fix: JWT Profile (#748)

* fix: correct env var for tracing type

* fix: local env tracing

* fix: key in detail as string

* fix: implement storage

* fix: machine key by id
fix: store public key as bytes instead of crypto value

* update oidc pkg

* dont check origins for service account tokens

* fix: scopes

* fix: dependencies

* fix: dependencies

* fix: remove unused code

* fix: variable naming

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

internal/auth/repository/eventsourcing/eventstore/user.go

@@ -334,3 +334,11 @@ func checkIDs(ctx context.Context, obj es_models.ObjectRoot) error {
 	}
 	return nil
 }
+
+func (repo *UserRepo) MachineKeyByID(ctx context.Context, keyID string) (*model.MachineKeyView, error) {
+	key, err := repo.View.MachineKeyByID(keyID)
+	if err != nil {
+		return nil, err
+	}
+	return usr_view_model.MachineKeyToModel(key), nil
+}

internal/auth/repository/eventsourcing/handler/handler.go

@@ -52,6 +52,7 @@ func Register(configs Configs, bulkLimit, errorCount uint64, view *view.View, ev
 			projectEvents: repos.ProjectEvents,
 			iamEvents:     repos.IamEvents,
 			iamID:         systemDefaults.IamID},
+		&MachineKeys{handler: handler{view, bulkLimit, configs.cycleDuration("MachineKey"), errorCount}},
 	}
 }
 

internal/auth/repository/eventsourcing/handler/machine_keys.go

@@ -0,0 +1,73 @@
+package handler
+
+import (
+	"time"
+
+	"github.com/caos/logging"
+
+	"github.com/caos/zitadel/internal/eventstore/models"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/eventstore/spooler"
+	"github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
+	usr_model "github.com/caos/zitadel/internal/user/repository/view/model"
+)
+
+type MachineKeys struct {
+	handler
+}
+
+const (
+	machineKeysTable = "auth.machine_keys"
+)
+
+func (d *MachineKeys) ViewModel() string {
+	return machineKeysTable
+}
+
+func (d *MachineKeys) EventQuery() (*models.SearchQuery, error) {
+	sequence, err := d.view.GetLatestMachineKeySequence()
+	if err != nil {
+		return nil, err
+	}
+	return es_models.NewSearchQuery().
+		AggregateTypeFilter(model.UserAggregate).
+		LatestSequenceFilter(sequence.CurrentSequence), nil
+}
+
+func (d *MachineKeys) Reduce(event *models.Event) (err error) {
+	switch event.AggregateType {
+	case model.UserAggregate:
+		err = d.processMachineKeys(event)
+	}
+	return err
+}
+
+func (d *MachineKeys) processMachineKeys(event *models.Event) (err error) {
+	key := new(usr_model.MachineKeyView)
+	switch event.Type {
+	case model.MachineKeyAdded:
+		err = key.AppendEvent(event)
+		if key.ExpirationDate.Before(time.Now()) {
+			return d.view.ProcessedMachineKeySequence(event.Sequence)
+		}
+	case model.MachineKeyRemoved:
+		err = key.SetData(event)
+		if err != nil {
+			return err
+		}
+		return d.view.DeleteMachineKey(key.ID, event.Sequence)
+	case model.UserRemoved:
+		return d.view.DeleteMachineKeysByUserID(event.AggregateID, event.Sequence)
+	default:
+		return d.view.ProcessedMachineKeySequence(event.Sequence)
+	}
+	if err != nil {
+		return err
+	}
+	return d.view.PutMachineKey(key, key.Sequence)
+}
+
+func (d *MachineKeys) OnError(event *models.Event, err error) error {
+	logging.LogWithFields("SPOOL-S9fe", "id", event.AggregateID).WithError(err).Warn("something went wrong in machine key handler")
+	return spooler.HandleError(event, err, d.view.GetLatestMachineKeyFailedEvent, d.view.ProcessedMachineKeyFailedEvent, d.view.ProcessedMachineKeySequence, d.errorCountUntilSkip)
+}

internal/auth/repository/eventsourcing/view/machine_keys.go

@@ -0,0 +1,71 @@
+package view
+
+import (
+	usr_model "github.com/caos/zitadel/internal/user/model"
+	"github.com/caos/zitadel/internal/user/repository/view"
+	"github.com/caos/zitadel/internal/user/repository/view/model"
+	"github.com/caos/zitadel/internal/view/repository"
+)
+
+const (
+	machineKeyTable = "auth.machine_keys"
+)
+
+func (v *View) MachineKeyByIDs(userID, keyID string) (*model.MachineKeyView, error) {
+	return view.MachineKeyByIDs(v.Db, machineKeyTable, userID, keyID)
+}
+
+func (v *View) MachineKeysByUserID(userID string) ([]*model.MachineKeyView, error) {
+	return view.MachineKeysByUserID(v.Db, machineKeyTable, userID)
+}
+
+func (v *View) MachineKeyByID(keyID string) (*model.MachineKeyView, error) {
+	return view.MachineKeyByID(v.Db, machineKeyTable, keyID)
+}
+
+func (v *View) SearchMachineKeys(request *usr_model.MachineKeySearchRequest) ([]*model.MachineKeyView, uint64, error) {
+	return view.SearchMachineKeys(v.Db, machineKeyTable, request)
+}
+
+func (v *View) PutMachineKey(key *model.MachineKeyView, sequence uint64) error {
+	err := view.PutMachineKey(v.Db, machineKeyTable, key)
+	if err != nil {
+		return err
+	}
+	if sequence != 0 {
+		return v.ProcessedMachineKeySequence(sequence)
+	}
+	return nil
+}
+
+func (v *View) DeleteMachineKey(keyID string, eventSequence uint64) error {
+	err := view.DeleteMachineKey(v.Db, machineKeyTable, keyID)
+	if err != nil {
+		return nil
+	}
+	return v.ProcessedMachineKeySequence(eventSequence)
+}
+
+func (v *View) DeleteMachineKeysByUserID(userID string, eventSequence uint64) error {
+	err := view.DeleteMachineKey(v.Db, machineKeyTable, userID)
+	if err != nil {
+		return nil
+	}
+	return v.ProcessedMachineKeySequence(eventSequence)
+}
+
+func (v *View) GetLatestMachineKeySequence() (*repository.CurrentSequence, error) {
+	return v.latestSequence(machineKeyTable)
+}
+
+func (v *View) ProcessedMachineKeySequence(eventSequence uint64) error {
+	return v.saveCurrentSequence(machineKeyTable, eventSequence)
+}
+
+func (v *View) GetLatestMachineKeyFailedEvent(sequence uint64) (*repository.FailedEvent, error) {
+	return v.latestFailedEvent(machineKeyTable, sequence)
+}
+
+func (v *View) ProcessedMachineKeyFailedEvent(failedEvent *repository.FailedEvent) error {
+	return v.saveFailedEvent(failedEvent)
+}

internal/auth/repository/user.go

@@ -32,6 +32,8 @@ type UserRepository interface {
 	SignOut(ctx context.Context, agentID string) error
 
 	UserByID(ctx context.Context, userID string) (*model.UserView, error)
+
+	MachineKeyByID(ctx context.Context, keyID string) (*model.MachineKeyView, error)
 }
 
 type myUserRepo interface {