mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
791d0587aa
# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
96 lines
2.8 KiB
Go
96 lines
2.8 KiB
Go
package execution
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/riverqueue/river"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
|
exec_repo "github.com/zitadel/zitadel/internal/repository/execution"
|
|
)
|
|
|
|
type Worker struct {
|
|
river.WorkerDefaults[*exec_repo.Request]
|
|
|
|
config WorkerConfig
|
|
now NowFunc
|
|
|
|
targetEncAlg crypto.EncryptionAlgorithm
|
|
activeSigningKey GetActiveSigningWebKey
|
|
}
|
|
|
|
// Timeout implements the Timeout-function of [river.Worker].
|
|
// Maximum time a job can run before the context gets cancelled.
|
|
// The time can be shorter than the sum of target timeouts, this is expected behavior to not block the request indefinitely.
|
|
func (w *Worker) Timeout(*river.Job[*exec_repo.Request]) time.Duration {
|
|
return w.config.TransactionDuration
|
|
}
|
|
|
|
// Work implements [river.Worker].
|
|
func (w *Worker) Work(ctx context.Context, job *river.Job[*exec_repo.Request]) error {
|
|
ctx = ContextWithExecuter(ctx, job.Args.Aggregate)
|
|
|
|
// if the event is too old, we can directly return as it will be removed anyway
|
|
if job.CreatedAt.Add(w.config.MaxTtl).Before(w.now()) {
|
|
return river.JobCancel(errors.New("event is too old"))
|
|
}
|
|
|
|
targets, err := TargetsFromRequest(job.Args)
|
|
if err != nil {
|
|
// If we are not able to get the targets from the request, we can cancel the job, as we have nothing to call
|
|
return river.JobCancel(fmt.Errorf("unable to unmarshal targets because %w", err))
|
|
}
|
|
|
|
_, err = CallTargets(ctx, targets, exec_repo.ContextInfoFromRequest(job.Args), w.targetEncAlg, w.activeSigningKey)
|
|
if err != nil {
|
|
// If there is an error returned from the targets, it means that the execution was interrupted
|
|
return river.JobCancel(fmt.Errorf("interruption during call of targets because %w", err))
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// NowFunc makes [time.Now] mockable
|
|
type NowFunc func() time.Time
|
|
|
|
type WorkerConfig struct {
|
|
Workers uint8
|
|
TransactionDuration time.Duration
|
|
MaxTtl time.Duration
|
|
}
|
|
|
|
func NewWorker(
|
|
config WorkerConfig,
|
|
targetEncAlg crypto.EncryptionAlgorithm,
|
|
activeSigningKey GetActiveSigningWebKey,
|
|
now NowFunc,
|
|
) *Worker {
|
|
return &Worker{
|
|
config: config,
|
|
now: now,
|
|
targetEncAlg: targetEncAlg,
|
|
activeSigningKey: activeSigningKey,
|
|
}
|
|
}
|
|
|
|
var _ river.Worker[*exec_repo.Request] = (*Worker)(nil)
|
|
|
|
func (w *Worker) Register(workers *river.Workers, queues map[string]river.QueueConfig) {
|
|
river.AddWorker(workers, w)
|
|
queues[exec_repo.QueueName] = river.QueueConfig{
|
|
MaxWorkers: int(w.config.Workers),
|
|
}
|
|
}
|
|
|
|
func TargetsFromRequest(e *exec_repo.Request) ([]target_domain.Target, error) {
|
|
var targets []target_domain.Target
|
|
if err := json.Unmarshal(e.TargetsData, &targets); err != nil {
|
|
return nil, err
|
|
}
|
|
return targets, nil
|
|
}
|