pubBytes, _ := x509.MarshalPKIXPublicKey(publicKey)
|
||||
return pem.EncodeToMemory(&pem.Block{Type: "PUBLIC KEY", Bytes: pubBytes})
|
||||
}()
|
||||
fingerprint = func() string {
|
||||
block, _ := x509.MarshalPKIXPublicKey(publicKey)
|
||||
hash := sha256.Sum256(block)
|
||||
return fmt.Sprintf("SHA256:%s", base64.RawStdEncoding.EncodeToString(hash[:]))
|
||||
}()
|
||||
|
||||
rsaPublicKey = func() *rsa.PublicKey {
|
||||
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
|
||||
return &privateKey.PublicKey
|
||||
}()
|
||||
rsaPublicKeyBytes = func() []byte {
|
||||
data, _ := crypto.PublicKeyToBytes(rsaPublicKey)
|
||||
return data
|
||||
}()
|
||||
rsaFingerprint = func() string {
|
||||
block, _ := x509.MarshalPKIXPublicKey(rsaPublicKey)
|
||||
hash := sha256.Sum256(block)
|
||||
return fmt.Sprintf("SHA256:%s", base64.RawStdEncoding.EncodeToString(hash[:]))
|
||||
}()
|
||||
)
|
||||
|
||||
func TestServer_AddPublicKey(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
type want struct {
|
||||
id bool
|
||||
creationDate bool
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
req *action.AddPublicKeyRequest
|
||||
want want
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "missing permission",
|
||||
ctx: instance.WithAuthorizationToken(context.Background(), integration.UserTypeOrgOwner),
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty target id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "",
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty public key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
PublicKey: nil,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "invalid public key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
PublicKey: []byte("invalid"),
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "expiration date in the past",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(-1 * time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "target not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.AddPublicKeyRequest{
|
||||
TargetId: "notexisting",
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "add public key, ok",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.AddPublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
return &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
}
|
||||
}(),
|
||||
want: want{
|
||||
id: true,
|
||||
creationDate: true,
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
start := time.Now()
|
||||
got, err := instance.Client.ActionV2.AddPublicKey(tt.ctx, tt.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
assert.NoError(t, err)
|
||||
assert.NotEmpty(t, got.GetKeyId())
|
||||
assertDateWithinRangeClockSkew(t, got.GetCreationDate().AsTime(), start, time.Now())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_ActivatePublicKey(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
req *action.ActivatePublicKeyRequest
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "missing permission",
|
||||
ctx: instance.WithAuthorizationToken(context.Background(), integration.UserTypeOrgOwner),
|
||||
req: &action.ActivatePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty target id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ActivatePublicKeyRequest{
|
||||
TargetId: "",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty key id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ActivatePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "target not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.ActivatePublicKeyRequest{
|
||||
TargetId: "notexisting",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "key not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.ActivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
return &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: "notexisting",
|
||||
}
|
||||
}(),
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "already expired key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.ActivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().Add(1 * time.Second)),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
time.Sleep(2 * time.Second)
|
||||
return &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "already activated key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.ActivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
_, err = instance.Client.ActionV2.ActivatePublicKey(isolatedIAMOwnerCTX, &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "activate key, ok",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.ActivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
start := time.Now()
|
||||
got, err := instance.Client.ActionV2.ActivatePublicKey(tt.ctx, tt.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
assert.NoError(t, err)
|
||||
assertDateWithinRangeClockSkew(t, got.GetChangeDate().AsTime(), start, time.Now())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_DeactivatePublicKey(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
req *action.DeactivatePublicKeyRequest
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "missing permission",
|
||||
ctx: instance.WithAuthorizationToken(context.Background(), integration.UserTypeOrgOwner),
|
||||
req: &action.DeactivatePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty target id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.DeactivatePublicKeyRequest{
|
||||
TargetId: "",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty key id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.DeactivatePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "target not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.DeactivatePublicKeyRequest{
|
||||
TargetId: "notexisting",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "key not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.DeactivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
return &action.DeactivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: "notexisting",
|
||||
}
|
||||
}(),
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "already deactivated key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.DeactivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.DeactivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "deactivate key, ok",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.DeactivatePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
ExpirationDate: timestamppb.New(time.Now().UTC().Add(time.Hour)),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
_, err = instance.Client.ActionV2.ActivatePublicKey(isolatedIAMOwnerCTX, &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.DeactivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
start := time.Now()
|
||||
got, err := instance.Client.ActionV2.DeactivatePublicKey(tt.ctx, tt.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
assert.NoError(t, err)
|
||||
assertDateWithinRangeClockSkew(t, got.GetChangeDate().AsTime(), start, time.Now())
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestServer_RemovePublicKey(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
req *action.RemovePublicKeyRequest
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
name: "missing permission",
|
||||
ctx: instance.WithAuthorizationToken(context.Background(), integration.UserTypeOrgOwner),
|
||||
req: &action.RemovePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty target id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.RemovePublicKeyRequest{
|
||||
TargetId: "",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "empty key id",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.RemovePublicKeyRequest{
|
||||
TargetId: "targetID",
|
||||
KeyId: "",
|
||||
},
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "target not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: &action.RemovePublicKeyRequest{
|
||||
TargetId: "notexisting",
|
||||
KeyId: "keyID",
|
||||
},
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "key not existing",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.RemovePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
return &action.RemovePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: "notexisting",
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
{
|
||||
name: "remove activated key",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.RemovePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
_, err = instance.Client.ActionV2.ActivatePublicKey(isolatedIAMOwnerCTX, &action.ActivatePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.RemovePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: true,
|
||||
},
|
||||
{
|
||||
name: "remove key, ok",
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
req: func() *action.RemovePublicKeyRequest {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false, action.PayloadType_PAYLOAD_TYPE_JSON).GetId()
|
||||
resp, err := instance.Client.ActionV2.AddPublicKey(isolatedIAMOwnerCTX, &action.AddPublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
PublicKey: publicKeyBytes,
|
||||
})
|
||||
require.NoError(t, err)
|
||||
return &action.RemovePublicKeyRequest{
|
||||
TargetId: targetID,
|
||||
KeyId: resp.GetKeyId(),
|
||||
}
|
||||
}(),
|
||||
wantErr: false,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
_, err := instance.Client.ActionV2.RemovePublicKey(tt.ctx, tt.req)
|
||||
if tt.wantErr {
|
||||
assert.Error(t, err)
|
||||
return
|
||||
}
|
||||
assert.NoError(t, err)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func assertDateWithinRangeClockSkew(t assert.TestingT, actual time.Time, start, end time.Time) {
|
||||
assert.WithinRange(t, actual, start.Add(-time.Second), end.Add(time.Second))
|
||||
}
|
||||
|
||||
@@ -15,6 +15,7 @@ import (
|
||||
"github.com/zitadel/zitadel/internal/query"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
"github.com/zitadel/zitadel/pkg/grpc/action/v2"
|
||||
filter_pb "github.com/zitadel/zitadel/pkg/grpc/filter/v2"
|
||||
)
|
||||
|
||||
const (
|
||||
@@ -58,6 +59,21 @@ func (s *Server) ListTargets(ctx context.Context, req *connect.Request[action.Li
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) ListPublicKeys(ctx context.Context, req *connect.Request[action.ListPublicKeysRequest]) (*connect.Response[action.ListPublicKeysResponse], error) {
|
||||
queries, err := s.listPublicKeysRequestToQuery(req.Msg)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
res, err := s.query.SearchAuthNKeys(ctx, queries, query.JoinFilterTarget, nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return connect.NewResponse(&action.ListPublicKeysResponse{
|
||||
Pagination: filter.QueryToPaginationPb(queries.SearchRequest, res.SearchResponse),
|
||||
PublicKeys: publicKeysToPb(res.AuthNKeys),
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) ListExecutions(ctx context.Context, req *connect.Request[action.ListExecutionsRequest]) (*connect.Response[action.ListExecutionsResponse], error) {
|
||||
queries, err := s.ListExecutionsRequestToModel(req.Msg)
|
||||
if err != nil {
|
||||
@@ -83,11 +99,12 @@ func targetsToPb(targets []*query.Target) []*action.Target {
|
||||
|
||||
func targetToPb(t *query.Target) *action.Target {
|
||||
target := &action.Target{
|
||||
Id: t.ID,
|
||||
Name: t.Name,
|
||||
Timeout: durationpb.New(t.Timeout),
|
||||
Endpoint: t.Endpoint,
|
||||
SigningKey: t.SigningKey,
|
||||
Id: t.ID,
|
||||
Name: t.Name,
|
||||
Timeout: durationpb.New(t.Timeout),
|
||||
Endpoint: t.Endpoint,
|
||||
SigningKey: t.SigningKey,
|
||||
PayloadType: payloadTypeToPb(t.PayloadType),
|
||||
}
|
||||
switch t.TargetType {
|
||||
case target_domain.TargetTypeWebhook:
|
||||
@@ -109,6 +126,21 @@ func targetToPb(t *query.Target) *action.Target {
|
||||
return target
|
||||
}
|
||||
|
||||
func payloadTypeToPb(payloadType target_domain.PayloadType) action.PayloadType {
|
||||
switch payloadType {
|
||||
case target_domain.PayloadTypeUnspecified:
|
||||
return action.PayloadType_PAYLOAD_TYPE_UNSPECIFIED
|
||||
case target_domain.PayloadTypeJSON:
|
||||
return action.PayloadType_PAYLOAD_TYPE_JSON
|
||||
case target_domain.PayloadTypeJWT:
|
||||
return action.PayloadType_PAYLOAD_TYPE_JWT
|
||||
case target_domain.PayloadTypeJWE:
|
||||
return action.PayloadType_PAYLOAD_TYPE_JWE
|
||||
default:
|
||||
return action.PayloadType_PAYLOAD_TYPE_UNSPECIFIED
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Server) ListTargetsRequestToModel(req *action.ListTargetsRequest) (*query.TargetSearchQueries, error) {
|
||||
offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
|
||||
if err != nil {
|
||||
@@ -403,3 +435,98 @@ func includeEventToCondition(id string) *action.Condition {
|
||||
func includeFunctionToCondition(id string) *action.Condition {
|
||||
return &action.Condition{ConditionType: &action.Condition_Function{Function: &action.FunctionExecution{Name: strings.TrimPrefix(id, "/")}}}
|
||||
}
|
||||
|
||||
func (s *Server) listPublicKeysRequestToQuery(req *action.ListPublicKeysRequest) (*query.AuthNKeySearchQueries, error) {
|
||||
offset, limit, asc, err := filter.PaginationPbToQuery(s.systemDefaults, req.Pagination)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
queries, err := publicKeyFiltersToQuery(req.Filters, req.GetTargetId())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &query.AuthNKeySearchQueries{
|
||||
SearchRequest: query.SearchRequest{
|
||||
Offset: offset,
|
||||
Limit: limit,
|
||||
Asc: asc,
|
||||
SortingColumn: publicKeyFieldNameToSortingColumn(req.GetSortingColumn()),
|
||||
},
|
||||
Queries: queries,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func publicKeyFiltersToQuery(filters []*action.PublicKeySearchFilter, targetID string) (_ []query.SearchQuery, err error) {
|
||||
f := make([]query.SearchQuery, len(filters)+1)
|
||||
for i, filter := range filters {
|
||||
f[i], err = publicKeyFilterToQuery(filter)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
f[len(filters)], err = query.NewAuthNKeyIdentifyerQuery(targetID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return f, nil
|
||||
}
|
||||
|
||||
func publicKeyFilterToQuery(filter *action.PublicKeySearchFilter) (query.SearchQuery, error) {
|
||||
switch q := filter.Filter.(type) {
|
||||
case *action.PublicKeySearchFilter_KeyIdsFilter:
|
||||
return publicKeyKeyIDsFilterToQuery(q.KeyIdsFilter)
|
||||
case *action.PublicKeySearchFilter_ActiveFilter:
|
||||
return publicKeyActiveFilterToQuery(q.ActiveFilter)
|
||||
case *action.PublicKeySearchFilter_ExpirationDateFilter:
|
||||
return publicKeyExpirationFilterToQuery(q.ExpirationDateFilter)
|
||||
default:
|
||||
return nil, zerrors.ThrowInvalidArgument(nil, "GRPC-vR9nC", "List.Query.Invalid")
|
||||
}
|
||||
}
|
||||
|
||||
func publicKeyKeyIDsFilterToQuery(idsFilter *filter_pb.InIDsFilter) (query.SearchQuery, error) {
|
||||
return query.NewAuthNKeyInIDsSearchQuery(idsFilter.GetIds())
|
||||
}
|
||||
|
||||
func publicKeyActiveFilterToQuery(activeFilter bool) (query.SearchQuery, error) {
|
||||
return query.NewAuthNKeyEnabledSearchQuery(activeFilter)
|
||||
}
|
||||
|
||||
func publicKeyExpirationFilterToQuery(f *filter_pb.TimestampFilter) (query.SearchQuery, error) {
|
||||
return query.NewAuthNKeyExpirationDateQuery(f.GetTimestamp().AsTime(), filter.TimestampMethodPbToQuery(f.Method))
|
||||
}
|
||||
|
||||
func publicKeyFieldNameToSortingColumn(column action.PublicKeyFieldName) query.Column {
|
||||
switch column {
|
||||
case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_UNSPECIFIED:
|
||||
return query.AuthNKeyColumnCreationDate
|
||||
case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_CREATION_DATE:
|
||||
return query.AuthNKeyColumnCreationDate
|
||||
case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_CHANGE_DATE:
|
||||
return query.AuthNKeyColumnChangeDate
|
||||
case action.PublicKeyFieldName_PUBLIC_KEY_FIELD_NAME_EXPIRATION_DATE:
|
||||
return query.AuthNKeyColumnExpiration
|
||||
default:
|
||||
return query.AuthNKeyColumnCreationDate
|
||||
}
|
||||
}
|
||||
|
||||
func publicKeysToPb(keys []*query.AuthNKey) []*action.PublicKey {
|
||||
pks := make([]*action.PublicKey, len(keys))
|
||||
for i, key := range keys {
|
||||
var expiration *timestamppb.Timestamp
|
||||
if !key.Expiration.IsZero() {
|
||||
expiration = timestamppb.New(key.Expiration)
|
||||
}
|
||||
pks[i] = &action.PublicKey{
|
||||
KeyId: key.ID,
|
||||
Active: key.Enabled,
|
||||
PublicKey: key.PublicKey,
|
||||
Fingerprint: key.Fingerprint,
|
||||
ExpirationDate: expiration,
|
||||
CreationDate: timestamppb.New(key.CreationDate),
|
||||
ChangeDate: timestamppb.New(key.ChangeDate),
|
||||
}
|
||||
}
|
||||
return pks
|
||||
}
|
||||
|
||||
@@ -2,6 +2,8 @@ package action
|
||||
|
||||
import (
|
||||
"context"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"connectrpc.com/connect"
|
||||
"github.com/muhlemmer/gu"
|
||||
@@ -64,6 +66,60 @@ func (s *Server) DeleteTarget(ctx context.Context, req *connect.Request[action.D
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) AddPublicKey(ctx context.Context, req *connect.Request[action.AddPublicKeyRequest]) (*connect.Response[action.AddPublicKeyResponse], error) {
|
||||
instanceID := authz.GetInstance(ctx).InstanceID()
|
||||
var expirationDate time.Time
|
||||
if req.Msg.GetExpirationDate() != nil {
|
||||
expirationDate = req.Msg.GetExpirationDate().AsTime()
|
||||
}
|
||||
key := &command.TargetPublicKey{
|
||||
TargetID: strings.TrimSpace(req.Msg.GetTargetId()),
|
||||
PublicKey: req.Msg.GetPublicKey(),
|
||||
Expiration: expirationDate,
|
||||
}
|
||||
creationDate, err := s.command.AddTargetPublicKey(ctx, key, instanceID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return connect.NewResponse(&action.AddPublicKeyResponse{
|
||||
KeyId: key.KeyID,
|
||||
CreationDate: timestamppb.New(creationDate),
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) ActivatePublicKey(ctx context.Context, req *connect.Request[action.ActivatePublicKeyRequest]) (*connect.Response[action.ActivatePublicKeyResponse], error) {
|
||||
instanceID := authz.GetInstance(ctx).InstanceID()
|
||||
changeDate, err := s.command.ActivateTargetPublicKey(ctx, strings.TrimSpace(req.Msg.GetTargetId()), strings.TrimSpace(req.Msg.GetKeyId()), instanceID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return connect.NewResponse(&action.ActivatePublicKeyResponse{
|
||||
ChangeDate: timestamppb.New(changeDate),
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) DeactivatePublicKey(ctx context.Context, req *connect.Request[action.DeactivatePublicKeyRequest]) (*connect.Response[action.DeactivatePublicKeyResponse], error) {
|
||||
instanceID := authz.GetInstance(ctx).InstanceID()
|
||||
changeDate, err := s.command.DeactivateTargetPublicKey(ctx, strings.TrimSpace(req.Msg.GetTargetId()), strings.TrimSpace(req.Msg.GetKeyId()), instanceID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return connect.NewResponse(&action.DeactivatePublicKeyResponse{
|
||||
ChangeDate: timestamppb.New(changeDate),
|
||||
}), nil
|
||||
}
|
||||
|
||||
func (s *Server) RemovePublicKey(ctx context.Context, req *connect.Request[action.RemovePublicKeyRequest]) (*connect.Response[action.RemovePublicKeyResponse], error) {
|
||||
instanceID := authz.GetInstance(ctx).InstanceID()
|
||||
deletionDate, err := s.command.RemoveTargetPublicKey(ctx, strings.TrimSpace(req.Msg.GetTargetId()), strings.TrimSpace(req.Msg.GetKeyId()), instanceID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return connect.NewResponse(&action.RemovePublicKeyResponse{
|
||||
DeletionDate: timestamppb.New(deletionDate),
|
||||
}), nil
|
||||
}
|
||||
|
||||
func createTargetToCommand(req *action.CreateTargetRequest) *command.AddTarget {
|
||||
var (
|
||||
targetType target_domain.TargetType
|
||||
@@ -85,6 +141,22 @@ func createTargetToCommand(req *action.CreateTargetRequest) *command.AddTarget {
|
||||
Endpoint: req.GetEndpoint(),
|
||||
Timeout: req.GetTimeout().AsDuration(),
|
||||
InterruptOnError: interruptOnError,
|
||||
PayloadType: payloadTypeToDomain(req.GetPayloadType()),
|
||||
}
|
||||
}
|
||||
|
||||
func payloadTypeToDomain(payloadType action.PayloadType) target_domain.PayloadType {
|
||||
switch payloadType {
|
||||
case action.PayloadType_PAYLOAD_TYPE_UNSPECIFIED:
|
||||
return target_domain.PayloadTypeUnspecified
|
||||
case action.PayloadType_PAYLOAD_TYPE_JSON:
|
||||
return target_domain.PayloadTypeJSON
|
||||
case action.PayloadType_PAYLOAD_TYPE_JWT:
|
||||
return target_domain.PayloadTypeJWT
|
||||
case action.PayloadType_PAYLOAD_TYPE_JWE:
|
||||
return target_domain.PayloadTypeJWE
|
||||
default:
|
||||
return target_domain.PayloadTypeUnspecified
|
||||
}
|
||||
}
|
||||
|
||||
@@ -102,6 +174,7 @@ func updateTargetToCommand(req *action.UpdateTargetRequest) *command.ChangeTarge
|
||||
Name: req.Name,
|
||||
Endpoint: req.Endpoint,
|
||||
ExpirationSigningKey: expirationSigningKey,
|
||||
PayloadType: payloadTypeToDomain(req.GetPayloadType()),
|
||||
}
|
||||
if req.TargetType != nil {
|
||||
switch t := req.GetTargetType().(type) {
|
||||
|
||||
@@ -30,6 +30,7 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
Endpoint: "",
|
||||
Timeout: 0,
|
||||
InterruptOnError: false,
|
||||
PayloadType: target_domain.PayloadTypeUnspecified,
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -40,7 +41,8 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
TargetType: &action.CreateTargetRequest_RestWebhook{
|
||||
RestWebhook: &action.RESTWebhook{},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JSON,
|
||||
}},
|
||||
want: &command.AddTarget{
|
||||
Name: "target 1",
|
||||
@@ -48,6 +50,7 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
Endpoint: "https://example.com/hooks/1",
|
||||
Timeout: 10 * time.Second,
|
||||
InterruptOnError: false,
|
||||
PayloadType: target_domain.PayloadTypeJSON,
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -58,7 +61,8 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
TargetType: &action.CreateTargetRequest_RestAsync{
|
||||
RestAsync: &action.RESTAsync{},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JWT,
|
||||
}},
|
||||
want: &command.AddTarget{
|
||||
Name: "target 1",
|
||||
@@ -66,6 +70,7 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
Endpoint: "https://example.com/hooks/1",
|
||||
Timeout: 10 * time.Second,
|
||||
InterruptOnError: false,
|
||||
PayloadType: target_domain.PayloadTypeJWT,
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -78,7 +83,8 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
InterruptOnError: true,
|
||||
},
|
||||
},
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
Timeout: durationpb.New(10 * time.Second),
|
||||
PayloadType: action.PayloadType_PAYLOAD_TYPE_JWE,
|
||||
}},
|
||||
want: &command.AddTarget{
|
||||
Name: "target 1",
|
||||
@@ -86,6 +92,7 @@ func Test_createTargetToCommand(t *testing.T) {
|
||||
Endpoint: "https://example.com/hooks/1",
|
||||
Timeout: 10 * time.Second,
|
||||
InterruptOnError: true,
|
||||
PayloadType: target_domain.PayloadTypeJWE,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
@@ -73,7 +73,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
targetCreatedName := integration.TargetName()
|
||||
targetCreatedURL := "https://nonexistent"
|
||||
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
targetCreated := instance.CreateTargetWithoutPayloadType(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
|
||||
// request received by target
|
||||
wantRequest := &middleware.ContextInfoRequest{
|
||||
@@ -223,7 +223,7 @@ func TestServer_ExecutionTarget(t *testing.T) {
|
||||
targetCreatedName := integration.TargetName()
|
||||
targetCreatedURL := "https://nonexistent"
|
||||
|
||||
targetCreated := instance.CreateTarget(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
targetCreated := instance.CreateTargetWithoutPayloadType(ctx, t, targetCreatedName, targetCreatedURL, target_domain.TargetTypeCall, false)
|
||||
|
||||
// GetTarget with used target
|
||||
request.Id = targetCreated.GetId()
|
||||
|
||||
@@ -18,7 +18,7 @@ import (
|
||||
func TestServer_SetExecution_Request(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -175,7 +175,7 @@ func assertSetExecutionResponse(t *testing.T, creationDate, setDate time.Time, e
|
||||
func TestServer_SetExecution_Response(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -319,7 +319,7 @@ func TestServer_SetExecution_Response(t *testing.T) {
|
||||
func TestServer_SetExecution_Event(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
@@ -482,7 +482,7 @@ func TestServer_SetExecution_Event(t *testing.T) {
|
||||
func TestServer_SetExecution_Function(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://notexisting", target_domain.TargetTypeWebhook, false)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
|
||||
@@ -54,7 +54,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -81,7 +81,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -108,7 +108,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, true)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, true)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -137,7 +137,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, false)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, false)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -166,7 +166,7 @@ func TestServer_GetTarget(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.GetTargetRequest, response *action.GetTargetResponse) error {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
request.Id = resp.GetId()
|
||||
response.Target.Id = resp.GetId()
|
||||
response.Target.Name = name
|
||||
@@ -261,7 +261,7 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListTargetsRequest, response *action.ListTargetsResponse) {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_InTargetIdsFilter{
|
||||
InTargetIdsFilter: &action.InTargetIDsFilter{
|
||||
TargetIds: []string{resp.GetId()},
|
||||
@@ -301,7 +301,7 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListTargetsRequest, response *action.ListTargetsResponse) {
|
||||
name := integration.TargetName()
|
||||
resp := instance.CreateTarget(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp := instance.CreateTargetWithoutPayloadType(ctx, t, name, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_TargetNameFilter{
|
||||
TargetNameFilter: &action.TargetNameFilter{
|
||||
TargetName: name,
|
||||
@@ -344,9 +344,9 @@ func TestServer_ListTargets(t *testing.T) {
|
||||
name1 := integration.TargetName()
|
||||
name2 := integration.TargetName()
|
||||
name3 := integration.TargetName()
|
||||
resp1 := instance.CreateTarget(ctx, t, name1, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp2 := instance.CreateTarget(ctx, t, name2, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
resp3 := instance.CreateTarget(ctx, t, name3, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
resp1 := instance.CreateTargetWithoutPayloadType(ctx, t, name1, "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
resp2 := instance.CreateTargetWithoutPayloadType(ctx, t, name2, "https://example.com", target_domain.TargetTypeCall, true)
|
||||
resp3 := instance.CreateTargetWithoutPayloadType(ctx, t, name3, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
request.Filters[0].Filter = &action.TargetSearchFilter_InTargetIdsFilter{
|
||||
InTargetIdsFilter: &action.InTargetIDsFilter{
|
||||
TargetIds: []string{resp1.GetId(), resp2.GetId(), resp3.GetId()},
|
||||
@@ -445,7 +445,7 @@ func assertPaginationResponse(t *assert.CollectT, expected *filter.PaginationRes
|
||||
func TestServer_ListExecutions(t *testing.T) {
|
||||
instance := integration.NewInstance(CTX)
|
||||
isolatedIAMOwnerCTX := instance.WithAuthorizationToken(CTX, integration.UserTypeIAMOwner)
|
||||
targetResp := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
targetResp := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
@@ -523,7 +523,7 @@ func TestServer_ListExecutions(t *testing.T) {
|
||||
args: args{
|
||||
ctx: isolatedIAMOwnerCTX,
|
||||
dep: func(ctx context.Context, request *action.ListExecutionsRequest, response *action.ListExecutionsResponse) {
|
||||
target := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
target := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false)
|
||||
// add target as Filter to the request
|
||||
request.Filters[0] = &action.ExecutionSearchFilter{
|
||||
Filter: &action.ExecutionSearchFilter_TargetFilter{
|
||||
|
||||
@@ -25,7 +25,7 @@ func TestServer_CreateTarget(t *testing.T) {
|
||||
signingKey bool
|
||||
}
|
||||
alreadyExistingTargetName := integration.TargetName()
|
||||
instance.CreateTarget(isolatedIAMOwnerCTX, t, alreadyExistingTargetName, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, alreadyExistingTargetName, "https://example.com", target_domain.TargetTypeAsync, false)
|
||||
tests := []struct {
|
||||
name string
|
||||
ctx context.Context
|
||||
@@ -262,7 +262,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "missing permission",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -289,7 +289,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "no change, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -307,7 +307,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change name, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -325,7 +325,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "regenerate signingkey, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -343,7 +343,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change type, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -365,7 +365,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change url, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -383,7 +383,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change timeout, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -401,7 +401,7 @@ func TestServer_UpdateTarget(t *testing.T) {
|
||||
{
|
||||
name: "change type async, ok",
|
||||
prepare: func(request *action.UpdateTargetRequest) {
|
||||
targetID := instance.CreateTarget(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeAsync, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(isolatedIAMOwnerCTX, t, "", "https://example.com", target_domain.TargetTypeAsync, false).GetId()
|
||||
request.Id = targetID
|
||||
},
|
||||
args: args{
|
||||
@@ -497,7 +497,7 @@ func TestServer_DeleteTarget(t *testing.T) {
|
||||
ctx: iamOwnerCtx,
|
||||
prepare: func(request *action.DeleteTargetRequest) (time.Time, time.Time) {
|
||||
creationDate := time.Now().UTC()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
return creationDate, time.Time{}
|
||||
},
|
||||
@@ -509,7 +509,7 @@ func TestServer_DeleteTarget(t *testing.T) {
|
||||
ctx: iamOwnerCtx,
|
||||
prepare: func(request *action.DeleteTargetRequest) (time.Time, time.Time) {
|
||||
creationDate := time.Now().UTC()
|
||||
targetID := instance.CreateTarget(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
targetID := instance.CreateTargetWithoutPayloadType(iamOwnerCtx, t, "", "https://example.com", target_domain.TargetTypeWebhook, false).GetId()
|
||||
request.Id = targetID
|
||||
instance.DeleteTarget(iamOwnerCtx, t, targetID)
|
||||
return creationDate, time.Now().UTC()
|
||||
|
||||
@@ -26,12 +26,12 @@ var headersToForward = map[string]bool{
|
||||
strings.ToLower(http_utils.Origin): true,
|
||||
}
|
||||
|
||||
func ExecutionHandler(alg crypto.EncryptionAlgorithm) connect.UnaryInterceptorFunc {
|
||||
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) connect.UnaryInterceptorFunc {
|
||||
return func(handler connect.UnaryFunc) connect.UnaryFunc {
|
||||
return func(ctx context.Context, req connect.AnyRequest) (_ connect.AnyResponse, err error) {
|
||||
|
||||
requestTargets := execution.QueryExecutionTargetsForRequest(ctx, req.Spec().Procedure)
|
||||
handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg)
|
||||
handledReq, err := executeTargetsForRequest(ctx, requestTargets, req.Spec().Procedure, req, alg, activeSigningKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -42,12 +42,12 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm) connect.UnaryInterceptorFu
|
||||
}
|
||||
|
||||
responseTargets := execution.QueryExecutionTargetsForResponse(ctx, req.Spec().Procedure)
|
||||
return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg)
|
||||
return executeTargetsForResponse(ctx, responseTargets, req.Spec().Procedure, handledReq, response, alg, activeSigningKey)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm) (_ connect.AnyRequest, err error) {
|
||||
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyRequest, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -67,14 +67,14 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
|
||||
Headers: SetRequestHeaders(req.Header()),
|
||||
}
|
||||
|
||||
_, err = execution.CallTargets(ctx, targets, info, alg)
|
||||
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return req, nil
|
||||
}
|
||||
|
||||
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm) (_ connect.AnyResponse, err error) {
|
||||
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req connect.AnyRequest, resp connect.AnyResponse, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ connect.AnyResponse, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -95,7 +95,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
|
||||
Headers: SetRequestHeaders(req.Header()),
|
||||
}
|
||||
|
||||
_, err = execution.CallTargets(ctx, targets, info, alg)
|
||||
_, err = execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -1,25 +1,43 @@
|
||||
package connect_middleware
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"reflect"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"connectrpc.com/connect"
|
||||
"github.com/go-jose/go-jose/v4"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/encoding/protojson"
|
||||
"google.golang.org/protobuf/proto"
|
||||
"google.golang.org/protobuf/types/known/structpb"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/crypto"
|
||||
"github.com/zitadel/zitadel/internal/execution"
|
||||
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
||||
)
|
||||
|
||||
var (
|
||||
privateKey = func() *rsa.PrivateKey {
|
||||
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
|
||||
return privateKey
|
||||
}()
|
||||
encryptionKey = func() []byte {
|
||||
data, _ := crypto.PublicKeyToBytes(&privateKey.PublicKey)
|
||||
return data
|
||||
}()
|
||||
encryptionKeyID = "encryption-key-id"
|
||||
signingAlgorithm = jose.RS256
|
||||
)
|
||||
|
||||
func newMockContentRequest(content string) *connect.Request[structpb.Struct] {
|
||||
return connect.NewRequest(&structpb.Struct{
|
||||
Fields: map[string]*structpb.Value{
|
||||
@@ -57,18 +75,20 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
|
||||
|
||||
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
type target struct {
|
||||
reqBody execution.ContextInfo
|
||||
sleep time.Duration
|
||||
statusCode int
|
||||
respBody connect.AnyResponse
|
||||
reqBody execution.ContextInfo
|
||||
sleep time.Duration
|
||||
statusCode int
|
||||
respBody connect.AnyResponse
|
||||
requestVerification func(*testing.T) func([]byte, []byte) bool
|
||||
}
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
|
||||
executionTargets []target_domain.Target
|
||||
targets []target
|
||||
fullMethod string
|
||||
req connect.AnyRequest
|
||||
executionTargets []target_domain.Target
|
||||
targets []target
|
||||
fullMethod string
|
||||
req connect.AnyRequest
|
||||
getActiveSigningWebKey execution.GetActiveSigningWebKey
|
||||
}
|
||||
type res struct {
|
||||
want interface{}
|
||||
@@ -139,10 +159,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -168,10 +189,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -196,10 +218,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -223,7 +246,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{reqBody: newMockContextInfoRequest("/service/method", "wrong")},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "wrong"),
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
},
|
||||
@@ -247,10 +273,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -274,10 +301,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -301,10 +329,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -329,9 +358,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusInternalServerError,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusInternalServerError,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -356,10 +386,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -384,10 +415,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -427,22 +459,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentResponse("content2"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentResponse("content2"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentResponse("content3"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentResponse("content3"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -481,22 +516,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentResponse("content2"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentResponse("content2"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentResponse("content3"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentResponse("content3"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -505,6 +543,70 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
wantErr: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
"payload JWT, ok",
|
||||
args{
|
||||
ctx: context.Background(),
|
||||
fullMethod: "/service/method",
|
||||
executionTargets: []target_domain.Target{
|
||||
{
|
||||
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
||||
TargetID: "target",
|
||||
TargetType: target_domain.TargetTypeWebhook,
|
||||
Timeout: time.Minute,
|
||||
InterruptOnError: true,
|
||||
PayloadType: target_domain.PayloadTypeJWT,
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJWTPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
||||
},
|
||||
res{
|
||||
want: newMockContentRequest("content"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"payload JWE, ok",
|
||||
args{
|
||||
ctx: context.Background(),
|
||||
fullMethod: "/service/method",
|
||||
executionTargets: []target_domain.Target{
|
||||
{
|
||||
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
||||
TargetID: "target",
|
||||
TargetType: target_domain.TargetTypeWebhook,
|
||||
Timeout: time.Minute,
|
||||
InterruptOnError: true,
|
||||
PayloadType: target_domain.PayloadTypeJWE,
|
||||
EncryptionKey: encryptionKey,
|
||||
EncryptionKeyID: encryptionKeyID,
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentResponse("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJWEPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
||||
},
|
||||
res{
|
||||
want: newMockContentRequest("content"),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
@@ -515,6 +617,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
target.sleep,
|
||||
target.statusCode,
|
||||
target.respBody,
|
||||
target.requestVerification(t),
|
||||
)
|
||||
|
||||
tt.args.executionTargets[i].Endpoint = url
|
||||
@@ -527,6 +630,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
tt.args.fullMethod,
|
||||
tt.args.req,
|
||||
nil,
|
||||
tt.args.getActiveSigningWebKey,
|
||||
)
|
||||
|
||||
if tt.res.wantErr {
|
||||
@@ -548,6 +652,7 @@ func testServerCall(
|
||||
sleep time.Duration,
|
||||
statusCode int,
|
||||
respBody connect.AnyResponse,
|
||||
requestVerification func(expected, sent []byte) bool,
|
||||
) (string, func()) {
|
||||
handler := func(w http.ResponseWriter, r *http.Request) {
|
||||
data, err := json.Marshal(reqBody)
|
||||
@@ -562,7 +667,7 @@ func testServerCall(
|
||||
return
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(data, sentBody) {
|
||||
if !requestVerification(data, sentBody) {
|
||||
http.Error(w, "error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
@@ -591,6 +696,45 @@ func testServerCall(
|
||||
return server.URL, server.Close
|
||||
}
|
||||
|
||||
func mockGetActiveSigningWebKey() func(ctx context.Context) (*jose.JSONWebKey, error) {
|
||||
return func(ctx context.Context) (*jose.JSONWebKey, error) {
|
||||
return &jose.JSONWebKey{
|
||||
Key: privateKey,
|
||||
Algorithm: string(signingAlgorithm),
|
||||
Use: "sig",
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
func validateJSONPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return bytes.Equal
|
||||
}
|
||||
|
||||
func validateJWTPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return func(expected, sent []byte) bool {
|
||||
jws, err := jose.ParseSigned(string(sent), []jose.SignatureAlgorithm{jose.RS256})
|
||||
require.NoError(t, err)
|
||||
payload, err := jws.Verify(privateKey.Public())
|
||||
require.NoError(t, err)
|
||||
return bytes.Equal(expected, payload)
|
||||
}
|
||||
}
|
||||
|
||||
func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return func(expected, sent []byte) bool {
|
||||
parsedJWE, err := jose.ParseEncrypted(string(sent), []jose.KeyAlgorithm{jose.RSA_OAEP_256, jose.ECDH_ES_A256KW}, []jose.ContentEncryption{jose.A256GCM})
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
require.Equal(t, encryptionKeyID, parsedJWE.Header.KeyID)
|
||||
require.Equal(t, "JWT", parsedJWE.Header.ExtraHeaders[jose.HeaderContentType].(string))
|
||||
|
||||
decryptedJWS, err := parsedJWE.Decrypt(privateKey)
|
||||
require.NoError(t, err)
|
||||
return validateJWTPayload(t)(expected, decryptedJWS)
|
||||
}
|
||||
}
|
||||
|
||||
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
type target struct {
|
||||
reqBody execution.ContextInfo
|
||||
@@ -710,6 +854,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
target.sleep,
|
||||
target.statusCode,
|
||||
target.respBody,
|
||||
validateJSONPayload(t),
|
||||
)
|
||||
|
||||
tt.args.executionTargets[i].Endpoint = url
|
||||
@@ -723,6 +868,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
tt.args.req,
|
||||
tt.args.resp,
|
||||
nil,
|
||||
mockGetActiveSigningWebKey(),
|
||||
)
|
||||
|
||||
if tt.res.wantErr {
|
||||
|
||||
@@ -18,11 +18,11 @@ import (
|
||||
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
||||
)
|
||||
|
||||
func ExecutionHandler(alg crypto.EncryptionAlgorithm) grpc.UnaryServerInterceptor {
|
||||
func ExecutionHandler(alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) grpc.UnaryServerInterceptor {
|
||||
return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
|
||||
requestTargets := execution.QueryExecutionTargetsForRequest(ctx, info.FullMethod)
|
||||
// call targets otherwise return req
|
||||
handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg)
|
||||
handledReq, err := executeTargetsForRequest(ctx, requestTargets, info.FullMethod, req, alg, activeSigningKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -33,11 +33,11 @@ func ExecutionHandler(alg crypto.EncryptionAlgorithm) grpc.UnaryServerIntercepto
|
||||
}
|
||||
|
||||
responseTargets := execution.QueryExecutionTargetsForResponse(ctx, info.FullMethod)
|
||||
return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg)
|
||||
return executeTargetsForResponse(ctx, responseTargets, info.FullMethod, handledReq, response, alg, activeSigningKey)
|
||||
}
|
||||
}
|
||||
|
||||
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req interface{}, alg crypto.EncryptionAlgorithm) (_ interface{}, err error) {
|
||||
func executeTargetsForRequest(ctx context.Context, targets []target_domain.Target, fullMethod string, req interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -58,10 +58,10 @@ func executeTargetsForRequest(ctx context.Context, targets []target_domain.Targe
|
||||
Headers: connect_middleware.SetRequestHeaders(md),
|
||||
}
|
||||
|
||||
return execution.CallTargets(ctx, targets, info, alg)
|
||||
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
|
||||
}
|
||||
|
||||
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm) (_ interface{}, err error) {
|
||||
func executeTargetsForResponse(ctx context.Context, targets []target_domain.Target, fullMethod string, req, resp interface{}, alg crypto.EncryptionAlgorithm, activeSigningKey execution.GetActiveSigningWebKey) (_ interface{}, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -83,7 +83,7 @@ func executeTargetsForResponse(ctx context.Context, targets []target_domain.Targ
|
||||
Headers: connect_middleware.SetRequestHeaders(md),
|
||||
}
|
||||
|
||||
return execution.CallTargets(ctx, targets, info, alg)
|
||||
return execution.CallTargets(ctx, targets, info, alg, activeSigningKey)
|
||||
}
|
||||
|
||||
var _ execution.ContextInfo = &ContextInfoRequest{}
|
||||
|
||||
@@ -1,24 +1,42 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"reflect"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/go-jose/go-jose/v4"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"google.golang.org/protobuf/encoding/protojson"
|
||||
"google.golang.org/protobuf/proto"
|
||||
"google.golang.org/protobuf/types/known/structpb"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/crypto"
|
||||
"github.com/zitadel/zitadel/internal/execution"
|
||||
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
||||
)
|
||||
|
||||
var (
|
||||
privateKey = func() *rsa.PrivateKey {
|
||||
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)
|
||||
return privateKey
|
||||
}()
|
||||
encryptionKey = func() []byte {
|
||||
data, _ := crypto.PublicKeyToBytes(&privateKey.PublicKey)
|
||||
return data
|
||||
}()
|
||||
encryptionKeyID = "encryption-key-id"
|
||||
signingAlgorithm = jose.RS256
|
||||
)
|
||||
|
||||
func newMockContentRequest(content string) proto.Message {
|
||||
return &structpb.Struct{
|
||||
Fields: map[string]*structpb.Value{
|
||||
@@ -46,18 +64,20 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
|
||||
|
||||
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
type target struct {
|
||||
reqBody execution.ContextInfo
|
||||
sleep time.Duration
|
||||
statusCode int
|
||||
respBody interface{}
|
||||
reqBody execution.ContextInfo
|
||||
sleep time.Duration
|
||||
statusCode int
|
||||
respBody interface{}
|
||||
requestVerification func(*testing.T) func([]byte, []byte) bool
|
||||
}
|
||||
type args struct {
|
||||
ctx context.Context
|
||||
|
||||
executionTargets []target_domain.Target
|
||||
targets []target
|
||||
fullMethod string
|
||||
req interface{}
|
||||
executionTargets []target_domain.Target
|
||||
targets []target
|
||||
fullMethod string
|
||||
req interface{}
|
||||
getActiveSigningWebKey execution.GetActiveSigningWebKey
|
||||
}
|
||||
type res struct {
|
||||
want interface{}
|
||||
@@ -128,10 +148,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -157,10 +178,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -185,10 +207,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -212,7 +235,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{reqBody: newMockContextInfoRequest("/service/method", "wrong")},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "wrong"),
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
},
|
||||
@@ -236,10 +262,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -263,10 +290,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -290,10 +318,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -318,9 +347,10 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusInternalServerError,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusInternalServerError,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -345,10 +375,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -373,10 +404,11 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -416,22 +448,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentRequest("content2"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentRequest("content2"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentRequest("content3"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentRequest("content3"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -470,22 +505,25 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentRequest("content2"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusBadRequest,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content1"),
|
||||
respBody: newMockContentRequest("content2"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusBadRequest,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentRequest("content3"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content2"),
|
||||
respBody: newMockContentRequest("content3"),
|
||||
sleep: 5 * time.Second,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJSONPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
@@ -494,6 +532,70 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
wantErr: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
"payload JWT, ok",
|
||||
args{
|
||||
ctx: context.Background(),
|
||||
fullMethod: "/service/method",
|
||||
executionTargets: []target_domain.Target{
|
||||
{
|
||||
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
||||
TargetID: "target",
|
||||
TargetType: target_domain.TargetTypeWebhook,
|
||||
Timeout: time.Minute,
|
||||
InterruptOnError: true,
|
||||
PayloadType: target_domain.PayloadTypeJWT,
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJWTPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
||||
},
|
||||
res{
|
||||
want: newMockContentRequest("content"),
|
||||
},
|
||||
},
|
||||
{
|
||||
"payload JWE, ok",
|
||||
args{
|
||||
ctx: context.Background(),
|
||||
fullMethod: "/service/method",
|
||||
executionTargets: []target_domain.Target{
|
||||
{
|
||||
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
|
||||
TargetID: "target",
|
||||
TargetType: target_domain.TargetTypeWebhook,
|
||||
Timeout: time.Minute,
|
||||
InterruptOnError: true,
|
||||
PayloadType: target_domain.PayloadTypeJWE,
|
||||
EncryptionKey: encryptionKey,
|
||||
EncryptionKeyID: encryptionKeyID,
|
||||
},
|
||||
},
|
||||
targets: []target{
|
||||
{
|
||||
reqBody: newMockContextInfoRequest("/service/method", "content"),
|
||||
respBody: newMockContentRequest("content1"),
|
||||
sleep: 0,
|
||||
statusCode: http.StatusOK,
|
||||
requestVerification: validateJWEPayload,
|
||||
},
|
||||
},
|
||||
req: newMockContentRequest("content"),
|
||||
getActiveSigningWebKey: mockGetActiveSigningWebKey(),
|
||||
},
|
||||
res{
|
||||
want: newMockContentRequest("content"),
|
||||
},
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
@@ -504,6 +606,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
target.sleep,
|
||||
target.statusCode,
|
||||
target.respBody,
|
||||
target.requestVerification(t),
|
||||
)
|
||||
|
||||
tt.args.executionTargets[i].Endpoint = url
|
||||
@@ -516,6 +619,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
|
||||
tt.args.fullMethod,
|
||||
tt.args.req,
|
||||
nil,
|
||||
tt.args.getActiveSigningWebKey,
|
||||
)
|
||||
|
||||
if tt.res.wantErr {
|
||||
@@ -537,6 +641,7 @@ func testServerCall(
|
||||
sleep time.Duration,
|
||||
statusCode int,
|
||||
respBody interface{},
|
||||
requestVerification func(expected, sent []byte) bool,
|
||||
) (string, func()) {
|
||||
handler := func(w http.ResponseWriter, r *http.Request) {
|
||||
data, err := json.Marshal(reqBody)
|
||||
@@ -551,7 +656,7 @@ func testServerCall(
|
||||
return
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(data, sentBody) {
|
||||
if !requestVerification(data, sentBody) {
|
||||
http.Error(w, "error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
@@ -580,6 +685,45 @@ func testServerCall(
|
||||
return server.URL, server.Close
|
||||
}
|
||||
|
||||
func mockGetActiveSigningWebKey() func(ctx context.Context) (*jose.JSONWebKey, error) {
|
||||
return func(ctx context.Context) (*jose.JSONWebKey, error) {
|
||||
return &jose.JSONWebKey{
|
||||
Key: privateKey,
|
||||
Algorithm: string(signingAlgorithm),
|
||||
Use: "sig",
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
func validateJSONPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return bytes.Equal
|
||||
}
|
||||
|
||||
func validateJWTPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return func(expected, sent []byte) bool {
|
||||
jws, err := jose.ParseSigned(string(sent), []jose.SignatureAlgorithm{jose.RS256})
|
||||
require.NoError(t, err)
|
||||
payload, err := jws.Verify(privateKey.Public())
|
||||
require.NoError(t, err)
|
||||
return bytes.Equal(expected, payload)
|
||||
}
|
||||
}
|
||||
|
||||
func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
|
||||
return func(expected, sent []byte) bool {
|
||||
parsedJWE, err := jose.ParseEncrypted(string(sent), []jose.KeyAlgorithm{jose.RSA_OAEP_256, jose.ECDH_ES_A256KW}, []jose.ContentEncryption{jose.A256GCM})
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
require.Equal(t, encryptionKeyID, parsedJWE.Header.KeyID)
|
||||
require.Equal(t, "JWT", parsedJWE.Header.ExtraHeaders[jose.HeaderContentType].(string))
|
||||
|
||||
decryptedJWS, err := parsedJWE.Decrypt(privateKey)
|
||||
require.NoError(t, err)
|
||||
return validateJWTPayload(t)(expected, decryptedJWS)
|
||||
}
|
||||
}
|
||||
|
||||
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
type target struct {
|
||||
reqBody execution.ContextInfo
|
||||
@@ -699,6 +843,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
target.sleep,
|
||||
target.statusCode,
|
||||
target.respBody,
|
||||
validateJSONPayload(t),
|
||||
)
|
||||
|
||||
tt.args.executionTargets[i].Endpoint = url
|
||||
@@ -712,6 +857,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
|
||||
tt.args.req,
|
||||
tt.args.resp,
|
||||
nil,
|
||||
mockGetActiveSigningWebKey(),
|
||||
)
|
||||
|
||||
if tt.res.wantErr {
|
||||
|
||||
@@ -79,7 +79,7 @@ func CreateServer(
|
||||
middleware.AuthorizationInterceptor(verifier, systemAuthz, authConfig),
|
||||
middleware.TranslationHandler(),
|
||||
middleware.QuotaExhaustedInterceptor(accessSvc, system_pb.SystemService_ServiceDesc.ServiceName),
|
||||
middleware.ExecutionHandler(targetEncAlg),
|
||||
middleware.ExecutionHandler(targetEncAlg, queries.GetActiveSigningWebKey),
|
||||
middleware.ValidationHandler(),
|
||||
middleware.ServiceHandler(),
|
||||
middleware.ActivityInterceptor(),
|
||||
|
||||
@@ -98,7 +98,7 @@ func authnKeyCreatedFilterToQuery(f *filter_pb.TimestampFilter) (query.SearchQue
|
||||
}
|
||||
|
||||
func authnKeyExpirationFilterToQuery(f *filter_pb.TimestampFilter) (query.SearchQuery, error) {
|
||||
return query.NewAuthNKeyExpirationDateDateQuery(f.Timestamp.AsTime(), filter.TimestampMethodPbToQuery(f.Method))
|
||||
return query.NewAuthNKeyExpirationDateQuery(f.Timestamp.AsTime(), filter.TimestampMethodPbToQuery(f.Method))
|
||||
}
|
||||
|
||||
// authnKeyFieldNameToSortingColumn defaults to the creation date because this ensures deterministic pagination
|
||||
|
||||
@@ -19,6 +19,7 @@ import (
|
||||
"github.com/zitadel/zitadel/internal/api/authz"
|
||||
http_utils "github.com/zitadel/zitadel/internal/api/http"
|
||||
"github.com/zitadel/zitadel/internal/api/http/middleware"
|
||||
"github.com/zitadel/zitadel/internal/api/oidc/sign"
|
||||
"github.com/zitadel/zitadel/internal/api/ui/login"
|
||||
"github.com/zitadel/zitadel/internal/auth/repository/eventsourcing/handler"
|
||||
"github.com/zitadel/zitadel/internal/command"
|
||||
@@ -300,7 +301,7 @@ func (o *OPStorage) TerminateSessionFromRequest(ctx context.Context, endSessionR
|
||||
} else {
|
||||
logoutURI = logoutURI.JoinPath(LogoutPath)
|
||||
}
|
||||
signer, _, err := GetSignerOnce(o.query.GetActiveSigningWebKey)(ctx)
|
||||
signer, _, err := sign.GetSignerOnce(o.query.GetActiveSigningWebKey)(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
package sign
|
||||
|
||||
import (
|
||||
"context"
|
||||
"sync"
|
||||
|
||||
"github.com/go-jose/go-jose/v4"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
)
|
||||
|
||||
// SignerFunc is a getter function that allows add-hoc retrieval of the instance's signer.
|
||||
type SignerFunc func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error)
|
||||
|
||||
// GetSignerOnce returns a function which retrieves the instance's signer from the database once.
|
||||
// Repeated calls of the returned function return the same results.
|
||||
func GetSignerOnce(
|
||||
getActiveSigningWebKey func(ctx context.Context) (*jose.JSONWebKey, error),
|
||||
) SignerFunc {
|
||||
var (
|
||||
once sync.Once
|
||||
signer jose.Signer
|
||||
signAlg jose.SignatureAlgorithm
|
||||
err error
|
||||
)
|
||||
return func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error) {
|
||||
once.Do(func() {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
var webKey *jose.JSONWebKey
|
||||
webKey, err = getActiveSigningWebKey(ctx)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
signer, signAlg, err = signerFromWebKey(webKey)
|
||||
})
|
||||
return signer, signAlg, err
|
||||
}
|
||||
}
|
||||
|
||||
func signerFromWebKey(signingKey *jose.JSONWebKey) (jose.Signer, jose.SignatureAlgorithm, error) {
|
||||
signAlg := jose.SignatureAlgorithm(signingKey.Algorithm)
|
||||
signer, err := jose.NewSigner(
|
||||
jose.SigningKey{
|
||||
Algorithm: signAlg,
|
||||
Key: signingKey,
|
||||
},
|
||||
(&jose.SignerOptions{}).WithType("JWT"),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, "", zerrors.ThrowInternal(err, "OIDC-oaF0s", "Errors.Internal")
|
||||
}
|
||||
return signer, signAlg, nil
|
||||
}
|
||||
@@ -4,18 +4,16 @@ import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"slices"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/go-jose/go-jose/v4"
|
||||
"github.com/zitadel/oidc/v3/pkg/crypto"
|
||||
"github.com/zitadel/oidc/v3/pkg/oidc"
|
||||
"github.com/zitadel/oidc/v3/pkg/op"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/api/oidc/sign"
|
||||
"github.com/zitadel/zitadel/internal/command"
|
||||
"github.com/zitadel/zitadel/internal/domain"
|
||||
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
)
|
||||
|
||||
/*
|
||||
@@ -59,53 +57,8 @@ func (s *Server) accessTokenResponseFromSession(ctx context.Context, client op.C
|
||||
return resp, err
|
||||
}
|
||||
|
||||
// SignerFunc is a getter function that allows add-hoc retrieval of the instance's signer.
|
||||
type SignerFunc func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error)
|
||||
|
||||
func (s *Server) getSignerOnce() SignerFunc {
|
||||
return GetSignerOnce(s.query.GetActiveSigningWebKey)
|
||||
}
|
||||
|
||||
// GetSignerOnce returns a function which retrieves the instance's signer from the database once.
|
||||
// Repeated calls of the returned function return the same results.
|
||||
func GetSignerOnce(
|
||||
getActiveSigningWebKey func(ctx context.Context) (*jose.JSONWebKey, error),
|
||||
) SignerFunc {
|
||||
var (
|
||||
once sync.Once
|
||||
signer jose.Signer
|
||||
signAlg jose.SignatureAlgorithm
|
||||
err error
|
||||
)
|
||||
return func(ctx context.Context) (jose.Signer, jose.SignatureAlgorithm, error) {
|
||||
once.Do(func() {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
var webKey *jose.JSONWebKey
|
||||
webKey, err = getActiveSigningWebKey(ctx)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
signer, signAlg, err = signerFromWebKey(webKey)
|
||||
})
|
||||
return signer, signAlg, err
|
||||
}
|
||||
}
|
||||
|
||||
func signerFromWebKey(signingKey *jose.JSONWebKey) (jose.Signer, jose.SignatureAlgorithm, error) {
|
||||
signAlg := jose.SignatureAlgorithm(signingKey.Algorithm)
|
||||
signer, err := jose.NewSigner(
|
||||
jose.SigningKey{
|
||||
Algorithm: signAlg,
|
||||
Key: signingKey,
|
||||
},
|
||||
(&jose.SignerOptions{}).WithType("JWT"),
|
||||
)
|
||||
if err != nil {
|
||||
return nil, "", zerrors.ThrowInternal(err, "OIDC-oaF0s", "Errors.Internal")
|
||||
}
|
||||
return signer, signAlg, nil
|
||||
func (s *Server) getSignerOnce() sign.SignerFunc {
|
||||
return sign.GetSignerOnce(s.query.GetActiveSigningWebKey)
|
||||
}
|
||||
|
||||
// userInfoFunc is a getter function that allows add-hoc retrieval of a user.
|
||||
@@ -120,7 +73,7 @@ func (s *Server) getUserInfo(userID, projectID, clientID string, projectRoleAsse
|
||||
}
|
||||
}
|
||||
|
||||
func (*Server) createIDToken(ctx context.Context, client op.Client, getUserInfo userInfoFunc, roleAssertion bool, getSigningKey SignerFunc, sessionID, accessToken string, audience []string, authMethods []domain.UserAuthMethodType, authTime time.Time, nonce string, actor *domain.TokenActor) (idToken string, exp uint64, err error) {
|
||||
func (*Server) createIDToken(ctx context.Context, client op.Client, getUserInfo userInfoFunc, roleAssertion bool, getSigningKey sign.SignerFunc, sessionID, accessToken string, audience []string, authMethods []domain.UserAuthMethodType, authTime time.Time, nonce string, actor *domain.TokenActor) (idToken string, exp uint64, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
@@ -164,7 +117,7 @@ func timeToOIDCExpiresIn(exp time.Time) uint64 {
|
||||
return uint64(time.Until(exp) / time.Second)
|
||||
}
|
||||
|
||||
func (s *Server) createJWT(ctx context.Context, client op.Client, session *command.OIDCSession, getUserInfo userInfoFunc, assertRoles bool, getSigner SignerFunc) (_ string, err error) {
|
||||
func (s *Server) createJWT(ctx context.Context, client op.Client, session *command.OIDCSession, getUserInfo userInfoFunc, assertRoles bool, getSigner sign.SignerFunc) (_ string, err error) {
|
||||
ctx, span := tracing.NewSpan(ctx)
|
||||
defer func() { span.EndWithError(err) }()
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ import (
|
||||
"golang.org/x/text/language"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/api/authz"
|
||||
"github.com/zitadel/zitadel/internal/api/oidc/sign"
|
||||
"github.com/zitadel/zitadel/internal/domain"
|
||||
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
@@ -317,7 +318,7 @@ func (s *Server) createExchangeJWT(
|
||||
client *Client,
|
||||
getUserInfo userInfoFunc,
|
||||
roleAssertion bool,
|
||||
getSigner SignerFunc,
|
||||
getSigner sign.SignerFunc,
|
||||
userID,
|
||||
resourceOwner string,
|
||||
audience,
|
||||
|
||||
@@ -461,7 +461,7 @@ func (s *Server) userinfoFlows(ctx context.Context, qu *query.OIDCUserInfo, user
|
||||
UserGrants: qu.UserGrants,
|
||||
}
|
||||
|
||||
resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm)
|
||||
resp, err := execution.CallTargets(ctx, executionTargets, info, s.targetEncryptionAlgorithm, s.query.GetActiveSigningWebKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -401,7 +401,7 @@ func (p *Storage) getCustomAttributes(ctx context.Context, user *query.User, use
|
||||
UserGrants: userGrants.UserGrants,
|
||||
}
|
||||
|
||||
resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg)
|
||||
resp, err := execution.CallTargets(ctx, executionTargets, info, p.targetEncAlg, p.query.GetActiveSigningWebKey)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user