mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 13:52:51 +00:00
01fe34a526
# Which Problems Are Solved Opaque tokens now use authenticated encryption. # How the Problems Are Solved - Upgrade zitadel/oidc to v3.47 - Copy crypto implementation for refresh and session tokens (internal to zitadel) - Added config that allows validating old tokens for gradual roll-out # Additional Changes - Set NX cache for `integration-test-build` to `false`, working on a seperate fix. # Additional Context - closes #11315 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: muhlemmer <[email protected]>
29 lines
979 B
Go
29 lines
979 B
Go
package domain
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
|
)
|
|
|
|
func NewRefreshToken(userID, tokenID string, algorithm crypto.AuthAlgorithm) (string, error) {
|
|
return RefreshToken(userID, tokenID, tokenID, algorithm)
|
|
}
|
|
|
|
func RefreshToken(userID, tokenID, token string, algorithm crypto.AuthAlgorithm) (string, error) {
|
|
return algorithm.EncryptToken(userID + ":" + tokenID + ":" + token)
|
|
}
|
|
|
|
func FromRefreshToken(refreshToken string, algorithm crypto.AuthAlgorithm) (userID, tokenID, token string, err error) {
|
|
decrypted, err := algorithm.DecryptToken(refreshToken)
|
|
if err != nil {
|
|
return "", "", "", zerrors.ThrowInvalidArgument(err, "DOMAIN-rie9A", "Errors.User.RefreshToken.Invalid")
|
|
}
|
|
split := strings.Split(decrypted, ":")
|
|
if len(split) != 3 {
|
|
return "", "", "", zerrors.ThrowInvalidArgument(nil, "DOMAIN-Se8oh", "Errors.User.RefreshToken.Invalid")
|
|
}
|
|
return split[0], split[1], split[2], nil
|
|
}
|