mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-31 03:22:15 +00:00
feat: Login, OP Support and Auth Queries (#177)
* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <[email protected]> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <[email protected]> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <[email protected]> * fix test * fix ports and enable console Co-authored-by: Fabiennne <[email protected]> Co-authored-by: Fabi <[email protected]> Co-authored-by: Silvan <[email protected]>
This commit is contained in:
Livio Amstutz
co-authored by
Silvan
Fabiennne
Fabi
Silvan
Fabiennne
Fabi
parent
46b60a6968
commit
8a5badddf6
@@ -2,29 +2,36 @@ package model
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
"github.com/caos/zitadel/internal/errors"
|
||||
)
|
||||
|
||||
type AuthRequest struct {
|
||||
ID string
|
||||
AgentID string
|
||||
CreationDate time.Time
|
||||
ChangeDate time.Time
|
||||
BrowserInfo *BrowserInfo
|
||||
ApplicationID string
|
||||
CallbackURI string
|
||||
TransferState string
|
||||
Prompt Prompt
|
||||
PossibleLOAs []LevelOfAssurance
|
||||
UiLocales []string
|
||||
LoginHint string
|
||||
PreselectedUserID string
|
||||
MaxAuthAge uint32
|
||||
Request Request
|
||||
ID string
|
||||
AgentID string
|
||||
CreationDate time.Time
|
||||
ChangeDate time.Time
|
||||
BrowserInfo *BrowserInfo
|
||||
ApplicationID string
|
||||
CallbackURI string
|
||||
TransferState string
|
||||
Prompt Prompt
|
||||
PossibleLOAs []LevelOfAssurance
|
||||
UiLocales []string
|
||||
LoginHint string
|
||||
MaxAuthAge uint32
|
||||
Request Request
|
||||
|
||||
levelOfAssurance LevelOfAssurance
|
||||
projectApplicationIDs []string
|
||||
UserID string
|
||||
PossibleSteps []NextStep
|
||||
levelOfAssurance LevelOfAssurance
|
||||
UserID string
|
||||
UserName string
|
||||
UserOrgID string
|
||||
PossibleSteps []NextStep
|
||||
PasswordVerified bool
|
||||
MfasVerified []MfaType
|
||||
Audience []string
|
||||
AuthTime time.Time
|
||||
Code string
|
||||
}
|
||||
|
||||
type Prompt int32
|
||||
@@ -46,22 +53,30 @@ const (
|
||||
func NewAuthRequest(id, agentID string, info *BrowserInfo, applicationID, callbackURI, transferState string,
|
||||
prompt Prompt, possibleLOAs []LevelOfAssurance, uiLocales []string, loginHint, preselectedUserID string, maxAuthAge uint32, request Request) *AuthRequest {
|
||||
return &AuthRequest{
|
||||
ID: id,
|
||||
AgentID: agentID,
|
||||
BrowserInfo: info,
|
||||
ApplicationID: applicationID,
|
||||
CallbackURI: callbackURI,
|
||||
TransferState: transferState,
|
||||
Prompt: prompt,
|
||||
PossibleLOAs: possibleLOAs,
|
||||
UiLocales: uiLocales,
|
||||
LoginHint: loginHint,
|
||||
PreselectedUserID: preselectedUserID,
|
||||
MaxAuthAge: maxAuthAge,
|
||||
Request: request,
|
||||
ID: id,
|
||||
AgentID: agentID,
|
||||
BrowserInfo: info,
|
||||
ApplicationID: applicationID,
|
||||
CallbackURI: callbackURI,
|
||||
TransferState: transferState,
|
||||
Prompt: prompt,
|
||||
PossibleLOAs: possibleLOAs,
|
||||
UiLocales: uiLocales,
|
||||
LoginHint: loginHint,
|
||||
UserID: preselectedUserID,
|
||||
MaxAuthAge: maxAuthAge,
|
||||
Request: request,
|
||||
}
|
||||
}
|
||||
|
||||
func NewAuthRequestFromType(requestType AuthRequestType) (*AuthRequest, error) {
|
||||
request, ok := authRequestTypeMapping[requestType]
|
||||
if !ok {
|
||||
return nil, errors.ThrowInvalidArgument(nil, "MODEL-ds2kl", "invalid request type")
|
||||
}
|
||||
return &AuthRequest{Request: request}, nil
|
||||
}
|
||||
|
||||
func (a *AuthRequest) IsValid() bool {
|
||||
return a.ID != "" &&
|
||||
a.AgentID != "" &&
|
||||
@@ -80,3 +95,9 @@ func (a *AuthRequest) WithCurrentInfo(info *BrowserInfo) *AuthRequest {
|
||||
a.BrowserInfo = info
|
||||
return a
|
||||
}
|
||||
|
||||
func (a *AuthRequest) SetUserInfo(userID string, userName string, userOrgID string) {
|
||||
a.UserID = userID
|
||||
a.UserName = userName
|
||||
a.UserOrgID = userOrgID
|
||||
}
|
||||
|
||||
@@ -1,6 +1,12 @@
|
||||
package model
|
||||
|
||||
import "net"
|
||||
import (
|
||||
"net"
|
||||
"net/http"
|
||||
|
||||
"github.com/caos/zitadel/internal/api"
|
||||
http_util "github.com/caos/zitadel/internal/api/http"
|
||||
)
|
||||
|
||||
type BrowserInfo struct {
|
||||
UserAgent string
|
||||
@@ -8,6 +14,14 @@ type BrowserInfo struct {
|
||||
RemoteIP net.IP
|
||||
}
|
||||
|
||||
func BrowserInfoFromRequest(r *http.Request) *BrowserInfo {
|
||||
return &BrowserInfo{
|
||||
UserAgent: r.Header.Get(api.UserAgent),
|
||||
AcceptLanguage: r.Header.Get(api.AcceptLanguage),
|
||||
RemoteIP: http_util.RemoteIPFromRequest(r),
|
||||
}
|
||||
}
|
||||
|
||||
func (i *BrowserInfo) IsValid() bool {
|
||||
return i.UserAgent != "" &&
|
||||
i.AcceptLanguage != "" &&
|
||||
|
||||
@@ -10,6 +10,7 @@ const (
|
||||
NextStepUnspecified NextStepType = iota
|
||||
NextStepLogin
|
||||
NextStepUserSelection
|
||||
NextStepInitUser
|
||||
NextStepPassword
|
||||
NextStepChangePassword
|
||||
NextStepInitPassword
|
||||
@@ -26,9 +27,7 @@ const (
|
||||
UserSessionStateTerminated
|
||||
)
|
||||
|
||||
type LoginStep struct {
|
||||
NotFound bool
|
||||
}
|
||||
type LoginStep struct{}
|
||||
|
||||
func (s *LoginStep) Type() NextStepType {
|
||||
return NextStepLogin
|
||||
@@ -48,30 +47,33 @@ type UserSelection struct {
|
||||
UserSessionState UserSessionState
|
||||
}
|
||||
|
||||
type PasswordStep struct {
|
||||
FailureCount uint16
|
||||
type InitUserStep struct {
|
||||
PasswordSet bool
|
||||
}
|
||||
|
||||
func (s *InitUserStep) Type() NextStepType {
|
||||
return NextStepInitUser
|
||||
}
|
||||
|
||||
type PasswordStep struct{}
|
||||
|
||||
func (s *PasswordStep) Type() NextStepType {
|
||||
return NextStepPassword
|
||||
}
|
||||
|
||||
type ChangePasswordStep struct {
|
||||
}
|
||||
type ChangePasswordStep struct{}
|
||||
|
||||
func (s *ChangePasswordStep) Type() NextStepType {
|
||||
return NextStepChangePassword
|
||||
}
|
||||
|
||||
type InitPasswordStep struct {
|
||||
}
|
||||
type InitPasswordStep struct{}
|
||||
|
||||
func (s *InitPasswordStep) Type() NextStepType {
|
||||
return NextStepInitPassword
|
||||
}
|
||||
|
||||
type VerifyEMailStep struct {
|
||||
}
|
||||
type VerifyEMailStep struct{}
|
||||
|
||||
func (s *VerifyEMailStep) Type() NextStepType {
|
||||
return NextStepVerifyEmail
|
||||
@@ -87,7 +89,6 @@ func (s *MfaPromptStep) Type() NextStepType {
|
||||
}
|
||||
|
||||
type MfaVerificationStep struct {
|
||||
FailureCount uint16
|
||||
MfaProviders []MfaType
|
||||
}
|
||||
|
||||
@@ -95,8 +96,7 @@ func (s *MfaVerificationStep) Type() NextStepType {
|
||||
return NextStepMfaVerify
|
||||
}
|
||||
|
||||
type RedirectToCallbackStep struct {
|
||||
}
|
||||
type RedirectToCallbackStep struct{}
|
||||
|
||||
func (s *RedirectToCallbackStep) Type() NextStepType {
|
||||
return NextStepRedirectToCallback
|
||||
@@ -111,7 +111,8 @@ const (
|
||||
type MfaLevel int
|
||||
|
||||
const (
|
||||
MfaLevelSoftware MfaLevel = iota
|
||||
MfaLevelNotSetUp MfaLevel = iota
|
||||
MfaLevelSoftware
|
||||
MfaLevelHardware
|
||||
MfaLevelHardwareCertified
|
||||
)
|
||||
|
||||
@@ -7,6 +7,12 @@ type Request interface {
|
||||
|
||||
type AuthRequestType int32
|
||||
|
||||
var (
|
||||
authRequestTypeMapping = map[AuthRequestType]Request{
|
||||
AuthRequestTypeOIDC: &AuthRequestOIDC{},
|
||||
}
|
||||
)
|
||||
|
||||
const (
|
||||
AuthRequestTypeOIDC AuthRequestType = iota
|
||||
AuthRequestTypeSAML
|
||||
|
||||
Reference in New Issue
Block a user