andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-03 04:42:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Marco A.
2026-06-15 15:36:14 +02:00
committed by GitHub
co-authored by Livio Spring
parent d184e976fc
commit 8e82ec1cb9
97 changed files with 1834 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/ui/login/custom_action.go
+4 -4
View File
@@ -152,7 +152,7 @@ func (l *Login) runPostExternalAuthenticationActions(
apiFields,
a.Script,
a.Name,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
)
cancel()
if err != nil {
@@ -226,7 +226,7 @@ func (l *Login) runPostInternalAuthenticationActions(
apiFields,
a.Script,
a.Name,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
)
cancel()
if err != nil {
@@ -346,7 +346,7 @@ func (l *Login) runPreCreationActions(
apiFields,
a.Script,
a.Name,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
)
cancel()
if err != nil {
@@ -423,7 +423,7 @@ func (l *Login) runPostCreationActions(
apiFields,
a.Script,
a.Name,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx), actions.WithUUID(actionCtx))...,
append(actions.ActionToOptions(a), actions.WithHTTP(actionCtx, l.httpClient), actions.WithUUID(actionCtx))...,
)
cancel()
if err != nil {
internal/api/ui/login/external_provider_handler.go
+11
View File
@@ -1053,6 +1053,7 @@ func (l *Login) googleProvider(ctx context.Context, identityProvider *query.IDPT
secret,
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.GoogleIDPTemplate.Scopes,
l.httpClient,
)
}
@@ -1079,6 +1080,7 @@ func (l *Login) oidcProvider(ctx context.Context, identityProvider *query.IDPTem
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.OIDCIDPTemplate.Scopes,
openid.DefaultMapper,
l.httpClient,
opts...,
)
}
@@ -1092,6 +1094,7 @@ func (l *Login) jwtProvider(identityProvider *query.IDPTemplate) (*jwt.Provider,
identityProvider.JWTIDPTemplate.HeaderName,
identityProvider.JWTIDPTemplate.Audience,
l.idpConfigAlg,
l.httpClient,
)
}
@@ -1123,6 +1126,7 @@ func (l *Login) oauthProvider(ctx context.Context, identityProvider *query.IDPTe
func() idp.User {
return oauth.NewUserMapper(identityProvider.OAuthIDPTemplate.IDAttribute)
},
l.httpClient,
opts...,
)
}
@@ -1176,6 +1180,7 @@ func (l *Login) samlProvider(ctx context.Context, identityProvider *query.IDPTem
identityProvider.Metadata,
identityProvider.Certificate,
key,
l.httpClient,
opts...,
)
}
@@ -1198,6 +1203,7 @@ func (l *Login) azureProvider(ctx context.Context, identityProvider *query.IDPTe
secret,
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.AzureADIDPTemplate.Scopes,
l.httpClient,
opts...,
)
}
@@ -1212,6 +1218,7 @@ func (l *Login) githubProvider(ctx context.Context, identityProvider *query.IDPT
secret,
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.GitHubIDPTemplate.Scopes,
l.httpClient,
)
}
@@ -1229,6 +1236,7 @@ func (l *Login) githubEnterpriseProvider(ctx context.Context, identityProvider *
identityProvider.GitHubEnterpriseIDPTemplate.TokenEndpoint,
identityProvider.GitHubEnterpriseIDPTemplate.UserEndpoint,
identityProvider.GitHubIDPTemplate.Scopes,
l.httpClient,
)
}
@@ -1242,6 +1250,7 @@ func (l *Login) gitlabProvider(ctx context.Context, identityProvider *query.IDPT
secret,
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.GitLabIDPTemplate.Scopes,
l.httpClient,
)
}
@@ -1257,6 +1266,7 @@ func (l *Login) gitlabSelfHostedProvider(ctx context.Context, identityProvider *
secret,
l.baseURL(ctx)+EndpointExternalLoginCallback,
identityProvider.GitLabSelfHostedIDPTemplate.Scopes,
l.httpClient,
)
}
@@ -1272,6 +1282,7 @@ func (l *Login) appleProvider(ctx context.Context, identityProvider *query.IDPTe
l.baseURL(ctx)+EndpointExternalLoginCallbackFormPost,
privateKey,
identityProvider.AppleIDPTemplate.Scopes,
l.httpClient,
)
}
internal/api/ui/login/login.go
+3
View File
@@ -44,6 +44,7 @@ type Login struct {
idpConfigAlg crypto.EncryptionAlgorithm
userCodeAlg crypto.EncryptionAlgorithm
caches *Caches
httpClient *http.Client
}
type Config struct {
@@ -198,6 +199,7 @@ func CreateLogin(
csrfCookieKey []byte,
cacheConnectors connector.Connectors,
federateLogoutCache cache.Cache[federatedlogout.Index, string, *federatedlogout.FederatedLogout],
httpClient *http.Client,
) (*Login, error) {
login := &Login{
oidcAuthCallbackURL: oidcAuthCallbackURL,
@@ -210,6 +212,7 @@ func CreateLogin(
authRepo: authRepo,
idpConfigAlg: idpConfigAlg,
userCodeAlg: userCodeAlg,
httpClient: httpClient,
}
csrfInterceptor := createCSRFInterceptor(config.CSRFCookieName, csrfCookieKey, externalSecure, login.csrfErrorHandler())
cacheInterceptor := createCacheInterceptor(config.Cache.MaxAge, config.Cache.SharedMaxAge, assetCache)