diff --git a/internal/user/model/user_view.go b/internal/user/model/user_view.go
index 019c92bbe3..72ed0af935 100644
--- a/internal/user/model/user_view.go
+++ b/internal/user/model/user_view.go
@@ -136,16 +136,6 @@ func (u *UserView) MFATypesSetupPossible(level req_model.MFALevel, policy *iam_m
}
}
//PLANNED: add sms
- fallthrough
- case req_model.MFALevelMultiFactor:
- if policy.HasMultiFactors() {
- for _, mfaType := range policy.MultiFactors {
- switch mfaType {
- case iam_model.MultiFactorTypeU2FWithPIN:
- types = append(types, req_model.MFATypeU2FUserVerification)
- }
- }
- }
}
return types
}
@@ -173,19 +163,6 @@ func (u *UserView) MFATypesAllowed(level req_model.MFALevel, policy *iam_model.L
}
}
//PLANNED: add sms
- fallthrough
- case req_model.MFALevelMultiFactor:
- if policy.HasMultiFactors() {
- for _, mfaType := range policy.MultiFactors {
- switch mfaType {
- case iam_model.MultiFactorTypeU2FWithPIN:
- if u.IsPasswordlessReady() {
- types = append(types, req_model.MFATypeU2FUserVerification)
- }
- }
- }
- }
- //PLANNED: add token
}
return types, required
}
diff --git a/internal/user/repository/eventsourcing/eventstore.go b/internal/user/repository/eventsourcing/eventstore.go
index 5d23d50447..922e6bf77a 100644
--- a/internal/user/repository/eventsourcing/eventstore.go
+++ b/internal/user/repository/eventsourcing/eventstore.go
@@ -1302,12 +1302,12 @@ func (es *UserEventstore) verifyMFAOTP(otp *usr_model.OTP, code string) error {
return nil
}
-func (es *UserEventstore) AddU2F(ctx context.Context, userID string, isLoginUI bool) (*usr_model.WebAuthNToken, error) {
+func (es *UserEventstore) AddU2F(ctx context.Context, userID string, accountName string, isLoginUI bool) (*usr_model.WebAuthNToken, error) {
user, err := es.HumanByID(ctx, userID)
if err != nil {
return nil, err
}
- webAuthN, err := es.webauthn.BeginRegistration(user, usr_model.AuthenticatorAttachmentUnspecified, usr_model.UserVerificationRequirementDiscouraged, isLoginUI, user.U2FTokens...)
+ webAuthN, err := es.webauthn.BeginRegistration(user, accountName, usr_model.AuthenticatorAttachmentUnspecified, usr_model.UserVerificationRequirementDiscouraged, isLoginUI, user.U2FTokens...)
if err != nil {
return nil, err
}
@@ -1353,7 +1353,7 @@ func (es *UserEventstore) RemoveU2FToken(ctx context.Context, userID, webAuthNTo
return err
}
if _, token := user.Human.GetU2F(webAuthNTokenID); token == nil {
- return errors.ThrowPreconditionFailed(nil, "EVENT-2M9ds", "Errors.User.NotHuman")
+ return errors.ThrowPreconditionFailed(nil, "EVENT-2M9ds", "Errors.User.MFA.U2F.NotExisting")
}
repoUser := model.UserFromModel(user)
err = es_sdk.Push(ctx, es.PushAggregates, repoUser.AppendEvents, MFAU2FRemoveAggregate(es.AggregateCreator(), repoUser, &model.WebAuthNTokenID{webAuthNTokenID}))
@@ -1410,12 +1410,20 @@ func (es *UserEventstore) VerifyMFAU2F(ctx context.Context, userID string, crede
return finishErr
}
-func (es *UserEventstore) AddPasswordless(ctx context.Context, userID string, isLoginUI bool) (*usr_model.WebAuthNToken, error) {
+func (es *UserEventstore) GetPasswordless(ctx context.Context, userID string) ([]*usr_model.WebAuthNToken, error) {
user, err := es.HumanByID(ctx, userID)
if err != nil {
return nil, err
}
- webAuthN, err := es.webauthn.BeginRegistration(user, usr_model.AuthenticatorAttachmentUnspecified, usr_model.UserVerificationRequirementRequired, isLoginUI, user.PasswordlessTokens...)
+ return user.PasswordlessTokens, nil
+}
+
+func (es *UserEventstore) AddPasswordless(ctx context.Context, userID, accountName string, isLoginUI bool) (*usr_model.WebAuthNToken, error) {
+ user, err := es.HumanByID(ctx, userID)
+ if err != nil {
+ return nil, err
+ }
+ webAuthN, err := es.webauthn.BeginRegistration(user, accountName, usr_model.AuthenticatorAttachmentUnspecified, usr_model.UserVerificationRequirementRequired, isLoginUI, user.PasswordlessTokens...)
if err != nil {
return nil, err
}
@@ -1616,11 +1624,10 @@ func (es *UserEventstore) AddMachineKey(ctx context.Context, key *usr_model.Mach
return nil, errors.ThrowPreconditionFailed(nil, "EVENT-5ROh4", "Errors.User.NotMachine")
}
- id, err := es.idGenerator.Next()
+ key.KeyID, err = es.idGenerator.Next()
if err != nil {
return nil, err
}
- key.KeyID = id
if key.ExpirationDate.IsZero() {
key.ExpirationDate, err = time.Parse(yearLayout, defaultExpirationDate)
diff --git a/internal/user/repository/eventsourcing/model/email.go b/internal/user/repository/eventsourcing/model/email.go
index 40aa598ddb..6575c4655e 100644
--- a/internal/user/repository/eventsourcing/model/email.go
+++ b/internal/user/repository/eventsourcing/model/email.go
@@ -16,8 +16,6 @@ type Email struct {
EmailAddress string `json:"email,omitempty"`
IsEmailVerified bool `json:"-"`
-
- isEmailUnique bool `json:"-"`
}
type EmailCode struct {
diff --git a/internal/user/repository/eventsourcing/model/profile.go b/internal/user/repository/eventsourcing/model/profile.go
index 71637831e6..77c1f6c57f 100644
--- a/internal/user/repository/eventsourcing/model/profile.go
+++ b/internal/user/repository/eventsourcing/model/profile.go
@@ -1,6 +1,8 @@
package model
import (
+ "encoding/json"
+
"golang.org/x/text/language"
es_models "github.com/caos/zitadel/internal/eventstore/models"
@@ -10,14 +12,12 @@ import (
type Profile struct {
es_models.ObjectRoot
- FirstName string `json:"firstName,omitempty"`
- LastName string `json:"lastName,omitempty"`
- NickName string `json:"nickName,omitempty"`
- DisplayName string `json:"displayName,omitempty"`
- PreferredLanguage language.Tag `json:"preferredLanguage,omitempty"`
- Gender int32 `json:"gender,omitempty"`
-
- isUserNameUnique bool
+ FirstName string `json:"firstName,omitempty"`
+ LastName string `json:"lastName,omitempty"`
+ NickName string `json:"nickName,omitempty"`
+ DisplayName string `json:"displayName,omitempty"`
+ PreferredLanguage LanguageTag `json:"preferredLanguage,omitempty"`
+ Gender int32 `json:"gender,omitempty"`
}
func (p *Profile) Changes(changed *Profile) map[string]interface{} {
@@ -34,7 +34,7 @@ func (p *Profile) Changes(changed *Profile) map[string]interface{} {
if changed.DisplayName != "" && p.DisplayName != changed.DisplayName {
changes["displayName"] = changed.DisplayName
}
- if changed.PreferredLanguage != language.Und && changed.PreferredLanguage != p.PreferredLanguage {
+ if language.Tag(changed.PreferredLanguage) != language.Und && changed.PreferredLanguage != p.PreferredLanguage {
changes["preferredLanguage"] = changed.PreferredLanguage
}
if changed.Gender != p.Gender {
@@ -50,7 +50,7 @@ func ProfileFromModel(profile *model.Profile) *Profile {
LastName: profile.LastName,
NickName: profile.NickName,
DisplayName: profile.DisplayName,
- PreferredLanguage: profile.PreferredLanguage,
+ PreferredLanguage: LanguageTag(profile.PreferredLanguage),
Gender: int32(profile.Gender),
}
}
@@ -62,7 +62,37 @@ func ProfileToModel(profile *Profile) *model.Profile {
LastName: profile.LastName,
NickName: profile.NickName,
DisplayName: profile.DisplayName,
- PreferredLanguage: profile.PreferredLanguage,
+ PreferredLanguage: language.Tag(profile.PreferredLanguage),
Gender: model.Gender(profile.Gender),
}
}
+
+type LanguageTag language.Tag
+
+func (t *LanguageTag) UnmarshalJSON(data []byte) error {
+ var tag string
+ err := json.Unmarshal(data, &tag)
+ if err != nil {
+ return err
+ }
+ *t = LanguageTag(language.Make(tag))
+ return nil
+}
+
+func (t LanguageTag) MarshalJSON() ([]byte, error) {
+ return json.Marshal(language.Tag(t))
+}
+
+func (t *LanguageTag) MarshalBinary() ([]byte, error) {
+ if t == nil {
+ return nil, nil
+ }
+
+ return []byte(language.Tag(*t).String()), nil
+}
+
+// UnmarshalBinary modifies the receiver so it must take a pointer receiver.
+func (t *LanguageTag) UnmarshalBinary(data []byte) error {
+ *t = LanguageTag(language.Make(string(data)))
+ return nil
+}
diff --git a/internal/user/repository/eventsourcing/model/profile_test.go b/internal/user/repository/eventsourcing/model/profile_test.go
index 53970abd0d..cf0d76eabc 100644
--- a/internal/user/repository/eventsourcing/model/profile_test.go
+++ b/internal/user/repository/eventsourcing/model/profile_test.go
@@ -23,8 +23,8 @@ func TestProfileChanges(t *testing.T) {
{
name: "all attributes changed",
args: args{
- existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: language.German, Gender: int32(user_model.GenderFemale)},
- newProfile: &Profile{FirstName: "FirstNameChanged", LastName: "LastNameChanged", NickName: "NickNameChanged", DisplayName: "DisplayNameChanged", PreferredLanguage: language.English, Gender: int32(user_model.GenderMale)},
+ existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: LanguageTag(language.German), Gender: int32(user_model.GenderFemale)},
+ newProfile: &Profile{FirstName: "FirstNameChanged", LastName: "LastNameChanged", NickName: "NickNameChanged", DisplayName: "DisplayNameChanged", PreferredLanguage: LanguageTag(language.English), Gender: int32(user_model.GenderMale)},
},
res: res{
changesLen: 6,
@@ -33,8 +33,8 @@ func TestProfileChanges(t *testing.T) {
{
name: "no changes",
args: args{
- existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: language.German, Gender: int32(user_model.GenderFemale)},
- newProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: language.German, Gender: int32(user_model.GenderFemale)},
+ existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: LanguageTag(language.German), Gender: int32(user_model.GenderFemale)},
+ newProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: LanguageTag(language.German), Gender: int32(user_model.GenderFemale)},
},
res: res{
changesLen: 0,
@@ -43,8 +43,8 @@ func TestProfileChanges(t *testing.T) {
{
name: "empty names",
args: args{
- existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: language.German, Gender: int32(user_model.GenderFemale)},
- newProfile: &Profile{FirstName: "", LastName: "", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: language.German, Gender: int32(user_model.GenderFemale)},
+ existingProfile: &Profile{FirstName: "FirstName", LastName: "LastName", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: LanguageTag(language.German), Gender: int32(user_model.GenderFemale)},
+ newProfile: &Profile{FirstName: "", LastName: "", NickName: "NickName", DisplayName: "DisplayName", PreferredLanguage: LanguageTag(language.German), Gender: int32(user_model.GenderFemale)},
},
res: res{
changesLen: 0,
diff --git a/internal/user/repository/eventsourcing/model/user.go b/internal/user/repository/eventsourcing/model/user.go
index d97ace7685..655af99da3 100644
--- a/internal/user/repository/eventsourcing/model/user.go
+++ b/internal/user/repository/eventsourcing/model/user.go
@@ -99,18 +99,18 @@ func (u *User) AppendEvent(event *es_models.Event) error {
}
if u.Human != nil {
- u.Human.User = u
+ u.Human.user = u
return u.Human.AppendEvent(event)
} else if u.Machine != nil {
- u.Machine.User = u
+ u.Machine.user = u
return u.Machine.AppendEvent(event)
}
if strings.HasPrefix(string(event.Type), "user.human") || event.AggregateVersion == "v1" {
- u.Human = &Human{User: u}
+ u.Human = &Human{user: u}
return u.Human.AppendEvent(event)
}
if strings.HasPrefix(string(event.Type), "user.machine") {
- u.Machine = &Machine{User: u}
+ u.Machine = &Machine{user: u}
return u.Machine.AppendEvent(event)
}
diff --git a/internal/user/repository/eventsourcing/model/user_human.go b/internal/user/repository/eventsourcing/model/user_human.go
index 36d6e33ac8..3e191d65cb 100644
--- a/internal/user/repository/eventsourcing/model/user_human.go
+++ b/internal/user/repository/eventsourcing/model/user_human.go
@@ -12,7 +12,7 @@ import (
)
type Human struct {
- *User `json:"-"`
+ user *User `json:"-"`
*Password
*Profile
@@ -69,6 +69,9 @@ func HumanFromModel(user *model.Human) *Human {
if user.U2FLogins != nil {
human.U2FLogins = WebAuthNLoginsFromModel(user.U2FLogins)
}
+ if user.PasswordlessLogins != nil {
+ human.PasswordlessLogins = WebAuthNLoginsFromModel(user.PasswordlessLogins)
+ }
return human
}
@@ -116,6 +119,9 @@ func HumanToModel(user *Human) *model.Human {
if user.U2FLogins != nil {
human.U2FLogins = WebAuthNLoginsToModel(user.U2FLogins)
}
+ if user.PasswordlessLogins != nil {
+ human.PasswordlessLogins = WebAuthNLoginsToModel(user.PasswordlessLogins)
+ }
return human
}
@@ -231,27 +237,27 @@ func (h *Human) AppendEvent(event *es_models.Event) (err error) {
}
func (h *Human) ComputeObject() {
- if h.State == int32(model.UserStateUnspecified) || h.State == int32(model.UserStateInitial) {
+ if h.user.State == int32(model.UserStateUnspecified) || h.user.State == int32(model.UserStateInitial) {
if h.Email != nil && h.IsEmailVerified {
- h.State = int32(model.UserStateActive)
+ h.user.State = int32(model.UserStateActive)
} else {
- h.State = int32(model.UserStateInitial)
+ h.user.State = int32(model.UserStateInitial)
}
}
if h.Password != nil && h.Password.ObjectRoot.IsZero() {
- h.Password.ObjectRoot = h.User.ObjectRoot
+ h.Password.ObjectRoot = h.user.ObjectRoot
}
if h.Profile != nil && h.Profile.ObjectRoot.IsZero() {
- h.Profile.ObjectRoot = h.User.ObjectRoot
+ h.Profile.ObjectRoot = h.user.ObjectRoot
}
if h.Email != nil && h.Email.ObjectRoot.IsZero() {
- h.Email.ObjectRoot = h.User.ObjectRoot
+ h.Email.ObjectRoot = h.user.ObjectRoot
}
if h.Phone != nil && h.Phone.ObjectRoot.IsZero() {
- h.Phone.ObjectRoot = h.User.ObjectRoot
+ h.Phone.ObjectRoot = h.user.ObjectRoot
}
if h.Address != nil && h.Address.ObjectRoot.IsZero() {
- h.Address.ObjectRoot = h.User.ObjectRoot
+ h.Address.ObjectRoot = h.user.ObjectRoot
}
}
diff --git a/internal/user/repository/eventsourcing/model/user_machine.go b/internal/user/repository/eventsourcing/model/user_machine.go
index a73aee5116..f73c75c5f0 100644
--- a/internal/user/repository/eventsourcing/model/user_machine.go
+++ b/internal/user/repository/eventsourcing/model/user_machine.go
@@ -13,7 +13,7 @@ import (
)
type Machine struct {
- *User `json:"-"`
+ user *User `json:"-"`
Name string `json:"name,omitempty"`
Description string `json:"description,omitempty"`
diff --git a/internal/user/repository/eventsourcing/model/web_auth_n.go b/internal/user/repository/eventsourcing/model/web_auth_n.go
index afbb602192..226ac77a71 100644
--- a/internal/user/repository/eventsourcing/model/web_auth_n.go
+++ b/internal/user/repository/eventsourcing/model/web_auth_n.go
@@ -17,11 +17,12 @@ type WebAuthNToken struct {
Challenge string `json:"challenge"`
State int32 `json:"-"`
- KeyID []byte `json:"keyId"`
- PublicKey []byte `json:"publicKey"`
- AttestationType string `json:"attestationType"`
- AAGUID []byte `json:"aaguid"`
- SignCount uint32 `json:"signCount"`
+ KeyID []byte `json:"keyId"`
+ PublicKey []byte `json:"publicKey"`
+ AttestationType string `json:"attestationType"`
+ AAGUID []byte `json:"aaguid"`
+ SignCount uint32 `json:"signCount"`
+ WebAuthNTokenName string `json:"webAuthNTokenName"`
}
type WebAuthNVerify struct {
@@ -79,29 +80,31 @@ func WebAuthNsFromModel(u2fs []*model.WebAuthNToken) []*WebAuthNToken {
func WebAuthNFromModel(webAuthN *model.WebAuthNToken) *WebAuthNToken {
return &WebAuthNToken{
- ObjectRoot: webAuthN.ObjectRoot,
- WebauthNTokenID: webAuthN.WebAuthNTokenID,
- Challenge: webAuthN.Challenge,
- State: int32(webAuthN.State),
- KeyID: webAuthN.KeyID,
- PublicKey: webAuthN.PublicKey,
- AAGUID: webAuthN.AAGUID,
- SignCount: webAuthN.SignCount,
- AttestationType: webAuthN.AttestationType,
+ ObjectRoot: webAuthN.ObjectRoot,
+ WebauthNTokenID: webAuthN.WebAuthNTokenID,
+ Challenge: webAuthN.Challenge,
+ State: int32(webAuthN.State),
+ KeyID: webAuthN.KeyID,
+ PublicKey: webAuthN.PublicKey,
+ AAGUID: webAuthN.AAGUID,
+ SignCount: webAuthN.SignCount,
+ AttestationType: webAuthN.AttestationType,
+ WebAuthNTokenName: webAuthN.WebAuthNTokenName,
}
}
func WebAuthNToModel(webAuthN *WebAuthNToken) *model.WebAuthNToken {
return &model.WebAuthNToken{
- ObjectRoot: webAuthN.ObjectRoot,
- WebAuthNTokenID: webAuthN.WebauthNTokenID,
- Challenge: webAuthN.Challenge,
- State: model.MFAState(webAuthN.State),
- KeyID: webAuthN.KeyID,
- PublicKey: webAuthN.PublicKey,
- AAGUID: webAuthN.AAGUID,
- SignCount: webAuthN.SignCount,
- AttestationType: webAuthN.AttestationType,
+ ObjectRoot: webAuthN.ObjectRoot,
+ WebAuthNTokenID: webAuthN.WebauthNTokenID,
+ Challenge: webAuthN.Challenge,
+ State: model.MFAState(webAuthN.State),
+ KeyID: webAuthN.KeyID,
+ PublicKey: webAuthN.PublicKey,
+ AAGUID: webAuthN.AAGUID,
+ SignCount: webAuthN.SignCount,
+ AttestationType: webAuthN.AttestationType,
+ WebAuthNTokenName: webAuthN.WebAuthNTokenName,
}
}
diff --git a/internal/user/repository/view/model/token.go b/internal/user/repository/view/model/token.go
index 725132ad52..eb20cf76c9 100644
--- a/internal/user/repository/view/model/token.go
+++ b/internal/user/repository/view/model/token.go
@@ -2,13 +2,14 @@ package model
import (
"encoding/json"
+ "time"
+
"github.com/caos/logging"
caos_errs "github.com/caos/zitadel/internal/errors"
"github.com/caos/zitadel/internal/eventstore/models"
es_models "github.com/caos/zitadel/internal/eventstore/models"
usr_model "github.com/caos/zitadel/internal/user/model"
usr_es_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
- "time"
"github.com/lib/pq"
)
diff --git a/internal/user/repository/view/model/user.go b/internal/user/repository/view/model/user.go
index 0d65bc108b..d98b89fdfa 100644
--- a/internal/user/repository/view/model/user.go
+++ b/internal/user/repository/view/model/user.go
@@ -374,7 +374,7 @@ func (u *UserView) addPasswordlessToken(event *models.Event) error {
}
}
token.State = int32(model.MFAStateNotReady)
- u.U2FTokens = append(u.U2FTokens, token)
+ u.PasswordlessTokens = append(u.PasswordlessTokens, token)
return nil
}
diff --git a/internal/user/repository/view/model/user_session.go b/internal/user/repository/view/model/user_session.go
index 514c829cf6..b64fb1b303 100644
--- a/internal/user/repository/view/model/user_session.go
+++ b/internal/user/repository/view/model/user_session.go
@@ -155,8 +155,12 @@ func (v *UserSessionView) AppendEvent(event *models.Event) error {
es_model.HumanSignedOut,
es_model.UserLocked,
es_model.UserDeactivated:
+ v.PasswordlessVerification = time.Time{}
v.PasswordVerification = time.Time{}
v.SecondFactorVerification = time.Time{}
+ v.SecondFactorVerificationType = int32(req_model.MFALevelNotSetUp)
+ v.MultiFactorVerification = time.Time{}
+ v.MultiFactorVerificationType = int32(req_model.MFALevelNotSetUp)
v.ExternalLoginVerification = time.Time{}
v.State = int32(req_model.UserSessionStateTerminated)
case es_model.HumanExternalIDPRemoved, es_model.HumanExternalIDPCascadeRemoved:
diff --git a/internal/user/repository/view/user_view.go b/internal/user/repository/view/user_view.go
index 30edc95903..191c4686c4 100644
--- a/internal/user/repository/view/user_view.go
+++ b/internal/user/repository/view/user_view.go
@@ -61,7 +61,7 @@ func UserByLoginNameAndResourceOwner(db *gorm.DB, table, loginName, resourceOwne
query := repository.PrepareGetByQuery(table, loginNameQuery, resourceOwnerQuery)
err := query(db, user)
if caos_errs.IsNotFound(err) {
- return nil, caos_errs.ThrowNotFound(nil, "VIEW-AD4qs", "Errors.User.NotFound")
+ return nil, caos_errs.ThrowNotFound(nil, "VIEW-AD4qs", "Errors.User.NotFoundOnOrg")
}
return user, err
}
diff --git a/internal/view/model/view.go b/internal/view/model/view.go
index 6f766b912b..5cb354a1b7 100644
--- a/internal/view/model/view.go
+++ b/internal/view/model/view.go
@@ -10,4 +10,5 @@ type View struct {
CurrentSequence uint64
EventTimestamp time.Time
LastSuccessfulSpoolerRun time.Time
+ AggregateType string
}
diff --git a/internal/view/repository/sequence.go b/internal/view/repository/sequence.go
index 10023b2b66..056787a5a7 100644
--- a/internal/view/repository/sequence.go
+++ b/internal/view/repository/sequence.go
@@ -1,11 +1,13 @@
package repository
import (
- caos_errs "github.com/caos/zitadel/internal/errors"
- "github.com/caos/zitadel/internal/view/model"
- "github.com/jinzhu/gorm"
"strings"
"time"
+
+ caos_errs "github.com/caos/zitadel/internal/errors"
+ int_model "github.com/caos/zitadel/internal/model"
+ "github.com/caos/zitadel/internal/view/model"
+ "github.com/jinzhu/gorm"
)
type CurrentSequence struct {
@@ -13,6 +15,18 @@ type CurrentSequence struct {
CurrentSequence uint64 `gorm:"column:current_sequence"`
EventTimestamp time.Time `gorm:"column:event_timestamp"`
LastSuccessfulSpoolerRun time.Time `gorm:"column:last_successful_spooler_run"`
+ AggregateType string `gorm:"column:aggregate_type;primary_key"`
+}
+
+type currentSequenceViewWithSequence struct {
+ ViewName string `gorm:"column:view_name;primary_key"`
+ CurrentSequence uint64 `gorm:"column:current_sequence"`
+ LastSuccessfulSpoolerRun time.Time `gorm:"column:last_successful_spooler_run"`
+}
+
+type currentSequenceView struct {
+ ViewName string `gorm:"column:view_name;primary_key"`
+ LastSuccessfulSpoolerRun time.Time `gorm:"column:last_successful_spooler_run"`
}
type SequenceSearchKey int32
@@ -20,6 +34,7 @@ type SequenceSearchKey int32
const (
SequenceSearchKeyUndefined SequenceSearchKey = iota
SequenceSearchKeyViewName
+ SequenceSearchKeyAggregateType
)
type sequenceSearchKey SequenceSearchKey
@@ -28,11 +43,30 @@ func (key sequenceSearchKey) ToColumnName() string {
switch SequenceSearchKey(key) {
case SequenceSearchKeyViewName:
return "view_name"
+ case SequenceSearchKeyAggregateType:
+ return "aggregate_type"
default:
return ""
}
}
+type sequenceSearchQuery struct {
+ key sequenceSearchKey
+ value string
+}
+
+func (q *sequenceSearchQuery) GetKey() ColumnKey {
+ return q.key
+}
+
+func (q *sequenceSearchQuery) GetMethod() int_model.SearchMethod {
+ return int_model.SearchMethodEquals
+}
+
+func (q *sequenceSearchQuery) GetValue() interface{} {
+ return q.value
+}
+
func CurrentSequenceToModel(sequence *CurrentSequence) *model.View {
dbView := strings.Split(sequence.ViewName, ".")
return &model.View{
@@ -41,26 +75,44 @@ func CurrentSequenceToModel(sequence *CurrentSequence) *model.View {
CurrentSequence: sequence.CurrentSequence,
EventTimestamp: sequence.EventTimestamp,
LastSuccessfulSpoolerRun: sequence.LastSuccessfulSpoolerRun,
+ AggregateType: sequence.AggregateType,
}
}
-func SaveCurrentSequence(db *gorm.DB, table, viewName string, sequence uint64, eventTimestamp time.Time) error {
- return UpdateCurrentSequence(db, table, &CurrentSequence{viewName, sequence, eventTimestamp, time.Now()})
+func SaveCurrentSequence(db *gorm.DB, table, viewName, aggregateType string, sequence uint64, eventTimestamp time.Time) error {
+ return UpdateCurrentSequence(db, table, &CurrentSequence{viewName, sequence, eventTimestamp, time.Now(), aggregateType})
}
-func UpdateCurrentSequence(db *gorm.DB, table string, currentSequence *CurrentSequence) error {
- save := PrepareSave(table)
- err := save(db, currentSequence)
+func UpdateCurrentSequence(db *gorm.DB, table string, currentSequence *CurrentSequence) (err error) {
+ var seq interface{} = currentSequence
+ if currentSequence.AggregateType == "" && currentSequence.CurrentSequence > 0 {
+ //spooler run
+ seq = ¤tSequenceView{ViewName: currentSequence.ViewName, LastSuccessfulSpoolerRun: currentSequence.LastSuccessfulSpoolerRun}
+ } else if currentSequence.AggregateType == "" {
+ //reset current sequence on view
+ seq = ¤tSequenceViewWithSequence{ViewName: currentSequence.ViewName, LastSuccessfulSpoolerRun: currentSequence.LastSuccessfulSpoolerRun, CurrentSequence: currentSequence.CurrentSequence}
+ }
+ save := PrepareSave(table)
+ err = save(db, seq)
if err != nil {
return caos_errs.ThrowInternal(err, "VIEW-5kOhP", "unable to updated processed sequence")
}
return nil
}
-func LatestSequence(db *gorm.DB, table, viewName string) (*CurrentSequence, error) {
+func LatestSequence(db *gorm.DB, table, viewName, aggregateType string) (*CurrentSequence, error) {
+ searchQueries := make([]SearchQuery, 0, 2)
+ searchQueries = append(searchQueries, &sequenceSearchQuery{key: sequenceSearchKey(SequenceSearchKeyViewName), value: viewName})
+ if aggregateType != "" {
+ searchQueries = append(searchQueries, &sequenceSearchQuery{key: sequenceSearchKey(SequenceSearchKeyAggregateType), value: aggregateType})
+ } else {
+ // ensure highest sequence of view
+ db = db.Order("current_sequence DESC")
+ }
+
+ query := PrepareGetByQuery(table, searchQueries...)
sequence := new(CurrentSequence)
- query := PrepareGetByKey(table, sequenceSearchKey(SequenceSearchKeyViewName), viewName)
err := query(db, sequence)
if err == nil {
@@ -89,5 +141,5 @@ func ClearView(db *gorm.DB, truncateView, sequenceTable string) error {
if err != nil {
return err
}
- return SaveCurrentSequence(db, sequenceTable, truncateView, 0, time.Now())
+ return SaveCurrentSequence(db, sequenceTable, truncateView, "", 0, time.Now())
}
diff --git a/internal/webauthn/webauthn.go b/internal/webauthn/webauthn.go
index 8c1fa0093f..b003b3d5f6 100644
--- a/internal/webauthn/webauthn.go
+++ b/internal/webauthn/webauthn.go
@@ -42,6 +42,7 @@ func StartServer(sd systemdefaults.WebAuthN) (*WebAuthN, error) {
type webUser struct {
*usr_model.User
+ accountName string
credentials []webauthn.Credential
}
@@ -50,7 +51,10 @@ func (u *webUser) WebAuthnID() []byte {
}
func (u *webUser) WebAuthnName() string {
- return u.PreferredLoginName
+ if u.accountName != "" {
+ return u.accountName
+ }
+ return u.UserName
}
func (u *webUser) WebAuthnDisplayName() string {
@@ -65,7 +69,7 @@ func (u *webUser) WebAuthnCredentials() []webauthn.Credential {
return u.credentials
}
-func (w *WebAuthN) BeginRegistration(user *usr_model.User, authType usr_model.AuthenticatorAttachment, userVerification usr_model.UserVerificationRequirement, isLoginUI bool, webAuthNs ...*usr_model.WebAuthNToken) (*usr_model.WebAuthNToken, error) {
+func (w *WebAuthN) BeginRegistration(user *usr_model.User, accountName string, authType usr_model.AuthenticatorAttachment, userVerification usr_model.UserVerificationRequirement, isLoginUI bool, webAuthNs ...*usr_model.WebAuthNToken) (*usr_model.WebAuthNToken, error) {
creds := WebAuthNsToCredentials(webAuthNs)
existing := make([]protocol.CredentialDescriptor, len(creds))
for i, cred := range creds {
@@ -77,6 +81,7 @@ func (w *WebAuthN) BeginRegistration(user *usr_model.User, authType usr_model.Au
credentialOptions, sessionData, err := w.web(isLoginUI).BeginRegistration(
&webUser{
User: user,
+ accountName: accountName,
credentials: creds,
},
webauthn.WithAuthenticatorSelection(protocol.AuthenticatorSelection{
diff --git a/migrations/cockroach/V1.26__current_sequence_table.sql b/migrations/cockroach/V1.26__current_sequence_table.sql
new file mode 100644
index 0000000000..61bf4bb87a
--- /dev/null
+++ b/migrations/cockroach/V1.26__current_sequence_table.sql
@@ -0,0 +1,21 @@
+ALTER TABLE management.current_sequences ADD COLUMN aggregate_type STRING NOT NULL DEFAULT '';
+ALTER TABLE auth.current_sequences ADD COLUMN aggregate_type STRING NOT NULL DEFAULT '';
+ALTER TABLE authz.current_sequences ADD COLUMN aggregate_type STRING NOT NULL DEFAULT '';
+ALTER TABLE adminapi.current_sequences ADD COLUMN aggregate_type STRING NOT NULL DEFAULT '';
+ALTER TABLE notification.current_sequences ADD COLUMN aggregate_type STRING NOT NULL DEFAULT '';
+
+BEGIN;
+
+ALTER TABLE management.current_sequences DROP CONSTRAINT "primary";
+ALTER TABLE auth.current_sequences DROP CONSTRAINT "primary";
+ALTER TABLE authz.current_sequences DROP CONSTRAINT "primary";
+ALTER TABLE adminapi.current_sequences DROP CONSTRAINT "primary";
+ALTER TABLE notification.current_sequences DROP CONSTRAINT "primary";
+
+ALTER TABLE management.current_sequences ADD CONSTRAINT "primary" PRIMARY KEY (view_name, aggregate_type);
+ALTER TABLE auth.current_sequences ADD CONSTRAINT "primary" PRIMARY KEY (view_name, aggregate_type);
+ALTER TABLE authz.current_sequences ADD CONSTRAINT "primary" PRIMARY KEY (view_name, aggregate_type);
+ALTER TABLE adminapi.current_sequences ADD CONSTRAINT "primary" PRIMARY KEY (view_name, aggregate_type);
+ALTER TABLE notification.current_sequences ADD CONSTRAINT "primary" PRIMARY KEY (view_name, aggregate_type);
+
+COMMIT;
\ No newline at end of file
diff --git a/pkg/grpc/auth/proto/auth.proto b/pkg/grpc/auth/proto/auth.proto
index 70490f9f22..645a03af68 100644
--- a/pkg/grpc/auth/proto/auth.proto
+++ b/pkg/grpc/auth/proto/auth.proto
@@ -337,6 +337,15 @@ service AuthService {
};
}
+ rpc GetMyPasswordless(google.protobuf.Empty) returns (WebAuthNTokens) {
+ option (google.api.http) = {
+ get: "/users/me/passwordless"
+ };
+ option (caos.zitadel.utils.v1.auth_option) = {
+ permission: "authenticated"
+ };
+ }
+
rpc AddMyPasswordless(google.protobuf.Empty) returns (WebAuthNResponse) {
option (google.api.http) = {
post: "/users/me/passwordless"
@@ -666,6 +675,16 @@ message MfaOtpResponse {
MFAState state = 4;
}
+message WebAuthNTokens {
+ repeated WebAuthNToken tokens = 1;
+}
+
+message WebAuthNToken {
+ string id = 1;
+ string name = 2;
+ MFAState state = 3;
+}
+
message WebAuthNResponse {
string id = 1;
bytes public_key = 2;
diff --git a/pkg/grpc/management/mock/management.proto.mock.go b/pkg/grpc/management/mock/management.proto.mock.go
index 1c92530fee..28011d98d1 100644
--- a/pkg/grpc/management/mock/management.proto.mock.go
+++ b/pkg/grpc/management/mock/management.proto.mock.go
@@ -1856,6 +1856,26 @@ func (mr *MockManagementServiceClientMockRecorder) RemoveMfaOTP(arg0, arg1 inter
return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveMfaOTP", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveMfaOTP), varargs...)
}
+// RemoveMfaU2F mocks base method
+func (m *MockManagementServiceClient) RemoveMfaU2F(arg0 context.Context, arg1 *management.WebAuthNTokenID, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
+ m.ctrl.T.Helper()
+ varargs := []interface{}{arg0, arg1}
+ for _, a := range arg2 {
+ varargs = append(varargs, a)
+ }
+ ret := m.ctrl.Call(m, "RemoveMfaU2F", varargs...)
+ ret0, _ := ret[0].(*emptypb.Empty)
+ ret1, _ := ret[1].(error)
+ return ret0, ret1
+}
+
+// RemoveMfaU2F indicates an expected call of RemoveMfaU2F
+func (mr *MockManagementServiceClientMockRecorder) RemoveMfaU2F(arg0, arg1 interface{}, arg2 ...interface{}) *gomock.Call {
+ mr.mock.ctrl.T.Helper()
+ varargs := append([]interface{}{arg0, arg1}, arg2...)
+ return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveMfaU2F", reflect.TypeOf((*MockManagementServiceClient)(nil).RemoveMfaU2F), varargs...)
+}
+
// RemoveMultiFactorFromLoginPolicy mocks base method
func (m *MockManagementServiceClient) RemoveMultiFactorFromLoginPolicy(arg0 context.Context, arg1 *management.MultiFactor, arg2 ...grpc.CallOption) (*emptypb.Empty, error) {
m.ctrl.T.Helper()
diff --git a/pkg/grpc/management/proto/management.proto b/pkg/grpc/management/proto/management.proto
index cd02b8f79e..a1a723e9fb 100644
--- a/pkg/grpc/management/proto/management.proto
+++ b/pkg/grpc/management/proto/management.proto
@@ -399,6 +399,36 @@ service ManagementService {
};
}
+ rpc RemoveMfaU2F(WebAuthNTokenID) returns (google.protobuf.Empty) {
+ option (google.api.http) = {
+ delete: "/users/{user_id}/mfas/u2f/{id}"
+ };
+
+ option (caos.zitadel.utils.v1.auth_option) = {
+ permission: "user.write"
+ };
+ }
+
+ rpc GetPasswordless(UserID) returns (WebAuthNTokens) {
+ option (google.api.http) = {
+ get: "/users/{id}/passwordless"
+ };
+
+ option (caos.zitadel.utils.v1.auth_option) = {
+ permission: "user.read"
+ };
+ }
+
+ rpc RemovePasswordless(WebAuthNTokenID) returns (google.protobuf.Empty) {
+ option (google.api.http) = {
+ delete: "/users/{user_id}/passwordless"
+ };
+
+ option (caos.zitadel.utils.v1.auth_option) = {
+ permission: "user.write"
+ };
+ }
+
// Sends an Notification (Email/SMS) with a password reset Link
rpc SendSetPasswordNotification(SetPasswordNotificationRequest) returns (google.protobuf.Empty) {
option (google.api.http) = {
@@ -1646,6 +1676,21 @@ message UserID {
string id = 1 [(validate.rules).string.min_len = 1];
}
+message WebAuthNTokens {
+ repeated WebAuthNToken tokens = 1;
+}
+
+message WebAuthNToken {
+ string id = 1;
+ string name = 2;
+ MFAState state = 3;
+}
+
+message WebAuthNTokenID {
+ string user_id = 1 [(validate.rules).string.min_len = 1];
+ string id = 2 [(validate.rules).string.min_len = 1];
+}
+
message LoginName {
string login_name = 1 [(validate.rules).string.min_len = 1];
}
@@ -2030,6 +2075,7 @@ message UserMultiFactor {
MfaType type = 1;
MFAState state = 2;
string attribute = 3;
+ string id = 4;
}
enum MfaType {
@@ -3081,6 +3127,7 @@ enum PasswordlessType {
PASSWORDLESSTYPE_ALLOWED = 1;
}
+
message IdpProviderID {
string idp_config_id = 1 [(validate.rules).string = {min_len: 1}];
}