andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-03 12:52:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Inject DenyList from config to `StartCommands()`

* Implementation draft

* Move address checker to separate package

* Migrate usages of actions.AddressChecker to denylist.AddressChecker

* Rename denylist package files

* Pass []denylist.AddressChecker to StartCommand

* Add DenyList to defaults.yaml and add custom config parser

* net: add HostnameToIPList function

* denylist: Add IsHostBlocked()

* actions: use denylist.IsHostBlocked()

* command: Inject ip lookup function + extend add target validationt test

* command: Unexport ChangeTarget.IsValid()

* command: Add denyList check on ChangeTarget validation

* command: Export ActionsV2DenyList and IPLookupFunction params

* Lint fix

* Check denylist during action execution

* Fix integration tests

* Apply suggestions

* Add `mapstructure.StringToSliceHookFunc()` to decode `HTTPConfigDecodeHook`
This commit is contained in:
Marco A.
2026-02-25 06:33:28 +01:00
committed by GitHub
parent bac224c56d
commit b2532e9666
38 changed files with 823 additions and 292 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/grpc/server/middleware/execution_interceptor_test.go
+73
View File
@@ -20,6 +20,7 @@ import (
"google.golang.org/protobuf/types/known/structpb"
"github.com/zitadel/zitadel/internal/crypto"
"github.com/zitadel/zitadel/internal/denylist"
"github.com/zitadel/zitadel/internal/execution"
target_domain "github.com/zitadel/zitadel/internal/execution/target"
)
@@ -63,6 +64,10 @@ func newMockContextInfoResponse(fullMethod, request, response string) *ContextIn
}
func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
type target struct {
reqBody execution.ContextInfo
sleep time.Duration
@@ -78,6 +83,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
fullMethod string
req interface{}
getActiveSigningWebKey execution.GetActiveSigningWebKey
deniedIPs []denylist.AddressChecker
}
type res struct {
want interface{}
@@ -275,6 +281,36 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
want: newMockContentRequest("content1"),
},
},
{
"when target endpoint is in denylist should return error",
args{
ctx: context.Background(),
fullMethod: "/service/method",
executionTargets: []target_domain.Target{
{
ExecutionID: "request./zitadel.session.v2.SessionService/SetSession",
TargetID: "target",
TargetType: target_domain.TargetTypeCall,
Timeout: time.Minute,
InterruptOnError: true,
},
},
targets: []target{
{
reqBody: newMockContextInfoRequest("/service/method", "content"),
respBody: newMockContentRequest("content1"),
sleep: 0,
statusCode: http.StatusOK,
requestVerification: validateJSONPayload,
},
},
req: newMockContentRequest("content"),
deniedIPs: deniedIPs,
},
res{
wantErr: true,
},
},
{
"target async, timeout",
args{
@@ -620,6 +656,7 @@ func Test_executeTargetsForGRPCFullMethod_request(t *testing.T) {
tt.args.req,
nil,
tt.args.getActiveSigningWebKey,
tt.args.deniedIPs,
)
if tt.res.wantErr {
@@ -725,6 +762,10 @@ func validateJWEPayload(t *testing.T) func(expected, sent []byte) bool {
}
func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
deniedLocalhost, err := denylist.NewHostChecker("127.0.0.1")
require.NoError(t, err)
deniedIPs := []denylist.AddressChecker{deniedLocalhost}
type target struct {
reqBody execution.ContextInfo
sleep time.Duration
@@ -739,6 +780,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
fullMethod string
req interface{}
resp interface{}
deniedIPs []denylist.AddressChecker
}
type res struct {
want interface{}
@@ -833,6 +875,36 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
want: newMockContentRequest("response1"),
},
},
{
"when target endpoint is in deny list should return error",
args{
ctx: context.Background(),
fullMethod: "/service/method",
executionTargets: []target_domain.Target{
{
ExecutionID: "response./zitadel.session.v2.SessionService/SetSession",
TargetID: "target",
TargetType: target_domain.TargetTypeCall,
Timeout: time.Minute,
InterruptOnError: true,
},
},
targets: []target{
{
reqBody: newMockContextInfoResponse("/service/method", "request", "response"),
respBody: newMockContentRequest("response1"),
sleep: 0,
statusCode: http.StatusOK,
},
},
req: newMockContentRequest("request"),
resp: newMockContentRequest("response"),
deniedIPs: deniedIPs,
},
res{
wantErr: true,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
@@ -858,6 +930,7 @@ func Test_executeTargetsForGRPCFullMethod_response(t *testing.T) {
tt.args.resp,
nil,
mockGetActiveSigningWebKey(),
tt.args.deniedIPs,
)
if tt.res.wantErr {