Commit Graph
751 Commits
Author SHA1 Message Date
6f07b8deee docs: Quickstart add frameworks (#11485)
# Which Problems Are Solved

The quickstart only shows the steps to take to get a working zitadel
login into your app with react.
For users with another framework or languages we didn't show how to get
to success fast.

# How the Problems Are Solved

- Adding different frameworks to the qucisktart example
- Make sure the app configurations in the onboarding flow from the
console match the configurations from the examples
- Docs link in console onboarding flow point towards quickstart
- Quickstart accepts framework selector, to pre select a framework from
another page

---------

Co-authored-by: Federico Coppede <[email protected]>
Co-authored-by: Copilot <[email protected]>
2026-02-04 13:09:25 +01:00
b99271755b chore: renamed one time password to OTP (#11447)
# Which Problems Are Solved

naming consistency for TOTP/OTP

# How the Problems Are Solved


# Additional Changes


# Additional Context

- Closes #11299 
- Closes #11302 
- Closes #11304

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Copilot <[email protected]>
2026-02-04 10:20:47 +01:00
Wim Van LaerandGitHub 61d4060df3 chore: naming inconsistency application (#11431) 2026-02-04 07:20:07 +00:00
09cf7cf0ae feat(oauth/oidc): move token exchange from beta to GA (#11475)
# Which Problems Are Solved

This PR marks the OAuth2 Token Exchange as general available (GA).

# How the Problems Are Solved

- API:
- deprecated the feature toggle (to prevent breaking changes) in v2beta
and v2 API
- removed all related event logic and updated the projection interation
  - removed the toggle usage for token exchange
  - removed related translations
- Management Console:
  - removed the feature toggle and its translations
- Docs:
  - removed all beta labels and feature toggle notes

# Additional Changes

- removed unused `Errors.WebKey.FeatureDisabled` translations

# Additional Context

- closes #11114

---------

Co-authored-by: Marco A. <[email protected]>
2026-02-02 09:47:56 +00:00
Florian ForsterandGitHub f7277b8641 docs: fix links from console and update nextjs (#11465) 2026-01-29 10:09:29 -08:00
d8ea041c56 docs: introduce versioned docs and migrate to fuma (#11166)
## Todos for release

- [x] Configure Env in docs project on vercel
- [x] Configure Root Path in the docs project on vercel
- [ ] Remove old CSP https://github.com/zitadel/website/pull/1592

## What we did

This pull request migrates the project documentation from the old
`docs/` directory to the new `apps/docs/` directory, introduces a new
documentation system built with Next.js and Fumadocs, and updates all
relevant references, configuration files, and documentation to reflect
this change. It also adds new configuration and ignore files for the new
documentation app, updates CI and linting to exclude the new docs from
certain checks, and revises the contributing guidelines accordingly.

**Documentation System Migration and New Docs App**

* Migrated all documentation from `docs/` to `apps/docs/`, and updated
all references in `README.md`, `CONTRIBUTING.md`, and other files to
point to the new location.
[[1]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L585-L640)
[[2]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L660-R607)
[[3]](diffhunk://#diff-eca12c0a30e25b4b46522ebf89465a03ba72a03f540796c979137931d8f92055L740-R687)
[[4]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L2-R3)
[[5]](diffhunk://#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5L30-R30)
* Added a new Next.js/Fumadocs-based documentation app under
`apps/docs/`, including core app files, layouts, routing, search API,
and a comprehensive `README.md` with development and contribution
instructions.
[[1]](diffhunk://#diff-5a1b07344a2c1b4d3f37b23ff1388b62cd9f57dea3c1cd23d8a0412b7602b132R1-R74)
[[2]](diffhunk://#diff-462b9ad1eabbb7d1c29bb9c36e4931eb180fd7190900e6d2babf8f4d66ad1c28R1-R39)
[[3]](diffhunk://#diff-e16ae25660ded787b10ac35dea96d5ecaacf895dae0afc8a9bd4382dc79a8c87R1-R7)
[apps/docs/app/[[...slug]]/layout.tsxR1-R81](diffhunk://#diff-59e08acde4e805b7aeccef1dcf98f1d71dfc550777e6b9402085cee0e9fa4e0aR1-R81),
[apps/docs/app/[[...slug]]/page.tsxR1-R79](diffhunk://#diff-e5df3f80d0fa01e12d63d81f29c57a9d14e846c78fd3beabb2ef768e38fd9580R1-R79),
[[4]](diffhunk://#diff-389b34918e040cacaa87cd7201ffa462cc2b0b716736f537e3d3c660ac69353bR1-R7)
[[5]](diffhunk://#diff-d3b03416d1c457b19f1c27b26f2db741412df841b875c26ccadc36e4522247f4R1-R29)
[[6]](diffhunk://#diff-c8fb8339570a5305809be7c618e14705fd86390dc278e6ce8ba224a7bc8b0c3cR1-R25)

**Configuration and Tooling Updates**

* Updated `.github/workflows/codeql.yml`, `.golangci.yaml`, and
`.github/dependabot.yml` to properly handle the new docs app: excluded
`apps/docs` from certain checks, added npm dependency updates for the
docs app, and excluded generated content.
[[1]](diffhunk://#diff-12783128521e452af0cfac94b99b8d250413c516ec71fe6d97dbea666ff7ba27L8-R14)
[[2]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R5-R6)
[[3]](diffhunk://#diff-9917ddc9f1c3304218f7269265b746d997c5c0615478177b5fceecd33ef47cb5R126-R129)
[[4]](diffhunk://#diff-dd4fbda47e51f1e35defb9275a9cd9c212ecde0b870cba89ddaaae65c5f3cd28R89-R106)
* Updated `.devcontainer/devcontainer.json` to use the latest Go 1.25.3
version for consistency.

**Licensing and Miscellaneous**

* Added `apps/docs/` to the list of licensed directories in
`LICENSING.md`.

These changes ensure the documentation is now maintained in a modern,
scalable system and all project tooling is updated to support the new
structure.

---------

Co-authored-by: Federico Coppede <[email protected]>
2026-01-29 08:38:36 -08:00
RamonandGitHub 7b6395c348 fix: improve NX caching (#11434)
# Which Problems Are Solved
This PR improves our NX caching, especially for the console and api.
It makes sure that if the console is changed the api is also rebuilt and
if the api is changed the functional-ui tests are rerun. It is important
to note this only fixes a subset of our problems.

# How the Problems Are Solved
NX ignores .gitignored files even if they are explicitly added to the
inputs of an NX target. To counteract this one can add these files to a
.nxignore file with a negated pattern.
https://nx.dev/docs/reference/inputs#token-behavior-with-nested-projects
. This solution is not documented per se but can be find in this Github
issue: https://github.com/nrwl/nx/issues/6821 . Further more nx
calculates the hashes of inputs at the start and does not recalculate
them even if a dependency of a target changes. To solve this problem one
needs to use
https://nx.dev/docs/reference/inputs#outputs-of-dependent-tasks . This
comment of an NX developer helped me further to understand the actual
behaviour of NX:
https://github.com/nrwl/nx/issues/33379#issuecomment-3657929455 .

# Additional Changes
Because the functional-ui tests now correctly run again they had to be
fixed. This pr unifies the field names in the user create v1 and v2 ui.

# Additional Context
To document this somewhere, this proposed fix does not work:
https://github.com/nrwl/nx/issues/6821#issuecomment-1309475504 . In my
local testing NX runtime inputs also get executed at the beginning of
the NX loop and ignore subsequent changes by targets. While testing this
fix and browsing through NX code I found this, which could be helpful in
the future and isn't documented: https://github.com/nrwl/nx/pull/31428
2026-01-29 14:42:52 +01:00
Marco A.andGitHub 96bbd6a65c chore: management console naming inconsistency (#11390)
# Which Problems Are Solved

The following terms have all been renamed to management console:

- Customer Portal (when used to mean the console)
- Console
- Admin Console

# How the Problems Are Solved

- Search & Replace smartly
- Use Copilot for translation files

Changes done to: backend + frontend codebase, docs, translations and
protobufs (descriptions only)

# Additional Context

- Partially Closes #11279
2026-01-26 14:52:15 +00:00
Livio SpringandGitHub bd6279153a fix: use versioned openapi protoc plugin for docs and console (#11423)
# Which Problems Are Solved

The docs and console API generators used an unversioned
`buf.build/grpc-ecosystem/openapiv2` plugin for the code generation. The
latest version has an issue and fails.

# How the Problems Are Solved

- pin the plugin to the latest running version

# Additional Changes

none
# Additional Context

- noticed internally
- requires backport to at least v4.x
- https://github.com/grpc-ecosystem/grpc-gateway/issues/6274
2026-01-26 13:20:46 +01:00
1fc6f048a9 feat(i18n): add Arabic language support (#11161)
## Which Problems Are Solved

- Add comprehensive Arabic language support to ZITADEL

## How the Problems Are Solved

- Added full Arabic translation files for the login UI, console, and
notification (yaml and json).
- Ensured all keys match the latest English reference files to avoid
missing or inconsistent entries.
- Updated the localization loader to include `ar` as a supported
language.

## Additional Changes


## Additional Context


Closes #11146

---------

Co-authored-by: Marco A. <[email protected]>
2026-01-22 17:07:47 +01:00
d7cec1d3bd chore: replace "manager role" with "administrator role" (#11395)
# Which Problems Are Solved

As part of the naming consistency initiative, the term `Manager Roles`
is replaced by `Administrator Roles`

# How the Problems Are Solved

By replacing `Manager Roles` with `Administrator Roles` in API docs,
Console UI, and guides.

# Additional Changes
N/A

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11293

---------

Co-authored-by: Copilot <[email protected]>
2026-01-21 13:06:27 +05:30
RamonandGitHub e401da3cfa fix(console): remove rehauled navigation #10863 (#10912)
# Which Problems Are Solved
The new breadcrumbs were causing problems with some more advanced
Zitadel setups. This pr removes the new breadcrumbs to revert to the old
navigation behaviour.

# How the Problems Are Solved
Most of the changes could be kept but those specific to the navigation
where mostly reverted.

# Additional Changes
Updated some dependencies.

# Additional Context
- Closes #10863
2026-01-16 08:30:09 +01:00
be9d2a53eb chore: replace given and family names with first and last names (#11343)
# Which Problems Are Solved

Naming inconsistency w.r.t the usage of Given Name / Family Name instead
of First Name / Last Name

# How the Problems Are Solved

* By replacing given and family names with first and last names in UI
and docs (not in the API definitions)
* Updated translations in multiple languages to first and last names
instead of given/family names

# Additional Changes
* Add `internal/**/*.yaml` path to the nx sources input to rebuild the
binary upon changes to these files
* Fix failing unit tests in `user_notifier_legacy_test.go` by updating
`Passwordless` with `Passkey`

# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11308

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
2026-01-15 10:29:48 +00:00
Wim Van LaerandGitHub 86fd769439 chore: rename password change to password changed (#11323)
# Which Problems Are Solved

Inconsistent naming: https://github.com/zitadel/zitadel/issues/11314

# How the Problems Are Solved

translations are done using gemini

# Additional Changes

# Additional Context

- Closes [#11314](https://github.com/zitadel/zitadel/issues/11314)
2026-01-14 12:49:44 +05:30
26e7c8499d chore: renamed passwordless to passkey (#11338)
# Which Problems Are Solved

Inconsistent naming of passkeys

# How the Problems Are Solved

translations are done using gemini

# Additional Changes


# Additional Context

- Closes #11298

---------

Co-authored-by: Gayathri Vijayan <[email protected]>
2026-01-13 08:19:42 +01:00
Federico CoppedeandGitHub d7a9e9d48b docs: fix PKCE broken reference (#11324)
This PR fixes the broken reference to the PKCE reference
2026-01-10 19:42:37 -03:00
96f9bbc044 docs: structure update (#11275)
### **Restructure Docs Navigation & Consolidate Core Concepts**

**Summary**
This PR refactors the documentation navigation to follow a clearer
**User Journey** and consolidates fragmented pages to reduce redundancy.

**Key Changes**

* **Sidebar:**
* Replaced the legacy resource-based structure with user-journey-focused
categories.

**Proposed Structure:**

```
Get Started
├─ Overview
│   └─ Guides Overview (Brief intro to docs, persona-aligned: "Get auth working in minutes for your B2B app.")
├─ Quickstart Guide
│   └─ Quickstart (Step-by-step: Sign up, spin up instance, connect app, log in – mirrors brand's 4-step guide.)
├─ Authenticate Users
│   ├─ Login with ZITADEL (OIDC)
│   ├─ Get ID / Access Token
│   └─ Logout
├─ Examples & SDKs
│   ├─ SPA / Frontend
│   ├─ Web Applications
│   ├─ APIs / Backend Services
│   ├─ Hybrid / Full-Stack
│   └─ Sample Applications (Include community-contributed examples for openness.)
├─ Key Concepts
│   ├─ Instances, Orgs, Projects, Apps
│   ├─ Policies (Intro)
│   └─ Users & Roles
└─ Use Cases
    ├─ B2B Integration (Tailored to multi-tenant enterprise needs.)
    ├─ B2C Login
    ├─ Multi-Tenant / SaaS
    ├─ Branded Login & White-Label
    └─ Machine-to-Machine (M2M)

Configure Identity & Policies
├─ Identity Providers
│   ├─ External IDPs (e.g., Google, Azure)
│   └─ Custom Providers
├─ Policies
│   ├─ Password Policies
│   ├─ Lockout Policies
│   └─ Privacy Policies
├─ Roles & Permissions
│   ├─ RBAC Setup
│   └─ Custom Roles
└─ Compliance & Security
    ├─ Audits & Logs
    └─ Certifications (Highlight trust through openness.)

Integrate & Authenticate
├─ OIDC & OAuth Flows
├─ API Access
│   ├─ gRPC APIs
│   └─ REST APIs
├─ SDKs
│   ├─ Go
│   ├─ JavaScript/TypeScript
│   ├─ Python
│   └─ Others (Link to community SDKs.)
└─ External Integrations
    ├─ SAML
    ├─ LDAP
    └─ Webhooks

Test & Debug
├─ Testing Tools
│   ├─ Console Testing
│   └─ API Playground
├─ Common Issues
│   ├─ Token Errors
│   └─ Integration Failures
└─ Debugging Guides
    ├─ Logs & Monitoring
    └─ Error Codes Reference

Deploy & Operate
├─ Deployment Options
│   ├─ Cloud (ZITADEL Cloud)
│   ├─ Self-Hosted (Linux, MacOS)
│   ├─ Docker Compose
│   └─ Kubernetes
├─ Configuration
│   ├─ Environment Variables
│   └─ Advanced Settings
├─ Scaling & Performance
│   ├─ High Availability
│   └─ Backup & Restore
└─ Monitoring & Maintenance
    ├─ Metrics
    └─ Upgrades

Architecture & Concepts
├─ System Architecture
│   ├─ Core Components
│   └─ Data Flow Diagrams (Expressive visuals per brand.)
├─ Principles
│   ├─ Multi-Tenancy
│   └─ Open Standards (OIDC, SAML)
└─ Advanced Topics
    ├─ Customization
    └─ Extensibility (Open-source contributions.)

Product, Releases & Support
├─ Product Features
│   ├─ Roadmap (Public, for transparency.)
│   └─ Pricing & Tiers
├─ Releases
│   ├─ Changelog
│   └─ Upgrade Guides
└─ Support Resources
    ├─ Community (Discord, GitHub – for community-led growth.)
    ├─ FAQ
    ├─ Contact Support
    └─ Contribute (Encourage feedback/shaping the product.)
```

**Content Consolidation:**
* Merged separate "Concept" and "Console Guide" files into single,
comprehensive **Overview** pages for core resources:
* `Organizations`, `Projects`, `Applications`, `Users`, `Console`, and
`Actions`.

```
concepts/structure/organizations + guides/manage/console/organizations -> guides/manage/console/organizations-overview

concepts/structure/projects + guides/manage/console/projects -> guides/manage/console/projects-overview

concepts/structure/applications + guides/manage/console/applications -> guides/manage/console/applications-overview

concepts/structure/users + guides/manage/console/users -> guides/manage/console/users-overview

guides/manage/console/actions + apis/actions/introduction -> guides/manage/console/actions-overview

concepts/features/console + guides/manage/console/overview -> guides/manage/console/console-overview
```


**Redirects (`vercel.json`):**
* Added permanent redirects for all the 6 legacy files mentioned above



**No files were deleted**

---------

Co-authored-by: Florian Forster <[email protected]>
2026-01-09 15:07:02 -03:00
RamonandGitHub 20b6c9869a chore: update deps (#11273)
# Which Problems Are Solved
Fix failing compliance alert because of old depedencies.

# How the Problems Are Solved
Updated our npm dependencies

# Additional Changes
- Updated Docusaurus to React 19 to unify our react versions
- Fixed flaky e2e test
2026-01-07 09:48:30 +01:00
RamonandGitHub 02f24b2e98 fix: inconsistent user creation v2 radio buttons #11092 (#11208)
# Which Problems Are Solved
Radio buttons in the User V2 creation form were unresponsive when
clicking directly on the radio button itself, only clicking on the label
text worked.

# How the Problems Are Solved
The app-auth-method-radio-theme mixin had a global input[type='radio']
selector that hid all radio inputs application-wide, breaking Angular
Material's mat-radio-button components. The selector is now scoped to
.auth-method-radio-button-wrapper so it only affects the intended
component.

# Additional Context
- Closes #11092
2025-12-30 11:03:15 +01:00
4489ffb82e fix(console): accept localhost redirect URIs without path nor port (#11001)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Some native OIDC applications use localhost without a path as redirect
URI. Currently, setting http://localhost as a redirect URI leads to a
compliance warning (Redirect URIs must begin with your own protocol,
http://127.0.0.1, http://[::1] or http://localhost.), while
http://localhost/some/path and http://localhost:some-port are accepted).

# How the Problems Are Solved

This PR parses the redirect URI instead of using prefix check to test if
hostname part is localhost, 127.0.0.1 or [::1] (IPv6 addresses are
canonicalized during parsing).

# Additional Context

This PR is a follow-up of https://github.com/zitadel/zitadel/pull/10836.

Signed-off-by: Yann Soubeyrand <[email protected]>
Co-authored-by: Ramon <[email protected]>
2025-12-30 10:53:04 +01:00
791d0587aa feat(action v2): add JWT and JWE payload type options (#11196)
# Which Problems Are Solved

The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.

# How the Problems Are Solved

- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
  - added a `fingerprint` column
  - dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies

# Additional Changes

None

# Additional Context

closes #11061

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
2025-12-29 13:35:53 +00:00
Federico CoppedeandGitHub 11cf2c252a chore(ux): Fix wording for application ID token settings (#11210)
When this checkbox is enabled, the user profile information (not the
roles assigned) will be returned as claims in the ID token. The current
wording is not accurate.
2025-12-18 18:13:18 +00:00
41cdc7805f feat(i18n): add Ukrainian language support (#10696)
## Summary
  - Add comprehensive Ukrainian language support to ZITADEL
  - Complete translation of all user-facing interfaces
  - Integration with existing language configuration system

  ## Changes Made
- ✅ **Console translations**: Complete Ukrainian translation for admin
console (2,861 translated strings)
- ✅ **Login interface**: Ukrainian translations for authentication flows
(535 strings)
- ✅ **Email notifications**: Ukrainian translations for system emails
(68 strings)
- ✅ **Common texts**: Ukrainian translations for success/error messages
(1,417 strings)
- ✅ **Language configuration**: Added Ukrainian to supported languages
and Angular locale registration
- ✅ **UI integration**: Added Ukrainian option to language selection
forms

  ## Translation Quality
  - Professional translations using established Ukrainian IT terminology
  - Formal language appropriate for business software
- Consistent terminology across all components (Users→Користувачі,
Organization→Організація, etc.)
  - Preserved all technical placeholders, HTML tags, and formatting

  ## Contributing Guidelines Compliance
  - ✅ Followed semantic commit message format
  - ✅ Added Ukrainian to all required configuration files
  - ✅ Maintained consistent file structure with existing languages
  - ✅ Used formal Ukrainian appropriate for business software

The Ukrainian translation is now ready for review by the ZITADEL team! 🚀

---------

Co-authored-by: Marco A. <[email protected]>
2025-12-11 15:37:31 +01:00
6e747172e4 chore(console): explain that a project can contain multiple applications that would b… (#11103)
# Which Problems Are Solved

It's unclear to new users that a single web application might have more
than one Zitadel "application", like one for the frontend and one for
the backend.

# How the Problems Are Solved
Updates the text defining projects in the onboarding

# Additional Changes
None
# Additional Context
Working on general improvements to make onboarding easier.

---------

Co-authored-by: David Skewis <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-12-02 10:48:22 +00:00
5beeb5738a feat: Add recovery code MFA support (#9954)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

One-time recovery codes are a common multi-factor authentication (MFA)
backup method, letting users access their account if they lose other MFA
devices. Support for recovery codes can also reduce support burden for
users locked out of their accounts and provide a more secure and
reliable form of verification than security questions.

# Which Problems Are Solved

Zitadel currently lacks support for recovery codes.

# How the Problems Are Solved

This PR partially addresses recovery code support in Zitadel.
Importantly, it adds recovery codes as a new 2FA `Factor` and an
additional `Check` type for the Session API.

```
Example recovery code flow:

1. User generates N new recovery codes using `POST /v2/users/{user_id}/recovery_codes`
2. Zitadel hashes and stores these codes and returns the un-hashed codes in the response
3. User creates new session with an additional check: `recoveryCode`
4. Code is checked against hash and, if valid, cannot be used again
5. User attempts to adds N more codes using the same endpoint 
6. If `remaining_codes + N <= RecoveryCodes->MaxCount` config value, then recovery codes are added in addition to original codes
7. User can remove all recovery codes using `DEL /v2/users/:userId/recovery_codes` 
```
This PR adds: 
- [x] Session recovery_code check support on `POST+PATCH /v2/sessions`
endpoints
- [x] Adds `mfa_recovery_code_checked_at` column (default null) to
`projections.sessions8` table
- [x] Support for `SECOND_FACTOR_TYPE_RECOVERY_CODES` as available 2FA
method on login policy
- [x] Support for importing recovery codes in /import code

Missing, will _not_ implement in this PR:
- [ ] Admin console support for displaying Recovery Code settings for
user(s)
- [ ] Zitadel Typescript login support for recovery codes 

TODO: 
- [x] Additional unit and integration tests
- [x] Error translations

# Additional Changes

None

# Additional Context

- Closes #6898

---------

Co-authored-by: Livio Spring <[email protected]>
2025-11-24 06:44:48 +00:00
David SkewisandGitHub 449285fda3 fix(console): add config for missing frameworks in app creation (#11057)
# Which Problems Are Solved

- Solves the issue of app creation when selecting go, python, ruby, php,
java, spring and node

# How the Problems Are Solved

- Adds the appropriate configs for each app type


# Additional Context

- Closes #11052
2025-11-10 15:05:50 +01:00
16b21569db fix(login): improve duration undefined check (#10949)
# Which Problems Are Solved
In the login we often check if a GRPC Duration is not defined however it
can also be set to 0. Using the API it's possible to set the password
check lifetime to zero which broke the login v2.

# How the Problems Are Solved
Also check if the GRPC Duration seconds field is not 0

# Additional Context
- May help if the issue here is actually accidentally setting password
lifetime check to 0 using the API #10865

Co-authored-by: Max Peintner <[email protected]>
2025-10-27 09:03:32 +01:00
MaximilianandGitHub 7e11f7a032 chore(ux): Change wording for project / application settings (#10775)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Close #10623: The terms, language, and spelling used on the project and
application settings for receiving roles is unnecessarily complicated or
wrong.


# How the Problems Are Solved

Update Settings in English. Translations are currently not considered.

# Additional Changes

Align proto documentation 

# Additional Context
2025-10-17 05:50:13 +00:00
381727e919 fix(console): create login policy before adding a factor (#10202)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

The api call for adding a mfa/2fa factor was running before creating a
login policy.

# How the Problems Are Solved

A new event emitter `beforeTypeAdd` is responsible for taking in a
callback, and then the parent component (login-policy) checks if a login
policy should be created, and then it is successfully created, calls the
callback.
The callback then adds the mfa/2fa factor as before.

# Additional Context

- Closes #9047

Co-authored-by: David Skewis <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
2025-10-16 11:12:07 +01:00
21edbc9afe fix(console): fix typo (#10753)
# Which Problems Are Solved

There's a typo on chinese translation under MEMBERSHIPS -> TITLE translation key

# How the Problems Are Solved

Fix typo

Co-authored-by: Marco A. <[email protected]>
2025-10-09 11:49:12 +02:00
f69a6ed4f3 chore: rehaul DevX (#10571)
# Which Problems Are Solved

Replaces Turbo by Nx and lays the foundation for the next CI
improvements. It enables using Nx Cloud to speed the up the pipelines
that affect any node package.
It streamlines the dev experience for frontend and backend developers by
providing the following commands:

| Task | Command | Notes |
|------|---------|--------|
| **Production** | `nx run PROJECT:prod` | Production server |
| **Develop** | `nx run PROJECT:dev` | Hot reloading development server
|
| **Test** | `nx run PROJECT:test` | Run all tests |
| **Lint** | `nx run PROJECT:lint` | Check code style |
| **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues |

The following values can be used for PROJECT:

- @zitadel/zitadel (root commands)
- @zitadel/api,
- @zitadel/login,
- @zitadel/console,
- @zitadel/docs,
- @zitadel/client
- @zitadel/proto

The project names and folders are streamlined:

| Old Folder | New Folder |
| --- | --- |
| ./e2e | ./tests/functional-ui |
| ./load-test | ./benchmark |
| ./build/zitadel | ./apps/api |
| ./console | ./apps/console (postponed so the PR is reviewable) |  

Also, all references to the TypeScript repo are removed so we can
archive it.

# How the Problems Are Solved

- Ran `npx nx@latest init`
- Replaced all turbo.json by project.json and fixed the target configs
- Removed Turbo dependency
- All JavaScript related code affected by a PRs changes is
quality-checked using the `nx affected` command
- We move PR checks that are runnable using Nx into the `check`
workflow. For workflows where we don't use Nx, yet, we restore
previously built dependency artifacts from Nx.
- We only use a single and easy to understand dev container
- The CONTRIBUTING.md is streamlined
- The setup with a generated client pat is orchestrated with Nx
- Everything related to the TypeScript repo is updated or removed. A
**Deploy with Vercel** button is added to the docs and the
CONTRIBUTING.md.

# Additional Changes

- NPM package names have a consistent pattern.
- Docker bake is removed. The login container is built and released like
the core container.
- The integration tests build the login container before running, so
they don't rely on the login container action anymore. This fixes
consistently failing checks on PRs from forks.
- The docs build in GitHub actions is removed, as we already build on
Vercel.

# Additional Context

- Internal discussion:
https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169
- Workflow dispatch test:
https://github.com/zitadel/zitadel/actions/runs/17760122959

---------

Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-10-08 10:27:02 +02:00
RamonandGitHub e47acaeef2 chore(console): Angular 20 #10690 (#10768)
# Which Problems Are Solved


# How the Problems Are Solved

# Additional Changes

# Additional Context
- Closes #10690
2025-10-08 07:10:50 +00:00
Livio SpringandGitHub 1a0588fef1 fix(idp): SAML signature algorithm (#10795)
# Which Problems Are Solved

https://github.com/zitadel/zitadel/pull/10520 added the possibility to
specify the signature algorithm for SAML auth requests. After releasing,
customer noticed that the Console UI would not correctly display the
selected algorithm and that it was not used in the login V1.

# How the Problems Are Solved

- Correctly map the algorithm in the UI
- Provide the option to the idp when creating a SAML request in login V1

# Additional Changes

None

# Additional Context

- closes https://github.com/zitadel/zitadel/issues/10780
- closes https://github.com/zitadel/zitadel/issues/10792
- requires backport to v4.x
2025-09-26 07:23:24 +00:00
RamonandGitHub b694b25cdf fix(console): improve actions creation dropdowns #10596 (#10677)
# Which Problems Are Solved
Actions V2 Method names got cut off in the creation dropdown
<img width="668" height="717" alt="old modal"
src="https://github.com/user-attachments/assets/e3dda16d-5326-464e-abc7-67a8b146037c"
/>

# How the Problems Are Solved
The modal now first requires a Service to be set and only afterwards are
users allowed set Methods. This way we can cut out the Service-Names
from the Method-Name leading to cleaner and shorter names.
<img width="796" height="988" alt="new modal"
src="https://github.com/user-attachments/assets/5002afdf-b639-44ef-954a-5482cca12f96"
/>


# Additional Changes
Changed the Modal dataloading to use Tanstack Query

# Additional Context
- Closes #10596
2025-09-10 09:04:45 +00:00
5cde52148f fix(console): Add login v2 url to identity providers (#10583)
# Which Problems Are Solved

When using login V2 the Callback URL for an Identity Provider is
different. When following the guideance in the console and using Login
V2 users will use the wrong callback url.

<img width="1234" height="323" alt="grafik"
src="https://github.com/user-attachments/assets/8632ecf2-d9e4-4e3b-8940-2bf80baab8df"
/>


# How the Problems Are Solved
I have added the correct Login V2 url to the identity providers and
updated our docs.

<img width="628" height="388" alt="grafik"
src="https://github.com/user-attachments/assets/2dd4f4f9-d68f-4605-a52e-2e51069da10e"
/>

# Additional Changes
Small refactorings and porting some components over to ChangeDetection
OnPush

# Additional Context

Replace this example with links to related issues, discussions, discord
threads, or other sources with more context.
Use the Closing #issue syntax for issues that are resolved with this PR.
- Closes #10461

---------

Co-authored-by: Max Peintner <[email protected]>
2025-09-10 07:05:55 +00:00
d9554d483c fix(console): Display MFA Name and Type correctly (#10586)
# Which Problems Are Solved
On the user detail page the mfa names and types where not displayed
correctly.

# How the Problems Are Solved
Switched to our internal TypeSafeCellDef and correctly parse the
@zitadel/proto types.

# Additional Context
- Closes #10493

Co-authored-by: Max Peintner <[email protected]>
2025-09-03 09:33:04 +02:00
75a67be669 feat: Feature flag for relational tables (#10599)
# Which Problems Are Solved

This PR introduces a new feature flag `EnableRelationalTables` that will
be used in following implementations to decide whether Zitadel should
use the relational model or the event sourcing one.

# TODO

  - [x] Implement flag at system level
- [x] Display the flag on console:
https://github.com/zitadel/zitadel/pull/10615

# How the Problems Are Solved

  - Implement loading the flag from config
- Add persistence of the flag through gRPC endpoint
(SetInstanceFeatures)
- Implement reading of the flag through gRPC endpoint
(GetInstanceFeatures)

# Additional Changes

Some minor refactoring to remove un-needed generics annotations

# Additional Context

- Closes #10574

---------

Co-authored-by: Silvan <[email protected]>
2025-09-02 09:48:46 +00:00
RamonandGitHub 5517fe234f fix(console): Improve default org selection method in new breadcrumbs (#10612)
# Which Problems Are Solved

e2e tests work again in chrome and all other browsers

# How the Problems Are Solved

If the user has no org selected we have to choose a default org to
select. The logic for this was faulty if a new organization was created
as the breadcrumb wasn't aware of the new org so it defaulted back to
the ZITADEL org.

# Additional changes

Improved the @zitadel/client package readme so the example code would
compile.
2025-09-01 15:06:35 +00:00
93fd27aebe fix(console): Timestamp to date Pipe type coercion (#10588)
# Which Problems Are Solved
Correctly display timestamps even if the seconds or nanos property is 0.

# How the Problems Are Solved
Instead of relying on javascript type coercion correctly check explictly
for undefined.

# Additional Changes

Use TypeSafeCellDefModule in personal-access-tokens component.

# Additional Context

- Closes #10032

Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
2025-09-01 06:02:35 +00:00
6d0b7ed2aa chore(i18n): Completion Chinese translation (#10109)
# Which Problems Are Solved

- Inconsistencies in the terminology used for "身份认证提供商" (identity
provider) and "身份认证提供者" (identity supplier) in the Chinese translation
files could lead to confusion among users.
- Missing translations for terminology related to identity providers
could hinder user experience and understanding.

# How the Problems Are Solved

- Unified the terms "身份认证提供商" and "身份认证提供者" to consistently use
"身份认证提供者" across all Chinese translation files.
- Added necessary translations to ensure that all relevant terms related
to identity providers are accurately represented in the Chinese
localization.

# Additional Changes

- Improved overall readability and clarity in the Chinese translations
by ensuring consistent terminology for identity-related phrases
throughout the application.
- Complete the missing translations.

# Additional Context

If I have missed any translations, please point them out, and I would be
happy to complete them.

---------

Co-authored-by: Florian Forster <[email protected]>
2025-08-28 14:56:26 +00:00
f963ea9f86 feat(console): rehauled navigation for instances including breadcrumb (#10283)
This PR significantly improves user navigation by introducing a new
instance-level navigation bar. This new bar, positioned above the
existing organization navigation, provides quick access to key sections:
Home, Organizations, Actions, and Settings.

Additionally, the breadcrumb component has been refined for more
consistent behavior, reintroducing intuitive breadcrumb buttons to
easily navigate up the hierarchy. These changes also include design
improvements for a cleaner and more streamlined appearance across the
interface.

<img width="423" height="138" alt="Screenshot 2025-07-17 at 14 55 46"
src="https://github.com/user-attachments/assets/ba9e40a1-1077-4cb6-8735-ac7ab637abe7"
/>
<img width="562" height="132" alt="Screenshot 2025-07-17 at 14 56 41"
src="https://github.com/user-attachments/assets/d85dc673-0df8-4677-9d2b-dc031dde42c3"
/>
<img width="545" height="254" alt="Screenshot 2025-07-17 at 14 56 10"
src="https://github.com/user-attachments/assets/eaf10117-079e-4181-8dbb-60c89b24556a"
/>
<img width="689" height="261" alt="Screenshot 2025-07-17 at 14 56 20"
src="https://github.com/user-attachments/assets/510ad550-1d9a-4c6a-8af1-66cb0b23619c"
/>

---------

Co-authored-by: conblem <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
2025-08-28 11:23:14 +02:00
Noah van der AaandGitHub cccba3f8f3 fix: Fix typo in keyboard shortcuts popup (#10581)
# Which Problems Are Solved

There is a typo in the keyboard shortcuts popup that adds an extra I to
the word instance.

# How the Problems Are Solved

Removed the extra I.
2025-08-28 08:48:56 +00:00
1d4e16a7e5 fix(translation): en - correct itegrate to integrate (#10367)
# Which Problems Are Solved

In the text shown on the Actions page in the console, 'integrate' is
mistyped as 'itegrate'.

<img width="1235" height="327" alt="image"
src="https://github.com/user-attachments/assets/bd1e8fc2-70bf-4ede-86fa-cc75647ec379"
/>

# How the Problems Are Solved

Spelling corrected to 'integrate'

<img width="1216" height="334" alt="image"
src="https://github.com/user-attachments/assets/68cbe20e-6b9c-4a4c-8c42-a84398ed994d"
/>


# Additional Changes

None

# Additional Context

None

Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Marco A. <[email protected]>
2025-08-27 15:52:49 +00:00
255d42da65 feat(saml): add SignatureMethod config for SAML IDP (#10520)
# Which Problems Are Solved
When a SAML IDP is created, the signing algorithm defaults to
`RSA-SHA1`.
This PR adds the functionality to configure the signing algorithm while
creating or updating a SAML IDP. When nothing is specified, `RSA-SHA1`
is the default.

Available options:
* RSA_SHA1
* RSA_SHA256
* RSA_SHA512


# How the Problems Are Solved

By introducing a new optional config to specify the Signing Algorithm. 

# Additional Changes
N/A

# Additional Context
- Closes #9842 

An existing bug in the UpdateSAMLProvider API will be fixed as a
followup in a different
[PR](https://github.com/zitadel/zitadel/pull/10557).

---------

Co-authored-by: Stefan Benz <[email protected]>
2025-08-27 09:07:13 +00:00
Max PeintnerandGitHub b6a2b7c70e fix(console): Improve SAML SP form typing (#10557)
This PR fixes a problem for the SAML provider in console where the
binding selection was not correctly applied when editing existing
providers

# Which Problems Are Solved

- SAML provider binding selection was not correctly applied when editing
existing providers
- Form used untyped reactive forms leading to potential runtime errors
- Hardcoded enum handling made the code fragile to API changes

# How the Problems Are Solved

- Created reusable utility functions (enum.utils.ts) that properly
convert between numeric enum values (from backend) and string keys (for
form controls)
- Improved type safety: Migrated from
UntypedFormGroup/UntypedFormControl to strongly typed
FormGroup<SAMLProviderForm> with FormControl<T>
2025-08-27 09:29:14 +02:00
d8518d48f2 fix(console): single feature patch (#10476)
# Which Problems Are Solved

This PR fixes an issue where all features where patched, instead of a
single one. This led to instance overrides which were not intended.
With this change, an update is executed whenever a toggle is hit, only
containing the respective feature, not all.

# How the Problems Are Solved

The console application was overriding the feature settings as an entire
request. A toggle change is now only changing the desired and targeted
feature using partial patches.

# Additional Context

Closes #10459

---------

Co-authored-by: Elio Bischof <[email protected]>
2025-08-22 09:55:31 +02:00
ac3a4037a7 fix: user profile picture editing dialog not having text (#10178)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Data was not passed to the profile picture component. This made the text
disappear.

# How the Problems Are Solved

I just passed the data to the component.

# Additional Context

Closes #9889.

Co-authored-by: David Skewis <[email protected]>
Co-authored-by: Ramon <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
2025-08-22 06:44:13 +00:00
Max PeintnerandGitHub cf02c4231a fix(console): pin buf gen versions (#10542)
Fix: Pin buf protoc plugin versions to resolve runtime protobuf
compatibility issues

# Which Problems Are Solved

The console application was experiencing a runtime error "requireUtf8 is
not a function" when the authentication service attempted to deserialize
protobuf messages. This error started occurring recently due to
automatic updates of buf protoc plugins.

# How the Problems Are Solved

pinning of the versions in buf.gen.yml and package.json
2025-08-21 17:32:15 +02:00
Marco A.andGitHub e8a9cd6964 fix: remove legacy events (#10464)
# Which Problems Are Solved

Some events that are now unused are clogging the event queue from time
to time.

# How the Problems Are Solved

Remove the events described in #10458

# Additional Changes

- Updated `stringer` and `enumer` in Makefile target `core_generate_all`
to resolve generated files compilation issues

# Notes
It looks like there are a lot of changes, but most of it is fixing
translation files. I suggest doing a review per-commit

# Additional Context

- Closes #10458
- Depends on https://github.com/zitadel/zitadel/pull/10513
2025-08-19 15:22:34 +02:00
5747109f14 fix(console): fix shrinking hover background on clear flow button (#10269)
## Problem
The mat-icon-button in the actions flow-type section had a shrinking
hover background. The hover effect was not displaying properly and
appeared constrained.

## Root Cause
The margin rules were being applied to all `span` elements, including
the Material button's internal elements (like `.mat-mdc-button-label`),
which interfered with the button's hover background positioning.

## Solution
- Changed the span selector from `span` to `> span` to target only
direct children
- Added specific margin reset for the button (`margin-right: 0`)
- Added margin reset for the icon inside the button
- This allows the Material button to use its default hover behavior

## Testing
- [x] No visual regressions in text spacing or layout
- [x] Button hover background now displays as a proper circle
- [x] Other buttons on the page remain unaffected
- [x] Matches the behavior of working buttons in trigger sections

## Type of Change
- [x] Bug fix (non-breaking change which fixes an UI issue)


Before :
<img width="427" height="411" alt="Screenshot 2025-07-15 at 6 08 35 PM"
src="https://github.com/user-attachments/assets/f728e1fa-6711-4e8b-ba24-2a84329f50d7"
/>

After fix :
<img width="406" height="404" alt="Screenshot 2025-07-15 at 6 09 36 PM"
src="https://github.com/user-attachments/assets/27d7b08d-684d-4094-8334-844a4e459025"
/>

Fixes hover background issue in actions flow-type section.

---------

Co-authored-by: Saurabh Thapliyal <[email protected]>
Co-authored-by: Marco A. <[email protected]>
2025-08-05 20:47:55 +02:00