feat(login): additionally use email/phone for authentication (#4563)

* feat: add ability to disable login by email and phone * feat: check login by email and phone * fix: set verified email / phone correctly on notify users * update projection version * fix merge * fix email/phone verified reduce tests * fix user tests * loginname check * cleanup * fix: update user projection version to handle fixed statement
2026-11-03 04:42:15 +00:00 · 2022-10-17 19:19:15 +00:00
parent 9ae58b62fd
commit b0b1e94090
54 changed files with 1245 additions and 768 deletions
@@ -15,56 +15,17 @@ import (
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 )

-func (c *Commands) ChangeDefaultLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
-	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
-	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.LoginPolicyWriteModel.WriteModel)
-	event, err := c.changeDefaultLoginPolicy(ctx, instanceAgg, existingPolicy, policy)
+func (c *Commands) ChangeDefaultLoginPolicy(ctx context.Context, policy *ChangeLoginPolicy) (*domain.ObjectDetails, error) {
+	instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
+	cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, prepareChangeDefaultLoginPolicy(instanceAgg, policy))
 	if err != nil {
 		return nil, err
 	}
-	pushedEvents, err := c.eventstore.Push(ctx, event)
+	pushedEvents, err := c.eventstore.Push(ctx, cmds...)
 	if err != nil {
 		return nil, err
 	}
-	err = AppendAndReduce(existingPolicy, pushedEvents...)
-	if err != nil {
-		return nil, err
-	}
-	return writeModelToLoginPolicy(&existingPolicy.LoginPolicyWriteModel), nil
-}
-
-func (c *Commands) changeDefaultLoginPolicy(ctx context.Context, instanceAgg *eventstore.Aggregate, existingPolicy *InstanceLoginPolicyWriteModel, policy *domain.LoginPolicy) (eventstore.Command, error) {
-	if ok := domain.ValidateDefaultRedirectURI(policy.DefaultRedirectURI); !ok {
-		return nil, caos_errs.ThrowInvalidArgument(nil, "IAM-SFdqd", "Errors.IAM.LoginPolicy.RedirectURIInvalid")
-	}
-	err := c.defaultLoginPolicyWriteModelByID(ctx, existingPolicy)
-	if err != nil {
-		return nil, err
-	}
-	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-M0sif", "Errors.IAM.LoginPolicy.NotFound")
-	}
-	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx,
-		instanceAgg,
-		policy.AllowUsernamePassword,
-		policy.AllowRegister,
-		policy.AllowExternalIDP,
-		policy.ForceMFA,
-		policy.HidePasswordReset,
-		policy.IgnoreUnknownUsernames,
-		policy.AllowDomainDiscovery,
-		policy.PasswordlessType,
-		policy.DefaultRedirectURI,
-		policy.PasswordCheckLifetime,
-		policy.ExternalLoginCheckLifetime,
-		policy.MFAInitSkipLifetime,
-		policy.SecondFactorCheckLifetime,
-		policy.MultiFactorCheckLifetime,
-	)
-	if !hasChanged {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.IAM.LoginPolicy.NotChanged")
-	}
-	return changedEvent, nil
+	return pushedEventsToObjectDetails(pushedEvents), nil
 }

 func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpProvider *domain.IDPProvider) (*domain.IDPProvider, error) {
@@ -255,6 +216,44 @@ func (c *Commands) getDefaultLoginPolicy(ctx context.Context) (*domain.LoginPoli
 	return policy, nil
 }

+func prepareChangeDefaultLoginPolicy(a *instance.Aggregate, policy *ChangeLoginPolicy) preparation.Validation {
+	return func() (preparation.CreateCommands, error) {
+		if ok := domain.ValidateDefaultRedirectURI(policy.DefaultRedirectURI); !ok {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "IAM-SFdqd", "Errors.IAM.LoginPolicy.RedirectURIInvalid")
+		}
+		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
+			wm := NewInstanceLoginPolicyWriteModel(ctx)
+			if err := queryAndReduce(ctx, filter, wm); err != nil {
+				return nil, err
+			}
+			if !wm.State.Exists() {
+				return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-M0sif", "Errors.IAM.LoginPolicy.NotFound")
+			}
+			changedEvent, hasChanged := wm.NewChangedEvent(ctx, &a.Aggregate,
+				policy.AllowUsernamePassword,
+				policy.AllowRegister,
+				policy.AllowExternalIDP,
+				policy.ForceMFA,
+				policy.HidePasswordReset,
+				policy.IgnoreUnknownUsernames,
+				policy.AllowDomainDiscovery,
+				policy.DisableLoginWithEmail,
+				policy.DisableLoginWithPhone,
+				policy.PasswordlessType,
+				policy.DefaultRedirectURI,
+				policy.PasswordCheckLifetime,
+				policy.ExternalLoginCheckLifetime,
+				policy.MFAInitSkipLifetime,
+				policy.SecondFactorCheckLifetime,
+				policy.MultiFactorCheckLifetime)
+			if !hasChanged {
+				return nil, caos_errs.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.IAM.LoginPolicy.NotChanged")
+			}
+			return []eventstore.Command{changedEvent}, nil
+		}, nil
+	}
+}
+
 func prepareAddDefaultLoginPolicy(
 	a *instance.Aggregate,
 	allowUsernamePassword bool,
@@ -264,6 +263,8 @@ func prepareAddDefaultLoginPolicy(
 	hidePasswordReset bool,
 	ignoreUnknownUsernames bool,
 	allowDomainDiscovery bool,
+	disableLoginWithEmail bool,
+	disableLoginWithPhone bool,
 	passwordlessType domain.PasswordlessType,
 	defaultRedirectURI string,
 	passwordCheckLifetime time.Duration,
@@ -295,6 +296,8 @@ func prepareAddDefaultLoginPolicy(
 					hidePasswordReset,
 					ignoreUnknownUsernames,
 					allowDomainDiscovery,
+					disableLoginWithEmail,
+					disableLoginWithPhone,
 					passwordlessType,
 					defaultRedirectURI,
 					passwordCheckLifetime,