feat: Login, OP Support and Auth Queries (#177)

* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix test * fix ports and enable console Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
2025-08-12 01:37:31 +00:00 · 2020-06-05 07:50:04 +02:00
parent 46b60a6968
commit 8a5badddf6
293 changed files with 14189 additions and 3176 deletions
--- a/internal/api/auth/context.go
+++ b/internal/api/auth/context.go
@@ -11,9 +11,9 @@ import (

 type key int

-var (
-	permissionsKey key
-	dataKey        key
+const (
+	permissionsKey key = 1
+	dataKey        key = 2
 )

 type CtxData struct {
@@ -36,7 +36,7 @@ type Grant struct {

 type TokenVerifier interface {
 	VerifyAccessToken(ctx context.Context, token string) (string, string, string, error)
-	ResolveGrants(ctx context.Context, sub, orgID string) ([]*Grant, error)
+	ResolveGrant(ctx context.Context) (*Grant, error)
 	GetProjectIDByClientID(ctx context.Context, clientID string) (string, error)
 }

--- a/internal/api/auth/permissions.go
+++ b/internal/api/auth/permissions.go
@@ -11,21 +11,20 @@ func getUserMethodPermissions(ctx context.Context, t TokenVerifier, requiredPerm
 	if ctxData.IsZero() {
 		return nil, nil, errors.ThrowUnauthenticated(nil, "AUTH-rKLWEH", "context missing")
 	}
-	grants, err := t.ResolveGrants(ctx, ctxData.UserID, ctxData.OrgID)
+	grant, err := t.ResolveGrant(ctx)
 	if err != nil {
 		return nil, nil, err
 	}
-	permissions := mapGrantsToPermissions(requiredPerm, grants, authConfig)
+	permissions := mapGrantToPermissions(requiredPerm, grant, authConfig)
 	return context.WithValue(ctx, permissionsKey, permissions), permissions, nil
 }

-func mapGrantsToPermissions(requiredPerm string, grants []*Grant, authConfig *Config) []string {
+func mapGrantToPermissions(requiredPerm string, grant *Grant, authConfig *Config) []string {
 	resolvedPermissions := make([]string, 0)
-	for _, grant := range grants {
-		for _, role := range grant.Roles {
-			resolvedPermissions = mapRoleToPerm(requiredPerm, role, authConfig, resolvedPermissions)
-		}
+	for _, role := range grant.Roles {
+		resolvedPermissions = mapRoleToPerm(requiredPerm, role, authConfig, resolvedPermissions)
 	}
+
 	return resolvedPermissions
 }

@@ -36,7 +35,7 @@ func mapRoleToPerm(requiredPerm, actualRole string, authConfig *Config, resolved
 	for _, p := range perms {
 		if p == requiredPerm {
 			p = addRoleContextIDToPerm(p, roleContextID)
-			if !existsPerm(resolvedPermissions, p) {
+			if !ExistsPerm(resolvedPermissions, p) {
 				resolvedPermissions = append(resolvedPermissions, p)
 			}
 		}
@@ -51,7 +50,7 @@ func addRoleContextIDToPerm(perm, roleContextID string) string {
 	return perm
 }

-func existsPerm(existing []string, perm string) bool {
+func ExistsPerm(existing []string, perm string) bool {
 	for _, e := range existing {
 		if e == perm {
 			return true
--- a/internal/api/auth/permissions_test.go
+++ b/internal/api/auth/permissions_test.go
@@ -12,15 +12,15 @@ func getTestCtx(userID, orgID string) context.Context {
 }

 type testVerifier struct {
-	grants []*Grant
+	grant *Grant
 }

 func (v *testVerifier) VerifyAccessToken(ctx context.Context, token string) (string, string, string, error) {
 	return "userID", "clientID", "agentID", nil
 }

-func (v *testVerifier) ResolveGrants(ctx context.Context, sub, orgID string) ([]*Grant, error) {
-	return v.grants, nil
+func (v *testVerifier) ResolveGrant(ctx context.Context) (*Grant, error) {
+	return v.grant, nil
 }

 func (v *testVerifier) GetProjectIDByClientID(ctx context.Context, clientID string) (string, error) {
@@ -57,8 +57,8 @@ func Test_GetUserMethodPermissions(t *testing.T) {
 			name: "Empty Context",
 			args: args{
 				ctx: getTestCtx("", ""),
-				verifier: &testVerifier{grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER"}}}},
+				verifier: &testVerifier{grant: &Grant{
+					Roles: []string{"ORG_OWNER"}}},
 				requiredPerm: "project.read",
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
@@ -81,7 +81,7 @@ func Test_GetUserMethodPermissions(t *testing.T) {
 			name: "No Grants",
 			args: args{
 				ctx:          getTestCtx("", ""),
-				verifier:     &testVerifier{grants: []*Grant{}},
+				verifier:     &testVerifier{grant: &Grant{}},
 				requiredPerm: "project.read",
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
@@ -102,8 +102,8 @@ func Test_GetUserMethodPermissions(t *testing.T) {
 			name: "Get Permissions",
 			args: args{
 				ctx: getTestCtx("userID", "orgID"),
-				verifier: &testVerifier{grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER"}}}},
+				verifier: &testVerifier{grant: &Grant{
+					Roles: []string{"ORG_OWNER"}}},
 				requiredPerm: "project.read",
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
@@ -143,7 +143,7 @@ func Test_GetUserMethodPermissions(t *testing.T) {
 func Test_MapGrantsToPermissions(t *testing.T) {
 	type args struct {
 		requiredPerm string
-		grants       []*Grant
+		grant        *Grant
 		authConfig   *Config
 	}
 	tests := []struct {
@@ -155,8 +155,7 @@ func Test_MapGrantsToPermissions(t *testing.T) {
 			name: "One Role existing perm",
 			args: args{
 				requiredPerm: "project.read",
-				grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER"}}},
+				grant:        &Grant{Roles: []string{"ORG_OWNER"}},
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
 						RoleMapping{
@@ -176,8 +175,7 @@ func Test_MapGrantsToPermissions(t *testing.T) {
 			name: "One Role not existing perm",
 			args: args{
 				requiredPerm: "project.write",
-				grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER"}}},
+				grant:        &Grant{Roles: []string{"ORG_OWNER"}},
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
 						RoleMapping{
@@ -197,8 +195,7 @@ func Test_MapGrantsToPermissions(t *testing.T) {
 			name: "Multiple Roles one existing",
 			args: args{
 				requiredPerm: "project.read",
-				grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER", "IAM_OWNER"}}},
+				grant:        &Grant{Roles: []string{"ORG_OWNER", "IAM_OWNER"}},
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
 						RoleMapping{
@@ -218,8 +215,7 @@ func Test_MapGrantsToPermissions(t *testing.T) {
 			name: "Multiple Roles, global and specific",
 			args: args{
 				requiredPerm: "project.read",
-				grants: []*Grant{&Grant{
-					Roles: []string{"ORG_OWNER", "PROJECT_OWNER:1"}}},
+				grant:        &Grant{Roles: []string{"ORG_OWNER", "PROJECT_OWNER:1"}},
 				authConfig: &Config{
 					RolePermissionMappings: []RoleMapping{
 						RoleMapping{
@@ -238,7 +234,7 @@ func Test_MapGrantsToPermissions(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := mapGrantsToPermissions(tt.args.requiredPerm, tt.args.grants, tt.args.authConfig)
+			result := mapGrantToPermissions(tt.args.requiredPerm, tt.args.grant, tt.args.authConfig)
 			if !equalStringArray(result, tt.result) {
 				t.Errorf("got wrong result, expecting: %v, actual: %v ", tt.result, result)
 			}
@@ -419,7 +415,7 @@ func Test_ExistisPerm(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := existsPerm(tt.args.existing, tt.args.perm)
+			result := ExistsPerm(tt.args.existing, tt.args.perm)
 			if result != tt.result {
 				t.Errorf("got wrong result, expecting: %v, actual: %v ", tt.result, result)
 			}
--- a/internal/api/header.go
+++ b/internal/api/header.go
@@ -7,6 +7,8 @@ const (
 	ContentType    = "content-type"
 	Location       = "location"
 	Origin         = "origin"
+	UserAgent      = "user-agent"
+	ForwardedFor   = "x-forwarded-for"

 	ZitadelOrgID = "x-zitadel-orgid"
 	//TODO: Remove as soon an authentification is implemented
--- a/internal/api/http/header.go
+++ b/internal/api/http/header.go
@@ -0,0 +1,71 @@
+package http
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/caos/zitadel/internal/api"
+)
+
+type key int
+
+var (
+	httpHeaders key
+	remoteAddr  key
+)
+
+func CopyHeadersToContext(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := context.WithValue(r.Context(), httpHeaders, r.Header)
+		ctx = context.WithValue(ctx, remoteAddr, r.RemoteAddr)
+		r = r.WithContext(ctx)
+		h(w, r)
+	}
+}
+
+func HeadersFromCtx(ctx context.Context) (http.Header, bool) {
+	headers, ok := ctx.Value(httpHeaders).(http.Header)
+	return headers, ok
+}
+
+func RemoteIPFromCtx(ctx context.Context) string {
+	ctxHeaders, ok := HeadersFromCtx(ctx)
+	if !ok {
+		return RemoteAddrFromCtx(ctx)
+	}
+	forwarded, ok := ForwardedFor(ctxHeaders)
+	if ok {
+		return forwarded
+	}
+	return RemoteAddrFromCtx(ctx)
+}
+
+func RemoteIPFromRequest(r *http.Request) net.IP {
+	return net.ParseIP(RemoteIPStringFromRequest(r))
+}
+
+func RemoteIPStringFromRequest(r *http.Request) string {
+	ip, ok := ForwardedFor(r.Header)
+	if ok {
+		return ip
+	}
+	return r.RemoteAddr
+}
+
+func ForwardedFor(headers http.Header) (string, bool) {
+	forwarded, ok := headers[api.ForwardedFor]
+	if ok {
+		ip := strings.Split(forwarded[0], ", ")[0]
+		if ip != "" {
+			return ip, true
+		}
+	}
+	return "", false
+}
+
+func RemoteAddrFromCtx(ctx context.Context) string {
+	ctxRemoteAddr, _ := ctx.Value(remoteAddr).(string)
+	return ctxRemoteAddr
+}
--- a/internal/api/http/user_agent_cookie.go
+++ b/internal/api/http/user_agent_cookie.go
@@ -0,0 +1,68 @@
+package http
+
+import (
+	"net/http"
+
+	"github.com/caos/zitadel/internal/crypto"
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/id"
+)
+
+type UserAgent struct {
+	ID string
+}
+
+type UserAgentHandler struct {
+	handler     *CookieHandler
+	cookieName  string
+	idGenerator id.Generator
+}
+
+type UserAgentCookieConfig struct {
+	Name   string
+	Domain string
+	Key    *crypto.KeyConfig
+}
+
+func NewUserAgentHandler(config *UserAgentCookieConfig, idGenerator id.Generator) (*UserAgentHandler, error) {
+	keys, _, err := crypto.LoadKeys(config.Key)
+	if err != nil {
+		return nil, err
+	}
+	cookieKey := []byte(keys[config.Key.EncryptionKeyID])
+	handler := NewCookieHandler(
+		WithEncryption(cookieKey, cookieKey),
+		WithDomain(config.Domain),
+		WithUnsecure(),
+	)
+	return &UserAgentHandler{
+		cookieName:  config.Name,
+		handler:     handler,
+		idGenerator: idGenerator,
+	}, nil
+}
+
+func (ua *UserAgentHandler) NewUserAgent() (*UserAgent, error) {
+	agentID, err := ua.idGenerator.Next()
+	if err != nil {
+		return nil, err
+	}
+	return &UserAgent{ID: agentID}, nil
+}
+
+func (ua *UserAgentHandler) GetUserAgent(r *http.Request) (*UserAgent, error) {
+	userAgent := new(UserAgent)
+	err := ua.handler.GetEncryptedCookieValue(r, ua.cookieName, userAgent)
+	if err != nil {
+		return nil, errors.ThrowPermissionDenied(err, "HTTP-YULqH4", "cannot read user agent cookie")
+	}
+	return userAgent, nil
+}
+
+func (ua *UserAgentHandler) SetUserAgent(w http.ResponseWriter, agent *UserAgent) error {
+	err := ua.handler.SetEncryptedCookie(w, ua.cookieName, agent)
+	if err != nil {
+		return errors.ThrowPermissionDenied(err, "HTTP-AqgqdA", "cannot set user agent cookie")
+	}
+	return nil
+}