mirror of
https://github.com/zitadel/zitadel.git
synced 2025-08-11 20:37:30 +00:00
feat(crypto): use passwap for machine and app secrets (#7657)
* feat(crypto): use passwap for machine and app secrets * fix command package tests * add hash generator command test * naming convention, fix query tests * rename PasswordHasher and cleanup start commands * add reducer tests * fix intergration tests, cleanup old config * add app secret unit tests * solve setup panics * fix push of updated events * add missing event translations * update documentation * solve linter errors * remove nolint:SA1019 as it doesn't seem to help anyway * add nolint to deprecated filter usage * update users migration version * remove unused ClientSecret from APIConfigChangedEvent --------- Co-authored-by: Livio Spring <livio.a@gmail.com>
This commit is contained in:
Tim Möhlmann
@@ -12,7 +12,6 @@ import (
|
||||
"github.com/stretchr/testify/require"
|
||||
"golang.org/x/text/language"
|
||||
|
||||
"github.com/zitadel/zitadel/internal/crypto"
|
||||
"github.com/zitadel/zitadel/internal/database"
|
||||
"github.com/zitadel/zitadel/internal/domain"
|
||||
"github.com/zitadel/zitadel/internal/zerrors"
|
||||
@@ -148,44 +147,44 @@ var (
|
||||
preferredLoginNameQuery = `SELECT preferred_login_name.user_id, preferred_login_name.login_name, preferred_login_name.instance_id` +
|
||||
` FROM projections.login_names3 AS preferred_login_name` +
|
||||
` WHERE preferred_login_name.is_primary = $1`
|
||||
userQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11.state,` +
|
||||
` projections.users11.type,` +
|
||||
` projections.users11.username,` +
|
||||
userQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12.state,` +
|
||||
` projections.users12.type,` +
|
||||
` projections.users12.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.first_name,` +
|
||||
` projections.users11_humans.last_name,` +
|
||||
` projections.users11_humans.nick_name,` +
|
||||
` projections.users11_humans.display_name,` +
|
||||
` projections.users11_humans.preferred_language,` +
|
||||
` projections.users11_humans.gender,` +
|
||||
` projections.users11_humans.avatar_key,` +
|
||||
` projections.users11_humans.email,` +
|
||||
` projections.users11_humans.is_email_verified,` +
|
||||
` projections.users11_humans.phone,` +
|
||||
` projections.users11_humans.is_phone_verified,` +
|
||||
` projections.users11_humans.password_change_required,` +
|
||||
` projections.users11_machines.user_id,` +
|
||||
` projections.users11_machines.name,` +
|
||||
` projections.users11_machines.description,` +
|
||||
` projections.users11_machines.secret,` +
|
||||
` projections.users11_machines.access_token_type,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.first_name,` +
|
||||
` projections.users12_humans.last_name,` +
|
||||
` projections.users12_humans.nick_name,` +
|
||||
` projections.users12_humans.display_name,` +
|
||||
` projections.users12_humans.preferred_language,` +
|
||||
` projections.users12_humans.gender,` +
|
||||
` projections.users12_humans.avatar_key,` +
|
||||
` projections.users12_humans.email,` +
|
||||
` projections.users12_humans.is_email_verified,` +
|
||||
` projections.users12_humans.phone,` +
|
||||
` projections.users12_humans.is_phone_verified,` +
|
||||
` projections.users12_humans.password_change_required,` +
|
||||
` projections.users12_machines.user_id,` +
|
||||
` projections.users12_machines.name,` +
|
||||
` projections.users12_machines.description,` +
|
||||
` projections.users12_machines.secret,` +
|
||||
` projections.users12_machines.access_token_type,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
` LEFT JOIN projections.users11_machines ON projections.users11.id = projections.users11_machines.user_id AND projections.users11.instance_id = projections.users11_machines.instance_id` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` LEFT JOIN projections.users12_machines ON projections.users12.id = projections.users12_machines.user_id AND projections.users12.instance_id = projections.users12_machines.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users11.id AND login_names.instance_id = projections.users11.instance_id` +
|
||||
` ON login_names.user_id = projections.users12.id AND login_names.instance_id = projections.users12.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users11.id AND preferred_login_name.instance_id = projections.users11.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users12.id AND preferred_login_name.instance_id = projections.users12.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
userCols = []string{
|
||||
"id",
|
||||
@@ -220,21 +219,21 @@ var (
|
||||
"access_token_type",
|
||||
"count",
|
||||
}
|
||||
profileQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.first_name,` +
|
||||
` projections.users11_humans.last_name,` +
|
||||
` projections.users11_humans.nick_name,` +
|
||||
` projections.users11_humans.display_name,` +
|
||||
` projections.users11_humans.preferred_language,` +
|
||||
` projections.users11_humans.gender,` +
|
||||
` projections.users11_humans.avatar_key` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
profileQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.first_name,` +
|
||||
` projections.users12_humans.last_name,` +
|
||||
` projections.users12_humans.nick_name,` +
|
||||
` projections.users12_humans.display_name,` +
|
||||
` projections.users12_humans.preferred_language,` +
|
||||
` projections.users12_humans.gender,` +
|
||||
` projections.users12_humans.avatar_key` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
profileCols = []string{
|
||||
"id",
|
||||
@@ -251,16 +250,16 @@ var (
|
||||
"gender",
|
||||
"avatar_key",
|
||||
}
|
||||
emailQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.email,` +
|
||||
` projections.users11_humans.is_email_verified` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
emailQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.email,` +
|
||||
` projections.users12_humans.is_email_verified` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
emailCols = []string{
|
||||
"id",
|
||||
@@ -272,16 +271,16 @@ var (
|
||||
"email",
|
||||
"is_email_verified",
|
||||
}
|
||||
phoneQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.phone,` +
|
||||
` projections.users11_humans.is_phone_verified` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
phoneQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.phone,` +
|
||||
` projections.users12_humans.is_phone_verified` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
phoneCols = []string{
|
||||
"id",
|
||||
@@ -293,14 +292,14 @@ var (
|
||||
"phone",
|
||||
"is_phone_verified",
|
||||
}
|
||||
userUniqueQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.state,` +
|
||||
` projections.users11.username,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.email,` +
|
||||
` projections.users11_humans.is_email_verified` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
userUniqueQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.state,` +
|
||||
` projections.users12.username,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.email,` +
|
||||
` projections.users12_humans.is_email_verified` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
userUniqueCols = []string{
|
||||
"id",
|
||||
@@ -310,40 +309,40 @@ var (
|
||||
"email",
|
||||
"is_email_verified",
|
||||
}
|
||||
notifyUserQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11.state,` +
|
||||
` projections.users11.type,` +
|
||||
` projections.users11.username,` +
|
||||
notifyUserQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12.state,` +
|
||||
` projections.users12.type,` +
|
||||
` projections.users12.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.first_name,` +
|
||||
` projections.users11_humans.last_name,` +
|
||||
` projections.users11_humans.nick_name,` +
|
||||
` projections.users11_humans.display_name,` +
|
||||
` projections.users11_humans.preferred_language,` +
|
||||
` projections.users11_humans.gender,` +
|
||||
` projections.users11_humans.avatar_key,` +
|
||||
` projections.users11_notifications.user_id,` +
|
||||
` projections.users11_notifications.last_email,` +
|
||||
` projections.users11_notifications.verified_email,` +
|
||||
` projections.users11_notifications.last_phone,` +
|
||||
` projections.users11_notifications.verified_phone,` +
|
||||
` projections.users11_notifications.password_set,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.first_name,` +
|
||||
` projections.users12_humans.last_name,` +
|
||||
` projections.users12_humans.nick_name,` +
|
||||
` projections.users12_humans.display_name,` +
|
||||
` projections.users12_humans.preferred_language,` +
|
||||
` projections.users12_humans.gender,` +
|
||||
` projections.users12_humans.avatar_key,` +
|
||||
` projections.users12_notifications.user_id,` +
|
||||
` projections.users12_notifications.last_email,` +
|
||||
` projections.users12_notifications.verified_email,` +
|
||||
` projections.users12_notifications.last_phone,` +
|
||||
` projections.users12_notifications.verified_phone,` +
|
||||
` projections.users12_notifications.password_set,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
` LEFT JOIN projections.users11_notifications ON projections.users11.id = projections.users11_notifications.user_id AND projections.users11.instance_id = projections.users11_notifications.instance_id` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` LEFT JOIN projections.users12_notifications ON projections.users12.id = projections.users12_notifications.user_id AND projections.users12.instance_id = projections.users12_notifications.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users11.id AND login_names.instance_id = projections.users11.instance_id` +
|
||||
` ON login_names.user_id = projections.users12.id AND login_names.instance_id = projections.users12.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users11.id AND preferred_login_name.instance_id = projections.users11.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users12.id AND preferred_login_name.instance_id = projections.users12.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
notifyUserCols = []string{
|
||||
"id",
|
||||
@@ -374,44 +373,44 @@ var (
|
||||
"password_set",
|
||||
"count",
|
||||
}
|
||||
usersQuery = `SELECT projections.users11.id,` +
|
||||
` projections.users11.creation_date,` +
|
||||
` projections.users11.change_date,` +
|
||||
` projections.users11.resource_owner,` +
|
||||
` projections.users11.sequence,` +
|
||||
` projections.users11.state,` +
|
||||
` projections.users11.type,` +
|
||||
` projections.users11.username,` +
|
||||
usersQuery = `SELECT projections.users12.id,` +
|
||||
` projections.users12.creation_date,` +
|
||||
` projections.users12.change_date,` +
|
||||
` projections.users12.resource_owner,` +
|
||||
` projections.users12.sequence,` +
|
||||
` projections.users12.state,` +
|
||||
` projections.users12.type,` +
|
||||
` projections.users12.username,` +
|
||||
` login_names.loginnames,` +
|
||||
` preferred_login_name.login_name,` +
|
||||
` projections.users11_humans.user_id,` +
|
||||
` projections.users11_humans.first_name,` +
|
||||
` projections.users11_humans.last_name,` +
|
||||
` projections.users11_humans.nick_name,` +
|
||||
` projections.users11_humans.display_name,` +
|
||||
` projections.users11_humans.preferred_language,` +
|
||||
` projections.users11_humans.gender,` +
|
||||
` projections.users11_humans.avatar_key,` +
|
||||
` projections.users11_humans.email,` +
|
||||
` projections.users11_humans.is_email_verified,` +
|
||||
` projections.users11_humans.phone,` +
|
||||
` projections.users11_humans.is_phone_verified,` +
|
||||
` projections.users11_humans.password_change_required,` +
|
||||
` projections.users11_machines.user_id,` +
|
||||
` projections.users11_machines.name,` +
|
||||
` projections.users11_machines.description,` +
|
||||
` projections.users11_machines.secret,` +
|
||||
` projections.users11_machines.access_token_type,` +
|
||||
` projections.users12_humans.user_id,` +
|
||||
` projections.users12_humans.first_name,` +
|
||||
` projections.users12_humans.last_name,` +
|
||||
` projections.users12_humans.nick_name,` +
|
||||
` projections.users12_humans.display_name,` +
|
||||
` projections.users12_humans.preferred_language,` +
|
||||
` projections.users12_humans.gender,` +
|
||||
` projections.users12_humans.avatar_key,` +
|
||||
` projections.users12_humans.email,` +
|
||||
` projections.users12_humans.is_email_verified,` +
|
||||
` projections.users12_humans.phone,` +
|
||||
` projections.users12_humans.is_phone_verified,` +
|
||||
` projections.users12_humans.password_change_required,` +
|
||||
` projections.users12_machines.user_id,` +
|
||||
` projections.users12_machines.name,` +
|
||||
` projections.users12_machines.description,` +
|
||||
` projections.users12_machines.secret,` +
|
||||
` projections.users12_machines.access_token_type,` +
|
||||
` COUNT(*) OVER ()` +
|
||||
` FROM projections.users11` +
|
||||
` LEFT JOIN projections.users11_humans ON projections.users11.id = projections.users11_humans.user_id AND projections.users11.instance_id = projections.users11_humans.instance_id` +
|
||||
` LEFT JOIN projections.users11_machines ON projections.users11.id = projections.users11_machines.user_id AND projections.users11.instance_id = projections.users11_machines.instance_id` +
|
||||
` FROM projections.users12` +
|
||||
` LEFT JOIN projections.users12_humans ON projections.users12.id = projections.users12_humans.user_id AND projections.users12.instance_id = projections.users12_humans.instance_id` +
|
||||
` LEFT JOIN projections.users12_machines ON projections.users12.id = projections.users12_machines.user_id AND projections.users12.instance_id = projections.users12_machines.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + loginNamesQuery + `) AS login_names` +
|
||||
` ON login_names.user_id = projections.users11.id AND login_names.instance_id = projections.users11.instance_id` +
|
||||
` ON login_names.user_id = projections.users12.id AND login_names.instance_id = projections.users12.instance_id` +
|
||||
` LEFT JOIN` +
|
||||
` (` + preferredLoginNameQuery + `) AS preferred_login_name` +
|
||||
` ON preferred_login_name.user_id = projections.users11.id AND preferred_login_name.instance_id = projections.users11.instance_id` +
|
||||
` ON preferred_login_name.user_id = projections.users12.id AND preferred_login_name.instance_id = projections.users12.instance_id` +
|
||||
` AS OF SYSTEM TIME '-1 ms'`
|
||||
usersCols = []string{
|
||||
"id",
|
||||
@@ -602,7 +601,7 @@ func Test_UserPrepares(t *testing.T) {
|
||||
Machine: &Machine{
|
||||
Name: "name",
|
||||
Description: "description",
|
||||
Secret: nil,
|
||||
EncodedSecret: "",
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
},
|
||||
},
|
||||
@@ -643,7 +642,7 @@ func Test_UserPrepares(t *testing.T) {
|
||||
"id",
|
||||
"name",
|
||||
"description",
|
||||
`{"CryptoType":1,"Algorithm":"bcrypt","Crypted":"deadbeef"}`,
|
||||
"secret",
|
||||
domain.OIDCTokenTypeBearer,
|
||||
1,
|
||||
},
|
||||
@@ -661,13 +660,9 @@ func Test_UserPrepares(t *testing.T) {
|
||||
LoginNames: database.TextArray[string]{"login_name1", "login_name2"},
|
||||
PreferredLoginName: "login_name1",
|
||||
Machine: &Machine{
|
||||
Name: "name",
|
||||
Description: "description",
|
||||
Secret: &crypto.CryptoValue{
|
||||
CryptoType: crypto.TypeHash,
|
||||
Algorithm: "bcrypt",
|
||||
Crypted: []byte{117, 230, 157, 109, 231, 159},
|
||||
},
|
||||
Name: "name",
|
||||
Description: "description",
|
||||
EncodedSecret: "secret",
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
},
|
||||
},
|
||||
@@ -1344,7 +1339,7 @@ func Test_UserPrepares(t *testing.T) {
|
||||
"id",
|
||||
"name",
|
||||
"description",
|
||||
`{"CryptoType":1,"Algorithm":"bcrypt","Crypted":"deadbeef"}`,
|
||||
"secret",
|
||||
domain.OIDCTokenTypeBearer,
|
||||
},
|
||||
},
|
||||
@@ -1393,13 +1388,9 @@ func Test_UserPrepares(t *testing.T) {
|
||||
LoginNames: database.TextArray[string]{"login_name1", "login_name2"},
|
||||
PreferredLoginName: "login_name1",
|
||||
Machine: &Machine{
|
||||
Name: "name",
|
||||
Description: "description",
|
||||
Secret: &crypto.CryptoValue{
|
||||
CryptoType: crypto.TypeHash,
|
||||
Algorithm: "bcrypt",
|
||||
Crypted: []byte{117, 230, 157, 109, 231, 159},
|
||||
},
|
||||
Name: "name",
|
||||
Description: "description",
|
||||
EncodedSecret: "secret",
|
||||
AccessTokenType: domain.OIDCTokenTypeBearer,
|
||||
},
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user