Merge commit from fork

* fix: Improve host header handling and deployment mode detection

* ZITADEL_CLOUD env

* refactor service config

* service config

* cleanup

* cleanup

* util for original and public host

* instanceHost, publicHost

* cleanup constructUrl

* cleanup middleware

* add x-zitadel-forward-host as fallback for current cloud setup

* fix build

* fix: lint

* fix: update test mocks

* fix: provide basepath to unit tests

* host handling

* unit tests

* imports

* fix: getPublicHost instead of getInstanceHost

* unit tests

* update nextjs, implement jwt verify for logout_token

* pass logout information in jwt to login v2

* handle hosts in jwks url

* point idp callbacks to the api and not the login UI

* logout_hint out of logout token, typecheck

* rm unused imports

* fix oidc integration test

---------

Co-authored-by: Livio Spring <[email protected]>

internal/api/oidc/auth_request_test.go

@@ -1,9 +1,13 @@
 package oidc
 
 import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
 	"net/url"
 	"testing"
 
+	"github.com/go-jose/go-jose/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/text/language"
@@ -18,6 +22,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 		redirectURI    string
 		logoutHint     string
 		uiLocales      []language.Tag
+		signer         jose.Signer
 		expectedParams map[string]string
 	}{
 		{
@@ -26,6 +31,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			redirectURI:  "https://client/cb",
 			expectedParams: map[string]string{
 				"post_logout_redirect": "https://client/cb",
+				"logout_token":         "", // presence checked separately
 			},
 		},
 		{
@@ -36,6 +42,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			expectedParams: map[string]string{
 				"post_logout_redirect": "https://client/cb",
 				"logout_hint":          "[email protected]",
+				"logout_token":         "", // presence checked separately
 			},
 		},
 		{
@@ -46,6 +53,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			expectedParams: map[string]string{
 				"post_logout_redirect": "https://client/cb",
 				"ui_locales":           "en it",
+				"logout_token":         "", // presence checked separately
 			},
 		},
 		{
@@ -58,6 +66,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 				"post_logout_redirect": "https://client/cb",
 				"logout_hint":          "logoutme",
 				"ui_locales":           "de-CH fr",
+				"logout_token":         "", // presence checked separately
 			},
 		},
 		{
@@ -66,6 +75,7 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			redirectURI:  "https://client/cb",
 			expectedParams: map[string]string{
 				"post_logout_redirect": "https://client/cb",
+				"logout_token":         "", // presence checked separately
 			},
 		},
 	}
@@ -79,9 +89,10 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			require.NoError(t, err)
 
 			// When
-			got := buildLoginV2LogoutURL(logoutURI, tc.redirectURI, tc.logoutHint, tc.uiLocales)
+			got, err := buildLoginV2LogoutURL(logoutURI, tc.redirectURI, tc.logoutHint, tc.uiLocales, signer)
 
 			// Then
+			require.NoError(t, err)
 			gotURL, err := url.Parse(got)
 			require.NoError(t, err)
 			require.NotContains(t, gotURL.String(), "/logout/")
@@ -91,8 +102,39 @@ func TestBuildLoginV2LogoutURL(t *testing.T) {
 			require.Len(t, q, len(tc.expectedParams))
 
 			for k, v := range tc.expectedParams {
+				if k == LoginLogoutTokenParam {
+					assertLogoutToken(t, q.Get(k), &logoutTokenPayload{
+						PostLogoutRedirectURI: tc.redirectURI,
+						LogoutHint:            tc.logoutHint,
+						UILocales:             tc.uiLocales,
+					})
+					continue
+				}
 				assert.Equal(t, v, q.Get(k))
 			}
 		})
 	}
 }
+
+func assertLogoutToken(t *testing.T, token string, payload *logoutTokenPayload) {
+	signature, err := jose.ParseSigned(token, []jose.SignatureAlgorithm{jose.RS256})
+	require.NoError(t, err)
+	logoutToken := new(logoutTokenPayload)
+	err = json.Unmarshal(signature.UnsafePayloadWithoutVerification(), logoutToken)
+	require.NoError(t, err)
+	assert.Equal(t, payload, logoutToken)
+}
+
+var (
+	privKey, _ = rsa.GenerateKey(rand.Reader, 2048)
+	signer     = func() jose.Signer {
+		signer, _ := jose.NewSigner(
+			jose.SigningKey{
+				Algorithm: jose.RS256,
+				Key:       privKey,
+			},
+			(&jose.SignerOptions{}).WithType("JWT"),
+		)
+		return signer
+	}()
+)