mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
318bfc36d7
# Which Problems Are Solved - Native iOS/Android passkeys need OS trust files on the ZITADEL domain; without them, Associated Domains / App Links verification fails. - Operators could not configure iOS Team ID + Bundle ID or Android package name + SHA-256 fingerprints on OIDC apps. - `/.well-known/apple-app-site-association` and `/.well-known/assetlinks.json` were not served from application config. # How the Problems Are Solved - Add iOS/Android app-link fields on OIDC app create/update (Application API v2 + Management), with validation. - Persist and project those fields; query active app-link configs instance-wide. - Serve AASA (`webcredentials`) and Digital Asset Links (`get_login_creds`) from well-known paths, with configurable `Cache-Control` and fingerprint normalization at serve time. - Console UI to edit the fields, with links to the well-known endpoints. - Operator docs for configuration, endpoints, caching, and verification. # Additional Changes - Document on API fields that well-known responses may be HTTP-cached and platform verifiers may delay propagation. - Runtime config: `WellKnown.AppLinksCacheControlMaxAge` (default `5m`; `0` → `no-store`). # Additional Context - Closes #12497 - Implemented and reviewed as stack: - #12531 API contract - #12532 storage wiring - #12536 well-known endpoints - #12537 console - #12547 docs --------- Co-authored-by: Cursor <[email protected]>
115 lines
4.5 KiB
Go
115 lines
4.5 KiB
Go
package command
|
|
|
|
import (
|
|
"github.com/muhlemmer/gu"
|
|
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
)
|
|
|
|
func projectWriteModelToProject(writeModel *ProjectWriteModel) *domain.Project {
|
|
return &domain.Project{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
Name: writeModel.Name,
|
|
ProjectRoleAssertion: writeModel.ProjectRoleAssertion,
|
|
ProjectRoleCheck: writeModel.ProjectRoleCheck,
|
|
HasProjectCheck: writeModel.HasProjectCheck,
|
|
PrivateLabelingSetting: writeModel.PrivateLabelingSetting,
|
|
}
|
|
}
|
|
|
|
func projectGrantWriteModelToProjectGrant(writeModel *ProjectGrantWriteModel) *domain.ProjectGrant {
|
|
return &domain.ProjectGrant{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
GrantID: writeModel.GrantID,
|
|
GrantedOrgID: writeModel.GrantedOrgID,
|
|
RoleKeys: writeModel.RoleKeys,
|
|
State: writeModel.State,
|
|
}
|
|
}
|
|
|
|
func oidcWriteModelToOIDCConfig(writeModel *OIDCApplicationWriteModel) *domain.OIDCApp {
|
|
return &domain.OIDCApp{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
AppID: writeModel.AppID,
|
|
AppName: writeModel.AppName,
|
|
State: writeModel.State,
|
|
ClientID: writeModel.ClientID,
|
|
RedirectUris: writeModel.RedirectUris,
|
|
ResponseTypes: writeModel.ResponseTypes,
|
|
GrantTypes: writeModel.GrantTypes,
|
|
ApplicationType: gu.Ptr(writeModel.ApplicationType),
|
|
AuthMethodType: gu.Ptr(writeModel.AuthMethodType),
|
|
PostLogoutRedirectUris: writeModel.PostLogoutRedirectUris,
|
|
OIDCVersion: gu.Ptr(writeModel.OIDCVersion),
|
|
DevMode: gu.Ptr(writeModel.DevMode),
|
|
AccessTokenType: gu.Ptr(writeModel.AccessTokenType),
|
|
AccessTokenRoleAssertion: gu.Ptr(writeModel.AccessTokenRoleAssertion),
|
|
IDTokenRoleAssertion: gu.Ptr(writeModel.IDTokenRoleAssertion),
|
|
IDTokenUserinfoAssertion: gu.Ptr(writeModel.IDTokenUserinfoAssertion),
|
|
ClockSkew: gu.Ptr(writeModel.ClockSkew),
|
|
AdditionalOrigins: writeModel.AdditionalOrigins,
|
|
SkipNativeAppSuccessPage: gu.Ptr(writeModel.SkipNativeAppSuccessPage),
|
|
BackChannelLogoutURI: gu.Ptr(writeModel.BackChannelLogoutURI),
|
|
LoginVersion: gu.Ptr(writeModel.LoginVersion),
|
|
LoginBaseURI: gu.Ptr(writeModel.LoginBaseURI),
|
|
IOSTeamID: emptyStringPtr(writeModel.IOSTeamID),
|
|
IOSBundleID: emptyStringPtr(writeModel.IOSBundleID),
|
|
AndroidPackageName: emptyStringPtr(writeModel.AndroidPackageName),
|
|
AndroidSHA256CertFingerprints: writeModel.AndroidSHA256CertFingerprints,
|
|
}
|
|
}
|
|
|
|
// emptyStringPtr returns nil for empty strings so unset app-link fields stay
|
|
// distinguishable from explicitly set values in equality checks / APIs.
|
|
func emptyStringPtr(s string) *string {
|
|
if s == "" {
|
|
return nil
|
|
}
|
|
return gu.Ptr(s)
|
|
}
|
|
|
|
func samlWriteModelToSAMLConfig(writeModel *SAMLApplicationWriteModel) *domain.SAMLApp {
|
|
return &domain.SAMLApp{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
AppID: writeModel.AppID,
|
|
AppName: writeModel.AppName,
|
|
State: writeModel.State,
|
|
Metadata: writeModel.Metadata,
|
|
MetadataURL: gu.Ptr(writeModel.MetadataURL),
|
|
EntityID: writeModel.EntityID,
|
|
LoginVersion: gu.Ptr(writeModel.LoginVersion),
|
|
LoginBaseURI: gu.Ptr(writeModel.LoginBaseURI),
|
|
}
|
|
}
|
|
|
|
func apiWriteModelToAPIConfig(writeModel *APIApplicationWriteModel) *domain.APIApp {
|
|
return &domain.APIApp{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
AppID: writeModel.AppID,
|
|
AppName: writeModel.AppName,
|
|
State: writeModel.State,
|
|
ClientID: writeModel.ClientID,
|
|
AuthMethodType: writeModel.AuthMethodType,
|
|
}
|
|
}
|
|
|
|
func memberWriteModelToProjectGrantMember(writeModel *ProjectGrantMemberWriteModel) *domain.ProjectGrantMember {
|
|
return &domain.ProjectGrantMember{
|
|
ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),
|
|
Roles: writeModel.Roles,
|
|
GrantID: writeModel.GrantID,
|
|
UserID: writeModel.UserID,
|
|
}
|
|
}
|
|
|
|
func applicationKeyWriteModelToKey(wm *ApplicationKeyWriteModel) *domain.ApplicationKey {
|
|
return &domain.ApplicationKey{
|
|
ObjectRoot: writeModelToObjectRoot(wm.WriteModel),
|
|
ApplicationID: wm.AppID,
|
|
ClientID: wm.ClientID,
|
|
KeyID: wm.KeyID,
|
|
Type: wm.KeyType,
|
|
ExpirationDate: wm.ExpirationDate,
|
|
}
|
|
}
|