feat: Login, OP Support and Auth Queries (#177)

* fix: change oidc config * fix: change oidc config secret * begin models * begin repo * fix: implement grpc app funcs * fix: add application requests * fix: converter * fix: converter * fix: converter and generate clientid * fix: tests * feat: project grant aggregate * feat: project grant * fix: project grant check if role existing * fix: project grant requests * fix: project grant fixes * fix: project grant member model * fix: project grant member aggregate * fix: project grant member eventstore * fix: project grant member requests * feat: user model * begin repo * repo models and more * feat: user command side * lots of functions * user command side * profile requests * commit before rebase on user * save * local config with gopass and more * begin new auth command (user centric) * Update internal/user/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/address.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/email.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/mfa.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/password.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/phone.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/model/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/usergrant/repository/eventsourcing/user_grant.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/user_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * Update internal/user/repository/eventsourcing/eventstore_mock_test.go Co-Authored-By: Livio Amstutz <livio.a@gmail.com> * changes from mr review * save files into basedir * changes from mr review * changes from mr review * move to auth request * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/usergrant/repository/eventsourcing/cache.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * changes requested on mr * fix generate codes * fix return if no events * password code * email verification step * more steps * lot of mfa * begin tests * more next steps * auth api * auth api (user) * auth api (user) * auth api (user) * differ requests * merge * tests * fix compilation error * mock for id generator * Update internal/user/repository/eventsourcing/model/password.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * Update internal/user/repository/eventsourcing/model/user.go Co-authored-by: Silvan <silvan.reusser@gmail.com> * requests of mr * check email * begin separation of command and query * otp * change packages * some cleanup and fixes * tests for auth request / next steps * add VerificationLifetimes to config and make it run * tests * fix code challenge validation * cleanup * fix merge * begin view * repackaging tests and configs * fix startup config for auth * add migration * add PromptSelectAccount * fix copy / paste * remove user_agent files * fixes * fix sequences in user_session * token commands * token queries and signout * fix * fix set password test * add token handler and table * handle session init * add session state * add user view test cases * change VerifyMyMfaOTP * some fixes * fix user repo in auth api * cleanup * add user session view test * fix merge * begin oidc * user agent and more * config * keys * key command and query * add login statics * key handler * start login * login handlers * lot of fixes * merge oidc * add missing exports * add missing exports * fix some bugs * authrequestid in htmls * getrequest * update auth request * fix userid check * add username to authrequest * fix user session and auth request handling * fix UserSessionsByAgentID * fix auth request tests * fix user session on UserPasswordChanged and MfaOtpRemoved * fix MfaTypesSetupPossible * handle mfa * fill username * auth request query checks new events * fix userSessionByIDs * fix tokens * fix userSessionByIDs test * add user selection * init code * user code creation date * add init user step * add verification failed types * add verification failures * verify init code * user init code handle * user init code handle * fix userSessionByIDs * update logging * user agent cookie * browserinfo from request * add DeleteAuthRequest * add static login files to binary * add login statik to build * move generate to separate file and remove statik.go files * remove static dirs from startup.yaml * generate into separate namespaces * merge master * auth request code * auth request type mapping * fix keys * improve tokens * improve register and basic styling * fix ailerons font * improve password reset * add audience to token * all oidc apps as audience * fix test nextStep * fix email texts * remove "not set" * lot of style changes * improve copy to clipboard * fix footer * add cookie handler * remove placeholders * fix compilation after merge * fix auth config * remove comments * typo * use new secrets store * change default pws to match default policy * fixes * add todo * enable login * fix db name * Auth queries (#179) * my usersession * org structure/ auth handlers * working user grant spooler * auth internal user grants * search my project orgs * remove permissions file * my zitadel permissions * my zitadel permissions * remove unused code * authz * app searches in view * token verification * fix user grant load * fix tests * fix tests * read configs * remove unused const * remove todos * env variables * app_name * working authz * search projects * global resourceowner * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * Update internal/api/auth/permissions.go Co-authored-by: Livio Amstutz <livio.a@gmail.com> * model2 rename * at least it works * check token expiry * search my user grants * remove token table from authz Co-authored-by: Livio Amstutz <livio.a@gmail.com> * fix test * fix ports and enable console Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com> Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com> Co-authored-by: Silvan <silvan.reusser@gmail.com>
2025-08-12 01:47:33 +00:00 · 2020-06-05 07:50:04 +02:00
parent 46b60a6968
commit 8a5badddf6
293 changed files with 14189 additions and 3176 deletions
--- a/internal/project/model/granted_project.go
+++ b/internal/project/model/granted_project.go
@@ -50,7 +50,7 @@ const (
 type GrantedProjectSearchQuery struct {
 	Key    GrantedProjectSearchKey
 	Method model.SearchMethod
-	Value  string
+	Value  interface{}
 }

 type GrantedProjectSearchResponse struct {
--- a/internal/project/repository/eventsourcing/eventstore.go
+++ b/internal/project/repository/eventsourcing/eventstore.go
@@ -4,18 +4,21 @@ import (
 	"context"
 	"github.com/caos/zitadel/internal/cache/config"
 	sd "github.com/caos/zitadel/internal/config/systemdefaults"
+	es_models "github.com/caos/zitadel/internal/eventstore/models"
+	"github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
+
 	"github.com/caos/zitadel/internal/crypto"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	es_int "github.com/caos/zitadel/internal/eventstore"
 	es_sdk "github.com/caos/zitadel/internal/eventstore/sdk"
 	"github.com/caos/zitadel/internal/id"
 	proj_model "github.com/caos/zitadel/internal/project/model"
-	"github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
 )

 type ProjectEventstore struct {
 	es_int.Eventstore
 	projectCache *ProjectCache
+	passwordAlg  crypto.HashAlgorithm
 	pwGenerator  crypto.Generator
 	idGenerator  id.Generator
 }
@@ -35,6 +38,7 @@ func StartProject(conf ProjectConfig, systemDefaults sd.SystemDefaults) (*Projec
 	return &ProjectEventstore{
 		Eventstore:   conf.Eventstore,
 		projectCache: projectCache,
+		passwordAlg:  passwordAlg,
 		pwGenerator:  pwGenerator,
 		idGenerator:  id.SonyFlakeGenerator,
 	}, nil
@@ -535,6 +539,42 @@ func (es *ProjectEventstore) ChangeOIDCConfigSecret(ctx context.Context, project
 	return nil, caos_errs.ThrowInternal(nil, "EVENT-dk87s", "Could not find app in list")
 }

+func (es *ProjectEventstore) VerifyOIDCClientSecret(ctx context.Context, projectID, appID string, secret string) error {
+	if appID == "" {
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-H3RT2", "some required fields missing")
+	}
+	existing, err := es.ProjectByID(ctx, projectID)
+	if err != nil {
+		return err
+	}
+	var app *proj_model.Application
+	if _, app = existing.GetApp(appID); app == nil {
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-D6hba", "App is not in this project")
+	}
+	if app.Type != proj_model.APPTYPE_OIDC {
+		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-huywq", "App is not an oidc application")
+	}
+
+	if err := crypto.CompareHash(app.OIDCConfig.ClientSecret, []byte(secret), es.passwordAlg); err == nil {
+		return es.setOIDCClientSecretCheckResult(ctx, existing, app.AppID, OIDCClientSecretCheckSucceededAggregate)
+	}
+	if err := es.setOIDCClientSecretCheckResult(ctx, existing, app.AppID, OIDCClientSecretCheckFailedAggregate); err != nil {
+		return err
+	}
+	return caos_errs.ThrowInvalidArgument(nil, "EVENT-wg24q", "invalid client secret")
+}
+
+func (es *ProjectEventstore) setOIDCClientSecretCheckResult(ctx context.Context, project *proj_model.Project, appID string, check func(*es_models.AggregateCreator, *model.Project, string) es_sdk.AggregateFunc) error {
+	repoProject := model.ProjectFromModel(project)
+	agg := check(es.AggregateCreator(), repoProject, appID)
+	err := es_sdk.Push(ctx, es.PushAggregates, repoProject.AppendEvents, agg)
+	if err != nil {
+		return err
+	}
+	es.projectCache.cacheProject(repoProject)
+	return nil
+}
+
 func (es *ProjectEventstore) ProjectGrantByIDs(ctx context.Context, projectID, grantID string) (*proj_model.ProjectGrant, error) {
 	if grantID == "" {
 		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-e8die", "grantID missing")
--- a/internal/project/repository/eventsourcing/model/project_grant_member.go
+++ b/internal/project/repository/eventsourcing/model/project_grant_member.go
@@ -59,7 +59,7 @@ func GrantMemberToModel(member *ProjectGrantMember) *model.ProjectGrantMember {

 func (p *Project) appendAddGrantMemberEvent(event *es_models.Event) error {
 	member := &ProjectGrantMember{}
-	err := member.getData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
@@ -73,13 +73,13 @@ func (p *Project) appendAddGrantMemberEvent(event *es_models.Event) error {

 func (p *Project) appendChangeGrantMemberEvent(event *es_models.Event) error {
 	member := &ProjectGrantMember{}
-	err := member.getData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
 	if _, g := GetProjectGrant(p.Grants, member.GrantID); g != nil {
 		if i, m := GetProjectGrantMember(g.Members, member.UserID); m != nil {
-			g.Members[i].getData(event)
+			g.Members[i].SetData(event)
 		}
 	}
 	return nil
@@ -87,7 +87,7 @@ func (p *Project) appendChangeGrantMemberEvent(event *es_models.Event) error {

 func (p *Project) appendRemoveGrantMemberEvent(event *es_models.Event) error {
 	member := &ProjectGrantMember{}
-	err := member.getData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
@@ -102,7 +102,7 @@ func (p *Project) appendRemoveGrantMemberEvent(event *es_models.Event) error {
 	return nil
 }

-func (m *ProjectGrantMember) getData(event *es_models.Event) error {
+func (m *ProjectGrantMember) SetData(event *es_models.Event) error {
 	m.ObjectRoot.AppendEvent(event)
 	if err := json.Unmarshal(event.Data, m); err != nil {
 		logging.Log("EVEN-8die2").WithError(err).Error("could not unmarshal event data")
--- a/internal/project/repository/eventsourcing/model/project_member.go
+++ b/internal/project/repository/eventsourcing/model/project_member.go
@@ -56,7 +56,7 @@ func ProjectMemberToModel(member *ProjectMember) *model.ProjectMember {

 func (p *Project) appendAddMemberEvent(event *es_models.Event) error {
 	member := &ProjectMember{}
-	err := member.setData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
@@ -67,7 +67,7 @@ func (p *Project) appendAddMemberEvent(event *es_models.Event) error {

 func (p *Project) appendChangeMemberEvent(event *es_models.Event) error {
 	member := &ProjectMember{}
-	err := member.setData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
@@ -79,7 +79,7 @@ func (p *Project) appendChangeMemberEvent(event *es_models.Event) error {

 func (p *Project) appendRemoveMemberEvent(event *es_models.Event) error {
 	member := &ProjectMember{}
-	err := member.setData(event)
+	err := member.SetData(event)
 	if err != nil {
 		return err
 	}
@@ -91,7 +91,7 @@ func (p *Project) appendRemoveMemberEvent(event *es_models.Event) error {
 	return nil
 }

-func (m *ProjectMember) setData(event *es_models.Event) error {
+func (m *ProjectMember) SetData(event *es_models.Event) error {
 	m.ObjectRoot.AppendEvent(event)
 	if err := json.Unmarshal(event.Data, m); err != nil {
 		logging.Log("EVEN-e4dkp").WithError(err).Error("could not unmarshal event data")
--- a/internal/project/repository/eventsourcing/model/types.go
+++ b/internal/project/repository/eventsourcing/model/types.go
@@ -35,7 +35,9 @@ const (
 	ApplicationDeactivated models.EventType = "project.application.deactivated"
 	ApplicationReactivated models.EventType = "project.application.reactivated"

-	OIDCConfigAdded         models.EventType = "project.application.config.oidc.added"
-	OIDCConfigChanged       models.EventType = "project.application.config.oidc.changed"
-	OIDCConfigSecretChanged models.EventType = "project.application.config.oidc.secret.changed"
+	OIDCConfigAdded                models.EventType = "project.application.config.oidc.added"
+	OIDCConfigChanged              models.EventType = "project.application.config.oidc.changed"
+	OIDCConfigSecretChanged        models.EventType = "project.application.config.oidc.secret.changed"
+	OIDCClientSecretCheckSucceeded models.EventType = "project.application.oidc.secret.check.succeeded"
+	OIDCClientSecretCheckFailed    models.EventType = "project.application.oidc.secret.check.failed"
 )
--- a/internal/project/repository/eventsourcing/project.go
+++ b/internal/project/repository/eventsourcing/project.go
@@ -6,7 +6,8 @@ import (
 	"github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore/models"
 	es_models "github.com/caos/zitadel/internal/eventstore/models"
-	org_model "github.com/caos/zitadel/internal/org/model"
+	es_sdk "github.com/caos/zitadel/internal/eventstore/sdk"
+	org_es_model "github.com/caos/zitadel/internal/org/repository/eventsourcing/model"
 	"github.com/caos/zitadel/internal/project/repository/eventsourcing/model"
 	usr_model "github.com/caos/zitadel/internal/user/repository/eventsourcing/model"
 )
@@ -290,7 +291,7 @@ func OIDCConfigSecretChangedAggregate(aggCreator *es_models.AggregateCreator, ex
 		if err != nil {
 			return nil, err
 		}
-		changes := make(map[string]interface{}, 1)
+		changes := make(map[string]interface{}, 2)
 		changes["appId"] = appID
 		changes["clientSecret"] = secret

@@ -300,6 +301,36 @@ func OIDCConfigSecretChangedAggregate(aggCreator *es_models.AggregateCreator, ex
 	}
 }

+func OIDCClientSecretCheckSucceededAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, appID string) es_sdk.AggregateFunc {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		agg, err := ProjectAggregate(ctx, aggCreator, existing)
+		if err != nil {
+			return nil, err
+		}
+		changes := make(map[string]interface{}, 1)
+		changes["appId"] = appID
+
+		agg.AppendEvent(model.OIDCClientSecretCheckSucceeded, changes)
+
+		return agg, nil
+	}
+}
+
+func OIDCClientSecretCheckFailedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, appID string) es_sdk.AggregateFunc {
+	return func(ctx context.Context) (*es_models.Aggregate, error) {
+		agg, err := ProjectAggregate(ctx, aggCreator, existing)
+		if err != nil {
+			return nil, err
+		}
+		changes := make(map[string]interface{}, 1)
+		changes["appId"] = appID
+
+		agg.AppendEvent(model.OIDCClientSecretCheckFailed, changes)
+
+		return agg, nil
+	}
+}
+
 func ProjectGrantAddedAggregate(aggCreator *es_models.AggregateCreator, existing *model.Project, grant *model.ProjectGrant) func(ctx context.Context) (*es_models.Aggregate, error) {
 	return func(ctx context.Context) (*es_models.Aggregate, error) {
 		if grant == nil {
@@ -310,7 +341,7 @@ func ProjectGrantAddedAggregate(aggCreator *es_models.AggregateCreator, existing
 			return nil, err
 		}
 		validationQuery := es_models.NewSearchQuery().
-			AggregateTypeFilter(org_model.OrgAggregate).
+			AggregateTypeFilter(org_es_model.OrgAggregate).
 			AggregateIDFilter(grant.GrantedOrgID)

 		validation := addProjectGrantValidation()
@@ -475,11 +506,11 @@ func addProjectGrantValidation() func(...*es_models.Event) error {
 		existsOrg := false
 		for _, event := range events {
 			switch event.AggregateType {
-			case org_model.OrgAggregate:
+			case org_es_model.OrgAggregate:
 				switch event.Type {
-				case org_model.OrgAdded:
+				case org_es_model.OrgAdded:
 					existsOrg = true
-				case org_model.OrgRemoved:
+				case org_es_model.OrgRemoved:
 					existsOrg = false
 				}
 			}
--- a/internal/project/repository/view/application_view.go
+++ b/internal/project/repository/view/application_view.go
@@ -1,6 +1,7 @@
 package view

 import (
+	global_model "github.com/caos/zitadel/internal/model"
 	proj_model "github.com/caos/zitadel/internal/project/model"
 	"github.com/caos/zitadel/internal/project/repository/view/model"
 	"github.com/caos/zitadel/internal/view"
@@ -14,6 +15,23 @@ func ApplicationByID(db *gorm.DB, table, appID string) (*model.ApplicationView,
 	return app, err
 }

+func ApplicationByOIDCClientID(db *gorm.DB, table, clientID string) (*model.ApplicationView, error) {
+	app := new(model.ApplicationView)
+	clientIDQuery := model.ApplicationSearchQuery{Key: proj_model.APPLICATIONSEARCHKEY_OIDC_CLIENT_ID, Value: clientID, Method: global_model.SEARCHMETHOD_EQUALS}
+	query := view.PrepareGetByQuery(table, clientIDQuery)
+	err := query(db, app)
+	return app, err
+}
+
+func ApplicationByProjectIDAndAppName(db *gorm.DB, table, projectID, appName string) (*model.ApplicationView, error) {
+	app := new(model.ApplicationView)
+	projectIDQuery := model.ApplicationSearchQuery{Key: proj_model.APPLICATIONSEARCHKEY_PROJECT_ID, Value: projectID, Method: global_model.SEARCHMETHOD_EQUALS}
+	appNameQuery := model.ApplicationSearchQuery{Key: proj_model.APPLICATIONSEARCHKEY_NAME, Value: appName, Method: global_model.SEARCHMETHOD_EQUALS}
+	query := view.PrepareGetByQuery(table, projectIDQuery, appNameQuery)
+	err := query(db, app)
+	return app, err
+}
+
 func SearchApplications(db *gorm.DB, table string, req *proj_model.ApplicationSearchRequest) ([]*model.ApplicationView, int, error) {
 	apps := make([]*model.ApplicationView, 0)
 	query := view.PrepareSearchQuery(table, model.ApplicationSearchRequest{Limit: req.Limit, Offset: req.Offset, Queries: req.Queries})
--- a/internal/project/repository/view/model/application.go
+++ b/internal/project/repository/view/model/application.go
@@ -16,7 +16,7 @@ const (
 	ApplicationKeyProjectID     = "project_id"
 	ApplicationKeyResourceOwner = "resource_owner"
 	ApplicationKeyOIDCClientID  = "oidc_client_id"
-	ApplicationKeyName          = "name"
+	ApplicationKeyName          = "app_name"
 )

 type ApplicationView struct {