Commit Graph
4285 Commits
Author SHA1 Message Date
Federico CoppedeandGitHub faefeaa53c docs: update actions V2 landing page (#11220)
Updated wording on the Actions V2 landing page and added a reference to
the sample scripts repository we have to deploy Actions for various use
cases to Cloudflare Workers.

Fixes #11028
2025-12-23 12:28:54 +00:00
Federico CoppedeandGitHub 3106dcfc67 docs: update database configuration page (#11219) 2025-12-22 17:08:12 +01:00
c9b89b97ab feat(login): Add Dutch (nl) locale (#11139)
# Which Problems Are Solved

* Missing Dutch (nl) translations in the login UI v2.

# How the Problems Are Solved

* Adds nl.json with Dutch translations.
* The same data is added to v2-default.json, because otherwise English
was overriding nl.json content.
* Adds Dutch to the language dropdown in somewhat alphabetical order.

# Additional Changes

None.

# Additional Context

None.

---------

Co-authored-by: thomas-swennenhuis <[email protected]>
2025-12-22 12:38:02 +00:00
Gayathri VijayanandGitHub af8deb1145 fix(authorizations): flaky integration tests (#11215)
# Which Problems Are Solved

Flaky integration tests related to authorizations RT.

# How the Problems Are Solved

By setting the `created_at` and `updated_at` timestamps based on event
timestamps while creating an authorization.

# Additional Changes
N/A
# Additional Context

https://cloud.nx.app/runs/ICj84SxEf0/task/%40zitadel%2Fapi%3Atest-integration
2025-12-22 09:41:01 +01:00
Gayathri VijayanandGitHub 7c01deb8ed fix(authorizations): comment out timestamp assertions (#11214)
# Which Problems Are Solved

Comment out timestamp assertions to temporarily unblock CI pipeline

# How the Problems Are Solved

Comment out timestamp assertions to temporarily unblock CI pipeline

# Additional Changes

N/A

# Additional Context
2025-12-19 15:37:44 +01:00
f7aa9810ee fix(i18n): fix typos in MustBeMemoryOfOrg strings (#11085)
# Which Problems Are Solved

Strings previously were:
- The user must **be member** of the {{.OrgName}} organization.

Fixed the grammar mistake / typo and it's now:
- The user must **be a member** of the {{.OrgName}} organization.

Co-authored-by: Wim Van Laer <[email protected]>
2025-12-19 13:42:23 +00:00
8472c7683d feat(rt): authorizations (#11066)
# Which Problems Are Solved

This PR implements relational table and repository interface for the
authorizations feature as described in
https://github.com/zitadel/zitadel/issues/10767

# How the Problems Are Solved

By
* adding new `zitadel.authorizations` and `zitadel.authorization_roles`
tables
* implementing the `AuthorizationRepository` interface to create,
update, query, and delete user authorizations and roles
* implementing `authorization_relational.go` projection to update
`zitadel.authorizations` and `zitadel.authorization_roles` tables based
on events

# Additional Changes
N/A

# Additional Context
- Closes #10767

---------

Co-authored-by: Livio Spring <[email protected]>
2025-12-19 07:03:27 +01:00
Federico CoppedeandGitHub 11cf2c252a chore(ux): Fix wording for application ID token settings (#11210)
When this checkbox is enabled, the user profile information (not the
roles assigned) will be returned as claims in the ID token. The current
wording is not accurate.
2025-12-18 18:13:18 +00:00
c9835afd39 chore(api): fix Zitadel typo (#11128)
# Which Problems Are Solved

ZITADEL is wrongly spelled like "ZITADLE" in the description of the GRPC
`zitadel.admin.v1.AdminService/Healthz` endpoint.

# How the Problems Are Solved

Fixed the spelling error.

# Additional Changes

None.

# Additional Context

None.

Co-authored-by: elinashoko <[email protected]>
2025-12-18 10:21:49 +00:00
80c4325799 docs(proxy_guide_tls_mode): sentence spacing (#11074)
# Which Problems Are Solved

add missing period and space before new sentence.

# How the Problems Are Solved

- add missing period and space before new sentence.

# Additional Changes

- no other changes

# Additional Context

- no related issues

Co-authored-by: Wim Van Laer <[email protected]>
2025-12-18 11:18:48 +01:00
Wim Van LaerandGitHub 1ce8bcbd78 fix: id token had no lifetime for client credentials (#11204)
# Which Problems Are Solved

- ID-token had no lifetime when a token was requested using the
`client_credentials` grant

# How the Problems Are Solved

- Take use the lifetime provided by the server.

# Additional Context

- Closes #11060
2025-12-17 13:39:55 +01:00
b339a3e696 feat: instance domain APIs with relational tables (#11051)
# Which Problems Are Solved

This PR implements the endpoints listed in
https://github.com/zitadel/zitadel/issues/10444 .

# How the Problems Are Solved

The implementation follows the same pattern as the Instance one. The
`Add` and `Remove` are implementing the `Commander` interface, while
`List` Domains endpoints are implementing the `Querier` interace.

The PR adds also some forgotten calls to the relational logic for the
Instance API. The commits are identifiable by the label `instance:`
prepended to them. This is the complete list: bafce01b0 , 6fe7257ab ,
e27bc9c34 , 8133ede73 , fde667953 , a3e1135ed , ee1a6f9c1

# Additional Context

- Closes #10444

---------

Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Lebogang Phoshoko <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>
2025-12-17 12:01:09 +01:00
Livio SpringandGitHub d79bfe6eba fix(login v1): update password verification handling (#11202)
# Which Problems Are Solved

Failed password attempts in login V1 potentially created new session
entries.

# How the Problems Are Solved

Correct handling to only update existing sessions.

# Additional Changes

None

# Additional Context

- reported through support
- requires backport to v4.x
2025-12-17 09:23:54 +01:00
5a7136fe67 docs: Disable emoji rendering (#10994)
# Which Problems Are Solved

We had to wrap reserved scopes like
`urn:zitadel:iam:org:id:178204173316174381` in a code block, because
Docusaurus was rendering 🆔 as emoji.

# How the Problems Are Solved

Update Docusaurus to 3.9.2. and disable the emoji rendering in markdown
files.

# Additional Changes


# Additional Context

Co-authored-by: Florian Forster <[email protected]>
2025-12-16 18:55:26 +00:00
82c774dab3 feat(languages): add French localization (#11050)
# Which Problems Are Solved

Previous login app had french localization and the new app doesn't have
it anymore. It simply re-add this missing locale.

# How the Problems Are Solved

Simply add french localization.

# Additional Changes

None

# Additional Context

I don't know how to add it by default in backend, i will happily make
the changes for adding by default this langage.

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
2025-12-16 16:35:14 +01:00
Max PeintnerandGitHub 9bbf0096b6 fix: update pnpm, react, react-dom (#11197)
Closes #11192 

# Which Problems Are Solved

Update pnpm, react and react-dom to the latest version

# How the Problems Are Solved

the version references are updated as part of the package.json files
2025-12-16 15:04:31 +00:00
ef593e2e05 docs: update broken reference links (#10888)
# Which Problems Are Solved

- Broken links that the NextJs frontend quickstart guide uses to refer
to the files in the example application.

# How the Problems Are Solved

- Links are updated
- The mentioned file paths are adapted to match the existing file
structure

# Additional Changes


# Additional Context

- [NextJs Frontend Quickstart
Guide](https://zitadel.com/docs/examples/login/nextjs)
- [Example Application](https://github.com/zitadel/zitadel-nextjs)

Co-authored-by: Wim Van Laer <[email protected]>
2025-12-16 14:53:28 +01:00
Mohamed TammamandGitHub 7faeb3ba03 Fix formatting of Back-End API Communication section (#11008)
Removed unnecessary space before 'Back-End API Communication' heading
for consistency.
2025-12-16 09:06:19 +00:00
2221b5ef74 fix(login): CVE-2025-55184 and CVE-2025-55183, update next (#11179)
# Which Problems Are Solved

Updates `next` to version `15.5.9` to address the following security
vulnerabilities:

- **CVE-2025-55184**
- **CVE-2025-55183**

# How the Problems Are Solved

- Bump `next` from `15.5.7` to `15.5.9` in `apps/login/package.json`

---------

Co-authored-by: PhenixH <[email protected]>
2025-12-12 13:01:05 +01:00
aafc15b8c3 fix: [CVE-2025-55182] [CVE-2025-66478] Quick update react and Nextjs for #11140 (#11143)
# Which Problems Are Solved

Temporary update of nextjs and react to fix major CVE (described #11140)

Build passing and force dependency for old deps, but we will need to
update packages (I update qrcode-react, minimal impact, not feasible for
react-hook-form which needs more work).

# How the Problems Are Solved

Upgrade dependencies to patched version of the same major and minor,
remove experimental flag dynamicIO and added flag useCache (used in
code)

# Additional Changes



# Additional Context

- https://nextjs.org/blog/CVE-2025-66478 
-
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

Co-authored-by: Max Peintner <[email protected]>
2025-12-12 10:30:49 +00:00
SilvanandGitHub 1b54a9eb05 fix(setup): member role synchronization execution check (#11180)
The change was introduced in
https://github.com/zitadel/zitadel/pull/11178.
The fix is to prevent wiping the memberships because the projection did
not init yet.

### Changes
- Introduces a check to determine if the member role synchronization
should be executed based on the existence of a specific database table
(`projections.instance_members4`).
- Ensures that the synchronization process only runs if the required
table is present in the database.
2025-12-12 10:09:03 +00:00
58612a6ef7 fix(fields): sync membership roles from projections (#11178)
# Which Problems Are Solved

Zitadel v4.7.2 fixed a security issue by switching to the permission v2
framework for user APIs. It appears that systems that are running since
before v2.68 that were affected by a precision bug in the eventstore,
which was fixed in that version. The precision bug results in certain
events being "skipped" while being projected into the fields table, used
by the new permission system. This caused certain membership roles to be
missing, resulting in empty user lists when executed by the affected
member. The permission system basically finds no matching memberships
and therefore returns no users at all.


# How the Problems Are Solved

After research we concluded that the legacy membership projections are
projected correctly. This PR synchronizes the projected state into the
fields table. As the membership roles are not marked unique, all rows
are first deleted and then the correct membership roles are then
inserted. The operation happens in a single transaction, during which
the fields table will remain locked for modifications. This to prevent
possible concurrent modifications to membership states.

# Additional Changes

- none

# Additional Context

- Introduced in
https://github.com/zitadel/zitadel/commit/0e17d0005a98ccbf92139961ef702ef03208ffd3
- Released in
[v4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)
- Related: https://github.com/zitadel/zitadel/issues/8863

---------

Co-authored-by: Silvan <[email protected]>
2025-12-12 09:09:09 +01:00
Tim MöhlmannandGitHub d2d85bd30e fix(email): accept SMTPUTF8 addresses (#11115)
# Which Problems Are Solved

Zitadel only accepted ASCII email addresses, while some users need to
enter internationalized addresses. For example `mö[email protected]`

# How the Problems Are Solved

- Use `net/mail` to validate email addresses, instead of a custom regex.
`net/mail` correctly accepts UTF-8 characters.
- In the management/v1 API email address validation is removed (only
string limits are applied)

# Additional Changes

- none

# Additional Context

Closes https://github.com/zitadel/zitadel/issues/9821
2025-12-11 22:59:13 +00:00
41cdc7805f feat(i18n): add Ukrainian language support (#10696)
## Summary
  - Add comprehensive Ukrainian language support to ZITADEL
  - Complete translation of all user-facing interfaces
  - Integration with existing language configuration system

  ## Changes Made
- ✅ **Console translations**: Complete Ukrainian translation for admin
console (2,861 translated strings)
- ✅ **Login interface**: Ukrainian translations for authentication flows
(535 strings)
- ✅ **Email notifications**: Ukrainian translations for system emails
(68 strings)
- ✅ **Common texts**: Ukrainian translations for success/error messages
(1,417 strings)
- ✅ **Language configuration**: Added Ukrainian to supported languages
and Angular locale registration
- ✅ **UI integration**: Added Ukrainian option to language selection
forms

  ## Translation Quality
  - Professional translations using established Ukrainian IT terminology
  - Formal language appropriate for business software
- Consistent terminology across all components (Users→Користувачі,
Organization→Організація, etc.)
  - Preserved all technical placeholders, HTML tags, and formatting

  ## Contributing Guidelines Compliance
  - ✅ Followed semantic commit message format
  - ✅ Added Ukrainian to all required configuration files
  - ✅ Maintained consistent file structure with existing languages
  - ✅ Used formal Ukrainian appropriate for business software

The Ukrainian translation is now ready for review by the ZITADEL team! 🚀

---------

Co-authored-by: Marco A. <[email protected]>
2025-12-11 15:37:31 +01:00
3903355d18 feat(settings): add secret generator type to settings RT implementation (#11152)
# Which Problems Are Solved

The `SecretGenerators` setting is missing among the instance settings in
the new relational model.

# How the Problems Are Solved

This PR adds:
* `SettingTypeSecretGenerator` type to the settings model
* `SecretGeneratorSettingsRepository` and
`secretGeneratorSettingsJSONChanges` interfaces to set, retrieve, and
delete `secret_generator` settings, and corresponding unit tests.
* projection reducers to reduce the following events:
  * `SecretGeneratorAddedEvent`
  * `SecretGeneratorChangedEvent`
  * `SecretGeneratorRemovedEvent`
* integration tests to test that the events get reduced correctly 

# Additional Changes
N/A

# Additional Context
- Part of https://github.com/zitadel/zitadel/issues/10207

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>
2025-12-11 12:33:19 +01:00
826039c620 Merge commit from fork
* Force v2 permission checks on user listing

* Remove duplicated tests

* cleanup and fix tests

---------

Co-authored-by: Livio Spring <[email protected]>
2025-12-10 13:13:56 +01:00
Livio SpringandGitHub dfe064f902 fix(login): fix back button on 2fa screen to allow username change (#11125)
# Which Problems Are Solved

As reported to support, the back button on the various 2FA pages in
login V1 opened the default redirect URI, which likely started a new
auth request (e.g. from Console).

# How the Problems Are Solved

Change the back buttons to navigate to the login screen again, where a
user can change the username.
Additionally, the back button has been added to the U2F verification
screen.

# Additional Changes

None

# Additional Context

- from support
- backport to v4
2025-12-09 12:37:26 +00:00
94f9ef966f docs: Dynamic Manager Permission Table (#11120)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Permissions for each manager role are stored in a .yaml file and can't
be easily searched in our docs.

# How the Problems Are Solved

We reference anyways the defaults.yaml file in our docs.
The script parses the yaml and produces a markdown table containing all
manager roles by manager permissions.

# Additional Changes

* Updated README with correct production build command

# Additional Context

---------

Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
2025-12-09 14:05:04 +02:00
Livio SpringandGitHub 541f8058cb chore(tests): fix login unit-tests (#11155)
# Which Problems Are Solved

The unit-tests on main currently fail. Most likely some nx cache issue.

# How the Problems Are Solved

Fix the unit tests.

# Additional Changes

none

# Additional Context

Noted on multiple PRs
2025-12-09 10:45:23 +00:00
Livio SpringandGitHub 5f3f53dca1 fix(api): add tracing interceptor on connectRPC services (#11147)
# Which Problems Are Solved

ConnectRPC based services (v2 API) was missing the root span of all
requests. Rest calls through grpc-gateway more or less worked properly.
This was due to a missing server interceptor for connectRPC services
itself. Rest call would work as the trace would start on the gateway
already.

# How the Problems Are Solved

Initiate an connectRPC OTEL interceptor and pass it to all services.

# Additional Changes

None

# Additional Context

- noticed internally
- requires backport to v4.x
2025-12-09 11:23:10 +01:00
df75be96ff Merge commit from fork
* fix: Improve host header handling and deployment mode detection

* ZITADEL_CLOUD env

* refactor service config

* service config

* cleanup

* cleanup

* util for original and public host

* instanceHost, publicHost

* cleanup constructUrl

* cleanup middleware

* add x-zitadel-forward-host as fallback for current cloud setup

* fix build

* fix: lint

* fix: update test mocks

* fix: provide basepath to unit tests

* host handling

* unit tests

* imports

* fix: getPublicHost instead of getInstanceHost

* unit tests

* update nextjs, implement jwt verify for logout_token

* pass logout information in jwt to login v2

* handle hosts in jwks url

* point idp callbacks to the api and not the login UI

* logout_hint out of logout token, typecheck

* rm unused imports

* fix oidc integration test

---------

Co-authored-by: Livio Spring <[email protected]>
2025-12-08 10:01:49 +01:00
Stefan BenzandGitHub f9e3871bb3 docs: add rest paths to api design (#9910)
# Which Problems Are Solved

REST paths for new APIs are unclear as they are not defined in the
API_DESIGN.

# How the Problems Are Solved

Add a part to the API_DESIGN, which can be removed at a later date when
migrating to RPC connect.

# Additional Changes

None

# Additional Context

None
2025-12-04 07:07:07 +00:00
a1bfdeb257 fix(actionsV2): executing request/response type for 'all' condition (#11071)
# Which Problems Are Solved

In actions v2, when the condition `all` is chosen, or a specific method
is not specified for a service action, the actions are not executed.

# How the Problems Are Solved

The wildcard suffix `.*` is used only for event groups. As global
`requests`, `responses` or `services with no specified method` do not
have this suffix, they were bypassing the prefix-match check. This check
therefore does not apply to action types other than `event`

This issue is fixed by removing the `e.ID == "event"` condition when
prefix-matching execution IDs to not exclude other action types
(`request`, `response`, etc).

# Additional Changes
N/A

# Additional Context

- Closes #10895

---------

Co-authored-by: Livio Spring <[email protected]>
2025-12-04 06:14:55 +00:00
SilvanandGitHub e26859d644 fix(domain): use crypto.CryptoValue (#11131)
Update the `Check` struct to utilize `crypto.CryptoValue` for the `Code`
field, enhancing security and type safety. Adjust the `CheckTypeInit`
struct accordingly to maintain consistency.
2025-12-03 21:41:22 +00:00
b4732579cb fix(RT): correct restricting null columns (#11123)
# Which Problems Are Solved

`IS NULL` and `IS NOT NULL` conditions were incorrectly marked as
restricting columns,
and currently fails unit tests. The restricting columns are mostly used
to ensure single row selection during DELETE and UPDATE . When a `IS NOT
NULL` condition is passed, the filter may (unintentionally) apply to all
rows, while still allowing the query to execute.

Settings and other repositories (still to be done) have unified tables
for instance-level settings and organization-level settings. In those
cases the organization ID may be null or have a value. The unique
condition is a compound of multiple columns, in which case `IS NULL` is
valid as part of the other restricting columns.

# How the Problems Are Solved

In order to prevent unsafe usage of null related filters and not break
settings:

- null conditions are no longer considered restricting columns
- A function to force the restricting column state on a condition is
provided
- The settings unique condition function forces restricting column state
on the returned condition.

# Additional Changes

- add `backend/v3` to the NX build.

# Additional Context

- [pipeline
failures](https://github.com/zitadel/zitadel/actions/runs/19852295780/job/56881654340?pr=11115#step:13:3197)

---------

Co-authored-by: Elio Bischof <[email protected]>
2025-12-03 16:15:49 +00:00
MaximilianandGitHub 96fffd9829 docs: Update link to redirect url settings (#11100)
# Which Problems Are Solved

wrong link to the redirect url settings in console

# How the Problems Are Solved

updated link
2025-12-03 07:29:00 +00:00
6e747172e4 chore(console): explain that a project can contain multiple applications that would b… (#11103)
# Which Problems Are Solved

It's unclear to new users that a single web application might have more
than one Zitadel "application", like one for the frontend and one for
the backend.

# How the Problems Are Solved
Updates the text defining projects in the onboarding

# Additional Changes
None
# Additional Context
Working on general improvements to make onboarding easier.

---------

Co-authored-by: David Skewis <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-12-02 10:48:22 +00:00
FuzzbizzandGitHub 8180801641 chore(console): more natural phrasing for grant type warning message (#11111)
# Which Problems Are Solved
- The warning for redirect URIs is awkwardly phrased in the past tense.

# How the Problems Are Solved

- The present tense is used and keywords enclosed in quotation marks 
<img width="444" height="35" alt="image"
src="https://github.com/user-attachments/assets/d7593ced-d53a-4655-b34b-d1fd00d9db49"
/>


# Additional Changes
N/A

# Additional Context
N/A
2025-12-02 11:40:46 +01:00
911967c865 feat(settings_relational): adding settings table for relational db (#10769)
# Which Problems Are Solved

As part of https://github.com/zitadel/zitadel/issues/9599 to push to
move to a relational db table model, this is the migration of the
settings

# Additional Changes

I had to add 2 non source code files
`backend/v3/storage/database/events_testing/font.otf` and
`backend/v3/storage/database/events_testing/picture.png`, these are used
as part of the reduce tests, hence why they're sourced inside
`backend/v3/storage/database/events_testing/settings_instance_test.go`

- Closes https://github.com/zitadel/zitadel/issues/10207

---------

Co-authored-by: adlerhurst <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
2025-12-02 08:16:21 +01:00
SilvanandGitHub 6c8619e2f0 fix(domain): add PasskeyTypeCondition to humanPasskeyConditions interface (#11113) 2025-12-01 17:42:18 +01:00
SilvanandGitHub 1c78604e21 fix(repo): prevent cascading products of aggregated objects (#11099)
This update prevents cascading products in aggregated object queries by
ensuring distinct values are used in JSON aggregations.
2025-12-01 08:44:23 +00:00
86cce629c7 chore(login): add unit tests for core business logic (#11083)
# Which Problems Are Solved

- Adds basic unit tests for core business logic
- Adds playwright tests for core flows

# How the Problems Are Solved

- Extends unit tests for session
- Adds unit tests for other core business logic (oidc, idp, auth etc)

# Additional Changes

- N/A

---------

Co-authored-by: Max Peintner <[email protected]>
2025-11-27 16:55:40 +00:00
207095f7c1 chore: fix README typo (#11072)
# Which Problems Are Solved
Just fixing a typo: onboaring -> onboarding


# How the Problems Are Solved
N/A

# Additional Changes

N/A.

# Additional Context

N/A

Co-authored-by: Florian Forster <[email protected]>
2025-11-26 00:21:28 +00:00
f5ce288ea5 feat(domain): define user repositories (#11059)
This pull request introduces a new set of domain models and repositories
for managing users within the new v3 structure. The goal is to establish
a clean, robust, and extensible foundation for user management.

### Summary

This PR accomplishes the following:

- **Polymorphic User Model**: Introduces a `User` model in user.go that
can represent either a `Human` or a `Machine` user. This provides a
unified way to handle different user types while allowing for specific
attributes and logic for each.
- **Repository Pattern**: Implements the repository pattern for
accessing and manipulating user data. This decouples the business logic
from the data storage implementation. The main repository interfaces
(`UserRepository`, `HumanUserRepository`, `MachineUserRepository`) are
now defined in `backend/v3/domain/user_repository.go`.
- **Comprehensive User Models**: The user.go file now also defines the
domain models for associated user data, including `UserMetadata`,
`IdentityProviderLink`, `Passkey`, `PersonalAccessToken`, and
`MachineKey`.
- **Generic Verification and Check System**: Introduces verification.go
and check.go to provide a standardized way of handling various
verification flows (e.g., email verification, OTP checks).
- **Generated Code**: Adds new generated files for enums
(`humangender_enumer.go`, `machinekeytype_enumer.go`,
`passkeytype_enumer.go`, `personalaccesstokentype_enumer.go`,
`userstate_enumer.go`, `usertype_enumer.go`) and mocks for the new
repositories.
- **Session Domain Refactoring**: Updates the session domain
(`backend/v3/domain/session*.go`) to align with the new user model
structure.

This foundational work paves the way for migrating user management logic
to the new `v3` backend, with a more maintainable and testable
architecture.

part of #10224

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>
2025-11-25 11:54:32 +01:00
5beeb5738a feat: Add recovery code MFA support (#9954)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

One-time recovery codes are a common multi-factor authentication (MFA)
backup method, letting users access their account if they lose other MFA
devices. Support for recovery codes can also reduce support burden for
users locked out of their accounts and provide a more secure and
reliable form of verification than security questions.

# Which Problems Are Solved

Zitadel currently lacks support for recovery codes.

# How the Problems Are Solved

This PR partially addresses recovery code support in Zitadel.
Importantly, it adds recovery codes as a new 2FA `Factor` and an
additional `Check` type for the Session API.

```
Example recovery code flow:

1. User generates N new recovery codes using `POST /v2/users/{user_id}/recovery_codes`
2. Zitadel hashes and stores these codes and returns the un-hashed codes in the response
3. User creates new session with an additional check: `recoveryCode`
4. Code is checked against hash and, if valid, cannot be used again
5. User attempts to adds N more codes using the same endpoint 
6. If `remaining_codes + N <= RecoveryCodes->MaxCount` config value, then recovery codes are added in addition to original codes
7. User can remove all recovery codes using `DEL /v2/users/:userId/recovery_codes` 
```
This PR adds: 
- [x] Session recovery_code check support on `POST+PATCH /v2/sessions`
endpoints
- [x] Adds `mfa_recovery_code_checked_at` column (default null) to
`projections.sessions8` table
- [x] Support for `SECOND_FACTOR_TYPE_RECOVERY_CODES` as available 2FA
method on login policy
- [x] Support for importing recovery codes in /import code

Missing, will _not_ implement in this PR:
- [ ] Admin console support for displaying Recovery Code settings for
user(s)
- [ ] Zitadel Typescript login support for recovery codes 

TODO: 
- [x] Additional unit and integration tests
- [x] Error translations

# Additional Changes

None

# Additional Context

- Closes #6898

---------

Co-authored-by: Livio Spring <[email protected]>
2025-11-24 06:44:48 +00:00
Mridang AgarwallaandGitHub afa92e55f7 docs: added the updated docs for the new react example (#11073)
# Which Problems Are Solved

The React example needed updates to align with current best practices
and improve documentation clarity for developers integrating Zitadel
authentication.

# How the Problems Are Solved

Updated the React example codebase with improved authentication flow
using react-oidc-context, enhanced error handling and TypeScript type
safety, and refined component structure for better maintainability.

# Additional Changes

Updated documentation to reflect implementation details, added
comprehensive environment variable configuration examples with exact
variable names from the codebase, improved inline code comments, and
updated dependencies to latest stable versions.

# Additional Context

- Related to React integration example improvements
- Enhances developer experience when implementing Zitadel PKCE
authentication in React applications
2025-11-17 20:22:51 +00:00
SilvanandGitHub 0f1b7c6eaa feat(database): add statement and CTE changes (#11069)
Read pull request "feat(database): add statement and CTE changes
(#11069)"

This pull request introduces new functionality for handling database
changes using statements and Common Table Expressions (CTEs).

### Summary

This PR accomplishes the following:

- **Statement and CTE Changes**: Adds new types and functions in
change.go for handling more complex database changes. This includes:
    -   `NewChangeToNull`: A change that sets a column to `NULL`.
- `NewChangeToColumn`: A change that sets a column's value to the value
of another column.
- `NewIncrementColumnChange`: A change that increments a column's value
by 1.
- `NewChangeToStatement`: A change that sets a column's value to the
result of a subquery.
- `NewCTEChange`: A change that uses a Common Table Expression (CTE) to
perform more complex updates.
- **Testing**: Adds comprehensive tests in change_test.go to cover the
new functionality and ensure the correctness of the generated SQL
statements and arguments.
- **Ignoring AI Files**: Updates the .gitignore to exclude files
generated by AI tools.

This work enhances the flexibility of the database layer, allowing for
more complex and efficient database operations.
2025-11-14 12:58:22 +00:00
9274e008fe feat(rt): project grants (#10951)
This pull request introduces a new feature that allows adding, updating,
and querying project grants The changes are primarily in the backend and
include new database tables, repositories, and domain logic to support
project grants.

## Changes

* New `project_grants` table: A new table `zitadel.project_grants` is
introduced to store project grants It includes columns for
`instance_id`, `id`, `state`, `project_id`, `granted_org_id` and
`granting_org_id`.
* New `ProjectGrantRepository`: A new repository
`ProjectGrantRepository` is created to handle all database operations
for project grants. It provides methods to `Get`, `List`, `Create`,
`Update`, and `Delete`.
* New `project_grant_roles` table: A new table
`zitadel.project_grant_roles` is introduced to store project grant roles
It includes columns for `instance_id`, `grant_id`, `key`, `project_id`
and `project_org_id`.
* New `ProjectGrantRoleRepository`: A new repository
`ProjectGrantRoleRepository` is created to handle all database
operations for project grant roles. It provides methods to `Get`,
`List`, `Add`, and `Delete`.
* New `project_grant_relational_projection`: A new projection
`project_grant_relational_projection` is added to update the
`zitadel.project_grants` and `zitadel.project_grant_roles` tables based
on events. It handles all project grant events.
* Updated `ProjectRepository`: The `ProjectRepository` is updated to
list granted projects.

# Additional Context

Closes https://github.com/zitadel/zitadel/issues/10766

---------

Co-authored-by: Stefan Benz <[email protected]>
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Silvan <[email protected]>
2025-11-14 11:04:16 +00:00
Livio SpringandGitHub 6051ce591d fix(deps): update saml and all other dependencies (#11067)
Updates saml and all other direct dependencies (which are possible) to
the latest version to include fixes and solve requested features:
- https://github.com/zitadel/saml/issues/103
- https://github.com/zitadel/saml/issues/104

(requires backport to v.4x at least for saml)
2025-11-13 07:14:25 +01:00
33c51deb20 Merge commit from fork
* validate IDP linking permissions

* fix: check policy before linking

* apply suggested review comments

---------

Co-authored-by: Max Peintner <[email protected]>
2025-11-12 13:48:40 +01:00