feat(action v2): add JWT and JWE payload type options (#11196)

# Which Problems Are Solved

The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.

# How the Problems Are Solved

- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
  - added a `fingerprint` column
  - dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies

# Additional Changes

None

# Additional Context

closes #11061

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>

internal/repository/target/eventstore.go

@@ -6,4 +6,8 @@ func init() {
 	eventstore.RegisterFilterEventMapper(AggregateType, AddedEventType, eventstore.GenericEventMapper[AddedEvent])
 	eventstore.RegisterFilterEventMapper(AggregateType, ChangedEventType, eventstore.GenericEventMapper[ChangedEvent])
 	eventstore.RegisterFilterEventMapper(AggregateType, RemovedEventType, eventstore.GenericEventMapper[RemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, KeyAddedEventType, eventstore.GenericEventMapper[KeyAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, KeyActivatedEventType, eventstore.GenericEventMapper[KeyActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, KeyDeactivatedEventType, eventstore.GenericEventMapper[KeyDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, KeyRemovedEventType, eventstore.GenericEventMapper[KeyRemovedEvent])
 }

internal/repository/target/key.go

@@ -0,0 +1,122 @@
+package target
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	keyEventTypePrefix      eventstore.EventType = "target.key."
+	KeyAddedEventType                            = keyEventTypePrefix + "added"
+	KeyActivatedEventType                        = keyEventTypePrefix + "activated"
+	KeyDeactivatedEventType                      = keyEventTypePrefix + "deactivated"
+	KeyRemovedEventType                          = keyEventTypePrefix + "removed"
+)
+
+type KeyAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	KeyID          string    `json:"keyId,omitempty"`
+	PublicKey      []byte    `json:"publicKey,omitempty"`
+	Fingerprint    string    `json:"fingerprint,omitempty"`
+	ExpirationDate time.Time `json:"expirationDate,omitzero"`
+}
+
+func (e *KeyAddedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = *b
+}
+
+func (e *KeyAddedEvent) Payload() any {
+	return e
+}
+
+func (e *KeyAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewKeyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	keyID string,
+	publicKey []byte,
+	fingerprint string,
+	expiration time.Time,
+) *KeyAddedEvent {
+	return &KeyAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx, aggregate, KeyAddedEventType,
+		),
+		KeyID:          keyID,
+		PublicKey:      publicKey,
+		Fingerprint:    fingerprint,
+		ExpirationDate: expiration,
+	}
+}
+
+type KeyActivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	KeyID string `json:"keyId,omitempty"`
+}
+
+func (e *KeyActivatedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = *b
+}
+
+func (e *KeyActivatedEvent) Payload() any {
+	return e
+}
+
+func (e *KeyActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewKeyActivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate, id string) *KeyActivatedEvent {
+	return &KeyActivatedEvent{*eventstore.NewBaseEventForPush(ctx, aggregate, KeyActivatedEventType), id}
+}
+
+type KeyDeactivatedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	KeyID string `json:"keyId,omitempty"`
+}
+
+func (e *KeyDeactivatedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = *b
+}
+
+func (e *KeyDeactivatedEvent) Payload() any {
+	return e
+}
+
+func (e *KeyDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewKeyDeactivatedEvent(ctx context.Context, aggregate *eventstore.Aggregate, id string) *KeyDeactivatedEvent {
+	return &KeyDeactivatedEvent{*eventstore.NewBaseEventForPush(ctx, aggregate, KeyDeactivatedEventType), id}
+}
+
+type KeyRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	KeyID string `json:"keyId,omitempty"`
+}
+
+func (e *KeyRemovedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
+	e.BaseEvent = *b
+}
+
+func (e *KeyRemovedEvent) Payload() any {
+	return e
+}
+
+func (e *KeyRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewKeyRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, id string) *KeyRemovedEvent {
+	return &KeyRemovedEvent{*eventstore.NewBaseEventForPush(ctx, aggregate, KeyRemovedEventType), id}
+}

internal/repository/target/target.go

@@ -19,12 +19,13 @@ const (
 type AddedEvent struct {
 	eventstore.BaseEvent `json:"-"`
 
-	Name             string                   `json:"name"`
-	TargetType       target_domain.TargetType `json:"targetType"`
-	Endpoint         string                   `json:"endpoint"`
-	Timeout          time.Duration            `json:"timeout"`
-	InterruptOnError bool                     `json:"interruptOnError"`
-	SigningKey       *crypto.CryptoValue      `json:"signingKey"`
+	Name             string                    `json:"name"`
+	TargetType       target_domain.TargetType  `json:"targetType"`
+	Endpoint         string                    `json:"endpoint"`
+	Timeout          time.Duration             `json:"timeout"`
+	InterruptOnError bool                      `json:"interruptOnError"`
+	SigningKey       *crypto.CryptoValue       `json:"signingKey"`
+	PayloadType      target_domain.PayloadType `json:"payloadType"`
 }
 
 func (e *AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
@@ -48,12 +49,20 @@ func NewAddedEvent(
 	timeout time.Duration,
 	interruptOnError bool,
 	signingKey *crypto.CryptoValue,
+	payloadType target_domain.PayloadType,
 ) *AddedEvent {
 	return &AddedEvent{
 		*eventstore.NewBaseEventForPush(
 			ctx, aggregate, AddedEventType,
 		),
-		name, targetType, endpoint, timeout, interruptOnError, signingKey}
+		name,
+		targetType,
+		endpoint,
+		timeout,
+		interruptOnError,
+		signingKey,
+		payloadType,
+	}
 }
 
 type ChangedEvent struct {
@@ -65,6 +74,7 @@ type ChangedEvent struct {
 	Timeout          *time.Duration            `json:"timeout,omitempty"`
 	InterruptOnError *bool                     `json:"interruptOnError,omitempty"`
 	SigningKey       *crypto.CryptoValue       `json:"signingKey,omitempty"`
+	PayloadType      target_domain.PayloadType `json:"payloadType,omitempty"`
 
 	oldName string
 }
@@ -144,6 +154,12 @@ func ChangeSigningKey(signingKey *crypto.CryptoValue) func(event *ChangedEvent)
 	}
 }
 
+func ChangePayloadType(payloadType target_domain.PayloadType) func(event *ChangedEvent) {
+	return func(e *ChangedEvent) {
+		e.PayloadType = payloadType
+	}
+}
+
 type RemovedEvent struct {
 	eventstore.BaseEvent `json:"-"`