From 6bf96ecbd7640850a525999360f9a9385e8c5c38 Mon Sep 17 00:00:00 2001 From: Livio Amstutz Date: Wed, 25 Mar 2020 09:32:52 +0100 Subject: [PATCH 1/4] add duration type --- internal/config/types/duration.go | 15 +++++++++ internal/config/types/duration_test.go | 46 ++++++++++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 internal/config/types/duration.go create mode 100644 internal/config/types/duration_test.go diff --git a/internal/config/types/duration.go b/internal/config/types/duration.go new file mode 100644 index 000000000..6413aea83 --- /dev/null +++ b/internal/config/types/duration.go @@ -0,0 +1,15 @@ +package types + +import ( + "time" +) + +type Duration struct { + time.Duration +} + +func (d *Duration) UnmarshalText(data []byte) error { + var err error + d.Duration, err = time.ParseDuration(string(data)) + return err +} diff --git a/internal/config/types/duration_test.go b/internal/config/types/duration_test.go new file mode 100644 index 000000000..8058d07a4 --- /dev/null +++ b/internal/config/types/duration_test.go @@ -0,0 +1,46 @@ +package types + +import ( + "testing" + "time" +) + +func TestDuration_UnmarshalText(t *testing.T) { + type args struct { + data []byte + } + tests := []struct { + name string + args args + wantErr bool + want time.Duration + }{ + { + "ok", + args{ + data: []byte("10s"), + }, + false, + time.Duration(10 * time.Second), + }, + { + "error", + args{ + data: []byte("10"), + }, + true, + time.Duration(0), + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + d := &Duration{} + if err := d.UnmarshalText(tt.args.data); (err != nil) != tt.wantErr { + t.Errorf("UnmarshalText() error = %v, wantErr %v", err, tt.wantErr) + } + if d.Duration != tt.want { + t.Errorf("UnmarshalText() got = %v, want %v", d.Duration, tt.want) + } + }) + } +} From 1aaf721d92c4748f41df971a53d696f9aa98a2c3 Mon Sep 17 00:00:00 2001 From: Livio Amstutz Date: Wed, 25 Mar 2020 10:41:17 +0100 Subject: [PATCH 2/4] cleanup --- cmd/zitadel/main.go | 5 ++--- cmd/zitadel/startup.yaml | 3 --- internal/api/auth/context.go | 4 ---- internal/api/grpc/config.go | 7 ++----- internal/config/{flag.go => array_flag.go} | 0 5 files changed, 4 insertions(+), 15 deletions(-) rename internal/config/{flag.go => array_flag.go} (100%) diff --git a/cmd/zitadel/main.go b/cmd/zitadel/main.go index 4c3137b9c..e56940361 100644 --- a/cmd/zitadel/main.go +++ b/cmd/zitadel/main.go @@ -22,8 +22,8 @@ type Config struct { Admin *admin.Config Console *console.Config - //Log - //Tracing tracing.TracingConfig + //Log //TODO: add + //Tracing tracing.TracingConfig //TODO: add AuthZ *authz.Config } @@ -35,7 +35,6 @@ func main() { loginEnabled := flag.Bool("login", true, "enable login ui") adminEnabled := flag.Bool("admin", true, "enable admin api") consoleEnabled := flag.Bool("console", true, "enable console ui") - flag.Parse() conf := new(Config) diff --git a/cmd/zitadel/startup.yaml b/cmd/zitadel/startup.yaml index 265ad4908..9a8a4bce6 100644 --- a/cmd/zitadel/startup.yaml +++ b/cmd/zitadel/startup.yaml @@ -14,7 +14,6 @@ Mgmt: GRPC: ServerPort: 60020 GatewayPort: 60021 - SearchLimit: 100 CustomHeaders: - x-caos- @@ -23,7 +22,6 @@ Auth: GRPC: ServerPort: 60050 GatewayPort: 60051 - SearchLimit: 100 CustomHeaders: - x-caos- @@ -35,7 +33,6 @@ Admin: GRPC: ServerPort: 60090 GatewayPort: 60091 - SearchLimit: 100 CustomHeaders: - x-caos- diff --git a/internal/api/auth/context.go b/internal/api/auth/context.go index 5638fa40d..b17affec2 100644 --- a/internal/api/auth/context.go +++ b/internal/api/auth/context.go @@ -7,10 +7,6 @@ import ( "github.com/caos/logging" ) -const ( - HeaderOrgID = "x-caos-zitadel-orgid" -) - type CtxKeyPermissions struct{} type CtxKeyData struct{} diff --git a/internal/api/grpc/config.go b/internal/api/grpc/config.go index 4895fda7e..1b3179d5a 100644 --- a/internal/api/grpc/config.go +++ b/internal/api/grpc/config.go @@ -3,14 +3,12 @@ package grpc type Config struct { ServerPort string GatewayPort string - SearchLimit int CustomHeaders []string } func (c *Config) ToServerConfig() *ServerConfig { return &ServerConfig{ - Port: c.ServerPort, - SearchLimit: c.SearchLimit, + Port: c.ServerPort, } } @@ -23,8 +21,7 @@ func (c *Config) ToGatewayConfig() *GatewayConfig { } type ServerConfig struct { - Port string - SearchLimit int + Port string } type GatewayConfig struct { diff --git a/internal/config/flag.go b/internal/config/array_flag.go similarity index 100% rename from internal/config/flag.go rename to internal/config/array_flag.go From 5ba9b4c0969952a5ccc4f5ab6784afa556eba081 Mon Sep 17 00:00:00 2001 From: Florian Forster Date: Thu, 19 Mar 2020 15:19:18 +0100 Subject: [PATCH 3/4] docs(readme): initiate boilerplate (#18) * docs(readme): initiate boilerplate * Update README.md Co-Authored-By: livio-a Co-authored-by: livio-a --- README.md | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 546361b2d..3ee954f4a 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,28 @@ -# zitadel +# Zitadel -![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg) +[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release) ![Release Badge](https://github.com/caos/zitadel/workflows/Test,%20Build,%20Release/badge.svg) [![GitHub license](https://img.shields.io/github/license/caos/zitadel)](https://github.com/caos/zitadel/blob/master/LICENSE) -[![GitHub release](https://img.shields.io/github/release/caos/zitadel)](https://github.com/caos/zitadel/releases/) +[![GitHub release](https://img.shields.io/github/release/caos/zitadel)](https://gitHub.com/caos/zitadel/releases/) +> This project is in alpha state. The API will continue breaking until version 1.0.0 is released + +## What Is It + +It will be an IAM ;-) + +## How Does It Work + +## Why Another IAM + +## How To Use It + +## How To Contribute + +TBD + +## License + +See the exact licensing terms [here](./LICENSE) + +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. From 9da20cfe25f9016c7d160ca0fc82eeee8d88e741 Mon Sep 17 00:00:00 2001 From: Florian Forster Date: Fri, 20 Mar 2020 06:30:10 +0100 Subject: [PATCH 4/4] docs(readme): security policy (#19) * Create SECURITY.md * Update README.md --- README.md | 4 ++++ SECURITY.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 SECURITY.md diff --git a/README.md b/README.md index 3ee954f4a..eb9c8971e 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,10 @@ It will be an IAM ;-) TBD +## Security + +See the policy [here](./SECURITY.md) + ## License See the exact licensing terms [here](./LICENSE) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..3c2d48d75 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,43 @@ +# Security Policy + +At CAOS we are extremely grateful for security aware people that disclose vulnerabilities to us and the open source community. All reports will be investigated by our team. + +## Supported Versions + +After the initial Release the following version support will apply + +| Version | Supported | +| ------- | ------------------ | +| 1.x.x | :white_check_mark: (not yet available) | +| 0.x.x | :x: | + +## Reporting a vulnerability + +To file a incident, please disclose by email to security@caos.ch with the security details. + +At the moment GPG encryption is no yet supported, however you may sign your message at will. + +### When should I report a vulnerability + +* You think you discovered a ... + * ... potential security vulnerability in zitadel + * ... vulnerability in another project that zitadel bases on +* For projects with their own vulnerability reporting and disclosure process, please report it directly there + +### When should I NOT report a vulnerability + +* You need help applying security related updates +* Your issue is not security related + +## Security Vulnerability Response + +TBD + +## Public Disclosure + +All accepted and mitigated vulnerabilitys will be published on the [Github Security Page](https://github.com/caos/zitadel/security/advisories) + +### Timing + +We think it is crucial to publish advisories `ASAP` as mitigations are ready. But due to the unknown nature of the discloures the time frame can range from 7 to 90 days. +