mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-21 23:14:26 +00:00
# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
184 lines
4.6 KiB
Go
184 lines
4.6 KiB
Go
package target
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
|
target_domain "github.com/zitadel/zitadel/internal/execution/target"
|
|
)
|
|
|
|
const (
|
|
eventTypePrefix eventstore.EventType = "target."
|
|
AddedEventType = eventTypePrefix + "added"
|
|
ChangedEventType = eventTypePrefix + "changed"
|
|
RemovedEventType = eventTypePrefix + "removed"
|
|
)
|
|
|
|
type AddedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name string `json:"name"`
|
|
TargetType target_domain.TargetType `json:"targetType"`
|
|
Endpoint string `json:"endpoint"`
|
|
Timeout time.Duration `json:"timeout"`
|
|
InterruptOnError bool `json:"interruptOnError"`
|
|
SigningKey *crypto.CryptoValue `json:"signingKey"`
|
|
PayloadType target_domain.PayloadType `json:"payloadType"`
|
|
}
|
|
|
|
func (e *AddedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
|
|
e.BaseEvent = *b
|
|
}
|
|
|
|
func (e *AddedEvent) Payload() any {
|
|
return e
|
|
}
|
|
|
|
func (e *AddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return []*eventstore.UniqueConstraint{NewAddUniqueConstraint(e.Name)}
|
|
}
|
|
|
|
func NewAddedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
name string,
|
|
targetType target_domain.TargetType,
|
|
endpoint string,
|
|
timeout time.Duration,
|
|
interruptOnError bool,
|
|
signingKey *crypto.CryptoValue,
|
|
payloadType target_domain.PayloadType,
|
|
) *AddedEvent {
|
|
return &AddedEvent{
|
|
*eventstore.NewBaseEventForPush(
|
|
ctx, aggregate, AddedEventType,
|
|
),
|
|
name,
|
|
targetType,
|
|
endpoint,
|
|
timeout,
|
|
interruptOnError,
|
|
signingKey,
|
|
payloadType,
|
|
}
|
|
}
|
|
|
|
type ChangedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
Name *string `json:"name,omitempty"`
|
|
TargetType *target_domain.TargetType `json:"targetType,omitempty"`
|
|
Endpoint *string `json:"endpoint,omitempty"`
|
|
Timeout *time.Duration `json:"timeout,omitempty"`
|
|
InterruptOnError *bool `json:"interruptOnError,omitempty"`
|
|
SigningKey *crypto.CryptoValue `json:"signingKey,omitempty"`
|
|
PayloadType target_domain.PayloadType `json:"payloadType,omitempty"`
|
|
|
|
oldName string
|
|
}
|
|
|
|
func (e *ChangedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
|
|
e.BaseEvent = *b
|
|
}
|
|
|
|
func (e *ChangedEvent) Payload() interface{} {
|
|
return e
|
|
}
|
|
|
|
func (e *ChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
if e.oldName == "" {
|
|
return nil
|
|
}
|
|
return []*eventstore.UniqueConstraint{
|
|
NewRemoveUniqueConstraint(e.oldName),
|
|
NewAddUniqueConstraint(*e.Name),
|
|
}
|
|
}
|
|
|
|
func NewChangedEvent(
|
|
ctx context.Context,
|
|
aggregate *eventstore.Aggregate,
|
|
changes []Changes,
|
|
) *ChangedEvent {
|
|
changeEvent := &ChangedEvent{
|
|
BaseEvent: *eventstore.NewBaseEventForPush(
|
|
ctx,
|
|
aggregate,
|
|
ChangedEventType,
|
|
),
|
|
}
|
|
for _, change := range changes {
|
|
change(changeEvent)
|
|
}
|
|
return changeEvent
|
|
}
|
|
|
|
type Changes func(event *ChangedEvent)
|
|
|
|
func ChangeName(oldName, name string) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.Name = &name
|
|
e.oldName = oldName
|
|
}
|
|
}
|
|
|
|
func ChangeTargetType(targetType target_domain.TargetType) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.TargetType = &targetType
|
|
}
|
|
}
|
|
|
|
func ChangeEndpoint(endpoint string) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.Endpoint = &endpoint
|
|
}
|
|
}
|
|
|
|
func ChangeTimeout(timeout time.Duration) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.Timeout = &timeout
|
|
}
|
|
}
|
|
|
|
func ChangeInterruptOnError(interruptOnError bool) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.InterruptOnError = &interruptOnError
|
|
}
|
|
}
|
|
|
|
func ChangeSigningKey(signingKey *crypto.CryptoValue) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.SigningKey = signingKey
|
|
}
|
|
}
|
|
|
|
func ChangePayloadType(payloadType target_domain.PayloadType) func(event *ChangedEvent) {
|
|
return func(e *ChangedEvent) {
|
|
e.PayloadType = payloadType
|
|
}
|
|
}
|
|
|
|
type RemovedEvent struct {
|
|
eventstore.BaseEvent `json:"-"`
|
|
|
|
name string
|
|
}
|
|
|
|
func (e *RemovedEvent) SetBaseEvent(b *eventstore.BaseEvent) {
|
|
e.BaseEvent = *b
|
|
}
|
|
|
|
func (e *RemovedEvent) Payload() any {
|
|
return e
|
|
}
|
|
|
|
func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
|
|
return []*eventstore.UniqueConstraint{NewRemoveUniqueConstraint(e.name)}
|
|
}
|
|
|
|
func NewRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, name string) *RemovedEvent {
|
|
return &RemovedEvent{*eventstore.NewBaseEventForPush(ctx, aggregate, RemovedEventType), name}
|
|
}
|