2022-03-24 16:21:34 +00:00
|
|
|
package query
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"database/sql"
|
2024-02-28 08:55:54 +00:00
|
|
|
_ "embed"
|
|
|
|
"encoding/json"
|
2023-12-08 14:30:55 +00:00
|
|
|
"errors"
|
2024-02-28 10:49:57 +00:00
|
|
|
"fmt"
|
2024-09-25 19:40:21 +00:00
|
|
|
"slices"
|
2022-04-25 08:01:17 +00:00
|
|
|
"strings"
|
2022-03-24 16:21:34 +00:00
|
|
|
"time"
|
|
|
|
|
|
|
|
sq "github.com/Masterminds/squirrel"
|
2023-10-19 10:19:10 +00:00
|
|
|
"github.com/zitadel/logging"
|
2022-03-24 16:21:34 +00:00
|
|
|
"golang.org/x/text/language"
|
|
|
|
|
2022-04-26 23:01:45 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
2023-02-27 21:36:43 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/api/call"
|
2022-12-14 06:17:36 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/database"
|
2024-09-25 19:40:21 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/eventstore"
|
2023-10-19 10:19:10 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/eventstore/handler/v2"
|
2024-02-28 08:55:54 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/feature"
|
2022-04-26 23:01:45 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/query/projection"
|
2022-12-01 08:18:53 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/telemetry/tracing"
|
2023-12-08 14:30:55 +00:00
|
|
|
"github.com/zitadel/zitadel/internal/zerrors"
|
2022-03-24 16:21:34 +00:00
|
|
|
)
|
|
|
|
|
2022-06-08 11:46:24 +00:00
|
|
|
const (
|
|
|
|
InstancesFilterTableAlias = "f"
|
|
|
|
)
|
|
|
|
|
2022-03-24 16:21:34 +00:00
|
|
|
var (
|
|
|
|
instanceTable = table{
|
2022-10-27 06:08:36 +00:00
|
|
|
name: projection.InstanceProjectionTable,
|
|
|
|
instanceIDCol: projection.InstanceColumnID,
|
2022-03-24 16:21:34 +00:00
|
|
|
}
|
2024-01-17 10:16:48 +00:00
|
|
|
limitsTable = table{
|
|
|
|
name: projection.LimitsProjectionTable,
|
|
|
|
instanceIDCol: projection.LimitsColumnInstanceID,
|
|
|
|
}
|
2022-03-24 16:21:34 +00:00
|
|
|
InstanceColumnID = Column{
|
|
|
|
name: projection.InstanceColumnID,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-04-21 10:37:39 +00:00
|
|
|
InstanceColumnName = Column{
|
|
|
|
name: projection.InstanceColumnName,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
|
|
|
InstanceColumnCreationDate = Column{
|
|
|
|
name: projection.InstanceColumnCreationDate,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-03-24 16:21:34 +00:00
|
|
|
InstanceColumnChangeDate = Column{
|
|
|
|
name: projection.InstanceColumnChangeDate,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
|
|
|
InstanceColumnSequence = Column{
|
|
|
|
name: projection.InstanceColumnSequence,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-06-03 12:30:39 +00:00
|
|
|
InstanceColumnDefaultOrgID = Column{
|
|
|
|
name: projection.InstanceColumnDefaultOrgID,
|
2022-03-24 16:21:34 +00:00
|
|
|
table: instanceTable,
|
|
|
|
}
|
|
|
|
InstanceColumnProjectID = Column{
|
|
|
|
name: projection.InstanceColumnProjectID,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-03-29 09:53:19 +00:00
|
|
|
InstanceColumnConsoleID = Column{
|
|
|
|
name: projection.InstanceColumnConsoleID,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-04-14 12:19:18 +00:00
|
|
|
InstanceColumnConsoleAppID = Column{
|
|
|
|
name: projection.InstanceColumnConsoleAppID,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2022-03-24 16:21:34 +00:00
|
|
|
InstanceColumnDefaultLanguage = Column{
|
|
|
|
name: projection.InstanceColumnDefaultLanguage,
|
|
|
|
table: instanceTable,
|
|
|
|
}
|
2024-01-17 10:16:48 +00:00
|
|
|
LimitsColumnInstanceID = Column{
|
|
|
|
name: projection.LimitsColumnInstanceID,
|
|
|
|
table: limitsTable,
|
|
|
|
}
|
|
|
|
LimitsColumnAuditLogRetention = Column{
|
|
|
|
name: projection.LimitsColumnAuditLogRetention,
|
|
|
|
table: limitsTable,
|
|
|
|
}
|
|
|
|
LimitsColumnBlock = Column{
|
|
|
|
name: projection.LimitsColumnBlock,
|
|
|
|
table: limitsTable,
|
|
|
|
}
|
2022-03-24 16:21:34 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type Instance struct {
|
2022-04-21 10:37:39 +00:00
|
|
|
ID string
|
|
|
|
ChangeDate time.Time
|
|
|
|
CreationDate time.Time
|
|
|
|
Sequence uint64
|
2022-04-27 15:18:34 +00:00
|
|
|
Name string
|
2022-03-24 16:21:34 +00:00
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
DefaultOrgID string
|
|
|
|
IAMProjectID string
|
|
|
|
ConsoleID string
|
|
|
|
ConsoleAppID string
|
|
|
|
DefaultLang language.Tag
|
|
|
|
Domains []*InstanceDomain
|
2022-03-24 16:21:34 +00:00
|
|
|
}
|
|
|
|
|
2022-04-21 10:37:39 +00:00
|
|
|
type Instances struct {
|
|
|
|
SearchResponse
|
|
|
|
Instances []*Instance
|
|
|
|
}
|
|
|
|
|
2022-03-24 16:21:34 +00:00
|
|
|
type InstanceSearchQueries struct {
|
|
|
|
SearchRequest
|
|
|
|
Queries []SearchQuery
|
|
|
|
}
|
|
|
|
|
2022-04-21 10:37:39 +00:00
|
|
|
func NewInstanceIDsListSearchQuery(ids ...string) (SearchQuery, error) {
|
|
|
|
list := make([]interface{}, len(ids))
|
|
|
|
for i, value := range ids {
|
|
|
|
list[i] = value
|
|
|
|
}
|
|
|
|
return NewListQuery(InstanceColumnID, list, ListIn)
|
|
|
|
}
|
|
|
|
|
2023-10-25 19:20:12 +00:00
|
|
|
func NewInstanceDomainsListSearchQuery(domains ...string) (SearchQuery, error) {
|
|
|
|
list := make([]interface{}, len(domains))
|
|
|
|
for i, value := range domains {
|
|
|
|
list[i] = value
|
|
|
|
}
|
|
|
|
|
|
|
|
return NewListQuery(InstanceDomainDomainCol, list, ListIn)
|
|
|
|
}
|
|
|
|
|
2022-03-24 16:21:34 +00:00
|
|
|
func (q *InstanceSearchQueries) toQuery(query sq.SelectBuilder) sq.SelectBuilder {
|
|
|
|
query = q.SearchRequest.toQuery(query)
|
|
|
|
for _, q := range q.Queries {
|
|
|
|
query = q.toQuery(query)
|
|
|
|
}
|
|
|
|
return query
|
|
|
|
}
|
|
|
|
|
2022-04-21 10:37:39 +00:00
|
|
|
func (q *Queries) SearchInstances(ctx context.Context, queries *InstanceSearchQueries) (instances *Instances, err error) {
|
2022-12-01 08:18:53 +00:00
|
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
|
|
defer func() { span.EndWithError(err) }()
|
|
|
|
|
2023-02-27 21:36:43 +00:00
|
|
|
filter, query, scan := prepareInstancesQuery(ctx, q.client)
|
2022-06-08 11:46:24 +00:00
|
|
|
stmt, args, err := query(queries.toQuery(filter)).ToSql()
|
2022-04-21 10:37:39 +00:00
|
|
|
if err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInvalidArgument(err, "QUERY-M9fow", "Errors.Query.SQLStatement")
|
2022-04-21 10:37:39 +00:00
|
|
|
}
|
|
|
|
|
2023-08-22 12:49:02 +00:00
|
|
|
err = q.client.QueryContext(ctx, func(rows *sql.Rows) error {
|
|
|
|
instances, err = scan(rows)
|
|
|
|
return err
|
|
|
|
}, stmt, args...)
|
2022-04-21 10:37:39 +00:00
|
|
|
if err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInternal(err, "QUERY-3j98f", "Errors.Internal")
|
2022-04-21 10:37:39 +00:00
|
|
|
}
|
|
|
|
return instances, err
|
|
|
|
}
|
|
|
|
|
2023-08-22 12:49:02 +00:00
|
|
|
func (q *Queries) Instance(ctx context.Context, shouldTriggerBulk bool) (instance *Instance, err error) {
|
2022-12-01 08:18:53 +00:00
|
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
|
|
defer func() { span.EndWithError(err) }()
|
|
|
|
|
2022-06-14 05:51:00 +00:00
|
|
|
if shouldTriggerBulk {
|
2023-10-26 15:07:56 +00:00
|
|
|
_, traceSpan := tracing.NewNamedSpan(ctx, "TriggerInstanceProjection")
|
2023-10-19 10:19:10 +00:00
|
|
|
ctx, err = projection.InstanceProjection.Trigger(ctx, handler.WithAwaitRunning())
|
|
|
|
logging.OnError(err).Debug("trigger failed")
|
2023-10-26 15:07:56 +00:00
|
|
|
traceSpan.EndWithError(err)
|
2022-06-14 05:51:00 +00:00
|
|
|
}
|
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
stmt, scan := prepareInstanceDomainQuery(ctx, q.client)
|
2022-03-24 16:21:34 +00:00
|
|
|
query, args, err := stmt.Where(sq.Eq{
|
2022-03-29 09:53:19 +00:00
|
|
|
InstanceColumnID.identifier(): authz.GetInstance(ctx).InstanceID(),
|
2022-03-24 16:21:34 +00:00
|
|
|
}).ToSql()
|
|
|
|
if err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInternal(err, "QUERY-d9ngs", "Errors.Query.SQLStatement")
|
2022-03-24 16:21:34 +00:00
|
|
|
}
|
|
|
|
|
2023-08-22 12:49:02 +00:00
|
|
|
err = q.client.QueryContext(ctx, func(rows *sql.Rows) error {
|
|
|
|
instance, err = scan(rows)
|
|
|
|
return err
|
|
|
|
}, query, args...)
|
|
|
|
return instance, err
|
2022-03-24 16:21:34 +00:00
|
|
|
}
|
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
var (
|
|
|
|
//go:embed instance_by_domain.sql
|
|
|
|
instanceByDomainQuery string
|
|
|
|
|
|
|
|
//go:embed instance_by_id.sql
|
|
|
|
instanceByIDQuery string
|
|
|
|
)
|
|
|
|
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
func (q *Queries) InstanceByHost(ctx context.Context, instanceHost, publicHost string) (_ authz.Instance, err error) {
|
2022-12-01 08:18:53 +00:00
|
|
|
ctx, span := tracing.NewSpan(ctx)
|
2024-02-28 10:49:57 +00:00
|
|
|
defer func() {
|
|
|
|
if err != nil {
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
err = fmt.Errorf("unable to get instance by host: instanceHost %s, publicHost %s: %w", instanceHost, publicHost, err)
|
2024-02-28 10:49:57 +00:00
|
|
|
}
|
|
|
|
span.EndWithError(err)
|
|
|
|
}()
|
2022-12-01 08:18:53 +00:00
|
|
|
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
instanceDomain := strings.Split(instanceHost, ":")[0] // remove possible port
|
|
|
|
publicDomain := strings.Split(publicHost, ":")[0] // remove possible port
|
2024-09-25 19:40:21 +00:00
|
|
|
|
|
|
|
instance, ok := q.caches.instance.Get(ctx, instanceIndexByHost, instanceDomain)
|
|
|
|
if ok {
|
|
|
|
return instance, instance.checkDomain(instanceDomain, publicDomain)
|
|
|
|
}
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
instance, scan := scanAuthzInstance()
|
2024-09-25 19:40:21 +00:00
|
|
|
if err = q.client.QueryRowContext(ctx, scan, instanceByDomainQuery, instanceDomain); err != nil {
|
|
|
|
return nil, err
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
}
|
2024-09-25 19:40:21 +00:00
|
|
|
q.caches.instance.Set(ctx, instance)
|
|
|
|
|
|
|
|
return instance, instance.checkDomain(instanceDomain, publicDomain)
|
2022-03-29 09:53:19 +00:00
|
|
|
}
|
|
|
|
|
2024-08-12 20:32:01 +00:00
|
|
|
func (q *Queries) InstanceByID(ctx context.Context, id string) (_ authz.Instance, err error) {
|
2024-02-28 08:55:54 +00:00
|
|
|
ctx, span := tracing.NewSpan(ctx)
|
|
|
|
defer func() { span.EndWithError(err) }()
|
2024-09-25 19:40:21 +00:00
|
|
|
|
|
|
|
instance, ok := q.caches.instance.Get(ctx, instanceIndexByID, id)
|
|
|
|
if ok {
|
|
|
|
return instance, nil
|
|
|
|
}
|
|
|
|
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
instance, scan := scanAuthzInstance()
|
2024-08-12 20:32:01 +00:00
|
|
|
err = q.client.QueryRowContext(ctx, scan, instanceByIDQuery, id)
|
|
|
|
logging.OnError(err).WithField("instance_id", id).Warn("instance by ID")
|
2024-09-25 19:40:21 +00:00
|
|
|
if err == nil {
|
|
|
|
q.caches.instance.Set(ctx, instance)
|
|
|
|
}
|
2024-02-28 08:55:54 +00:00
|
|
|
return instance, err
|
2023-02-15 01:52:11 +00:00
|
|
|
}
|
|
|
|
|
2022-03-24 16:21:34 +00:00
|
|
|
func (q *Queries) GetDefaultLanguage(ctx context.Context) language.Tag {
|
2022-06-14 05:51:00 +00:00
|
|
|
instance, err := q.Instance(ctx, false)
|
2022-03-24 16:21:34 +00:00
|
|
|
if err != nil {
|
|
|
|
return language.Und
|
|
|
|
}
|
2024-02-28 08:55:54 +00:00
|
|
|
return instance.DefaultLang
|
2022-03-24 16:21:34 +00:00
|
|
|
}
|
2022-04-21 10:37:39 +00:00
|
|
|
|
2023-02-27 21:36:43 +00:00
|
|
|
func prepareInstancesQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(sq.SelectBuilder) sq.SelectBuilder, func(*sql.Rows) (*Instances, error)) {
|
2022-06-08 11:46:24 +00:00
|
|
|
instanceFilterTable := instanceTable.setAlias(InstancesFilterTableAlias)
|
|
|
|
instanceFilterIDColumn := InstanceColumnID.setTable(instanceFilterTable)
|
|
|
|
instanceFilterCountColumn := InstancesFilterTableAlias + ".count"
|
2022-04-21 10:37:39 +00:00
|
|
|
return sq.Select(
|
|
|
|
InstanceColumnID.identifier(),
|
|
|
|
countColumn.identifier(),
|
2023-11-07 06:12:16 +00:00
|
|
|
).Distinct().From(instanceTable.identifier()).
|
2023-10-25 19:20:12 +00:00
|
|
|
LeftJoin(join(InstanceDomainInstanceIDCol, InstanceColumnID)),
|
2022-06-08 11:46:24 +00:00
|
|
|
func(builder sq.SelectBuilder) sq.SelectBuilder {
|
|
|
|
return sq.Select(
|
|
|
|
instanceFilterCountColumn,
|
|
|
|
instanceFilterIDColumn.identifier(),
|
|
|
|
InstanceColumnCreationDate.identifier(),
|
|
|
|
InstanceColumnChangeDate.identifier(),
|
|
|
|
InstanceColumnSequence.identifier(),
|
|
|
|
InstanceColumnName.identifier(),
|
|
|
|
InstanceColumnDefaultOrgID.identifier(),
|
|
|
|
InstanceColumnProjectID.identifier(),
|
|
|
|
InstanceColumnConsoleID.identifier(),
|
|
|
|
InstanceColumnConsoleAppID.identifier(),
|
|
|
|
InstanceColumnDefaultLanguage.identifier(),
|
|
|
|
InstanceDomainDomainCol.identifier(),
|
|
|
|
InstanceDomainIsPrimaryCol.identifier(),
|
|
|
|
InstanceDomainIsGeneratedCol.identifier(),
|
|
|
|
InstanceDomainCreationDateCol.identifier(),
|
|
|
|
InstanceDomainChangeDateCol.identifier(),
|
|
|
|
InstanceDomainSequenceCol.identifier(),
|
|
|
|
).FromSelect(builder, InstancesFilterTableAlias).
|
|
|
|
LeftJoin(join(InstanceColumnID, instanceFilterIDColumn)).
|
2023-02-27 21:36:43 +00:00
|
|
|
LeftJoin(join(InstanceDomainInstanceIDCol, instanceFilterIDColumn) + db.Timetravel(call.Took(ctx))).
|
2022-06-08 11:46:24 +00:00
|
|
|
PlaceholderFormat(sq.Dollar)
|
|
|
|
},
|
2022-04-21 10:37:39 +00:00
|
|
|
func(rows *sql.Rows) (*Instances, error) {
|
|
|
|
instances := make([]*Instance, 0)
|
2022-06-08 11:46:24 +00:00
|
|
|
var lastInstance *Instance
|
2022-04-21 10:37:39 +00:00
|
|
|
var count uint64
|
|
|
|
for rows.Next() {
|
|
|
|
instance := new(Instance)
|
|
|
|
lang := ""
|
2022-06-08 11:46:24 +00:00
|
|
|
var (
|
|
|
|
domain sql.NullString
|
|
|
|
isPrimary sql.NullBool
|
|
|
|
isGenerated sql.NullBool
|
|
|
|
changeDate sql.NullTime
|
|
|
|
creationDate sql.NullTime
|
|
|
|
sequence sql.NullInt64
|
|
|
|
)
|
2022-04-21 10:37:39 +00:00
|
|
|
err := rows.Scan(
|
2022-06-08 11:46:24 +00:00
|
|
|
&count,
|
2022-04-21 10:37:39 +00:00
|
|
|
&instance.ID,
|
|
|
|
&instance.CreationDate,
|
|
|
|
&instance.ChangeDate,
|
|
|
|
&instance.Sequence,
|
2022-04-27 15:18:34 +00:00
|
|
|
&instance.Name,
|
2022-06-03 12:30:39 +00:00
|
|
|
&instance.DefaultOrgID,
|
2022-04-21 10:37:39 +00:00
|
|
|
&instance.IAMProjectID,
|
|
|
|
&instance.ConsoleID,
|
|
|
|
&instance.ConsoleAppID,
|
|
|
|
&lang,
|
2022-06-08 11:46:24 +00:00
|
|
|
&domain,
|
|
|
|
&isPrimary,
|
|
|
|
&isGenerated,
|
|
|
|
&changeDate,
|
|
|
|
&creationDate,
|
|
|
|
&sequence,
|
2022-04-21 10:37:39 +00:00
|
|
|
)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-06-08 11:46:24 +00:00
|
|
|
if instance.ID == "" || !domain.Valid {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
instance.DefaultLang = language.Make(lang)
|
|
|
|
instanceDomain := &InstanceDomain{
|
|
|
|
CreationDate: creationDate.Time,
|
|
|
|
ChangeDate: changeDate.Time,
|
|
|
|
Sequence: uint64(sequence.Int64),
|
|
|
|
Domain: domain.String,
|
|
|
|
IsPrimary: isPrimary.Bool,
|
|
|
|
IsGenerated: isGenerated.Bool,
|
|
|
|
InstanceID: instance.ID,
|
|
|
|
}
|
|
|
|
if lastInstance != nil && instance.ID == lastInstance.ID {
|
|
|
|
lastInstance.Domains = append(lastInstance.Domains, instanceDomain)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
lastInstance = instance
|
|
|
|
instance.Domains = append(instance.Domains, instanceDomain)
|
2022-04-21 10:37:39 +00:00
|
|
|
instances = append(instances, instance)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := rows.Close(); err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInternal(err, "QUERY-8nlWW", "Errors.Query.CloseRows")
|
2022-04-21 10:37:39 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &Instances{
|
|
|
|
Instances: instances,
|
|
|
|
SearchResponse: SearchResponse{
|
|
|
|
Count: count,
|
|
|
|
},
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
}
|
2022-04-25 08:01:17 +00:00
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
func prepareInstanceDomainQuery(ctx context.Context, db prepareDatabase) (sq.SelectBuilder, func(*sql.Rows) (*Instance, error)) {
|
2022-04-25 08:01:17 +00:00
|
|
|
return sq.Select(
|
|
|
|
InstanceColumnID.identifier(),
|
|
|
|
InstanceColumnCreationDate.identifier(),
|
|
|
|
InstanceColumnChangeDate.identifier(),
|
|
|
|
InstanceColumnSequence.identifier(),
|
2022-04-27 15:18:34 +00:00
|
|
|
InstanceColumnName.identifier(),
|
2022-06-03 12:30:39 +00:00
|
|
|
InstanceColumnDefaultOrgID.identifier(),
|
2022-04-25 08:01:17 +00:00
|
|
|
InstanceColumnProjectID.identifier(),
|
|
|
|
InstanceColumnConsoleID.identifier(),
|
|
|
|
InstanceColumnConsoleAppID.identifier(),
|
|
|
|
InstanceColumnDefaultLanguage.identifier(),
|
2022-04-27 15:18:34 +00:00
|
|
|
InstanceDomainDomainCol.identifier(),
|
|
|
|
InstanceDomainIsPrimaryCol.identifier(),
|
|
|
|
InstanceDomainIsGeneratedCol.identifier(),
|
|
|
|
InstanceDomainCreationDateCol.identifier(),
|
|
|
|
InstanceDomainChangeDateCol.identifier(),
|
|
|
|
InstanceDomainSequenceCol.identifier(),
|
2022-04-25 08:01:17 +00:00
|
|
|
).
|
|
|
|
From(instanceTable.identifier()).
|
2023-02-27 21:36:43 +00:00
|
|
|
LeftJoin(join(InstanceDomainInstanceIDCol, InstanceColumnID) + db.Timetravel(call.Took(ctx))).
|
2022-04-25 08:01:17 +00:00
|
|
|
PlaceholderFormat(sq.Dollar),
|
2022-04-27 15:18:34 +00:00
|
|
|
func(rows *sql.Rows) (*Instance, error) {
|
|
|
|
instance := &Instance{
|
|
|
|
Domains: make([]*InstanceDomain, 0),
|
|
|
|
}
|
2022-04-25 08:01:17 +00:00
|
|
|
lang := ""
|
2022-04-27 15:18:34 +00:00
|
|
|
for rows.Next() {
|
|
|
|
var (
|
|
|
|
domain sql.NullString
|
|
|
|
isPrimary sql.NullBool
|
|
|
|
isGenerated sql.NullBool
|
|
|
|
changeDate sql.NullTime
|
|
|
|
creationDate sql.NullTime
|
2022-06-08 11:46:24 +00:00
|
|
|
sequence sql.NullInt64
|
2022-04-27 15:18:34 +00:00
|
|
|
)
|
|
|
|
err := rows.Scan(
|
|
|
|
&instance.ID,
|
|
|
|
&instance.CreationDate,
|
|
|
|
&instance.ChangeDate,
|
|
|
|
&instance.Sequence,
|
|
|
|
&instance.Name,
|
2022-06-03 12:30:39 +00:00
|
|
|
&instance.DefaultOrgID,
|
2022-04-27 15:18:34 +00:00
|
|
|
&instance.IAMProjectID,
|
|
|
|
&instance.ConsoleID,
|
|
|
|
&instance.ConsoleAppID,
|
|
|
|
&lang,
|
|
|
|
&domain,
|
|
|
|
&isPrimary,
|
|
|
|
&isGenerated,
|
|
|
|
&changeDate,
|
|
|
|
&creationDate,
|
2022-06-08 11:46:24 +00:00
|
|
|
&sequence,
|
2022-04-27 15:18:34 +00:00
|
|
|
)
|
|
|
|
if err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInternal(err, "QUERY-d9nw", "Errors.Internal")
|
2022-04-27 15:18:34 +00:00
|
|
|
}
|
|
|
|
if !domain.Valid {
|
|
|
|
continue
|
2022-04-25 08:01:17 +00:00
|
|
|
}
|
2022-04-27 15:18:34 +00:00
|
|
|
instance.Domains = append(instance.Domains, &InstanceDomain{
|
|
|
|
CreationDate: creationDate.Time,
|
|
|
|
ChangeDate: changeDate.Time,
|
2022-06-08 11:46:24 +00:00
|
|
|
Sequence: uint64(sequence.Int64),
|
2022-04-27 15:18:34 +00:00
|
|
|
Domain: domain.String,
|
|
|
|
IsPrimary: isPrimary.Bool,
|
|
|
|
IsGenerated: isGenerated.Bool,
|
|
|
|
InstanceID: instance.ID,
|
|
|
|
})
|
|
|
|
}
|
2022-08-17 06:07:41 +00:00
|
|
|
if instance.ID == "" {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowNotFound(nil, "QUERY-n0wng", "Errors.IAM.NotFound")
|
2022-08-17 06:07:41 +00:00
|
|
|
}
|
2022-05-03 13:58:38 +00:00
|
|
|
instance.DefaultLang = language.Make(lang)
|
2022-04-27 15:18:34 +00:00
|
|
|
if err := rows.Close(); err != nil {
|
2023-12-08 14:30:55 +00:00
|
|
|
return nil, zerrors.ThrowInternal(err, "QUERY-Dfbe2", "Errors.Query.CloseRows")
|
2022-04-25 08:01:17 +00:00
|
|
|
}
|
|
|
|
return instance, nil
|
|
|
|
}
|
|
|
|
}
|
2022-12-14 06:17:36 +00:00
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
type authzInstance struct {
|
2024-02-28 10:21:11 +00:00
|
|
|
id string
|
|
|
|
iamProjectID string
|
|
|
|
consoleID string
|
|
|
|
consoleAppID string
|
|
|
|
defaultLang language.Tag
|
|
|
|
defaultOrgID string
|
|
|
|
csp csp
|
|
|
|
enableImpersonation bool
|
|
|
|
block *bool
|
|
|
|
auditLogRetention *time.Duration
|
|
|
|
features feature.Features
|
2024-09-25 19:40:21 +00:00
|
|
|
externalDomains database.TextArray[string]
|
|
|
|
trustedDomains database.TextArray[string]
|
2024-02-28 08:55:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type csp struct {
|
2024-02-28 10:21:11 +00:00
|
|
|
enableIframeEmbedding bool
|
|
|
|
allowedOrigins database.TextArray[string]
|
2024-02-28 08:55:54 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) InstanceID() string {
|
|
|
|
return i.id
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) ProjectID() string {
|
|
|
|
return i.iamProjectID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) ConsoleClientID() string {
|
|
|
|
return i.consoleID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) ConsoleApplicationID() string {
|
|
|
|
return i.consoleAppID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) DefaultLanguage() language.Tag {
|
|
|
|
return i.defaultLang
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) DefaultOrganisationID() string {
|
|
|
|
return i.defaultOrgID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) SecurityPolicyAllowedOrigins() []string {
|
2024-02-28 10:21:11 +00:00
|
|
|
if !i.csp.enableIframeEmbedding {
|
2024-02-28 08:55:54 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return i.csp.allowedOrigins
|
|
|
|
}
|
|
|
|
|
2024-02-28 10:21:11 +00:00
|
|
|
func (i *authzInstance) EnableImpersonation() bool {
|
|
|
|
return i.enableImpersonation
|
|
|
|
}
|
|
|
|
|
2024-02-28 08:55:54 +00:00
|
|
|
func (i *authzInstance) Block() *bool {
|
|
|
|
return i.block
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) AuditLogRetention() *time.Duration {
|
|
|
|
return i.auditLogRetention
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *authzInstance) Features() feature.Features {
|
|
|
|
return i.features
|
|
|
|
}
|
|
|
|
|
2024-09-25 19:40:21 +00:00
|
|
|
var errPublicDomain = "public domain %q not trusted"
|
|
|
|
|
|
|
|
func (i *authzInstance) checkDomain(instanceDomain, publicDomain string) error {
|
|
|
|
// in case public domain is empty, or the same as the instance domain, we do not need to check it
|
|
|
|
if publicDomain == "" || instanceDomain == publicDomain {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if !slices.Contains(i.trustedDomains, publicDomain) {
|
|
|
|
return zerrors.ThrowNotFound(fmt.Errorf(errPublicDomain, publicDomain), "QUERY-IuGh1", "Errors.IAM.NotFound")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Keys implements [cache.Entry]
|
|
|
|
func (i *authzInstance) Keys(index instanceIndex) []string {
|
|
|
|
switch index {
|
|
|
|
case instanceIndexByID:
|
|
|
|
return []string{i.id}
|
|
|
|
case instanceIndexByHost:
|
|
|
|
return i.externalDomains
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
feat: trusted (instance) domains (#8369)
# Which Problems Are Solved
ZITADEL currently selects the instance context based on a HTTP header
(see https://github.com/zitadel/zitadel/issues/8279#issue-2399959845 and
checks it against the list of instance domains. Let's call it instance
or API domain.
For any context based URL (e.g. OAuth, OIDC, SAML endpoints, links in
emails, ...) the requested domain (instance domain) will be used. Let's
call it the public domain.
In cases of proxied setups, all exposed domains (public domains) require
the domain to be managed as instance domain.
This can either be done using the "ExternalDomain" in the runtime config
or via system API, which requires a validation through CustomerPortal on
zitadel.cloud.
# How the Problems Are Solved
- Two new headers / header list are added:
- `InstanceHostHeaders`: an ordered list (first sent wins), which will
be used to match the instance.
(For backward compatibility: the `HTTP1HostHeader`, `HTTP2HostHeader`
and `forwarded`, `x-forwarded-for`, `x-forwarded-host` are checked
afterwards as well)
- `PublicHostHeaders`: an ordered list (first sent wins), which will be
used as public host / domain. This will be checked against a list of
trusted domains on the instance.
- The middleware intercepts all requests to the API and passes a
`DomainCtx` object with the hosts and protocol into the context
(previously only a computed `origin` was passed)
- HTTP / GRPC server do not longer try to match the headers to instances
themself, but use the passed `http.DomainContext` in their interceptors.
- The `RequestedHost` and `RequestedDomain` from authz.Instance are
removed in favor of the `http.DomainContext`
- When authenticating to or signing out from Console UI, the current
`http.DomainContext(ctx).Origin` (already checked by instance
interceptor for validity) is used to compute and dynamically add a
`redirect_uri` and `post_logout_redirect_uri`.
- Gateway passes all configured host headers (previously only did
`x-zitadel-*`)
- Admin API allows to manage trusted domain
# Additional Changes
None
# Additional Context
- part of #8279
- open topics:
- "single-instance" mode
- Console UI
2024-07-31 15:00:38 +00:00
|
|
|
func scanAuthzInstance() (*authzInstance, func(row *sql.Row) error) {
|
|
|
|
instance := &authzInstance{}
|
2024-02-28 08:55:54 +00:00
|
|
|
return instance, func(row *sql.Row) error {
|
|
|
|
var (
|
|
|
|
lang string
|
2024-02-28 10:21:11 +00:00
|
|
|
enableIframeEmbedding sql.NullBool
|
|
|
|
enableImpersonation sql.NullBool
|
2024-02-28 08:55:54 +00:00
|
|
|
auditLogRetention database.NullDuration
|
|
|
|
block sql.NullBool
|
|
|
|
features []byte
|
|
|
|
)
|
|
|
|
err := row.Scan(
|
|
|
|
&instance.id,
|
|
|
|
&instance.defaultOrgID,
|
|
|
|
&instance.iamProjectID,
|
|
|
|
&instance.consoleID,
|
|
|
|
&instance.consoleAppID,
|
|
|
|
&lang,
|
2024-02-28 10:21:11 +00:00
|
|
|
&enableIframeEmbedding,
|
2024-02-28 08:55:54 +00:00
|
|
|
&instance.csp.allowedOrigins,
|
2024-02-28 10:21:11 +00:00
|
|
|
&enableImpersonation,
|
2024-02-28 08:55:54 +00:00
|
|
|
&auditLogRetention,
|
|
|
|
&block,
|
|
|
|
&features,
|
2024-09-25 19:40:21 +00:00
|
|
|
&instance.externalDomains,
|
|
|
|
&instance.trustedDomains,
|
2024-02-28 08:55:54 +00:00
|
|
|
)
|
|
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
|
|
return zerrors.ThrowNotFound(nil, "QUERY-1kIjX", "Errors.IAM.NotFound")
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return zerrors.ThrowInternal(err, "QUERY-d3fas", "Errors.Internal")
|
2022-12-14 06:17:36 +00:00
|
|
|
}
|
2024-02-28 08:55:54 +00:00
|
|
|
instance.defaultLang = language.Make(lang)
|
|
|
|
if auditLogRetention.Valid {
|
|
|
|
instance.auditLogRetention = &auditLogRetention.Duration
|
|
|
|
}
|
|
|
|
if block.Valid {
|
|
|
|
instance.block = &block.Bool
|
|
|
|
}
|
2024-02-28 10:21:11 +00:00
|
|
|
instance.csp.enableIframeEmbedding = enableIframeEmbedding.Bool
|
|
|
|
instance.enableImpersonation = enableImpersonation.Bool
|
2024-02-28 08:55:54 +00:00
|
|
|
if len(features) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if err = json.Unmarshal(features, &instance.features); err != nil {
|
|
|
|
return zerrors.ThrowInternal(err, "QUERY-Po8ki", "Errors.Internal")
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2022-12-14 06:17:36 +00:00
|
|
|
}
|
2024-09-25 19:40:21 +00:00
|
|
|
|
|
|
|
func (c *Caches) registerInstanceInvalidation() {
|
|
|
|
invalidate := cacheInvalidationFunc(c.instance, instanceIndexByID, getAggregateID)
|
|
|
|
projection.InstanceProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
projection.InstanceDomainProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
projection.InstanceFeatureProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
projection.InstanceTrustedDomainProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
projection.SecurityPolicyProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
|
|
|
|
// limits uses own aggregate ID, invalidate using resource owner.
|
|
|
|
invalidate = cacheInvalidationFunc(c.instance, instanceIndexByID, getResourceOwner)
|
|
|
|
projection.LimitsProjection.RegisterCacheInvalidation(invalidate)
|
|
|
|
|
|
|
|
// System feature update should invalidate all instances, so Truncate the cache.
|
|
|
|
projection.SystemFeatureProjection.RegisterCacheInvalidation(func(ctx context.Context, _ []*eventstore.Aggregate) {
|
|
|
|
err := c.instance.Truncate(ctx)
|
|
|
|
logging.OnError(err).Warn("cache truncate failed")
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
type instanceIndex int16
|
|
|
|
|
|
|
|
//go:generate enumer -type instanceIndex
|
|
|
|
const (
|
|
|
|
instanceIndexByID instanceIndex = iota
|
|
|
|
instanceIndexByHost
|
|
|
|
)
|