mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-18 05:52:51 +00:00
791d0587aa
# Which Problems Are Solved The payload in actions V2 is currently sent as JSON to the target endpoint. It might get exposed to intermediary infrastructure or logging systems. For these scenarios there needs to be an application-layer encryption, where the provider of the endpoint can define an key to be used for the encryption. # How the Problems Are Solved - Added an additional option to the target to specify the payload type: `JSON` (current and default), `JWT`, `JWE` (api and console) - added endpoints to upload and manage public keys (to be used for encryption) for a target - updated all action v2 executions (interceptors, oidc, saml, ...) to provide the `GetActiveSigningWebKey` from queries - implemented jwt and jwe in the exections incl. refactoring of code and tests - changes to the authn_keys table: - added a `fingerprint` column - dropped not null constraint on expiration - moved the `GetSignerOnce` into its own package to prevent circular dependencies # Additional Changes None # Additional Context closes #11061 --------- Co-authored-by: Marco A. <[email protected]> Co-authored-by: conblem <[email protected]> Co-authored-by: Silvan <[email protected]>
85 lines
2.7 KiB
SQL
85 lines
2.7 KiB
SQL
with domain as (
|
|
SELECT instance_id FROM eventstore.fields
|
|
WHERE object_type = 'instance_domain'
|
|
AND object_id = $1
|
|
AND field_name = 'domain'
|
|
), instance_features as (
|
|
select i.*
|
|
from domain d
|
|
join projections.instance_features2 i on d.instance_id = i.instance_id
|
|
), features as (
|
|
select instance_id, json_object_agg(
|
|
coalesce(i.key, s.key),
|
|
coalesce(i.value, s.value)
|
|
) features
|
|
from domain d
|
|
cross join projections.system_features s
|
|
full outer join instance_features i using (instance_id, key)
|
|
group by instance_id
|
|
), external_domains as (
|
|
select ed.instance_id, array_agg(ed.domain) as domains
|
|
from domain d
|
|
join projections.instance_domains ed on d.instance_id = ed.instance_id
|
|
group by ed.instance_id
|
|
), trusted_domains as (
|
|
select td.instance_id, array_agg(td.domain) as domains
|
|
from domain d
|
|
join projections.instance_trusted_domains td on d.instance_id = td.instance_id
|
|
group by td.instance_id
|
|
), execution_targets as (
|
|
select instance_id, json_agg(x.execution_targets) as execution_targets from (
|
|
select e.instance_id, json_build_object(
|
|
'execution_id', et.execution_id,
|
|
'target_id', t.id,
|
|
'target_type', t.target_type,
|
|
'endpoint', t.endpoint,
|
|
'timeout', t.timeout,
|
|
'interrupt_on_error', t.interrupt_on_error,
|
|
'signing_key', t.signing_key,
|
|
'payload_type', t.payload_type,
|
|
'encryption_key', encode(k.public_key, 'base64'),
|
|
'encryption_key_id', k.id
|
|
) as execution_targets
|
|
from domain d
|
|
join projections.executions1 e
|
|
on d.instance_id = e.instance_id
|
|
join projections.executions1_targets et
|
|
on e.instance_id = et.instance_id
|
|
and e.id = et.execution_id
|
|
join projections.targets2 t
|
|
on et.instance_id = t.instance_id
|
|
and et.target_id = t.id
|
|
left join projections.authn_keys2 k
|
|
on k.instance_id = et.instance_id
|
|
and k.object_id = t.id
|
|
and k.enabled = true
|
|
and (k.expiration IS NULL or k.expiration > now())
|
|
order by et.position asc
|
|
) as x
|
|
group by instance_id
|
|
)
|
|
select
|
|
i.id,
|
|
i.default_org_id,
|
|
i.iam_project_id,
|
|
i.console_client_id,
|
|
i.console_app_id,
|
|
i.default_language,
|
|
s.enable_iframe_embedding,
|
|
s.origins,
|
|
s.enable_impersonation,
|
|
l.audit_log_retention,
|
|
l.block,
|
|
f.features,
|
|
ed.domains as external_domains,
|
|
td.domains as trusted_domains,
|
|
et.execution_targets
|
|
from domain d
|
|
join projections.instances i on i.id = d.instance_id
|
|
left join projections.security_policies2 s on i.id = s.instance_id
|
|
left join projections.limits l on i.id = l.instance_id
|
|
left join features f on i.id = f.instance_id
|
|
left join external_domains ed on i.id = ed.instance_id
|
|
left join trusted_domains td on i.id = td.instance_id
|
|
left join execution_targets et on i.id = et.instance_id;
|