mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
01fe34a526
# Which Problems Are Solved Opaque tokens now use authenticated encryption. # How the Problems Are Solved - Upgrade zitadel/oidc to v3.47 - Copy crypto implementation for refresh and session tokens (internal to zitadel) - Added config that allows validating old tokens for gradual roll-out # Additional Changes - Set NX cache for `integration-test-build` to `false`, working on a seperate fix. # Additional Context - closes #11315 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: muhlemmer <[email protected]>
72 lines
1.5 KiB
Go
72 lines
1.5 KiB
Go
package crypto
|
|
|
|
import (
|
|
"crypto/rand"
|
|
|
|
"github.com/zitadel/logging"
|
|
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
type KeyConfig struct {
|
|
LegacyToken bool
|
|
EncryptionKeyID string
|
|
DecryptionKeyIDs []string
|
|
}
|
|
|
|
type Keys map[string]string
|
|
|
|
type Key struct {
|
|
ID string
|
|
Value string
|
|
}
|
|
|
|
func NewKey(id string) (*Key, error) {
|
|
randBytes := make([]byte, 32)
|
|
if _, err := rand.Read(randBytes); err != nil {
|
|
return nil, err
|
|
}
|
|
return &Key{
|
|
ID: id,
|
|
Value: string(randBytes),
|
|
}, nil
|
|
}
|
|
|
|
func LoadKey(id string, keyStorage KeyStorage) (string, error) {
|
|
key, err := keyStorage.ReadKey(id)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return key.Value, nil
|
|
}
|
|
|
|
func LoadKeys(config *KeyConfig, keyStorage KeyStorage) (Keys, []string, error) {
|
|
if config == nil {
|
|
return nil, nil, zerrors.ThrowInvalidArgument(nil, "CRYPT-dJK8s", "config must not be nil")
|
|
}
|
|
readKeys, err := keyStorage.ReadKeys()
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
keys := make(Keys)
|
|
ids := make([]string, 0, len(config.DecryptionKeyIDs)+1)
|
|
if config.EncryptionKeyID != "" {
|
|
key, ok := readKeys[config.EncryptionKeyID]
|
|
if !ok {
|
|
return nil, nil, zerrors.ThrowInternalf(nil, "CRYPT-v2Kas", "encryption key %s not found", config.EncryptionKeyID)
|
|
}
|
|
keys[config.EncryptionKeyID] = key
|
|
ids = append(ids, config.EncryptionKeyID)
|
|
}
|
|
for _, id := range config.DecryptionKeyIDs {
|
|
key, ok := readKeys[id]
|
|
if !ok {
|
|
logging.Errorf("description key %s not found", id)
|
|
continue
|
|
}
|
|
keys[id] = key
|
|
ids = append(ids, id)
|
|
}
|
|
return keys, ids, nil
|
|
}
|