andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-10 08:05:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Marco A.
2026-06-15 15:36:14 +02:00
committed by GitHub
co-authored by Livio Spring
parent d184e976fc
commit 8e82ec1cb9
97 changed files with 1834 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/start/config.go
+6 -1
View File
@@ -17,6 +17,7 @@ import (
"github.com/zitadel/zitadel/internal/actions"
admin_es "github.com/zitadel/zitadel/internal/admin/repository/eventsourcing"
"github.com/zitadel/zitadel/internal/api/authz"
"github.com/zitadel/zitadel/internal/api/http"
"github.com/zitadel/zitadel/internal/api/http/middleware"
"github.com/zitadel/zitadel/internal/api/oidc"
"github.com/zitadel/zitadel/internal/api/saml"
@@ -87,6 +88,7 @@ type Config struct {
Quotas *QuotasConfig
Telemetry *handlers.TelemetryPusherConfig
ServicePing *serviceping.Config
HTTPClient *http.ClientConfig
}
type QuotasConfig struct {
@@ -121,9 +123,12 @@ func NewConfig(cmd *cobra.Command, v *viper.Viper) (*Config, instrumentation.Shu
}
id.Configure(config.Machine)
var actionsDenylist []denylist.AddressChecker
if config.Actions != nil {
actions.SetHTTPConfig(&config.Actions.HTTP)
actionsDenylist = config.Actions.HTTP.DenyList
}
config.HTTPClient.MergeDeprecatedDenylists(actionsDenylist, config.Executions.DenyList)
err = config.SystemDefaults.Validate()
if err != nil {
cmd/start/start.go
+27 -4
View File
@@ -272,6 +272,8 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
new_domain.SetWebAuthNConfig(webAuthNConfig)
httpClient := config.HTTPClient.NewClient()
commands, err := command.StartCommands(ctx,
eventstoreClient,
cacheConnectors,
@@ -291,7 +293,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
keys.SAML,
keys.Target,
keys.OIDC,
&http.Client{},
httpClient,
permissionCheck,
sessionTokenVerifier,
config.OIDC.DefaultAccessTokenLifetime,
@@ -299,7 +301,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
config.OIDC.DefaultRefreshTokenIdleExpiration,
config.DefaultInstance.SecretGenerators,
config.Login.DefaultPaths,
config.Executions.DenyList,
config.HTTPClient.DenyList,
)
if err != nil {
return fmt.Errorf("cannot start commands: %w", err)
@@ -345,12 +347,14 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
keys.SMTP,
keys.SMS,
q,
httpClient,
)
notification.Start(ctx)
execution.Register(
ctx,
config.Executions,
httpClient,
q,
keys.Target,
queries.GetActiveSigningWebKey,
@@ -390,6 +394,7 @@ func startZitadel(ctx context.Context, config *Config, masterKey string, server
keys,
permissionCheck,
cacheConnectors,
httpClient,
)
if err != nil {
return err
@@ -435,6 +440,7 @@ func startAPIs(
keys *encryption.EncryptionKeys,
permissionCheck domain.PermissionCheck,
cacheConnectors connector.Connectors,
httpClient *http.Client,
) (*api.API, error) {
repo := struct {
authz_repo.Repository
@@ -492,7 +498,7 @@ func startAPIs(
keys.Target,
translator,
config.Instrumentation.Trace.TrustRemoteSpans,
config.Executions.DenyList,
httpClient,
)
if err != nil {
return nil, fmt.Errorf("error creating api %w", err)
@@ -675,13 +681,29 @@ func startAPIs(
config.Log.Slog(),
config.SystemDefaults.SecretHasher,
federatedLogoutsCache,
httpClient,
)
if err != nil {
return nil, fmt.Errorf("unable to start oidc provider: %w", err)
}
apis.RegisterHandlerPrefixes(oidcServer, oidcPrefixes...)
samlProvider, err := saml.NewProvider(config.SAML, config.ExternalSecure, commands, queries, authRepo, keys.OIDC, keys.SAML, keys.Target, eventstore, dbClient, instanceInterceptor.Handler, userAgentInterceptor, limitingAccessInterceptor)
samlProvider, err := saml.NewProvider(
config.SAML,
config.ExternalSecure,
commands,
queries,
authRepo,
keys.OIDC,
keys.SAML,
keys.Target,
eventstore,
dbClient,
instanceInterceptor.Handler,
userAgentInterceptor,
limitingAccessInterceptor,
httpClient,
)
if err != nil {
return nil, fmt.Errorf("unable to start saml provider: %w", err)
}
@@ -726,6 +748,7 @@ func startAPIs(
keys.CSRFCookieKey,
cacheConnectors,
federatedLogoutsCache,
httpClient,
)
if err != nil {
return nil, fmt.Errorf("unable to start login: %w", err)