mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 21:52:54 +00:00
d10be4c09ad94b725da170e1284d59bfbf2c7f0e
14
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
     
|
61cab8878e |
feat(backend): state persisted objects (#9870)
This PR initiates the rework of Zitadel's backend to state-persisted objects. This change is a step towards a more scalable and maintainable architecture. ## Changes * **New `/backend/v3` package**: A new package structure has been introduced to house the reworked backend logic. This includes: * `domain`: Contains the core business logic, commands, and repository interfaces. * `storage`: Implements the repository interfaces for database interactions with new transactional tables. * `telemetry`: Provides logging and tracing capabilities. * **Transactional Tables**: New database tables have been defined for `instances`, `instance_domains`, `organizations`, and `org_domains`. * **Projections**: New projections have been created to populate the new relational tables from the existing event store, ensuring data consistency during the migration. * **Repositories**: New repositories provide an abstraction layer for accessing and manipulating the data in the new tables. * **Setup**: A new setup step for `TransactionalTables` has been added to manage the database migrations for the new tables. This PR lays the foundation for future work to fully transition to state-persisted objects for these components, which will improve performance and simplify data access patterns. This PR initiates the rework of ZITADEL's backend to state-persisted objects. This is a foundational step towards a new architecture that will improve performance and maintainability. The following objects are migrated from event-sourced aggregates to state-persisted objects: * Instances * incl. Domains * Orgs * incl. Domains The structure of the new backend implementation follows the software architecture defined in this [wiki page](https://github.com/zitadel/zitadel/wiki/Software-Architecturel). This PR includes: * The initial implementation of the new transactional repositories for the objects listed above. * Projections to populate the new relational tables from the existing event store. * Adjustments to the build and test process to accommodate the new backend structure. This is a work in progress and further changes will be made to complete the migration. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Iraq Jaber <[email protected]> Co-authored-by: Iraq <[email protected]> Co-authored-by: Tim Möhlmann <[email protected]> |
||
|
64a3bb3149 |
feat(v3alpha): web key resource (#8262)
# Which Problems Are Solved Implement a new API service that allows management of OIDC signing web keys. This allows users to manage rotation of the instance level keys. which are currently managed based on expiry. The API accepts the generation of the following key types and parameters: - RSA keys with 2048, 3072 or 4096 bit in size and: - Signing with SHA-256 (RS256) - Signing with SHA-384 (RS384) - Signing with SHA-512 (RS512) - ECDSA keys with - P256 curve - P384 curve - P512 curve - ED25519 keys # How the Problems Are Solved Keys are serialized for storage using the JSON web key format from the `jose` library. This is the format that will be used by OIDC for signing, verification and publication. Each instance can have a number of key pairs. All existing public keys are meant to be used for token verification and publication the keys endpoint. Keys can be activated and the active private key is meant to sign new tokens. There is always exactly 1 active signing key: 1. When the first key for an instance is generated, it is automatically activated. 2. Activation of the next key automatically deactivates the previously active key. 3. Keys cannot be manually deactivated from the API 4. Active keys cannot be deleted # Additional Changes - Query methods that later will be used by the OIDC package are already implemented. Preparation for #8031 - Fix indentation in french translation for instance event - Move user_schema translations to consistent positions in all translation files # Additional Context - Closes #8030 - Part of #7809 --------- Co-authored-by: Elio Bischof <[email protected]> |
||
|
Tim MöhlmannandGitHub
|
4e3fd305ab |
fix(crypto): reject decrypted strings with non-UTF8 characters. (#8374)
# Which Problems Are Solved We noticed logging where 500: Internal Server errors were returned from the token endpoint, mostly for the `refresh_token` grant. The error was thrown by the database as it received non-UTF8 strings for token IDs Zitadel uses symmetric encryption for opaque tokens, including refresh tokens. Encrypted values are base64 encoded. It appeared to be possible to send garbage base64 to the token endpoint, which will pass decryption and string-splitting. In those cases the resulting ID is not a valid UTF-8 string. Invalid non-UTF8 strings are now rejected during token decryption. # How the Problems Are Solved - `AESCrypto.DecryptString()` checks if the decrypted bytes only contain valid UTF-8 characters before converting them into a string. - `AESCrypto.Decrypt()` is unmodified and still allows decryption on non-UTF8 byte strings. - `FromRefreshToken` now uses `DecryptString` instead of `Decrypt` # Additional Changes - Unit tests added for `FromRefreshToken` and `AESCrypto.DecryptString()`. - Fuzz tests added for `FromRefreshToken` and `AESCrypto.DecryptString()`. This was to pinpoint the problem - Testdata with values that resulted in invalid strings are committed. In the pipeline this results in the Fuzz tests to execute as regular unit-test cases. As we don't use the `-fuzz` flag in the pipeline no further fuzzing is performed. # Additional Context - Closes #7765 - https://go.dev/doc/tutorial/fuzz |
||
|
2089992d75 |
feat(crypto): use passwap for machine and app secrets (#7657)
* feat(crypto): use passwap for machine and app secrets * fix command package tests * add hash generator command test * naming convention, fix query tests * rename PasswordHasher and cleanup start commands * add reducer tests * fix intergration tests, cleanup old config * add app secret unit tests * solve setup panics * fix push of updated events * add missing event translations * update documentation * solve linter errors * remove nolint:SA1019 as it doesn't seem to help anyway * add nolint to deprecated filter usage * update users migration version * remove unused ClientSecret from APIConfigChangedEvent --------- Co-authored-by: Livio Spring <[email protected]> |
||
|
|
f680dd934d |
refactor: rename package errors to zerrors (#7039)
* chore: rename package errors to zerrors * rename package errors to gerrors * fix error related linting issues * fix zitadel error assertion * fix gosimple linting issues * fix deprecated linting issues * resolve gci linting issues * fix import structure --------- Co-authored-by: Elio Bischof <[email protected]> |
||
|
|
4589ddad4a |
feat: integrate passwap for human user password hashing (#6196)
* feat: use passwap for human user passwords * fix tests * passwap config * add the event mapper * cleanup query side and api * solve linting errors * regression test * try to fix linter errors again * pass systemdefaults into externalConfigChange migration * fix: user password set in auth view * pin passwap v0.2.0 * v2: validate hashed password hash based on prefix * resolve remaining comments * add error tag and translation for unsupported hash encoding * fix unit test --------- Co-authored-by: Livio Spring <[email protected]> |
||
|
1b5d6ce89e |
feat: session checks with intent (#6031)
* feat: session checks with intent * feat: session checks with intent * fix: integration tests for intent session * fix: integration tests for intent session * fix merge * fix: integration tests for intent session --------- Co-authored-by: Livio Spring <[email protected]> |
||
  
|
bc9a85daf3 |
feat: V2 alpha import and export of organizations (#3798)
* feat(import): add functionality to import data into an instance * feat(import): move import to admin api and additional checks for nil pointer * fix(export): export implementation with filtered members and grants * fix: export and import implementation * fix: add possibility to export hashed passwords with the user * fix(import): import with structure of v1 and v2 * docs: add v1 proto * fix(import): check im imported user is already existing * fix(import): add otp import function * fix(import): add external idps, domains, custom text and messages * fix(import): correct usage of default values from login policy * fix(export): fix renaming of add project function * fix(import): move checks for unit tests * expect filter * fix(import): move checks for unit tests * fix(import): move checks for unit tests * fix(import): produce prerelease from branch * fix(import): correctly use provided user id for machine user imports * fix(import): corrected otp import and added guide for export and import * fix: import verified and primary domains * fix(import): add reading from gcs, s3 and localfile with tracing * fix(import): gcs and s3, file size correction and error logging * Delete docker-compose.yml * fix(import): progress logging and count of resources * fix(import): progress logging and count of resources * log subscription * fix(import): incorporate review * fix(import): incorporate review * docs: add suggestion for import Co-authored-by: Fabi <[email protected]> * fix(import): add verification otp event and handling of deleted but existing users Co-authored-by: Livio Amstutz <[email protected]> Co-authored-by: Fabienne <[email protected]> Co-authored-by: Silvan <[email protected]> Co-authored-by: Fabi <[email protected]> |
||
|
fa9f581d56 |
chore(v2): move to new org (#3499)
* chore: move to new org * logging * fix: org rename caos -> zitadel Co-authored-by: adlerhurst <[email protected]> |
||
|
8a5badddf6 |
feat: Login, OP Support and Auth Queries (#177)
* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <[email protected]> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <[email protected]> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <[email protected]> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <[email protected]> * fix test * fix ports and enable console Co-authored-by: Fabiennne <[email protected]> Co-authored-by: Fabi <[email protected]> Co-authored-by: Silvan <[email protected]> |
||
|
|
effc2c23c2 |
feat: add auth command side (#107)
* fix: query tests * fix: use prepare funcs * fix: go mod * fix: generate files * fix(eventstore): tests * fix(eventstore): rename modifier to editor * fix(migrations): add cluster migration, fix(migrations): fix typo of host in clean clsuter * fix(eventstore): move health * fix(eventstore): AggregateTypeFilter aggregateType as param * code quality * fix: go tests * feat: add member funcs * feat: add member model * feat: add member events * feat: add member repo model * fix: better error func testing * fix: project member funcs * fix: add tests * fix: add tests * feat: implement member requests * fix: merge master * fix: merge master * fix: read existing in project repo * fix: fix tests * feat: add internal cache * feat: add cache mock * fix: return values of cache mock * feat: add project role * fix: add cache config * fix: add role to eventstore * fix: use eventstore sdk * fix: use eventstore sdk * fix: add project role grpc requests * fix: fix getby id * fix: changes for mr * fix: change value to interface * feat: add app event creations * fix: searchmethods * Update internal/project/model/project_member.go Co-Authored-By: Silvan <[email protected]> * fix: use get project func * fix: append events * fix: check if value is string on equal ignore case * fix: add changes test * fix: add go mod * fix: add some tests * fix: return err not nil * fix: return err not nil * fix: add aggregate funcs and tests * fix: add oidc aggregate funcs and tests * fix: add oidc * fix: add some tests * fix: tests * feat: eventstore repository * fix: remove gorm * version * feat: pkg * feat: eventstore without eventstore-lib * rename files * gnueg * fix: global model * feat: add global view functions * feat(eventstore): sdk * fix(eventstore): rename app to eventstore * delete empty test * fix(models): delete unused struct * feat(eventstore): overwrite context data * fix: use global sql config * fix: oidc validation * fix: generate client secret * fix: generate client id * fix: test change app * fix: deactivate/reactivate application * fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <[email protected]> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <[email protected]> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <[email protected]> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <[email protected]> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <[email protected]> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * fixes * Update internal/auth/repository/eventsourcing/eventstore/auth_request.go Co-authored-by: Fabi <[email protected]> * Update internal/auth/repository/eventsourcing/eventstore/auth_request.go Co-authored-by: Fabi <[email protected]> * Update internal/auth/repository/eventsourcing/eventstore/auth_request.go Co-authored-by: Fabi <[email protected]> * Update internal/auth/repository/eventsourcing/eventstore/auth_request.go Co-authored-by: Fabi <[email protected]> * extract method usersForUserSelection * add todo for policy check * id on auth req * fix enum name Co-authored-by: Fabiennne <[email protected]> Co-authored-by: adlerhurst <[email protected]> Co-authored-by: Fabi <[email protected]> |
||
|
Livio Amstutz
|
e04c0116f5 | refactor crypto tests | ||
|
Livio Amstutz
|
59dc4dbe85 | improve some functions | ||
|
Livio Amstutz
|
90342ed872 | feat: add crypto pkg |