mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
9067605b66
* fix(crypto): use authenticated encryption for IDP intent tokens IDP intent tokens were encrypted with AES-CFB which provides no integrity protection, making them malleable. Switch to A256GCM via the existing AuthAlgorithm interface (EncryptToken/DecryptToken), the same approach already used for OIDC and session tokens. The idpConfigEncryption key type is widened from EncryptionAlgorithm to AuthEncryptionAlgorithm so that data-at-rest encryption (IDP client secrets, LDAP bind passwords, SAML keys) continues to use the CFB path unmodified. Co-authored-by: Cursor <[email protected]> * fix(proto): raise IDP intent token max length to 500 for authenticated tokens The switch to authenticated A256GCM (JWE compact serialization) makes IDP intent tokens longer (~270 chars) than the previous AES-CFB base64 output. Raise the max_len/max_length validation and OpenAPI constraints on every idp_intent_token field from 200 to 500 so the new tokens are accepted: user v2/v2beta (idp + user_service), session v2/v2beta, and resources user v3alpha. Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Cursor <[email protected]> Co-authored-by: Claude Opus 4.8 <[email protected]>
91 lines
2.8 KiB
Go
91 lines
2.8 KiB
Go
package crypto
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"go.uber.org/mock/gomock"
|
|
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
func CreateMockEncryptionAlg(ctrl *gomock.Controller) EncryptionAlgorithm {
|
|
mCrypto := NewMockEncryptionAlgorithm(ctrl)
|
|
mCrypto.EXPECT().Algorithm().AnyTimes().Return("enc")
|
|
mCrypto.EXPECT().EncryptionKeyID().AnyTimes().Return("id")
|
|
mCrypto.EXPECT().DecryptionKeyIDs().AnyTimes().Return([]string{"id"})
|
|
mCrypto.EXPECT().Encrypt(gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte) ([]byte, error) {
|
|
return code, nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte, keyID string) (string, error) {
|
|
if keyID != "id" {
|
|
return "", zerrors.ThrowInternal(nil, "id", "invalid key id")
|
|
}
|
|
return string(code), nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().Decrypt(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte, keyID string) ([]byte, error) {
|
|
if keyID != "id" {
|
|
return nil, zerrors.ThrowInternal(nil, "id", "invalid key id")
|
|
}
|
|
return code, nil
|
|
},
|
|
)
|
|
return mCrypto
|
|
}
|
|
|
|
func CreateMockAuthEncryptionAlg(ctrl *gomock.Controller) AuthEncryptionAlgorithm {
|
|
mCrypto := NewMockAuthEncryptionAlgorithm(ctrl)
|
|
mCrypto.EXPECT().Algorithm().AnyTimes().Return("enc")
|
|
mCrypto.EXPECT().EncryptionKeyID().AnyTimes().Return("id")
|
|
mCrypto.EXPECT().DecryptionKeyIDs().AnyTimes().Return([]string{"id"})
|
|
mCrypto.EXPECT().Encrypt(gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte) ([]byte, error) {
|
|
return code, nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().DecryptString(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte, keyID string) (string, error) {
|
|
if keyID != "id" {
|
|
return "", zerrors.ThrowInternal(nil, "id", "invalid key id")
|
|
}
|
|
return string(code), nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().Decrypt(gomock.Any(), gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(code []byte, keyID string) ([]byte, error) {
|
|
if keyID != "id" {
|
|
return nil, zerrors.ThrowInternal(nil, "id", "invalid key id")
|
|
}
|
|
return code, nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().EncryptToken(gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(data string) (string, error) {
|
|
return data, nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().DecryptToken(gomock.Any()).AnyTimes().DoAndReturn(
|
|
func(token string) (string, error) {
|
|
return token, nil
|
|
},
|
|
)
|
|
mCrypto.EXPECT().LegacyTokenEnabled().AnyTimes().Return(false)
|
|
return mCrypto
|
|
}
|
|
|
|
func createMockCrypto(t *testing.T) EncryptionAlgorithm {
|
|
mCrypto := NewMockEncryptionAlgorithm(gomock.NewController(t))
|
|
mCrypto.EXPECT().Algorithm().AnyTimes().Return("crypto")
|
|
return mCrypto
|
|
}
|
|
|
|
func createMockGenerator(t *testing.T, crypto EncryptionAlgorithm) Generator {
|
|
mGenerator := NewMockGenerator(gomock.NewController(t))
|
|
mGenerator.EXPECT().Alg().AnyTimes().Return(crypto)
|
|
return mGenerator
|
|
}
|