Since I and the agents sometimes get confused about which scopes and
types to use in our commits and PRs, I've created an explicit list that
we can verify against our existing `semantic.yml` file.
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
## Problem
Enabling `Disable Phone Login` (or `Disable Email Login`) in the login
policy caused some users to receive "User not found in the system" even
when logging in with a valid, non-phone identifier. Users whose
preferred login name looked like an email address (e.g. `[email protected]`
in an org-scoped context) were rejected incorrectly. Toggling the
setting back off immediately restored login for those users.
Fixes#11518
## Root Cause
In `loginname.ts` and `password.ts`, the post-lookup guard that enforces
the disable-phone/email restriction used `||` instead of `&&`:
```ts
// BEFORE (buggy): rejects if preferredLoginName doesn't match OR email doesn't match
// → any user whose preferredLoginName ≠ raw email is rejected
if (user.preferredLoginName !== concatLoginname || humanUser?.email?.email !== command.loginName) {
return preventUserEnumeration(...);
}
// AFTER (correct): rejects only if preferredLoginName doesn't match AND email doesn't match
// → user passes through if they matched by either their preferred login name or their email
if (user.preferredLoginName !== concatLoginname && humanUser?.email?.email !== command.loginName) {
return preventUserEnumeration(...);
}
```
The intent is to allow the user through if they matched by their
preferred login name **or** by the still-permitted identifier. By De
Morgan's law, the rejection condition must be `¬A ∧ ¬B`, not `¬A ∨ ¬B`.
## Changes
- **`loginname.ts`**: fixed 2 `||` → `&&` in the `disableLoginWithEmail`
and `disableLoginWithPhone` guards
- **`password.ts`**: fixed 4 `||` → `&&` across the same guards in both
`resetPassword` and `sendPassword`
- **`loginname.test.ts`**: added two regression tests:
- `disableLoginWithPhone=true`, user logs in with their email-format
preferred login name → must succeed (was broken)
- `disableLoginWithPhone=true`, user logs in with their actual phone
number → must be blocked (feature still works)
## Testing
All 654 unit tests pass.
Co-authored-by: Max Peintner <[email protected]>
This pull request makes a minor update to the Go feature version in the
dev container configuration, ensuring compatibility with the latest
patch releases in the 1.25 series.
* Updated the Go feature version from `1.25.3` to `1.25` in
`.devcontainer/devcontainer.json` to allow for the latest patch version
to be used.
Summary
- refreshed multiple concept, guide, SDK example, policy, and
troubleshooting pages to match the latest structure
- synchronized `apps/docs/lib/sidebar-data.ts` and
`apps/docs/redirects.json` with the new layout so navigation and URL
rewrites stay consistent
---------
Co-authored-by: Copilot <[email protected]>
Co-authored-by: fcoppede <[email protected]>
Summary
- audited doc CSVs to replace insecure http links and ensure paths point
to the migrated `apps/docs` structure
- preserved downstream link intent while keeping references aligned with
the `/docs` deployment prefix
---------
Co-authored-by: Copilot <[email protected]>
This pull request makes a small change to the environment variables used
when spawning a child process in the `generate-proto-docs.mjs` script.
The hardcoded `BUF_TOKEN` environment variable has been removed, and now
only the existing environment variables from `process.env` are passed to
the child process.
- Removed the hardcoded `BUF_TOKEN` from the environment variables when
spawning the child process in `generate-proto-docs.mjs`.
This fixes a case where potentially some static files get not properly
treated as inputs in the hash for nx cache calculation.
Also it fixes a problem where the assets.mdx get sorted randomly each
generation.
Factors in some overlap from
https://github.com/zitadel/zitadel/pull/11447
---------
Co-authored-by: Copilot <[email protected]>
This pull request introduces several improvements and security
enhancements to the documentation build scripts in
`apps/docs/scripts/fetch-remote-content.mjs`, as well as updates to the
test configuration in `apps/docs/package.json` and
`apps/docs/project.json`. The main focus is on enabling local
development workflows, improving safety when handling refs and file
paths, and making the codebase more robust against injection and
traversal attacks.
**Security and validation improvements:**
* Added `safeLog` and `isValidRef` helper functions to sanitize logs and
validate refs, preventing log and command injection vulnerabilities.
* Updated logic for reading local files and external content to ensure
paths are securely resolved and checked, preventing directory traversal
and unauthorized file access.
**Local development and workflow enhancements:**
* Refactored content fetching logic to support copying local content and
public assets when the source ref matches the local branch, enabling
easier local testing and development.
[[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L70-R202)
[[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1R230-L145)
[[3]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L155-R250)
* Improved handling of external files (like `defaults.yaml` and
`setup/steps.yaml`) in local and remote workflows, including secure
copying and conditional downloading.
[[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L70-R202)
[[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1R266-R364)
* Enhanced relative import fixing logic to robustly rewrite paths and
ensure external files are downloaded or copied as needed, with clearer
separation of cases for content, public, and external assets.
(F768070bL263R373,
[[1]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L310-R398)
[[2]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L345-L349)
[[3]](diffhunk://#diff-0d1ade7f3d86ad72c66b573c31b0bc34d318dbf964198164719822d300d397d1L360-R425)
**Testing and configuration updates:**
* Added a new `test:scripts` npm script for running script-level tests,
and updated the Nx test command to use this script for the docs app.
[[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R19)
[[2]](diffhunk://#diff-92d9997980c0871325f1a46a6d363cc28da597bd19ed327e979774d9e7838cabL216-R216)
These changes improve the reliability, security, and developer
experience of the documentation build process.
This pull request primarily updates dependencies in the documentation
app and the root package to keep them current and introduce new features
or bug fixes. The most notable changes are version bumps for several
core and UI-related packages, as well as the addition of new packages
related to syntax highlighting.
Dependency updates and additions:
* Updated `fumadocs-core`, `fumadocs-mdx`, and `fumadocs-ui` to version
`16.4.11`, `14.2.6`, and `16.4.11` respectively, and bumped
`fumadocs-openapi` to `^10.2.4` in `apps/docs/package.json` for improved
documentation features and bug fixes.
* Updated `next` and `eslint-config-next` to version `16.1.6` in
`apps/docs/package.json` for framework and linting improvements.
[[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R27-R44)
[[2]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677L60-R62)
* Bumped `shiki` to `^3.21.0` in both `apps/docs/package.json` and the
root `package.json` for enhanced syntax highlighting.
[[1]](diffhunk://#diff-d03d2ce97fad5059ad6248fca5f5919994b09bca360f883318c03f1f817ae677R27-R44)
[[2]](diffhunk://#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R19)
New package additions for syntax highlighting:
* Added `@shikijs/rehype` and `@shikijs/types` at version `^3.21.0` in
`apps/docs/package.json` to support advanced code highlighting in
documentation.
This pull request significantly expands and restructures the Kubernetes
deployment documentation for Zitadel. It introduces detailed,
task-focused guides for installation, configuration, ingress, and
database setup, replacing the previous minimal documentation. The new
docs provide comprehensive instructions and best practices for deploying
Zitadel on Kubernetes using Helm, including security, scaling, and high
availability considerations.
The most important changes are:
**Documentation Restructuring and Overview**
- Added a new `index.mdx` providing an overview of the Zitadel Helm
chart, architecture, prerequisites, and quick links to relevant
resources and next steps.
- Removed the old minimal Kubernetes deployment page and replaced it
with a structured, multi-page documentation set.
**Installation and Setup**
- Added an `installation.mdx` guide with step-by-step instructions for
preparing prerequisites, creating Kubernetes secrets, configuring
`values.yaml`, installing the Helm chart, and verifying the deployment.
**Configuration and Best Practices**
- Added a `configuration.mdx` guide covering Helm chart configuration
options, including replica count, container images, security contexts,
external domain setup, secrets management, scaling, autoscaling, pod
disruption budgets, and anti-affinity rules.
**Ingress and Database Configuration**
- Added an `ingress.mdx` guide detailing how to configure Kubernetes
ingress resources for Zitadel and Login containers, including TLS
termination and certificate management.
- Added a `database.mdx` guide explaining how to connect Zitadel to
PostgreSQL with various TLS/security options and how to manage database
credentials and certificates using Kubernetes secrets.
This pull request updates the fallback branch logic and improves
handling of branch names in the `fetch-remote-content.mjs` script. The
changes ensure better compatibility with both `main` and `master`
branches, and clarify how documentation versions are labeled.
Branch handling improvements:
* Changed the fallback branch from `fuma-docs` to `main` for fetching
content when a newer version does not exist.
* Updated branch detection logic to recognize both `main` and `master`
as valid primary branches, instead of just `main` and `fuma-docs`.
* Improved local version labeling: if the current branch is `main` or
`master`, it now returns a standardized label (`ZITADEL Docs`) and marks
it as not unreleased; other branches are handled accordingly.
## Todos for release
- [x] Configure Env in docs project on vercel
- [x] Configure Root Path in the docs project on vercel
- [ ] Remove old CSP https://github.com/zitadel/website/pull/1592
## What we did
This pull request migrates the project documentation from the old
`docs/` directory to the new `apps/docs/` directory, introduces a new
documentation system built with Next.js and Fumadocs, and updates all
relevant references, configuration files, and documentation to reflect
this change. It also adds new configuration and ignore files for the new
documentation app, updates CI and linting to exclude the new docs from
certain checks, and revises the contributing guidelines accordingly.
**Documentation System Migration and New Docs App**
* Migrated all documentation from `docs/` to `apps/docs/`, and updated
all references in `README.md`, `CONTRIBUTING.md`, and other files to
point to the new location.
[[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640)
[[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607)
[[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687)
[[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3)
[[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30)
* Added a new Next.js/Fumadocs-based documentation app under
`apps/docs/`, including core app files, layouts, routing, search API,
and a comprehensive `README.md` with development and contribution
instructions.
[[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74)
[[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39)
[[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7)
[apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81),
[apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79),
[[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7)
[[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29)
[[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25)
**Configuration and Tooling Updates**
* Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and
`.github/dependabot.yml` to properly handle the new docs app: excluded
`apps/docs` from certain checks, added npm dependency updates for the
docs app, and excluded generated content.
[[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14)
[[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6)
[[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129)
[[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106)
* Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3
version for consistency.
**Licensing and Miscellaneous**
* Added `apps/docs/` to the list of licensed directories in
`LICENSING.md`.
These changes ensure the documentation is now maintained in a modern,
scalable system and all project tooling is updated to support the new
structure.
---------
Co-authored-by: Federico Coppede <[email protected]>
This pull request enhances the documentation site configuration by
introducing a new plugin and making minor adjustments to existing
settings. The primary focus is on integrating the
`@signalwire/docusaurus-plugin-llms-txt` plugin to improve content
handling and adding relevant dependencies.
### Plugin Integration:
*
[`docs/docusaurus.config.js`](diffhunk://#diff-28742c737e523f302e6de471b7fc27284dc8cf720be639e6afe4c17a550cd654R245-R255):
Added the `@signalwire/docusaurus-plugin-llms-txt` plugin with
configuration options, including a depth of 3, log level of 1, exclusion
of certain routes, and enabling markdown file support.
*
[`docs/package.json`](diffhunk://#diff-adfa337ce44dc2902621da20152a048dac41878cf3716dfc4cc56d03aa212a56R33):
Included the `@signalwire/docusaurus-plugin-llms-txt` dependency
(version `^1.2.0`) to support the new plugin integration.
### Configuration Adjustments:
*
[`docs/docusaurus.config.js`](diffhunk://#diff-28742c737e523f302e6de471b7fc27284dc8cf720be639e6afe4c17a550cd654L221):
Removed the `docItemComponent` property under the `module.exports`
configuration.
This pull request updates several dependencies in the
`docs/package.json` file to their latest minor versions, ensuring
compatibility and access to the latest features and fixes.
Dependency updates:
* Updated `@docusaurus/core`, `@docusaurus/faster`,
`@docusaurus/preset-classic`, `@docusaurus/theme-mermaid`, and
`@docusaurus/theme-search-algolia` from version `^3.8.0` to `^3.8.1` in
the `dependencies` section.
* Updated `@docusaurus/module-type-aliases` and `@docusaurus/types` from
version `^3.8.0` to `^3.8.1` in the `devDependencies` section.
Co-authored-by: Florian Forster <florian@zitadel>
This pull request includes a minor change to the `README.md` file. It
removes a broken markdown link syntax for an image and replaces it with
the correct image syntax to properly display the "New Login Showcase"
image.
> [!IMPORTANT]
> We need to change the ENV `VERCEL_FORCE_NO_BUILD_CACHE` to `0` which
is currently `1` to enable the cache on all deployments
This pull request includes several updates to the documentation and
benchmarking components, focusing on improving performance, error
handling, and compatibility with newer versions of Docusaurus. The key
changes include the removal of outdated configurations, updates to
dependencies, and enhancements to the `BenchmarkChart` component for
better error handling and data validation.
### Documentation and Configuration Updates:
* **Removed outdated Babel and Webpack configurations**: The
`babel.config.js` file was deleted, and the Webpack configuration was
removed from `docusaurus.config.js` to align with the latest Docusaurus
setup.
[[1]](diffhunk://#diff-2ed4f5b03d34a87ef641e9e36af4a98a1c0ddaf74d07ce93665957be69b7b09aL1-L4)
[[2]](diffhunk://#diff-28742c737e523f302e6de471b7fc27284dc8cf720be639e6afe4c17a550cd654L204-L225)
* **Added experimental features in Docusaurus**: Introduced a `future`
section in `docusaurus.config.js` to enable experimental features like
`swcJsLoader`, `rspackBundler`, and `lightningCssMinimizer`, while
disabling problematic settings due to known issues.
### Dependency Updates:
* **Upgraded Docusaurus and related packages**: Updated dependencies in
`package.json` to use Docusaurus version `^3.8.0` and newer versions of
associated plugins and themes for improved performance and
compatibility.
[[1]](diffhunk://#diff-adfa337ce44dc2902621da20152a048dac41878cf3716dfc4cc56d03aa212a56L25-R39)
[[2]](diffhunk://#diff-adfa337ce44dc2902621da20152a048dac41878cf3716dfc4cc56d03aa212a56L66-R67)
### Component Enhancements:
* **Improved `BenchmarkChart` error handling**: Refactored the
`BenchmarkChart` component to validate input data, handle errors
gracefully, and provide meaningful fallback messages when data is
missing or invalid.
[[1]](diffhunk://#diff-ce9fccf51f6b863dd58a39f361a9cf980b10357bccc7381f928788483b30cb0eL4-R21)
[[2]](diffhunk://#diff-ce9fccf51f6b863dd58a39f361a9cf980b10357bccc7381f928788483b30cb0eR72-R76)
* **Fixed edge cases in chart rendering**: Addressed issues like invalid
timestamps, undefined `p99` values, and empty data sets to ensure robust
chart generation.
[[1]](diffhunk://#diff-ce9fccf51f6b863dd58a39f361a9cf980b10357bccc7381f928788483b30cb0eL19-L29)
[[2]](diffhunk://#diff-ce9fccf51f6b863dd58a39f361a9cf980b10357bccc7381f928788483b30cb0eL38-R61)
### Documentation Benchmark Updates:
* **Simplified imports in benchmark files**: Replaced the use of
`raw-loader` with direct imports for benchmark data in multiple `.mdx`
files to streamline the documentation setup.
[[1]](diffhunk://#diff-a9710709396e5ff6756aedf89dfcbd62aeea15368ba33bf3932ebf33046a29e8L66-R66)
[[2]](diffhunk://#diff-0a9b6103c97c58792450bfd2d337bbb8a6b72df2ae326cc56ebc96e01c0acd6bL35-R35)
[[3]](diffhunk://#diff-38f45388e065c57f1282a43bb319354da3c218e96d95ca20f4d11709f48491b8L36-R36)
[[4]](diffhunk://#diff-b8e792ebe42fcb16a493e35d23b58a91c2117d949953487e70f379c64e5cb7c0L36-R36)
[[5]](diffhunk://#diff-3778acfa893504004008b162fa95f21f1c7c40dcf1868bbbaaa504ac5d51901aL38-R38)
# Which Problems Are Solved
This improves the `ADOPTERS.md` file to better understand its purpose.
# How the Problems Are Solved
Adding additional instructions to the `ADOPTERS.md` file
# Which Problems Are Solved
We want to give adopters a platform to show that they are using ZITADEL
# How the Problems Are Solved
Addding an ADOPTERS.md file
# Additional Changes
none
# Additional Context
none
# Fallback to Vercel CI
Since we cannot share the vercel_token on forks we cannot deploy by
vercel CLI.
This PR reverts to the last working state by using vercel CI.
I will look into a fix with an npm script or a turbo config to ignore
builds on folder changes.
# Which Problems Are Solved
This allows us to build multiple docs in parallel and only runs when
docs/proto are changed.
# Additional Changes
- [ ] Change "required" in GitHub from Vercel to the docs flow
---------
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
We identified some frequent rate limits in ZITADEL Cloud.
# How the Problems Are Solved
We increase the rate limits of some endpoint.
# Additional Context
(Private) Relates to https://github.com/zitadel/DevOps/issues/43
* chore: remove crdb from third party sub-processors
* remove clickhouse
* add hubspot
* fix: google end-user data flag
---------
Co-authored-by: mffap <[email protected]>
* integrate docs into nav
* generator for local use, production needs to be set by env
* fix typo
* local dev
* docs: annotate the first user endpoints in the management api
* docs: annotate the first user endpoints in the management api
* docs: annotate the first user endpoints in the management api
* docs: annotate the first user endpoints in the management api
* docs: add header params
* rewrite docs links and improve ci
* tweak build command
* fix path
* Update docs/docusaurus.config.js
Co-authored-by: Max Peintner <[email protected]>
* fix docker
* docs: add header params
* docs: Add tags to management api. add some descriptions
* docs: more descriptions
* docs: more descriptions
* docs: required fields
* docs: example request
* docs: example request
* docs: example request
* docs: example request
* docs: example request
* docs: user metadata requests
* docs: user requests
* docs: user requests
* docs: user requests
* docs: user requests
* docs: change nav add first methods to authentication api
* docs: auth api
* docs: auth api
* docs: auth api
* docs: auth api
* docs: auth api
* docs: api sidenav
* chore: use buf without docker
* fix deploy
* fix ci
* fix vercel
* docs: admin
* docs: admin api docs
* docs: admin api docs
* docs: admin api docs
* docs: admin api docs
* docs: security
* docs: security
* docs: admin api
* docs: change to env vars
* docs: auth api
* docs: remove assets, deprecated requests, menu
* reworked page with PaloAltoNetworks/docusaurus-openapi-docs
* works with the resolutions
* fix broken build by adding assets again
* add tags to menu
* chore: improve build speed
* no-minify
* test ssr
* ssr 20
* use lazy
* increase mem
* use default mem
* change names
* docs: remove assets, deprecated requests, menu
* docs: management api
* docs: management api
* docs: management api
* docs: sidebar
* not the best word smithing but it is ;-)
* more typos
* merge main
* fix some error
* trial
* update grpc gateway
* trigger vercel build
* docs: deprecated requests
* docs: deprecated requests
---------
Co-authored-by: Fabienne <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
* chore(docs): fix links for domain migration
* try trailing slash for netlify
* trial
* fix typo
* test path
* try preview proxied
* test local proxy
* try to define the domain with redirect to /docs
* remove build commands
* debug netlify router and fix image link
* working config
* fix analytics
Florian ForsterandGitHub
