diff --git a/cmd/admin/setup/03.go b/cmd/admin/setup/03.go index fc8660986f..2459f2dc63 100644 --- a/cmd/admin/setup/03.go +++ b/cmd/admin/setup/03.go @@ -23,8 +23,8 @@ type DefaultInstance struct { domain string defaults systemdefaults.SystemDefaults zitadelRoles []authz.RoleMapping - baseURL string externalSecure bool + externalPort uint16 } func (mig *DefaultInstance) Execute(ctx context.Context) error { @@ -47,6 +47,8 @@ func (mig *DefaultInstance) Execute(ctx context.Context) error { nil, nil, nil, + mig.externalSecure, + mig.externalPort, nil, nil, nil, @@ -60,7 +62,7 @@ func (mig *DefaultInstance) Execute(ctx context.Context) error { } ctx = authz.WithRequestedDomain(ctx, mig.domain) - _, _, err = cmd.SetUpInstance(ctx, &mig.InstanceSetup, mig.externalSecure, mig.baseURL) + _, _, err = cmd.SetUpInstance(ctx, &mig.InstanceSetup, mig.externalSecure) return err } diff --git a/cmd/admin/setup/config.go b/cmd/admin/setup/config.go index 57c520ac9e..95248ae335 100644 --- a/cmd/admin/setup/config.go +++ b/cmd/admin/setup/config.go @@ -4,11 +4,11 @@ import ( "bytes" "github.com/caos/logging" - "github.com/caos/zitadel/internal/command" "github.com/mitchellh/mapstructure" "github.com/spf13/viper" "github.com/caos/zitadel/internal/api/authz" + "github.com/caos/zitadel/internal/command" "github.com/caos/zitadel/internal/config/hook" "github.com/caos/zitadel/internal/config/systemdefaults" "github.com/caos/zitadel/internal/crypto" @@ -20,7 +20,6 @@ type Config struct { SystemDefaults systemdefaults.SystemDefaults InternalAuthZ authz.Config ExternalPort uint16 - ExternalDomain string ExternalSecure bool Log *logging.Config EncryptionKeys *encryptionKeyConfig diff --git a/cmd/admin/setup/setup.go b/cmd/admin/setup/setup.go index dd05bd3c2d..69d7e38e59 100644 --- a/cmd/admin/setup/setup.go +++ b/cmd/admin/setup/setup.go @@ -10,7 +10,6 @@ import ( "github.com/spf13/viper" "github.com/caos/zitadel/cmd/admin/key" - http_util "github.com/caos/zitadel/internal/api/http" "github.com/caos/zitadel/internal/database" "github.com/caos/zitadel/internal/eventstore" "github.com/caos/zitadel/internal/migration" @@ -59,18 +58,18 @@ func Setup(config *Config, steps *Steps, masterKey string) { steps.S3DefaultInstance.InstanceSetup.Org.Human.Email.Address = strings.TrimSpace(steps.S3DefaultInstance.InstanceSetup.Org.Human.Email.Address) if steps.S3DefaultInstance.InstanceSetup.Org.Human.Email.Address == "" { - steps.S3DefaultInstance.InstanceSetup.Org.Human.Email.Address = "admin@" + config.ExternalDomain + steps.S3DefaultInstance.InstanceSetup.Org.Human.Email.Address = "admin@" + instanceSetup.CustomDomain } steps.S3DefaultInstance.es = eventstoreClient steps.S3DefaultInstance.db = dbClient steps.S3DefaultInstance.defaults = config.SystemDefaults steps.S3DefaultInstance.masterKey = masterKey - steps.S3DefaultInstance.domain = config.ExternalDomain + steps.S3DefaultInstance.domain = instanceSetup.CustomDomain steps.S3DefaultInstance.zitadelRoles = config.InternalAuthZ.RolePermissionMappings steps.S3DefaultInstance.userEncryptionKey = config.EncryptionKeys.User steps.S3DefaultInstance.externalSecure = config.ExternalSecure - steps.S3DefaultInstance.baseURL = http_util.BuildHTTP(config.ExternalDomain, config.ExternalPort, config.ExternalSecure) + steps.S3DefaultInstance.externalPort = config.ExternalPort ctx := context.Background() err = migration.Migrate(ctx, eventstoreClient, steps.s1ProjectionTable) diff --git a/cmd/admin/start/config.go b/cmd/admin/start/config.go index 2109984f78..c9171d3f2a 100644 --- a/cmd/admin/start/config.go +++ b/cmd/admin/start/config.go @@ -28,7 +28,6 @@ type Config struct { Log *logging.Config Port uint16 ExternalPort uint16 - ExternalDomain string ExternalSecure bool HTTP2HostHeader string HTTP1HostHeader string diff --git a/cmd/admin/start/start.go b/cmd/admin/start/start.go index 0f156d03ce..5fd6832704 100644 --- a/cmd/admin/start/start.go +++ b/cmd/admin/start/start.go @@ -29,7 +29,6 @@ import ( "github.com/caos/zitadel/internal/api/grpc/auth" "github.com/caos/zitadel/internal/api/grpc/management" "github.com/caos/zitadel/internal/api/grpc/system" - http_util "github.com/caos/zitadel/internal/api/http" "github.com/caos/zitadel/internal/api/http/middleware" "github.com/caos/zitadel/internal/api/oidc" "github.com/caos/zitadel/internal/api/ui/console" @@ -112,12 +111,28 @@ func startZitadel(config *Config, masterKey string) error { DisplayName: config.WebAuthNName, ExternalSecure: config.ExternalSecure, } - commands, err := command.StartCommands(eventstoreClient, config.SystemDefaults, config.InternalAuthZ.RolePermissionMappings, storage, authZRepo, webAuthNConfig, keys.IDPConfig, keys.OTP, keys.SMTP, keys.SMS, keys.User, keys.DomainVerification, keys.OIDC) + commands, err := command.StartCommands( + eventstoreClient, + config.SystemDefaults, + config.InternalAuthZ.RolePermissionMappings, + storage, + authZRepo, + webAuthNConfig, + config.ExternalSecure, + config.ExternalPort, + keys.IDPConfig, + keys.OTP, + keys.SMTP, + keys.SMS, + keys.User, + keys.DomainVerification, + keys.OIDC, + ) if err != nil { return fmt.Errorf("cannot start commands: %w", err) } - notification.Start(config.Notification, config.SystemDefaults, commands, queries, dbClient, assets.HandlerPrefix, keys.User, keys.SMTP, keys.SMS) + notification.Start(config.Notification, config.ExternalPort, config.ExternalSecure, commands, queries, dbClient, assets.HandlerPrefix, keys.User, keys.SMTP, keys.SMS) router := mux.NewRouter() err = startAPIs(ctx, router, commands, queries, eventstoreClient, dbClient, config, storage, authZRepo, keys) @@ -146,16 +161,16 @@ func startAPIs(ctx context.Context, router *mux.Router, commands *command.Comman if err != nil { return fmt.Errorf("error starting admin repo: %w", err) } - if err := authenticatedAPIs.RegisterServer(ctx, system.CreateServer(commands, queries, adminRepo, config.DefaultInstance, config.ExternalPort, config.ExternalDomain, config.ExternalSecure)); err != nil { + if err := authenticatedAPIs.RegisterServer(ctx, system.CreateServer(commands, queries, adminRepo, config.DefaultInstance, config.ExternalSecure)); err != nil { return err } - if err := authenticatedAPIs.RegisterServer(ctx, admin.CreateServer(commands, queries, adminRepo, config.SystemDefaults.Domain, assets.HandlerPrefix, keys.User)); err != nil { + if err := authenticatedAPIs.RegisterServer(ctx, admin.CreateServer(commands, queries, adminRepo, assets.HandlerPrefix, keys.User)); err != nil { return err } - if err := authenticatedAPIs.RegisterServer(ctx, management.CreateServer(commands, queries, config.SystemDefaults, assets.HandlerPrefix, keys.User)); err != nil { + if err := authenticatedAPIs.RegisterServer(ctx, management.CreateServer(commands, queries, config.SystemDefaults, assets.HandlerPrefix, keys.User, config.ExternalSecure, oidc.HandlerPrefix)); err != nil { return err } - if err := authenticatedAPIs.RegisterServer(ctx, auth.CreateServer(commands, queries, authRepo, config.SystemDefaults, assets.HandlerPrefix, keys.User)); err != nil { + if err := authenticatedAPIs.RegisterServer(ctx, auth.CreateServer(commands, queries, authRepo, config.SystemDefaults, assets.HandlerPrefix, keys.User, config.ExternalSecure)); err != nil { return err } @@ -179,14 +194,13 @@ func startAPIs(ctx context.Context, router *mux.Router, commands *command.Comman } authenticatedAPIs.RegisterHandler(openapi.HandlerPrefix, openAPIHandler) - baseURL := http_util.BuildHTTP(config.ExternalDomain, config.ExternalPort, config.ExternalSecure) c, err := console.Start(config.Console, config.ExternalSecure, oidcProvider.IssuerFromRequest, instanceInterceptor.Handler) if err != nil { return fmt.Errorf("unable to start console: %w", err) } authenticatedAPIs.RegisterHandler(console.HandlerPrefix, c) - l, err := login.CreateLogin(config.Login, commands, queries, authRepo, store, config.SystemDefaults, console.HandlerPrefix+"/", config.ExternalDomain, baseURL, op.AuthCallbackURL(oidcProvider), config.ExternalSecure, userAgentInterceptor, op.NewIssuerInterceptor(oidcProvider.IssuerFromRequest).Handler, instanceInterceptor.Handler, keys.User, keys.IDPConfig, keys.CSRFCookieKey) + l, err := login.CreateLogin(config.Login, commands, queries, authRepo, store, console.HandlerPrefix+"/", op.AuthCallbackURL(oidcProvider), config.ExternalSecure, userAgentInterceptor, op.NewIssuerInterceptor(oidcProvider.IssuerFromRequest).Handler, instanceInterceptor.Handler, keys.User, keys.IDPConfig, keys.CSRFCookieKey) if err != nil { return fmt.Errorf("unable to start login: %w", err) } diff --git a/cmd/defaults.yaml b/cmd/defaults.yaml index a76b2eb71f..f35d695e74 100644 --- a/cmd/defaults.yaml +++ b/cmd/defaults.yaml @@ -5,7 +5,6 @@ Log: Port: 8080 ExternalPort: 8080 -ExternalDomain: localhost ExternalSecure: true HTTP2HostHeader: ":authority" HTTP1HostHeader: "host" @@ -97,7 +96,6 @@ Login: SharedMaxAge: 168h #7d Console: - ConsoleOverwriteDir: "" ShortCache: MaxAge: 5m SharedMaxAge: 15m @@ -138,25 +136,8 @@ EncryptionKeys: CSRFCookieKeyID: "csrfCookieKey" UserAgentCookieKeyID: "userAgentCookieKey" -#TODO: configure as soon as possible -#AssetStorage: -# Type: $ZITADEL_ASSET_STORAGE_TYPE -# Config: -# Endpoint: $ZITADEL_ASSET_STORAGE_ENDPOINT -# AccessKeyID: $ZITADEL_ASSET_STORAGE_ACCESS_KEY_ID -# SecretAccessKey: $ZITADEL_ASSET_STORAGE_SECRET_ACCESS_KEY -# SSL: $ZITADEL_ASSET_STORAGE_SSL -# Location: $ZITADEL_ASSET_STORAGE_LOCATION -# BucketPrefix: $ZITADEL_ASSET_STORAGE_BUCKET_PREFIX -# MultiDelete: $ZITADEL_ASSET_STORAGE_MULTI_DELETE - #TODO: remove as soon as possible SystemDefaults: - # DefaultLanguage: 'en' - Domain: $ZITADEL_DEFAULT_DOMAIN - ZitadelDocs: - Issuer: $ZITADEL_ISSUER - DiscoveryEndpoint: '$ZITADEL_ISSUER/.well-known/openid-configuration' SecretGenerators: PasswordSaltCost: 14 MachineKeySize: 2048 @@ -172,19 +153,11 @@ SystemDefaults: IncludeDigits: true IncludeSymbols: false Notifications: - Endpoints: - InitCode: '$ZITADEL_ACCOUNTS/user/init?userID={{.UserID}}&code={{.Code}}&passwordset={{.PasswordSet}}' - PasswordReset: '$ZITADEL_ACCOUNTS/password/init?userID={{.UserID}}&code={{.Code}}' - VerifyEmail: '$ZITADEL_ACCOUNTS/mail/verification?userID={{.UserID}}&code={{.Code}}' - DomainClaimed: '$ZITADEL_ACCOUNTS/login' - PasswordlessRegistration: '$ZITADEL_ACCOUNTS/login/passwordless/init' FileSystemPath: '.notifications/' KeyConfig: Size: 2048 PrivateKeyLifetime: 6h PublicKeyLifetime: 30h - SigningKeyRotationCheck: 10s - SigningKeyGracefulPeriod: 10m DefaultInstance: InstanceName: diff --git a/internal/api/authz/instance.go b/internal/api/authz/instance.go index 6f55c20438..dcbd4f090e 100644 --- a/internal/api/authz/instance.go +++ b/internal/api/authz/instance.go @@ -2,6 +2,8 @@ package authz import ( "context" + + "golang.org/x/text/language" ) var ( @@ -14,6 +16,8 @@ type Instance interface { ConsoleClientID() string ConsoleApplicationID() string RequestedDomain() string + RequestedHost() string + DefaultLanguage() language.Tag } type InstanceVerifier interface { @@ -21,8 +25,11 @@ type InstanceVerifier interface { } type instance struct { - ID string - Domain string + ID string + Domain string + projectID string + appID string + clientID string } func (i *instance) InstanceID() string { @@ -30,21 +37,29 @@ func (i *instance) InstanceID() string { } func (i *instance) ProjectID() string { - return "" + return i.projectID } func (i *instance) ConsoleClientID() string { - return "" + return i.clientID } func (i *instance) ConsoleApplicationID() string { - return "" + return i.appID } func (i *instance) RequestedDomain() string { return i.Domain } +func (i *instance) RequestedHost() string { + return i.Domain +} + +func (i *instance) DefaultLanguage() language.Tag { + return language.Und +} + func GetInstance(ctx context.Context) Instance { instance, ok := ctx.Value(instanceKey).(Instance) if !ok { @@ -70,3 +85,15 @@ func WithRequestedDomain(ctx context.Context, domain string) context.Context { i.Domain = domain return context.WithValue(ctx, instanceKey, i) } + +func WithConsole(ctx context.Context, projectID, appID string) context.Context { + i, ok := ctx.Value(instanceKey).(*instance) + if !ok { + i = new(instance) + } + + i.projectID = projectID + i.appID = appID + //i.clientID = clientID + return context.WithValue(ctx, instanceKey, i) +} diff --git a/internal/api/authz/instance_test.go b/internal/api/authz/instance_test.go index db714cf118..3cbc24e52f 100644 --- a/internal/api/authz/instance_test.go +++ b/internal/api/authz/instance_test.go @@ -5,6 +5,7 @@ import ( "testing" "github.com/stretchr/testify/assert" + "golang.org/x/text/language" ) func Test_Instance(t *testing.T) { @@ -83,6 +84,14 @@ func (m *mockInstance) ConsoleApplicationID() string { return "appID" } +func (m *mockInstance) DefaultLanguage() language.Tag { + return language.English +} + func (m *mockInstance) RequestedDomain() string { return "zitadel.cloud" } + +func (m *mockInstance) RequestedHost() string { + return "zitadel.cloud:443" +} diff --git a/internal/api/grpc/admin/custom_text.go b/internal/api/grpc/admin/custom_text.go index c6ae47cdc5..e249f560a9 100644 --- a/internal/api/grpc/admin/custom_text.go +++ b/internal/api/grpc/admin/custom_text.go @@ -3,9 +3,9 @@ package admin import ( "context" - "github.com/caos/zitadel/internal/api/authz" "golang.org/x/text/language" + "github.com/caos/zitadel/internal/api/authz" "github.com/caos/zitadel/internal/api/grpc/object" text_grpc "github.com/caos/zitadel/internal/api/grpc/text" "github.com/caos/zitadel/internal/domain" @@ -13,7 +13,7 @@ import ( ) func (s *Server) GetDefaultInitMessageText(ctx context.Context, req *admin_pb.GetDefaultInitMessageTextRequest) (*admin_pb.GetDefaultInitMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.InitCodeMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.InitCodeMessageType, req.Language) if err != nil { return nil, err } @@ -61,7 +61,7 @@ func (s *Server) ResetCustomInitMessageTextToDefault(ctx context.Context, req *a } func (s *Server) GetDefaultPasswordResetMessageText(ctx context.Context, req *admin_pb.GetDefaultPasswordResetMessageTextRequest) (*admin_pb.GetDefaultPasswordResetMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.PasswordResetMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.PasswordResetMessageType, req.Language) if err != nil { return nil, err } @@ -109,7 +109,7 @@ func (s *Server) ResetCustomPasswordResetMessageTextToDefault(ctx context.Contex } func (s *Server) GetDefaultVerifyEmailMessageText(ctx context.Context, req *admin_pb.GetDefaultVerifyEmailMessageTextRequest) (*admin_pb.GetDefaultVerifyEmailMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.VerifyEmailMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.VerifyEmailMessageType, req.Language) if err != nil { return nil, err } @@ -157,7 +157,7 @@ func (s *Server) ResetCustomVerifyEmailMessageTextToDefault(ctx context.Context, } func (s *Server) GetDefaultVerifyPhoneMessageText(ctx context.Context, req *admin_pb.GetDefaultVerifyPhoneMessageTextRequest) (*admin_pb.GetDefaultVerifyPhoneMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.VerifyPhoneMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.VerifyPhoneMessageType, req.Language) if err != nil { return nil, err } @@ -205,7 +205,7 @@ func (s *Server) ResetCustomVerifyPhoneMessageTextToDefault(ctx context.Context, } func (s *Server) GetDefaultDomainClaimedMessageText(ctx context.Context, req *admin_pb.GetDefaultDomainClaimedMessageTextRequest) (*admin_pb.GetDefaultDomainClaimedMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.DomainClaimedMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.DomainClaimedMessageType, req.Language) if err != nil { return nil, err } @@ -253,7 +253,7 @@ func (s *Server) ResetCustomDomainClaimedMessageTextToDefault(ctx context.Contex } func (s *Server) GetDefaultPasswordlessRegistrationMessageText(ctx context.Context, req *admin_pb.GetDefaultPasswordlessRegistrationMessageTextRequest) (*admin_pb.GetDefaultPasswordlessRegistrationMessageTextResponse, error) { - msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(domain.PasswordlessRegistrationMessageType, req.Language) + msg, err := s.query.DefaultMessageTextByTypeAndLanguageFromFileSystem(ctx, domain.PasswordlessRegistrationMessageType, req.Language) if err != nil { return nil, err } diff --git a/internal/api/grpc/admin/language.go b/internal/api/grpc/admin/language.go index dcbca8724a..4e5c07338d 100644 --- a/internal/api/grpc/admin/language.go +++ b/internal/api/grpc/admin/language.go @@ -5,6 +5,7 @@ import ( "golang.org/x/text/language" + "github.com/caos/zitadel/internal/api/authz" "github.com/caos/zitadel/internal/api/grpc/text" caos_errors "github.com/caos/zitadel/internal/errors" admin_pb "github.com/caos/zitadel/pkg/grpc/admin" @@ -34,6 +35,6 @@ func (s *Server) SetDefaultLanguage(ctx context.Context, req *admin_pb.SetDefaul return nil, nil } -func (s *Server) GetDefaultLanguage(ctx context.Context, req *admin_pb.GetDefaultLanguageRequest) (*admin_pb.GetDefaultLanguageResponse, error) { - return &admin_pb.GetDefaultLanguageResponse{Language: s.query.GetDefaultLanguage(ctx).String()}, nil +func (s *Server) GetDefaultLanguage(ctx context.Context, _ *admin_pb.GetDefaultLanguageRequest) (*admin_pb.GetDefaultLanguageResponse, error) { + return &admin_pb.GetDefaultLanguageResponse{Language: authz.GetInstance(ctx).DefaultLanguage().String()}, nil } diff --git a/internal/api/grpc/admin/org.go b/internal/api/grpc/admin/org.go index 5a71783d24..61ab2331d4 100644 --- a/internal/api/grpc/admin/org.go +++ b/internal/api/grpc/admin/org.go @@ -5,6 +5,7 @@ import ( "google.golang.org/protobuf/types/known/timestamppb" + "github.com/caos/zitadel/internal/api/authz" "github.com/caos/zitadel/internal/api/grpc/object" org_grpc "github.com/caos/zitadel/internal/api/grpc/org" "github.com/caos/zitadel/internal/command" @@ -47,7 +48,7 @@ func (s *Server) ListOrgs(ctx context.Context, req *admin_pb.ListOrgsRequest) (* } func (s *Server) SetUpOrg(ctx context.Context, req *admin_pb.SetUpOrgRequest) (*admin_pb.SetUpOrgResponse, error) { - userIDs, err := s.getClaimedUserIDsOfOrgDomain(ctx, domain.NewIAMDomainName(req.Org.Name, s.iamDomain)) + userIDs, err := s.getClaimedUserIDsOfOrgDomain(ctx, domain.NewIAMDomainName(req.Org.Name, authz.GetInstance(ctx).RequestedDomain())) if err != nil { return nil, err } diff --git a/internal/api/grpc/admin/server.go b/internal/api/grpc/admin/server.go index 38bc6041d9..618b584319 100644 --- a/internal/api/grpc/admin/server.go +++ b/internal/api/grpc/admin/server.go @@ -24,7 +24,6 @@ type Server struct { command *command.Commands query *query.Queries administrator repository.AdministratorRepository - iamDomain string assetsAPIDomain string userCodeAlg crypto.EncryptionAlgorithm } @@ -36,7 +35,6 @@ type Config struct { func CreateServer(command *command.Commands, query *query.Queries, repo repository.Repository, - iamDomain, assetsAPIDomain string, userCodeAlg crypto.EncryptionAlgorithm, ) *Server { @@ -44,7 +42,6 @@ func CreateServer(command *command.Commands, command: command, query: query, administrator: repo, - iamDomain: iamDomain, assetsAPIDomain: assetsAPIDomain, userCodeAlg: userCodeAlg, } diff --git a/internal/api/grpc/auth/passwordless.go b/internal/api/grpc/auth/passwordless.go index ffe9a2e275..8435e7a4eb 100644 --- a/internal/api/grpc/auth/passwordless.go +++ b/internal/api/grpc/auth/passwordless.go @@ -8,6 +8,8 @@ import ( "github.com/caos/zitadel/internal/api/authz" "github.com/caos/zitadel/internal/api/grpc/object" user_grpc "github.com/caos/zitadel/internal/api/grpc/user" + "github.com/caos/zitadel/internal/api/http" + "github.com/caos/zitadel/internal/api/ui/login" "github.com/caos/zitadel/internal/domain" "github.com/caos/zitadel/internal/query" auth_pb "github.com/caos/zitadel/pkg/grpc/auth" @@ -65,9 +67,10 @@ func (s *Server) AddMyPasswordlessLink(ctx context.Context, _ *auth_pb.AddMyPass if err != nil { return nil, err } + origin := http.BuildOrigin(authz.GetInstance(ctx).RequestedHost(), s.externalSecure) return &auth_pb.AddMyPasswordlessLinkResponse{ Details: object.AddToDetailsPb(initCode.Sequence, initCode.ChangeDate, initCode.ResourceOwner), - Link: initCode.Link(s.defaults.Notifications.Endpoints.PasswordlessRegistration), + Link: initCode.Link(origin + login.HandlerPrefix + login.EndpointPasswordlessRegistration), Expiration: durationpb.New(initCode.Expiration), }, nil } diff --git a/internal/api/grpc/auth/server.go b/internal/api/grpc/auth/server.go index f2e1f49f27..3c4ae7f379 100644 --- a/internal/api/grpc/auth/server.go +++ b/internal/api/grpc/auth/server.go @@ -28,6 +28,7 @@ type Server struct { defaults systemdefaults.SystemDefaults assetsAPIDomain string userCodeAlg crypto.EncryptionAlgorithm + externalSecure bool } type Config struct { @@ -40,6 +41,7 @@ func CreateServer(command *command.Commands, defaults systemdefaults.SystemDefaults, assetsAPIDomain string, userCodeAlg crypto.EncryptionAlgorithm, + externalSecure bool, ) *Server { return &Server{ command: command, @@ -48,6 +50,7 @@ func CreateServer(command *command.Commands, defaults: defaults, assetsAPIDomain: assetsAPIDomain, userCodeAlg: userCodeAlg, + externalSecure: externalSecure, } } diff --git a/internal/api/grpc/management/information.go b/internal/api/grpc/management/information.go index 4d8d1895fd..2b8882bff9 100644 --- a/internal/api/grpc/management/information.go +++ b/internal/api/grpc/management/information.go @@ -3,6 +3,10 @@ package management import ( "context" + "github.com/caos/oidc/v2/pkg/oidc" + + "github.com/caos/zitadel/internal/api/authz" + "github.com/caos/zitadel/internal/api/http" mgmt_pb "github.com/caos/zitadel/pkg/grpc/management" ) @@ -10,9 +14,10 @@ func (s *Server) Healthz(context.Context, *mgmt_pb.HealthzRequest) (*mgmt_pb.Hea return &mgmt_pb.HealthzResponse{}, nil } -func (s *Server) GetOIDCInformation(ctx context.Context, req *mgmt_pb.GetOIDCInformationRequest) (*mgmt_pb.GetOIDCInformationResponse, error) { +func (s *Server) GetOIDCInformation(ctx context.Context, _ *mgmt_pb.GetOIDCInformationRequest) (*mgmt_pb.GetOIDCInformationResponse, error) { + issuer := http.BuildOrigin(authz.GetInstance(ctx).RequestedDomain(), s.externalSecure) + s.issuerPath return &mgmt_pb.GetOIDCInformationResponse{ - Issuer: s.systemDefaults.ZitadelDocs.Issuer, - DiscoveryEndpoint: s.systemDefaults.ZitadelDocs.DiscoveryEndpoint, + Issuer: issuer, + DiscoveryEndpoint: issuer + oidc.DiscoveryEndpoint, }, nil } diff --git a/internal/api/grpc/management/org.go b/internal/api/grpc/management/org.go index 749f60c705..0cf3666a89 100644 --- a/internal/api/grpc/management/org.go +++ b/internal/api/grpc/management/org.go @@ -48,7 +48,7 @@ func (s *Server) ListOrgChanges(ctx context.Context, req *mgmt_pb.ListOrgChanges } func (s *Server) AddOrg(ctx context.Context, req *mgmt_pb.AddOrgRequest) (*mgmt_pb.AddOrgResponse, error) { - userIDs, err := s.getClaimedUserIDsOfOrgDomain(ctx, domain.NewIAMDomainName(req.Name, s.systemDefaults.Domain), "") + userIDs, err := s.getClaimedUserIDsOfOrgDomain(ctx, domain.NewIAMDomainName(req.Name, authz.GetInstance(ctx).RequestedDomain()), "") if err != nil { return nil, err } diff --git a/internal/api/grpc/management/server.go b/internal/api/grpc/management/server.go index 1e000d9223..4e1271fccf 100644 --- a/internal/api/grpc/management/server.go +++ b/internal/api/grpc/management/server.go @@ -26,6 +26,8 @@ type Server struct { assetAPIPrefix string passwordHashAlg crypto.HashAlgorithm userCodeAlg crypto.EncryptionAlgorithm + externalSecure bool + issuerPath string } func CreateServer( @@ -34,6 +36,8 @@ func CreateServer( sd systemdefaults.SystemDefaults, assetAPIPrefix string, userCodeAlg crypto.EncryptionAlgorithm, + externalSecure bool, + issuerPath string, ) *Server { return &Server{ command: command, @@ -42,6 +46,8 @@ func CreateServer( assetAPIPrefix: assetAPIPrefix, passwordHashAlg: crypto.NewBCrypt(sd.SecretGenerators.PasswordSaltCost), userCodeAlg: userCodeAlg, + externalSecure: externalSecure, + issuerPath: issuerPath, } } diff --git a/internal/api/grpc/management/user.go b/internal/api/grpc/management/user.go index f2577ba7e0..78671590ca 100644 --- a/internal/api/grpc/management/user.go +++ b/internal/api/grpc/management/user.go @@ -16,7 +16,9 @@ import ( "github.com/caos/zitadel/internal/api/grpc/metadata" obj_grpc "github.com/caos/zitadel/internal/api/grpc/object" user_grpc "github.com/caos/zitadel/internal/api/grpc/user" + "github.com/caos/zitadel/internal/api/http" z_oidc "github.com/caos/zitadel/internal/api/oidc" + "github.com/caos/zitadel/internal/api/ui/login" "github.com/caos/zitadel/internal/command" "github.com/caos/zitadel/internal/domain" "github.com/caos/zitadel/internal/query" @@ -259,8 +261,9 @@ func (s *Server) ImportHumanUser(ctx context.Context, req *mgmt_pb.ImportHumanUs ), } if code != nil { + origin := http.BuildOrigin(authz.GetInstance(ctx).RequestedHost(), s.externalSecure) resp.PasswordlessRegistration = &mgmt_pb.ImportHumanUserResponse_PasswordlessRegistration{ - Link: code.Link(s.systemDefaults.Notifications.Endpoints.PasswordlessRegistration), + Link: code.Link(origin + login.HandlerPrefix + login.EndpointPasswordlessRegistration), Lifetime: durationpb.New(code.Expiration), Expiration: durationpb.New(code.Expiration), } @@ -654,9 +657,10 @@ func (s *Server) AddPasswordlessRegistration(ctx context.Context, req *mgmt_pb.A if err != nil { return nil, err } + origin := http.BuildOrigin(authz.GetInstance(ctx).RequestedHost(), s.externalSecure) return &mgmt_pb.AddPasswordlessRegistrationResponse{ Details: obj_grpc.AddToDetailsPb(initCode.Sequence, initCode.ChangeDate, initCode.ResourceOwner), - Link: initCode.Link(s.systemDefaults.Notifications.Endpoints.PasswordlessRegistration), + Link: initCode.Link(origin + login.HandlerPrefix + login.EndpointPasswordlessRegistration), Expiration: durationpb.New(initCode.Expiration), }, nil } diff --git a/internal/api/grpc/server/middleware/instance_interceptor_test.go b/internal/api/grpc/server/middleware/instance_interceptor_test.go index 8bfc274cc6..7d0dadae86 100644 --- a/internal/api/grpc/server/middleware/instance_interceptor_test.go +++ b/internal/api/grpc/server/middleware/instance_interceptor_test.go @@ -6,6 +6,7 @@ import ( "reflect" "testing" + "golang.org/x/text/language" "google.golang.org/grpc" "google.golang.org/grpc/metadata" @@ -177,6 +178,14 @@ func (m *mockInstance) ConsoleApplicationID() string { return "consoleApplicationID" } +func (m *mockInstance) DefaultLanguage() language.Tag { + return language.English +} + func (m *mockInstance) RequestedDomain() string { return "localhost" } + +func (m *mockInstance) RequestedHost() string { + return "localhost:8080" +} diff --git a/internal/api/grpc/server/middleware/translation_interceptor.go b/internal/api/grpc/server/middleware/translation_interceptor.go index 09a2f37e18..a23cebb3a8 100644 --- a/internal/api/grpc/server/middleware/translation_interceptor.go +++ b/internal/api/grpc/server/middleware/translation_interceptor.go @@ -3,17 +3,17 @@ package middleware import ( "context" - "github.com/caos/zitadel/internal/query" "google.golang.org/grpc" + "github.com/caos/zitadel/internal/api/authz" + _ "github.com/caos/zitadel/internal/statik" ) -func TranslationHandler(query *query.Queries) func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - translator := newZitadelTranslator(query.GetDefaultLanguage(context.Background())) - +func TranslationHandler() func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { resp, err := handler(ctx, req) + translator := newZitadelTranslator(authz.GetInstance(ctx).DefaultLanguage()) if loc, ok := resp.(localizers); ok && resp != nil { translateFields(ctx, loc, translator) } diff --git a/internal/api/grpc/server/middleware/translator.go b/internal/api/grpc/server/middleware/translator.go index 7bd8daa665..88ac2ccdc1 100644 --- a/internal/api/grpc/server/middleware/translator.go +++ b/internal/api/grpc/server/middleware/translator.go @@ -48,7 +48,7 @@ func translatorFromNamespace(namespace string, defaultLanguage language.Tag) *i1 dir, err := fs.NewWithNamespace(namespace) logging.LogWithFields("ERROR-7usEW", "namespace", namespace).OnError(err).Panic("unable to get namespace") - translator, err := i18n.NewTranslator(dir, i18n.TranslatorConfig{DefaultLanguage: defaultLanguage}) + translator, err := i18n.NewTranslator(dir, defaultLanguage, "") logging.Log("ERROR-Sk8sf").OnError(err).Panic("unable to get i18n translator") return translator diff --git a/internal/api/grpc/server/server.go b/internal/api/grpc/server/server.go index c0b7ec78c2..3cad7cf8ea 100644 --- a/internal/api/grpc/server/server.go +++ b/internal/api/grpc/server/server.go @@ -1,15 +1,14 @@ package server import ( - grpc_api "github.com/caos/zitadel/internal/api/grpc" - "github.com/caos/zitadel/internal/query" - "github.com/caos/zitadel/internal/telemetry/metrics" - grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware" "google.golang.org/grpc" "github.com/caos/zitadel/internal/api/authz" + grpc_api "github.com/caos/zitadel/internal/api/grpc" "github.com/caos/zitadel/internal/api/grpc/server/middleware" + "github.com/caos/zitadel/internal/query" + "github.com/caos/zitadel/internal/telemetry/metrics" ) type Server interface { @@ -33,7 +32,7 @@ func CreateServer(verifier *authz.TokenVerifier, authConfig authz.Config, querie //TODO: Handle Ignored Services middleware.InstanceInterceptor(queries, hostHeaderName, "/zitadel.system.v1.SystemService"), middleware.AuthorizationInterceptor(verifier, authConfig), - middleware.TranslationHandler(queries), + middleware.TranslationHandler(), middleware.ValidationHandler(), middleware.ServiceHandler(), ), diff --git a/internal/api/grpc/system/instance.go b/internal/api/grpc/system/instance.go index 053c25563f..d7f0335ddd 100644 --- a/internal/api/grpc/system/instance.go +++ b/internal/api/grpc/system/instance.go @@ -40,7 +40,7 @@ func (s *Server) GetInstance(ctx context.Context, req *system_pb.GetInstanceRequ } func (s *Server) AddInstance(ctx context.Context, req *system_pb.AddInstanceRequest) (*system_pb.AddInstanceResponse, error) { - id, details, err := s.command.SetUpInstance(ctx, AddInstancePbToSetupInstance(req, s.DefaultInstance), s.ExternalSecure, s.BaseURL) + id, details, err := s.command.SetUpInstance(ctx, AddInstancePbToSetupInstance(req, s.DefaultInstance), s.ExternalSecure) if err != nil { return nil, err } diff --git a/internal/api/grpc/system/server.go b/internal/api/grpc/system/server.go index 007dd0548b..fba50e3d22 100644 --- a/internal/api/grpc/system/server.go +++ b/internal/api/grpc/system/server.go @@ -1,10 +1,10 @@ package system import ( - "github.com/caos/zitadel/internal/admin/repository" - http_util "github.com/caos/zitadel/internal/api/http" "google.golang.org/grpc" + "github.com/caos/zitadel/internal/admin/repository" + "github.com/caos/zitadel/internal/admin/repository/eventsourcing" "github.com/caos/zitadel/internal/api/authz" "github.com/caos/zitadel/internal/api/grpc/server" @@ -26,7 +26,6 @@ type Server struct { administrator repository.AdministratorRepository DefaultInstance command.InstanceSetup ExternalSecure bool - BaseURL string } type Config struct { @@ -37,8 +36,6 @@ func CreateServer(command *command.Commands, query *query.Queries, repo repository.Repository, defaultInstance command.InstanceSetup, - externalPort uint16, - externalDomain string, externalSecure bool) *Server { return &Server{ command: command, @@ -46,7 +43,6 @@ func CreateServer(command *command.Commands, administrator: repo, DefaultInstance: defaultInstance, ExternalSecure: externalSecure, - BaseURL: http_util.BuildHTTP(externalDomain, externalPort, externalSecure), } } diff --git a/internal/api/http/middleware/instance_interceptor_test.go b/internal/api/http/middleware/instance_interceptor_test.go index 10052fd2c7..217fd6c593 100644 --- a/internal/api/http/middleware/instance_interceptor_test.go +++ b/internal/api/http/middleware/instance_interceptor_test.go @@ -9,6 +9,7 @@ import ( "testing" "github.com/stretchr/testify/assert" + "golang.org/x/text/language" "github.com/caos/zitadel/internal/api/authz" ) @@ -261,6 +262,14 @@ func (m *mockInstance) ConsoleApplicationID() string { return "consoleApplicationID" } +func (m *mockInstance) DefaultLanguage() language.Tag { + return language.English +} + func (m *mockInstance) RequestedDomain() string { return "zitadel.cloud" } + +func (m *mockInstance) RequestedHost() string { + return "zitadel.cloud:443" +} diff --git a/internal/api/http/origin.go b/internal/api/http/origin.go index 8b7130970e..7e0a58f5c1 100644 --- a/internal/api/http/origin.go +++ b/internal/api/http/origin.go @@ -32,7 +32,11 @@ func IsOrigin(rawOrigin string) bool { } func BuildHTTP(hostname string, externalPort uint16, secure bool) string { - return BuildOrigin(fmt.Sprintf("%s:%d", hostname, externalPort), secure) + host := hostname + if externalPort != 0 { + host = fmt.Sprintf("%s:%d", hostname, externalPort) + } + return BuildOrigin(host, secure) } func BuildOrigin(host string, secure bool) string { diff --git a/internal/api/ui/console/console.go b/internal/api/ui/console/console.go index 5a59fae8fb..7b4b09e628 100644 --- a/internal/api/ui/console/console.go +++ b/internal/api/ui/console/console.go @@ -19,9 +19,8 @@ import ( ) type Config struct { - ConsoleOverwriteDir string - ShortCache middleware.CacheConfig - LongCache middleware.CacheConfig + ShortCache middleware.CacheConfig + LongCache middleware.CacheConfig } type spaHandler struct { diff --git a/internal/api/ui/login/change_password_handler.go b/internal/api/ui/login/change_password_handler.go index 5a60a3ab78..39a9772e40 100644 --- a/internal/api/ui/login/change_password_handler.go +++ b/internal/api/ui/login/change_password_handler.go @@ -61,12 +61,12 @@ func (l *Login) renderChangePassword(w http.ResponseWriter, r *http.Request, aut data.HasNumber = NumberRegex } } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplChangePassword], data, nil) } func (l *Login) renderChangePasswordDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) { var errType, errMessage string data := l.getUserData(r, authReq, "Password Change Done", errType, errMessage) - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplChangePasswordDone], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplChangePasswordDone], data, nil) } diff --git a/internal/api/ui/login/external_login_handler.go b/internal/api/ui/login/external_login_handler.go index cef37b16ed..09c2b7d42c 100644 --- a/internal/api/ui/login/external_login_handler.go +++ b/internal/api/ui/login/external_login_handler.go @@ -1,6 +1,7 @@ package login import ( + "context" "encoding/base64" "net/http" "net/url" @@ -100,7 +101,7 @@ func (l *Login) handleIDP(w http.ResponseWriter, r *http.Request, authReq *domai } func (l *Login) handleOIDCAuthorize(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, idpConfig *iam_model.IDPConfigView, callbackEndpoint string) { - provider, err := l.getRPConfig(idpConfig, callbackEndpoint) + provider, err := l.getRPConfig(r.Context(), idpConfig, callbackEndpoint) if err != nil { l.renderLogin(w, r, authReq, err) return @@ -150,7 +151,7 @@ func (l *Login) handleExternalLoginCallback(w http.ResponseWriter, r *http.Reque return } if idpConfig.IsOIDC { - provider, err := l.getRPConfig(idpConfig, EndpointExternalLoginCallback) + provider, err := l.getRPConfig(r.Context(), idpConfig, EndpointExternalLoginCallback) if err != nil { l.renderLogin(w, r, authReq, err) return @@ -166,13 +167,13 @@ func (l *Login) handleExternalLoginCallback(w http.ResponseWriter, r *http.Reque l.renderError(w, r, authReq, caos_errors.ThrowPreconditionFailed(nil, "RP-asff2", "Errors.ExternalIDP.IDPTypeNotImplemented")) } -func (l *Login) getRPConfig(idpConfig *iam_model.IDPConfigView, callbackEndpoint string) (rp.RelyingParty, error) { +func (l *Login) getRPConfig(ctx context.Context, idpConfig *iam_model.IDPConfigView, callbackEndpoint string) (rp.RelyingParty, error) { oidcClientSecret, err := crypto.DecryptString(idpConfig.OIDCClientSecret, l.idpConfigAlg) if err != nil { return nil, err } if idpConfig.OIDCIssuer != "" { - return rp.NewRelyingPartyOIDC(idpConfig.OIDCIssuer, idpConfig.OIDCClientID, oidcClientSecret, l.baseURL+callbackEndpoint, idpConfig.OIDCScopes, rp.WithVerifierOpts(rp.WithIssuedAtOffset(3*time.Second))) + return rp.NewRelyingPartyOIDC(idpConfig.OIDCIssuer, idpConfig.OIDCClientID, oidcClientSecret, l.baseURL(ctx)+callbackEndpoint, idpConfig.OIDCScopes, rp.WithVerifierOpts(rp.WithIssuedAtOffset(3*time.Second))) } if idpConfig.OAuthAuthorizationEndpoint == "" || idpConfig.OAuthTokenEndpoint == "" { return nil, caos_errors.ThrowPreconditionFailed(nil, "RP-4n0fs", "Errors.IdentityProvider.InvalidConfig") @@ -184,7 +185,7 @@ func (l *Login) getRPConfig(idpConfig *iam_model.IDPConfigView, callbackEndpoint AuthURL: idpConfig.OAuthAuthorizationEndpoint, TokenURL: idpConfig.OAuthTokenEndpoint, }, - RedirectURL: l.baseURL + callbackEndpoint, + RedirectURL: l.baseURL(ctx) + callbackEndpoint, Scopes: idpConfig.OIDCScopes, } return rp.NewRelyingPartyOAuth(oauth2Config, rp.WithVerifierOpts(rp.WithIssuedAtOffset(3*time.Second))) @@ -308,7 +309,7 @@ func (l *Login) renderExternalNotFoundOption(w http.ResponseWriter, r *http.Requ data.ExternalPhone = human.PhoneNumber data.ExternalPhoneVerified = human.IsPhoneVerified } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplExternalNotFoundOption], data, nil) } diff --git a/internal/api/ui/login/external_register_handler.go b/internal/api/ui/login/external_register_handler.go index 50523e0eae..3fdb83ef3e 100644 --- a/internal/api/ui/login/external_register_handler.go +++ b/internal/api/ui/login/external_register_handler.go @@ -97,7 +97,7 @@ func (l *Login) handleExternalRegisterCallback(w http.ResponseWriter, r *http.Re l.renderError(w, r, authReq, err) return } - provider, err := l.getRPConfig(idpConfig, EndpointExternalRegisterCallback) + provider, err := l.getRPConfig(r.Context(), idpConfig, EndpointExternalRegisterCallback) if err != nil { l.renderRegisterOption(w, r, authReq, err) return @@ -192,7 +192,7 @@ func (l *Login) renderExternalRegisterOverview(w http.ResponseWriter, r *http.Re data.ExternalPhone = human.PhoneNumber data.ExternalPhoneVerified = human.IsPhoneVerified } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplExternalRegisterOverview], data, nil) } diff --git a/internal/api/ui/login/init_password_handler.go b/internal/api/ui/login/init_password_handler.go index 97f2aa8467..d1c7445d77 100644 --- a/internal/api/ui/login/init_password_handler.go +++ b/internal/api/ui/login/init_password_handler.go @@ -1,6 +1,7 @@ package login import ( + "fmt" "net/http" http_mw "github.com/caos/zitadel/internal/api/http/middleware" @@ -38,6 +39,10 @@ type initPasswordData struct { HasSymbol string } +func InitPasswordLink(origin, userID, code string) string { + return fmt.Sprintf("%s%s?userID=%s&code=%s", externalLink(origin), EndpointInitPassword, userID, code) +} + func (l *Login) handleInitPassword(w http.ResponseWriter, r *http.Request) { userID := r.FormValue(queryInitPWUserID) code := r.FormValue(queryInitPWCode) @@ -142,11 +147,11 @@ func (l *Login) renderInitPassword(w http.ResponseWriter, r *http.Request, authR data.HasNumber = NumberRegex } } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplInitPassword], data, nil) } func (l *Login) renderInitPasswordDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) { data := l.getUserData(r, authReq, "Password Init Done", "", "") - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplInitPasswordDone], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplInitPasswordDone], data, nil) } diff --git a/internal/api/ui/login/init_user_handler.go b/internal/api/ui/login/init_user_handler.go index 2ad369d995..fa91ce5ac6 100644 --- a/internal/api/ui/login/init_user_handler.go +++ b/internal/api/ui/login/init_user_handler.go @@ -1,6 +1,7 @@ package login import ( + "fmt" "net/http" "strconv" @@ -41,6 +42,10 @@ type initUserData struct { HasSymbol string } +func InitUserLink(origin, userID, code string, passwordSet bool) string { + return fmt.Sprintf("%s%s?userID=%s&code=%s&passwordset=%t", externalLink(origin), EndpointInitUser, userID, code, passwordSet) +} + func (l *Login) handleInitUser(w http.ResponseWriter, r *http.Request) { userID := r.FormValue(queryInitUserUserID) code := r.FormValue(queryInitUserCode) @@ -132,11 +137,11 @@ func (l *Login) renderInitUser(w http.ResponseWriter, r *http.Request, authReq * data.HasNumber = NumberRegex } } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplInitUser], data, nil) } func (l *Login) renderInitUserDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) { data := l.getUserData(r, authReq, "User Init Done", "", "") - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplInitUserDone], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplInitUserDone], data, nil) } diff --git a/internal/api/ui/login/jwt_handler.go b/internal/api/ui/login/jwt_handler.go index a33db9a0b9..af8677ee21 100644 --- a/internal/api/ui/login/jwt_handler.go +++ b/internal/api/ui/login/jwt_handler.go @@ -99,7 +99,7 @@ func (l *Login) handleJWTExtraction(w http.ResponseWriter, r *http.Request, auth return } } - redirect, err := l.redirectToJWTCallback(authReq) + redirect, err := l.redirectToJWTCallback(r.Context(), authReq) if err != nil { l.renderError(w, r, nil, err) return @@ -153,7 +153,7 @@ func (l *Login) jwtExtractionUserNotFound(w http.ResponseWriter, r *http.Request l.renderError(w, r, authReq, err) return } - redirect, err := l.redirectToJWTCallback(authReq) + redirect, err := l.redirectToJWTCallback(r.Context(), authReq) if err != nil { l.renderError(w, r, nil, err) return @@ -174,8 +174,8 @@ func (l *Login) appendUserGrants(ctx context.Context, userGrants []*domain.UserG return nil } -func (l *Login) redirectToJWTCallback(authReq *domain.AuthRequest) (string, error) { - redirect, err := url.Parse(l.baseURL + EndpointJWTCallback) +func (l *Login) redirectToJWTCallback(ctx context.Context, authReq *domain.AuthRequest) (string, error) { + redirect, err := url.Parse(l.baseURL(ctx) + EndpointJWTCallback) if err != nil { return "", err } diff --git a/internal/api/ui/login/link_users_handler.go b/internal/api/ui/login/link_users_handler.go index 9d56126360..65f95a655b 100644 --- a/internal/api/ui/login/link_users_handler.go +++ b/internal/api/ui/login/link_users_handler.go @@ -20,5 +20,5 @@ func (l *Login) linkUsers(w http.ResponseWriter, r *http.Request, authReq *domai func (l *Login) renderLinkUsersDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) { var errType, errMessage string data := l.getUserData(r, authReq, "Linking Users Done", errType, errMessage) - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLinkUsersDone], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplLinkUsersDone], data, nil) } diff --git a/internal/api/ui/login/login.go b/internal/api/ui/login/login.go index afba27591b..cb3122b39d 100644 --- a/internal/api/ui/login/login.go +++ b/internal/api/ui/login/login.go @@ -16,7 +16,6 @@ import ( auth_repository "github.com/caos/zitadel/internal/auth/repository" "github.com/caos/zitadel/internal/auth/repository/eventsourcing" "github.com/caos/zitadel/internal/command" - "github.com/caos/zitadel/internal/config/systemdefaults" "github.com/caos/zitadel/internal/crypto" "github.com/caos/zitadel/internal/domain" "github.com/caos/zitadel/internal/form" @@ -33,12 +32,11 @@ type Login struct { query *query.Queries staticStorage static.Storage authRepo auth_repository.Repository - baseURL string + externalSecure bool consolePath string oidcAuthCallbackURL func(context.Context, string) string idpConfigAlg crypto.EncryptionAlgorithm userCodeAlg crypto.EncryptionAlgorithm - iamDomain string } type Config struct { @@ -58,10 +56,7 @@ func CreateLogin(config Config, query *query.Queries, authRepo *eventsourcing.EsRepository, staticStorage static.Storage, - systemDefaults systemdefaults.SystemDefaults, - consolePath, - domain, - baseURL string, + consolePath string, oidcAuthCallbackURL func(context.Context, string) string, externalSecure bool, userAgentCookie, @@ -74,13 +69,12 @@ func CreateLogin(config Config, login := &Login{ oidcAuthCallbackURL: oidcAuthCallbackURL, - baseURL: baseURL + HandlerPrefix, + externalSecure: externalSecure, consolePath: consolePath, command: command, query: query, staticStorage: staticStorage, authRepo: authRepo, - iamDomain: domain, idpConfigAlg: idpConfigAlg, userCodeAlg: userCodeAlg, } @@ -100,7 +94,7 @@ func CreateLogin(config Config, security := middleware.SecurityHeaders(csp(), login.cspErrorHandler) login.router = CreateRouter(login, statikFS, instanceHandler, csrfInterceptor, cacheInterceptor, security, userAgentCookie, middleware.TelemetryHandler(EndpointResources), issuerInterceptor) - login.renderer = CreateRenderer(HandlerPrefix, statikFS, staticStorage, config.LanguageCookieName, systemDefaults.DefaultLanguage) + login.renderer = CreateRenderer(HandlerPrefix, statikFS, staticStorage, config.LanguageCookieName) login.parser = form.NewParser() return login, nil } @@ -128,7 +122,7 @@ func (l *Login) Handler() http.Handler { } func (l *Login) getClaimedUserIDsOfOrgDomain(ctx context.Context, orgName string) ([]string, error) { - loginName, err := query.NewUserPreferredLoginNameSearchQuery("@"+domain.NewIAMDomainName(orgName, l.iamDomain), query.TextEndsWithIgnoreCase) + loginName, err := query.NewUserPreferredLoginNameSearchQuery("@"+domain.NewIAMDomainName(orgName, authz.GetInstance(ctx).RequestedDomain()), query.TextEndsWithIgnoreCase) if err != nil { return nil, err } @@ -150,3 +144,7 @@ func setContext(ctx context.Context, resourceOwner string) context.Context { } return authz.SetCtxData(ctx, data) } + +func (l *Login) baseURL(ctx context.Context) string { + return http_utils.BuildOrigin(authz.GetInstance(ctx).RequestedHost(), l.externalSecure) + HandlerPrefix +} diff --git a/internal/api/ui/login/login_handler.go b/internal/api/ui/login/login_handler.go index c1400cadcf..cc292ba690 100644 --- a/internal/api/ui/login/login_handler.go +++ b/internal/api/ui/login/login_handler.go @@ -17,6 +17,14 @@ type loginData struct { Register bool `schema:"register"` } +func LoginLink(origin string) string { + return externalLink(origin) + EndpointLogin +} + +func externalLink(origin string) string { + return origin + HandlerPrefix +} + func (l *Login) handleLogin(w http.ResponseWriter, r *http.Request) { authReq, err := l.getAuthRequest(r) if err != nil { @@ -82,5 +90,5 @@ func (l *Login) renderLogin(w http.ResponseWriter, r *http.Request, authReq *dom return authReq.LoginPolicy != nil && authReq.LoginPolicy.AllowExternalIDP && authReq.AllowedExternalIDPs != nil && len(authReq.AllowedExternalIDPs) > 0 }, } - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLogin], data, funcs) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplLogin], data, funcs) } diff --git a/internal/api/ui/login/login_success_handler.go b/internal/api/ui/login/login_success_handler.go index 5e8e7f64a9..cdb9fa9b76 100644 --- a/internal/api/ui/login/login_success_handler.go +++ b/internal/api/ui/login/login_success_handler.go @@ -45,7 +45,7 @@ func (l *Login) renderSuccessAndCallback(w http.ResponseWriter, r *http.Request, if authReq != nil { data.RedirectURI = l.oidcAuthCallbackURL(r.Context(), "") //the id will be set via the html (maybe change this with the login refactoring) } - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLoginSuccess], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplLoginSuccess], data, nil) } func (l *Login) redirectToCallback(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) { diff --git a/internal/api/ui/login/logout_handler.go b/internal/api/ui/login/logout_handler.go index 26a9005f5f..1efb81ba92 100644 --- a/internal/api/ui/login/logout_handler.go +++ b/internal/api/ui/login/logout_handler.go @@ -14,5 +14,5 @@ func (l *Login) handleLogoutDone(w http.ResponseWriter, r *http.Request) { func (l *Login) renderLogoutDone(w http.ResponseWriter, r *http.Request) { data := l.getUserData(r, nil, "Logout Done", "", "") - l.renderer.RenderTemplate(w, r, l.getTranslator(nil), l.renderer.Templates[tmplLogoutDone], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), nil), l.renderer.Templates[tmplLogoutDone], data, nil) } diff --git a/internal/api/ui/login/mail_verify_handler.go b/internal/api/ui/login/mail_verify_handler.go index 08c7f03730..c00d25b726 100644 --- a/internal/api/ui/login/mail_verify_handler.go +++ b/internal/api/ui/login/mail_verify_handler.go @@ -1,6 +1,7 @@ package login import ( + "fmt" "net/http" "github.com/caos/zitadel/internal/domain" @@ -26,6 +27,10 @@ type mailVerificationData struct { UserID string } +func MailVerificationLink(origin, userID, code string) string { + return fmt.Sprintf("%s%s?userID=%s&code=%s", externalLink(origin), EndpointMailVerification, userID, code) +} + func (l *Login) handleMailVerification(w http.ResponseWriter, r *http.Request) { userID := r.FormValue(queryUserID) code := r.FormValue(queryCode) @@ -92,7 +97,7 @@ func (l *Login) renderMailVerification(w http.ResponseWriter, r *http.Request, a UserID: userID, profileData: l.getProfileData(authReq), } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMailVerification], data, nil) } @@ -101,6 +106,6 @@ func (l *Login) renderMailVerified(w http.ResponseWriter, r *http.Request, authR baseData: l.getBaseData(r, authReq, "Mail Verified", "", ""), profileData: l.getProfileData(authReq), } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMailVerified], data, nil) } diff --git a/internal/api/ui/login/mfa_init_done_handler.go b/internal/api/ui/login/mfa_init_done_handler.go index 021e6fd44a..1b43c6ddcf 100644 --- a/internal/api/ui/login/mfa_init_done_handler.go +++ b/internal/api/ui/login/mfa_init_done_handler.go @@ -17,6 +17,6 @@ func (l *Login) renderMFAInitDone(w http.ResponseWriter, r *http.Request, authRe var errType, errMessage string data.baseData = l.getBaseData(r, authReq, "MFA Init Done", errType, errMessage) data.profileData = l.getProfileData(authReq) - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAInitDone], data, nil) } diff --git a/internal/api/ui/login/mfa_init_u2f.go b/internal/api/ui/login/mfa_init_u2f.go index 3a2b7ff047..6b932cc71f 100644 --- a/internal/api/ui/login/mfa_init_u2f.go +++ b/internal/api/ui/login/mfa_init_u2f.go @@ -36,7 +36,7 @@ func (l *Login) renderRegisterU2F(w http.ResponseWriter, r *http.Request, authRe }, MFAType: domain.MFATypeU2F, } - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplMFAU2FInit], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplMFAU2FInit], data, nil) } func (l *Login) handleRegisterU2F(w http.ResponseWriter, r *http.Request) { diff --git a/internal/api/ui/login/mfa_init_verify_handler.go b/internal/api/ui/login/mfa_init_verify_handler.go index 75c2172536..9ff463571b 100644 --- a/internal/api/ui/login/mfa_init_verify_handler.go +++ b/internal/api/ui/login/mfa_init_verify_handler.go @@ -79,7 +79,7 @@ func (l *Login) renderMFAInitVerify(w http.ResponseWriter, r *http.Request, auth } } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAInitVerify], data, nil) } diff --git a/internal/api/ui/login/mfa_prompt_handler.go b/internal/api/ui/login/mfa_prompt_handler.go index 0c50c1f979..228b490308 100644 --- a/internal/api/ui/login/mfa_prompt_handler.go +++ b/internal/api/ui/login/mfa_prompt_handler.go @@ -74,7 +74,7 @@ func (l *Login) renderMFAPrompt(w http.ResponseWriter, r *http.Request, authReq l.handleMFACreation(w, r, authReq, data) return } - translator := l.getTranslator(authReq) + translator := l.getTranslator(r.Context(), authReq) l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAPrompt], data, nil) } diff --git a/internal/api/ui/login/mfa_verify_handler.go b/internal/api/ui/login/mfa_verify_handler.go index f4c2d52e59..79dc0cfe28 100644 --- a/internal/api/ui/login/mfa_verify_handler.go +++ b/internal/api/ui/login/mfa_verify_handler.go @@ -74,7 +74,7 @@ func (l *Login) renderMFAVerifySelected(w http.ResponseWriter, r *http.Request, l.renderError(w, r, authReq, err) return } - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplMFAVerify], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplMFAVerify], data, nil) } func removeSelectedProviderFromList(providers []domain.MFAType, selected domain.MFAType) []domain.MFAType { diff --git a/internal/api/ui/login/mfa_verify_u2f_handler.go b/internal/api/ui/login/mfa_verify_u2f_handler.go index 6b85213471..8fa087c79e 100644 --- a/internal/api/ui/login/mfa_verify_u2f_handler.go +++ b/internal/api/ui/login/mfa_verify_u2f_handler.go @@ -45,7 +45,7 @@ func (l *Login) renderU2FVerification(w http.ResponseWriter, r *http.Request, au MFAProviders: providers, SelectedProvider: -1, } - l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplU2FVerification], data, nil) + l.renderer.RenderTemplate(w, r, l.getTranslator(r.Context(), authReq), l.renderer.Templates[tmplU2FVerification], data, nil) } func (l *Login) handleU2FVerification(w http.ResponseWriter, r *http.Request) { diff --git a/internal/api/ui/login/password_complexity_policy_handler.go b/internal/api/ui/login/password_complexity_policy_handler.go index 74eb66047c..a4994f7e26 100644 --- a/internal/api/ui/login/password_complexity_policy_handler.go +++ b/internal/api/ui/login/password_complexity_policy_handler.go @@ -47,7 +47,7 @@ func (l *Login) getPasswordComplexityPolicyByUserID(r *http.Request, authReq *do func (l *Login) generatePolicyDescription(r *http.Request, authReq *domain.AuthRequest, policy *iam_model.PasswordComplexityPolicyView) (string, error) { description := "